joyce8/EMBER2024-capa huggingface dataset:
Function at 0x55ee50
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff0c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xf4], edx
mov dword [ebp - 0xf0], edx
mov dword [ebp - 0xec], edx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x55f041
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00406b08
call fcn.00553580
test al, al
je 0x55ee98
call fcn.0055a22c
test al, al
je 0x55ef76
mov dl, 1
mov eax, dword [0x439db4]
call fcn.00446718
mov dword [ebp - 0x10], eax
xor edx, edx
push ebp
push 0x55ef6f
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 0x10]
call fcn.0055eae0
lea eax, [ebp - 4]
mov edx, 0x55f05c
call fcn.00406f30
lea eax, [ebp - 0xe6]
xor ecx, ecx
mov edx, 0xd2
call fcn.00404a64
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x55ef54
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov edi, eax
lea eax, [ebp - 4]
call fcn.004070d0
mov word [eax], di
lea ecx, [ebp - 0xec]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xec]
lea edx, [ebp - 0xc]
call fcn.0055ec10
test al, al
je 0x55ef4e
lea eax, [ebp - 0xf0]
mov edx, dword [ebp - 4]
movzx edx, word [edx]
call fcn.004076ac
mov edx, dword [ebp - 0xf0]
mov eax, esi
call fcn.00407898
inc ebx
dec dword [ebp - 0x14]
jne 0x55eef7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f01b
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dword [ebp - 0x10], edx
call fcn.00405080
ret
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x55f014
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xe6]
xor ecx, ecx
mov edx, 0xd2
call fcn.00404a64
lea eax, [ebp - 0xe6]
push eax
push 0xd2
call sub.kernel32.dll_GetLogicalDriveStringsW
lea ebx, [ebp - 0xe6]
jmp 0x55eff7
lea eax, [ebp - 4]
mov edx, ebx
call fcn.004076ec
add ebx, 8
mov eax, dword [ebp - 4]
call fcn.0040769c
push eax
call sub.kernel32.dll_GetDriveTypeW
cmp eax, 2
jne 0x55eff7
lea eax, [ebp - 0xf4]
mov edx, dword [ebp - 4]
movzx edx, word [edx]
call fcn.004076ac
mov edx, dword [ebp - 0xf4]
mov eax, esi
call fcn.00407898
cmp word [ebx], 0
jne 0x55efb9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x55f01b
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_SetErrorMode
ret

Function at 0x57261c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x57266d
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x572654
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x572644
jmp 0x57266d
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x572655
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x585808
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 0x14], edx
xor edx, edx
push ebp
push 0x58586c
push dword fs:[edx]
mov dword fs:[edx], esp
push 6
lea edx, [ebp - 0xe]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xe]
mov ecx, 7
call fcn.00407740
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.0041e0ec
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x585873
lea eax, [ebp - 0x14]
call fcn.00406b08
ret

Function at 0x586200
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x270], ebx
mov dword [ebp - 0x26c], ebx
mov dword [ebp - 0x268], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00406bec
xor eax, eax
push ebp
push 0x5863ac
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x586337
xor ebx, ebx
lea eax, [ebp - 0x268]
push eax
xor ecx, ecx
xor edx, edx
mov al, 1
call fcn.00569744
mov eax, dword [ebp - 0x268]
lea edx, [ebp - 8]
call fcn.00569a2c
lea eax, [ebp - 0xc]
mov edx, 0x5863c8
call fcn.00406f30
lea eax, [ebp - 0x264]
push eax
lea eax, [ebp - 0x26c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.004078f0
mov eax, dword [ebp - 0x26c]
call fcn.0040769c
push eax
call sub.kernel32.dll_FindFirstFileW
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
je 0x586326
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x238]
mov ecx, 0x104
call fcn.00407740
mov ecx, dword [ebp - 0x270]
lea eax, [edi + 0xd0]
mov edx, dword [ebp - 8]
call fcn.004078f0
call fcn.00428a70
push eax
mov ecx, dword [edi + 0xd0]
mov dl, 1
mov eax, dword [0x45358c]
call fcn.00454d44
mov esi, eax
mov edx, esi
mov eax, edi
call fcn.0058654c
mov ebx, eax
mov eax, esi
call fcn.00405080
test bl, bl
jne 0x58631d
lea eax, [ebp - 0x264]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x5862af
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_FindClose
test bl, bl
je 0x586381
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00406ee8
jmp 0x586381
lea eax, [edi + 0xd0]
mov edx, dword [ebp - 4]
call fcn.00406ee8
call fcn.00428a70
push eax
mov ecx, dword [edi + 0xd0]
mov dl, 1
mov eax, dword [0x45358c]
call fcn.00454d44
mov esi, eax
mov edx, esi
mov eax, edi
call fcn.0058654c
mov eax, esi
call fcn.00405080
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.00406ee8
mov eax, edi
call fcn.00586cd0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5863b3
lea eax, [ebp - 0x270]
mov edx, 3
call fcn.00406b68
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406b68
ret
Function at 0x58725c
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00406bec
xor eax, eax
push ebp
push 0x5873e4
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x5872b7
lea eax, [ebp - 4]
push eax
mov edx, dword [esi + 0x68]
lea eax, [ebp - 0xc]
mov ecx, 0x587400
call fcn.004078f0
mov ecx, dword [ebp - 0xc]
mov edx, dword [esi + 0x4c]
movzx eax, byte [esi + 0x48]
call fcn.00569744
xor edx, edx
push ebp
push 0x5873af
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0041ec80
mov eax, dword [ebp - 0x10]
call fcn.0041e944
mov eax, dword [ebp - 4]
call fcn.0040769c
mov edx, eax
lea eax, [ebp - 0x14]
call fcn.004076ec
mov eax, dword [ebp - 0x14]
call fcn.0040769c
push eax
call sub.kernel32.dll_DeleteFileW
cmp eax, 1
sbb ebx, ebx
inc ebx
test bl, bl
jne 0x587365
call sub.kernel32.dll_GetLastError
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.0040769c
mov edx, eax
lea eax, [ebp - 0x18]
call fcn.004076ec
mov eax, dword [ebp - 0x18]
call fcn.0040769c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x58735f
test ah, 4
je 0x58735f
test al, 0x10
je 0x58735f
mov eax, dword [ebp - 4]
call fcn.0040769c
mov edx, eax
lea eax, [ebp - 0x1c]
call fcn.004076ec
mov eax, dword [ebp - 0x1c]
call fcn.0040769c
push eax
call sub.kernel32.dll_RemoveDirectoryW
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x587365
push edi
call sub.kernel32.dll_SetLastError
lea eax, [esi + 0xd0]
mov edx, dword [ebp - 4]
call fcn.00406ee8
call fcn.00428a70
push eax
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x45358c]
call fcn.00454d44
mov ebx, eax
mov edx, ebx
mov eax, esi
call fcn.00586e40
mov eax, ebx
call fcn.00405080
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.00406ee8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x5873c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5873eb
lea eax, [ebp - 0x1c]
mov edx, 5
call fcn.00406b68
lea eax, [ebp - 4]
call fcn.00406b08
ret
Function at 0x587d0c
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd90
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x26c], edx
mov dword [ebp - 0x270], edx
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x587e95
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
cmp byte [ebx + 0xb0], 0
je 0x587d7d
lea eax, [ebp - 0x260]
push eax
xor ecx, ecx
xor edx, edx
mov al, 1
call fcn.00569744
mov eax, dword [ebp - 0x260]
lea edx, [ebp - 4]
call fcn.00569a2c
jmp 0x587da0
lea eax, [ebp - 0x264]
push eax
xor ecx, ecx
mov edx, dword [ebx + 0x4c]
movzx eax, byte [ebx + 0x48]
call fcn.00569744
mov eax, dword [ebp - 0x264]
lea edx, [ebp - 4]
call fcn.00569a2c
lea eax, [ebp - 8]
mov ecx, 0x587eb4
mov edx, dword [ebx + 0x68]
call fcn.004078f0
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x268]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
call fcn.004078f0
mov eax, dword [ebp - 0x268]
call fcn.0040769c
push eax
call sub.kernel32.dll_FindFirstFileW
mov edi, eax
cmp edi, 0xffffffff
je 0x587e6a
mov ecx, ebx
mov dl, 1
mov eax, dword [0x583d34]
call fcn.00588054
mov esi, eax
lea eax, [ebp - 0x270]
lea edx, [ebp - 0x230]
mov ecx, 0x104
call fcn.00407740
mov ecx, dword [ebp - 0x270]
lea eax, [ebp - 0x26c]
mov edx, dword [ebp - 4]
call fcn.004078f0
mov edx, dword [ebp - 0x26c]
mov eax, esi
call fcn.0058839c
test al, al
je 0x587e4c
mov edx, esi
mov eax, ebx
call fcn.00585cb8
test al, al
je 0x587e4c
mov byte [ebp - 9], 1
mov edx, esi
mov eax, dword [ebx + 0x64]
call fcn.00442750
jmp 0x587e53
mov eax, esi
call fcn.00405080
lea eax, [ebp - 0x25c]
push eax
push edi
call sub.kernel32.dll_FindNextFileW
test eax, eax
jne 0x587de4
push edi
call sub.kernel32.dll_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x587e9c
lea eax, [ebp - 0x270]
mov edx, 5
call fcn.00406b68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b68
ret
Function at 0x589218
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x589382
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x589244
call sub.kernel32.dll_GetUserDefaultLCID
mov esi, eax
mov eax, esi
call fcn.00585808
mov dword [ebx + 0x28], eax
mov dword [ebx + 0x2c], esi
xor eax, eax
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
lea eax, [ebx + 0x14]
mov edx, 0x58939c
call fcn.00406ee8
lea ecx, [ebp - 4]
mov edx, 0x1002
mov eax, esi
call fcn.0056bb70
lea ecx, [ebp - 0x14]
mov edx, 0x1001
mov eax, esi
call fcn.0056bb70
push dword [ebp - 0x14]
push 0x5893d4
push dword [ebp - 4]
push 0x5893e8
lea eax, [ebx + 0x18]
mov edx, 4
call fcn.00407978
lea ecx, [ebp - 0x18]
mov edx, 4
mov eax, esi
call fcn.0056bb70
push dword [ebp - 0x18]
push 0x5893d4
lea ecx, [ebp - 0x1c]
mov edx, 8
mov eax, esi
call fcn.0056bb70
push dword [ebp - 0x1c]
push 0x5893e8
lea eax, [ebx + 0x38]
mov edx, 4
call fcn.00407978
call fcn.00420b24
fstp qword [ebp - 0x10]
wait
push dword [ebp - 0xc]
push dword [ebp - 0x10]
lea ecx, [ebp - 8]
mov edx, dword [0x5c7c34]
mov eax, 0x5893f8
call fcn.004219a4
lea eax, [ebx + 0x1c]
mov ecx, dword [ebp - 8]
mov edx, 0x589418
call fcn.004078f0
lea eax, [ebx + 0x20]
mov edx, 0x589470
call fcn.00406ee8
push 0x5894a0
push dword [ebp - 4]
push 0x5894b8
lea eax, [ebx + 0x30]
mov edx, 3
call fcn.00407978
mov eax, dword [ebx + 4]
push dword [eax + 0x68]
push dword [ebp - 4]
push 0x5894d0
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.00407978
mov edx, dword [ebp - 0x20]
mov eax, ebx
call fcn.00589110
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x589389
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00406b68
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b68
ret

Function at 0x58afb8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x58b02b
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
mov dword [ebp - 8], edx
test al, al
je 0x58b015
lea ecx, [ebp - 4]
lea edx, [ebp - 0xc]
call fcn.0058ae14
cmp dword [ebp - 0xc], 0
je 0x58b00a
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004298dc
test al, al
je 0x58b015
xor eax, eax
mov dword [ebp - 8], eax
jmp 0x58b015
mov eax, dword [ebp - 4]
call fcn.0058af0c
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b032
lea eax, [ebp - 4]
call fcn.00406b08
ret
Function at 0x58b0d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov ebx, edx
xor edx, edx
push ebp
push 0x58b192
push dword fs:[edx]
mov dword fs:[edx], esp
test al, al
jne 0x58b0fc
mov eax, ebx
call fcn.00406b08
jmp 0x58b17c
mov ecx, ebx
lea edx, [ebp - 8]
call fcn.0058ae14
cmp dword [ebp - 8], 0
je 0x58b17c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004298d0
test al, al
je 0x58b175
xor eax, eax
push ebp
push 0x58b16e
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, ebx
mov eax, dword [ebp - 0xc]
call fcn.0058b03c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b17c
lea eax, [ebp - 4]
call fcn.0040a194
push eax
call sub.shell32.dll_SHGetMalloc
call fcn.004298d0
test al, al
je 0x58b16d
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
mov eax, ebx
call fcn.00406b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x58b199
lea eax, [ebp - 4]
call fcn.0040a194
ret

Function at 0x59d23c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.0040769c
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x59d255
test al, 0x10
jne 0x59d259
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x5a4b5c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406bec
mov eax, dword [ebp - 8]
call fcn.00406bec
mov eax, dword [ebp + 8]
call fcn.00406bec
xor eax, eax
push ebp
push 0x5a4c05
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00404a64
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], ebx
mov eax, 0x5a4c14
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.0040769c
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.0040769c
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 1
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4c0c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b68
lea eax, [ebp + 8]
call fcn.00406b08
ret

Function at 0x5a4c20
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00406bec
mov eax, dword [ebp - 8]
call fcn.00406bec
xor eax, eax
push ebp
push 0x5a4c9c
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.005a4b00
test al, al
je 0x5a4c67
push 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.005a4b5c
jmp 0x5a4c81
push 1
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.0040769c
push eax
push 0x5a4ca8
push ebx
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4ca3
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406b68
ret

Function at 0x5a4cb4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x5a4d8a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406f30
lea eax, [ebp - 4]
call fcn.004070e0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040769c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x5a4d74
mov eax, ebx
call fcn.00404404
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x5a4d6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.0040769c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x5a4d57
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x5a4d9c
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x5a4d57
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4d74
mov eax, dword [ebp - 0x10]
call fcn.00404420
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5a4d91
lea eax, [ebp - 4]
call fcn.00406b08
ret
Function at 0x5ab470
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00406bec
xor eax, eax
push ebp
push 0x5ab5a5
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x5ab578
xor edx, edx
push ebp
push 0x5ab571
push dword fs:[edx]
mov dword fs:[edx], esp
mov ebx, dword [ebp - 4]
mov eax, ebx
test eax, eax
je 0x5ab4bd
sub eax, 4
mov eax, dword [eax]
inc eax
push eax
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x5ab546
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov esi, eax
xor eax, eax
push ebp
push 0x5ab535
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x5ab4fc
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.0040769c
lea ecx, [ebx + 1]
mov edx, esi
call fcn.0040464c
call sub.user32.dll_EmptyClipboard
mov eax, dword [ebp - 8]
push eax
push 1
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab53c
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret
mov ecx, dword [0x5c7564]
mov dl, 1
mov eax, dword [0x4176dc]
call fcn.004235c8
call fcn.004061f0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5ab5ac
lea eax, [ebp - 4]
call fcn.00406b08
ret
Function at 0x401000
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.004021df
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
xor ebx, ebx
push esi
call edi
cmp eax, 0xffffffff
je 0x401036
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.004021df
inc ebx
pop ecx
cmp ebx, 0xa
jl 0x401016
push esi
call edi
inc eax
pop edi
neg eax
sbb eax, eax
pop esi
inc eax
pop ebx
ret

Function at 0x401084
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
push str.E5C53971_D80E_4500_BE0D_761BF3CD8457
xor ebx, ebx
push 1
push ebx
mov dword [0x515fbc], eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x515fd8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4010d5
push dword [0x515fd8]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push dword [0x515fd8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x2711
jmp 0x4011b4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, 0x41205c
lea edi, [ebp - 4]
movsw word es:[edi], word [esi]
lea ecx, [ebp - 4]
push ecx
push eax
movsb byte es:[edi], byte [esi]
call fcn.00401043
mov edi, eax
pop ecx
cmp edi, ebx
pop ecx
je 0x40118c
lea eax, [edi - 1]
mov ebx, str.SILENCE
mov dword [0x515fc0], eax
mov esi, str.CHECKSUM
push str.SILENT
call fcn.00407b80
push eax
push str.SILENT
push edi
call fcn.00407a3b
add esp, 0x10
test eax, eax
je 0x40116e
push ebx
call fcn.00407b80
push eax
push ebx
push edi
call fcn.00407a3b
add esp, 0x10
test eax, eax
je 0x40116e
push esi
call fcn.00407b80
push eax
push esi
push edi
call fcn.00407a3b
add esp, 0x10
test eax, eax
jne 0x401178
push esi
call fcn.00407b80
add eax, edi
push eax
call fcn.004079b0
pop ecx
mov dword [0x515fd0], eax
pop ecx
jmp 0x401178
mov dword [0x515fcc], 1
lea eax, [ebp - 4]
push eax
push edi
call fcn.00401043
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x401110
xor ebx, ebx
cmp dword [0x515fcc], ebx
pop edi
pop esi
push ebx
je 0x40119e
call fcn.0040147c
jmp 0x4011af
push 0x4011b9
push ebx
push 0x65
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov eax, dword [0x515fdc]
pop ebx
leave
ret 0x10
Function at 0x401e09
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
push edi
push edi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push edi
push eax
push 0x100000
push 0x415eb4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401e55
cmp word [0x415eb4], 0x5a4d
jne 0x401e55
mov ecx, dword [0x415ef0]
cmp dword [ecx + 0x415eb4], 0x4550
je 0x401e5a
or eax, 0xffffffff
jmp 0x401e85
push esi
xor eax, eax
movzx esi, word [ecx + 0x415eba]
cmp esi, edi
jle 0x401e84
lea edx, [ecx + 0x415fbc]
mov ecx, dword [edx + 4]
add ecx, dword [edx]
cmp ecx, eax
jbe 0x401e79
mov eax, ecx
add edx, 0x28
inc edi
movsx ecx, di
cmp ecx, esi
jl 0x401e6e
pop esi
pop edi
leave
ret

Function at 0x401e88
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
push esi
push 0x44
xor ebx, ebx
pop esi
lea eax, [ebp - 0x74]
push esi
push ebx
push eax
call fcn.00408350
add esp, 0xc
lea eax, [ebp - 0x74]
mov dword [ebp - 0x74], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
cmp dword [0x515fc4], ebx
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x401ec8
push str.__AUTOPATCH
push dword [ebp + 8]
call esi
cmp dword [ebp + 0xc], ebx
je 0x401eec
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x401eec
push 0x412150
push dword [ebp + 8]
call esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x74]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x401f3d
cmp dword [ebp + 0x10], ebx
mov dword [ebp + 8], ebx
je 0x401f28
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp + 8]
jmp 0x401f7d
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 7
mov edx, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x2f]
mov byte [ebp - 0x30], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push edx
lea eax, [ebp - 0x30]
push 0x41214c
push eax
call fcn.004082f1
add esp, 0xc
lea eax, [ebp - 0x30]
push ebx
push dword [ebp + 8]
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, 0x2719
pop edi
pop esi
pop ebx
leave
ret