joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40919c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x4091d5
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.004036c0
jmp 0x4091de
mov eax, ebx
mov edx, esi
call fcn.00403674
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4091e8
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.KERNEL32.DLL_GetLocaleInfoA_1
test eax, eax
jle 0x409209
mov al, byte [esp]
jmp 0x40920b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x41252c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp byte [0x43a3ec], 0
je 0x412563
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041242c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx]
jmp 0x4125b9
mov eax, dword [ebp + 8]
mov edx, 0x400
call fcn.00403b88
mov eax, dword [ebp - 4]
call fcn.00403a1c
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00403858
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00403a1c
push eax
mov eax, dword [ebp + 0xc]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 8]
call fcn.00403a1c
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
mov edx, eax
mov eax, dword [ebp + 8]
call fcn.00403b88
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4125c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4126db
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x43a3ec], 0
je 0x4125ff
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041242c
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
jmp 0x4126c5
mov eax, 0x4000
call fcn.004025b0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4126be
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040d528
xor eax, eax
push ebp
push 0x4126a1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
call fcn.00403a1c
push eax
push 0x4000
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
je 0x41268b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x412683
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00403790
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.004071bc
inc eax
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x412661
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4126a8
mov eax, dword [ebp - 8]
call fcn.0040d5e4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4126e2
lea eax, [ebp - 0x14]
call fcn.004035dc
ret
Function at 0x4126e8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x412811
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x43a3ec], 0
je 0x41272e
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.0041242c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
jmp 0x4127fb
mov eax, 0x4000
call fcn.004025b0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4127f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040d528
xor eax, eax
push ebp
push 0x4127d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
call fcn.00403a1c
push eax
push 0x4000
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a1c
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
je 0x4127c1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x4127b9
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00403790
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x14]
call fcn.004071bc
inc eax
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
jne 0x412797
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4127de
mov eax, dword [ebp - 0xc]
call fcn.0040d5e4
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412818
lea eax, [ebp - 0x18]
call fcn.004035dc
ret

Function at 0x412ce8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x412d8b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x412d12
mov byte [ebp - 5], 1
jmp 0x412d75
mov byte [ebp - 5], 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403a1c
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x412d75
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00403b88
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403a1c
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x412d75
mov eax, dword [ebp - 0xc]
call fcn.00403a1c
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00403790
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412d92
lea eax, [ebp - 0xc]
call fcn.004035dc
ret
Function at 0x412d9c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x412e58
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00412c04
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x14]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x412e42
xor eax, eax
push ebp
push 0x412e3b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e42
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e5f
lea eax, [ebp - 0x14]
call fcn.004035dc
ret

Function at 0x413268
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4133a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00412c04
mov eax, dword [ebp - 8]
call fcn.0040d528
xor eax, eax
push ebp
push 0x413380
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41336a
xor eax, eax
push ebp
push 0x413363
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x400
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x413346
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x420]
call fcn.00403790
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0
je 0x4132f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41336a
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413387
mov eax, dword [ebp - 8]
call fcn.0040d5e4
ret
Function at 0x4138ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41397f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412c04
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413965
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x413969
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413986
lea eax, [ebp - 0x10]
call fcn.004035dc
ret

Function at 0x413990
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413a19
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412c04
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0x10]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413a03
mov eax, dword [ebp - 8]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413a20
lea eax, [ebp - 0x10]
call fcn.004035dc
ret
Function at 0x413a28
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413b9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
mov dl, 1
mov eax, dword [0x40c47c]
call fcn.00402c74
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x413b70
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 5], 0
je 0x413ad3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00413268
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x413ad3
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00416f84
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00403860
mov eax, dword [ebp - 0x28]
mov dl, 1
call fcn.00413a28
inc dword [ebp - 0x20]
dec dword [ebp - 0x24]
jne 0x413a9b
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004170e0
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00406f90
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.00406ec8
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004170e0
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.00403674
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00412c04
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0xc]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413b5a
mov eax, dword [ebp - 0x10]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 6]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413b77
mov eax, dword [ebp - 0x1c]
call fcn.00402c9c
ret
Function at 0x413c28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413ce3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412c04
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413ccd
xor eax, eax
push ebp
push 0x413cc6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413caf
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413ccd
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413cea
lea eax, [ebp - 0x10]
call fcn.004035dc
ret

Function at 0x413cf4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413daf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412c04
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413d99
xor eax, eax
push ebp
push 0x413d92
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x413d7b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413d99
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413db6
lea eax, [ebp - 0x10]
call fcn.004035dc
ret
Function at 0x41534c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035dc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x4153bd
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.00403b88
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403a1c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x4153b3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403a1c
call fcn.004071bc
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00403b88
jmp 0x4153bd
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00403b88
mov esp, ebp
pop ebp
ret

Function at 0x4154d0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [0x43ba80]
cmp dword [eax], 2
jne 0x41553d
test byte [ebp - 4], 0xb
je 0x41553d
lea eax, [ebp - 0xc]
push eax
push 0x20
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x41553d
lea eax, [ebp - 0x18]
push eax
push 0x415558
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x41553d
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x415551
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x415590
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406b10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x415679
xor eax, eax
push ebp
push 0x415672
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
lea edx, [ebp - 0x54]
mov ecx, 0x40
mov eax, dword [ebp - 0x10]
call fcn.00406b74
cmp eax, 0x40
je 0x4155f1
call fcn.00403194
jmp 0x415679
cmp word [ebp - 0x54], 0x5a4d
jne 0x4155ff
cmp dword [ebp - 0x18], 0
jne 0x415606
call fcn.00403194
jmp 0x415679
mov eax, dword [ebp - 4]
call fcn.00417030
cmp eax, dword [ebp - 0x18]
jg 0x41561a
call fcn.00403194
jmp 0x415679
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00406bcc
inc eax
jne 0x415631
call fcn.00403194
jmp 0x415679
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00406b74
cmp eax, 4
je 0x41564d
call fcn.00403194
jmp 0x415679
cmp dword [ebp - 0x14], 0x4550
jne 0x41565c
mov eax, dword [ebp - 8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415679
mov eax, dword [ebp - 0x10]
call fcn.00406bd8
ret
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x415e50
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00403a1c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x415f0c
mov eax, dword [ebp - 0x14]
inc eax
call fcn.004025b0
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x415f05
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403a1c
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x415f14
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x415ed5
call fcn.00403194
jmp 0x415f0c
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415f0c
mov eax, dword [ebp - 0x1c]
call fcn.004025c8
ret
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret
Function at 0x41650c
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x416779
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e0]
call fcn.00419038
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x1e0]
call fcn.00406ec8
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x1d8]
call fcn.004170e0
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.00406ec8
push 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x41678c
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.00416a7c
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.004038a4
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404cba
lea eax, [ebp - 0x1cc]
call fcn.00404f42
call fcn.00402674
push ebp
mov eax, 0x41679c
call fcn.0041649c
pop ecx
push ebp
push 0x4167ac
push dword [ebp - 0x1e0]
push 0x4167bc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00403918
mov eax, dword [ebp - 0x238]
call fcn.0041649c
pop ecx
push ebp
push 0x4167c8
push dword [ebp - 0x1e0]
push 0x4167bc
push 0x4167dc
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00403918
mov eax, dword [ebp - 0x238]
call fcn.0041649c
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x41667b
push ebp
push 0x4167f0
push dword [ebp - 0x1d8]
push 0x4167bc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00403918
mov eax, dword [ebp - 0x238]
call fcn.0041649c
pop ecx
push ebp
push 0x4167ac
push dword [ebp - 0x1d4]
push 0x4167bc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00403918
mov eax, dword [ebp - 0x238]
call fcn.0041649c
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404d5c
call fcn.00402674
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x44
call fcn.004029cc
mov dword [ebp - 0x208], 1
mov word [ebp - 0x204], 0
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.00403a1c
push eax
push 0
push 0x40
push 0
push 0
push 0
push 0x4167bc
push dword [ebp - 0x1d4]
push 0x4167bc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00403918
mov eax, dword [ebp - 0x238]
call fcn.00403a1c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x416750
mov eax, dword [ebp - 0x1ec]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x1f0]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416780
lea eax, [ebp - 0x238]
call fcn.004035dc
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.00403600
ret

Function at 0x4168b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041688c
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize_1
cmp ebx, eax
jge 0x4168d9
mov byte [ebp - 5], 0
jmp 0x4168dd
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret