joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1b2ffa0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa08000]
push edi
or ebp, 0xffffffff
jmp 0x1b2ffc2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1b2ffc9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1b2ffb8
mov eax, 1
add ebx, ebx
jne 0x1b2ffdb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1b2ffec
jne 0x1b3000b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1b3000b
dec eax
add ebx, ebx
jne 0x1b2fff8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x1b2ffd0
add ebx, ebx
jne 0x1b30007
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x1b3005d
xor ecx, ecx
sub eax, 3
jb 0x1b30023
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1b30092
sar eax, 1
mov ebp, eax
jmp 0x1b3002e
add ebx, ebx
jne 0x1b3002e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1b2fffc
inc ecx
add ebx, ebx
jne 0x1b3003c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1b2fffc
add ebx, ebx
jne 0x1b30049
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1b3003e
jne 0x1b3005a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1b3003e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1b3007c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1b3006e
jmp 0x1b2ffbe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1b3007c
add edi, ecx
jmp 0x1b2ffbe
pop esi
mov edi, esi
mov ecx, 0x7627
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1b3009a
cmp byte [edi], 0x24
jne 0x1b3009a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1b3009f
lea edi, [esi + 0x172c000]
mov eax, dword [edi]
or eax, eax
je 0x1b30117
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x176b728]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x176b84c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1b300cc
mov ecx, edi
jns 0x1b300fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x176b854]
or eax, eax
je 0x1b30111
mov dword [ebx], eax
add ebx, 4
jmp 0x1b300e9
call dword [esi + 0x176b850]
mov ebp, dword [esi + 0x176b858]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1b3014b
sub esp, 0xffffff80
jmp 0x4fbdde
Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40201c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x402028
push 0x402024
push 0x402020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x402028]
push dword [0x402024]
push dword [0x402020]
mov dword [0x402014], esp
call fcn.00401b40
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x401464
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x14], 0
push 4
mov edi, dword [ebp + 8]
add edi, 0x3c
push edi
lea edi, [ebp - 0xc]
push edi
call sub.CRTDLL.DLL_memcpy
add esp, 0xc
mov edi, dword [ebp - 0xc]
add edi, dword [ebp + 8]
mov dword [ebp - 0x10], edi
mov edi, dword [ebp - 0xc]
add edi, 0xf8
add edi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 4]
mov esi, dword [ebp + 0xc]
cmp dword [edi + 0xc], esi
jbe 0x4014c6
mov eax, dword [ebp + 0xc]
jmp 0x401543
mov dword [ebp - 8], 0
jmp 0x401534
mov edi, dword [ebp - 0xc]
add edi, 0xf8
imul esi, dword [ebp - 8], 0x28
add edi, esi
add edi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov edi, dword [ebp - 4]
mov edi, dword [edi + 0xc]
cmp dword [ebp + 0xc], edi
jb 0x4014f6
mov ebx, 1
jmp 0x4014fb
mov ebx, 0
mov edi, dword [ebp - 4]
mov esi, dword [edi + 0xc]
add esi, dword [edi + 8]
cmp dword [ebp + 0xc], esi
jae 0x401512
mov dword [ebp - 0x18], 1
jmp 0x401519
mov dword [ebp - 0x18], 0
test dword [ebp - 0x18], ebx
je 0x401531
mov edi, dword [ebp - 4]
mov esi, dword [edi + 0x14]
mov ebx, dword [ebp + 0xc]
sub ebx, dword [edi + 0xc]
mov edi, esi
add edi, ebx
mov dword [ebp - 0x14], edi
inc dword [ebp - 8]
mov edi, dword [ebp - 0x10]
movzx edi, word [edi + 6]
cmp dword [ebp - 8], edi
jl 0x4014cf
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401b40
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.dll_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x401b74
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x401b8f
mov edi, eax
inc edi
jmp 0x401b6c
inc edi
cmp byte [edi], 0x20
je 0x401b6b
jmp 0x401b8f
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x401b80
cmp eax, 0x20
jne 0x401b73
jmp 0x401b83
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x401b8f
cmp eax, 0x20
je 0x401b82
push 0
call sub.KERNEL32.dll_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.00401769
pop edi
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4014e6
Capabilities:
Check for software breakpoints

Disassembly:
mov ecx, dword [esp + 4]
push 0xfffffffffffffffb
pop eax
mov dl, byte [eax + ecx]
cmp dl, 0x90
je 0x4014fa
cmp dl, 0xcc
jne 0x401544
inc eax
cmp eax, 0xffffffff
jle 0x4014ed
mov al, byte [ecx]
cmp al, 0x8b
je 0x40150a
cmp al, 0x89
jne 0x401544
cmp byte [ecx + 1], 0xff
jne 0x401544
mov eax, 0x40189c
mov byte [ecx - 5], 0xe9
sub eax, ecx
mov dword [ecx - 4], eax
lea eax, [ecx + 2]
mov dword [0x436a10], eax
mov eax, 0xf9eb
push 0
push 0
mov word [ecx], ax
call dword [0x42a014]
push eax
call dword [0x42a034]
mov al, 1
ret 0xc
xor al, al
jmp 0x401541
Function at 0x405a3d
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.shell32.dll_ShellExecuteExW]
ret 4

Function at 0x405b23
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x405b32
pop dword [ebp - 0x4c]
mov eax, 0x405b32
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0xf5f5cc42
add dword [ebp - 0x5c], 0x585c7909
mov dword [ebp - 0x58], 0x229abf7b
add dword [ebp - 0x58], 0xf988cca
mov dword [ebp - 0x54], 0xeca053a8
add dword [ebp - 0x54], 0x5fabf086
mov dword [ebp - 0x50], 0x457bf2a5
add dword [ebp - 0x50], 0xba840d5b
lea eax, [ebp - 0x5c]
push eax
mov eax, 0xa5761ce8
add eax, 0x5aca6390
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x309abeca
sub dword [ebp - 0x5c], 0xbc285574
mov dword [ebp - 0x58], 0xe64b65a8
add dword [ebp - 0x58], 0x5b20fbcd
mov dword [ebp - 0x54], 0x6be83e6
add dword [ebp - 0x54], 0x5cb0e886
mov dword [ebp - 0x50], 0x4c3d8544
sub dword [ebp - 0x50], 0x4c3d8544
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xbc6d9364
sub eax, 0xbc2d12e8
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3ac30
push 0
call eax
mov ecx, 0x5702
mov ebx, eax
mov edx, 0x7235830b
add edx, 0x8e0f90f5
add edx, dword [ebp - 0x4c]
mov edi, 0xdc89624f
add dword [ebp - 0x38], 0x1cba0387
mov esi, dword [edx]
add dword [ebp - 0x40], 0x55cae1ed
sub esi, edi
xor dword [ebp - 8], edi
mov dword [ebx], esi
sub dword [ebp - 0x1c], eax
add ebx, 4
add edx, 4
loop 0x405c43
add eax, 0x3596f58
sub eax, 0x358207d
mov ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x405dee
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42fa70
push esi
call fcn.00406411
push esi
call fcn.00405d91
mov edi, eax
test edi, edi
jne 0x405e0f
xor eax, eax
jmp 0x405e67
push edi
call fcn.004066c0
test byte [0x434f1c], 0x80
je 0x405e2c
mov ax, word [edi]
test ax, ax
je 0x405e0b
cmp ax, 0x5c
je 0x405e0b
sub edi, esi
sar edi, 1
jmp 0x405e46
call fcn.0040676f
test eax, eax
je 0x405e40
test byte [eax], 0x10
je 0x405e0b
push esi
call fcn.00405d32
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405e32
call fcn.00405ce6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405ee2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405f01
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x4068f3
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x43190c], 0
push esi
jne 0x40692a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406904
mov dword [ecx*4 + 0x431908], eax
inc ecx
cmp ecx, 0x100
jl 0x4068ff
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x40695b
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x431908]
xor eax, esi
inc ecx
dec edx
jne 0x40693d
pop edi
not eax
pop esi
ret 0xc

Function at 0x663d32c5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push edi
push 0x15
pop ecx
push 0x20
pop edx
push 4
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
pop eax
push 0
push 0
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x54]
mov ecx, section..data
push eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x40], ecx
mov ecx, 0x663d6004
push 0x663d14a8
push 1
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x4c], 0x663d146c
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], 0x663d1430
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x24], ecx
call dword [sym.imp.ntdll.dll_RtlQueryRegistryValues]
push dword [0x663d6004]
push dword [section..data]
push 0x663d13c0
push 0x100000
call fcn.663d3368
add esp, 0x10
pop edi
leave
ret

Function at 0x663d486a
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push esi
push edi
call ebp
mov edi, eax
push 0x663d6220
add edi, 0x7fffffff
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, 0x663d6208
jmp 0x663d48b4
call ebp
sub eax, dword [esi + 0x10]
cmp eax, 0x7fffffff
jae 0x663d48c0
mov eax, dword [esi]
mov ecx, dword [esi + 4]
push 0
push esi
mov dword [ecx], eax
push fcn.663d3412
mov dword [eax + 4], ecx
call dword [sym.imp.ntdll.dll_RtlQueueWorkItem]
mov esi, dword [0x663d6208]
cmp esi, ebx
jne 0x663d4890
jmp 0x663d48c3
mov edi, dword [esi + 0x10]
push 0x663d6220
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5e401e2d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x5e40906c]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push 0x2001f
mov ebx, ecx
push eax
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x108]
mov dword [ebp - 0x110], eax
mov dword [ebp - 0x108], esi
call fcn.5e4018c7
cmp eax, esi
jne 0x5e401ece
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x5e401e85
lea eax, [ebp - 0x104]
push eax
call fcn.5e401e2d
cmp eax, esi
jne 0x5e401ecd
lea eax, [ebp - 0x118]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x108]
mov dword [ebp - 0x10c], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x108]
je 0x5e401e75
call fcn.5e401854
push dword [ebp - 0x110]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 0x108]
mov esi, eax
call fcn.5e401854
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
call fcn.5e4054a5
leave
ret 4

Function at 0x5e4026fa
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x5e40906c]
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x114], eax
mov eax, dword [ebp + 0x14]
push 0x5e409124
mov dword [ebp - 0x118], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.5e4017d6
push edi
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.5e401d86
mov edi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c]
push eax
xor esi, esi
push esi
mov ebx, 0x20006
push ebx
push esi
push esi
push esi
lea eax, [ebp - 0x108]
push eax
push 0x80000000
call edi
cmp dword [ebp - 0x10c], esi
je 0x5e402807
push dword [ebp - 0x114]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp - 0x114]
push 1
push esi
push 0x5e40281c
push dword [ebp - 0x10c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x110]
push eax
push esi
push ebx
push esi
push esi
push esi
push str.Bits
push dword [ebp - 0x10c]
call edi
cmp dword [ebp - 0x110], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x5e4027ff
push dword [ebp + 0x10]
push dword [ebp - 0x118]
push 3
push esi
push 0x5e402818
push dword [ebp - 0x110]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x110]
call edi
push dword [ebp - 0x10c]
call edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.5e4054a5
leave
ret 0x10

Function at 0x5e4031d7
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp + 0x10], ecx
jbe 0x5e403205
mov edx, dword [ebp + 0xc]
movzx edx, byte [ecx + edx]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x5e409148]
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x5e4031e6
pop ebp
ret 0xc
Function at 0x40323a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 8]
xor ebx, ebx
and dword [ebp - 8], ebx
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], ebx
push dword [eax]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x4033bc
push edi
push esi
call fcn.004143b1
mov edi, eax
pop ecx
test edi, edi
je 0x4033bb
mov eax, dword [ebp + 8]
push edi
push esi
push dword [ebp - 8]
push dword [eax]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4033b4
call fcn.0040386b
test eax, eax
je 0x403326
call fcn.004037f1
test eax, eax
jne 0x403326
and dword [ebp + 8], ebx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x18]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x403326
test dword [ebp + 8], 0xfffffffc
jbe 0x403326
call fcn.00402a92
push eax
lea ecx, [ebp - 0xc]
call fcn.00402d6e
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + ebx*4 + 2]
push eax
movzx eax, word [ecx + ebx*4]
push eax
lea eax, [ebp - 0xc]
push str.StringFileInfo_04x_04xFileVersion
push eax
call fcn.00403128
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 0x10]
and dword [ebp - 0x14], 0
add esp, 0x10
and dword [ebp - 0x10], 0
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x403372
lea ecx, [esi - 0x10]
call fcn.00403b1f
mov eax, dword [ebp + 8]
inc ebx
shr eax, 2
cmp ebx, eax
jb 0x4032c8
mov ebx, dword [ebp + 0xc]
and dword [ebp + 8], 0
lea eax, [ebp - 0x18]
and dword [ebp - 0x18], 0
push eax
lea eax, [ebp + 8]
push eax
push 0x467688
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4033b1
mov ecx, dword [ebp + 8]
movzx eax, word [ecx + 0xc]
push eax
movzx eax, word [ecx + 0xe]
push eax
movzx eax, word [ecx + 8]
push eax
movzx eax, word [ecx + 0xa]
push eax
push str._d._d._d._d
push ebx
call fcn.00403128
xor ebx, ebx
add esp, 0x18
inc ebx
jmp 0x4033b4
push dword [ebp - 0x10]
mov ebx, dword [ebp + 0xc]
mov ecx, ebx
push dword [ebp - 0x14]
call fcn.00403f40
push 0x2e
push 0x2c
mov ecx, ebx
call fcn.00403d24
push 0x20
mov ecx, ebx
call fcn.00403b37
lea ecx, [esi - 0x10]
mov dword [ebp - 4], 1
call fcn.00403b1f
mov eax, dword [ebx]
cmp dword [eax - 0xc], 0
je 0x403329
mov ebx, dword [ebp - 4]
push edi
call fcn.004143ba
pop ecx
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40701c
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x116c
call fcn.004144e0
mov eax, dword [0x47f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40718b
push ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push edi
call ebx
test eax, eax
je 0x40718a
test esi, esi
je 0x40718a
push esi
call ebx
test eax, eax
je 0x40706b
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1000
xor ebx, ebx
lea eax, [ebp - 0x1004]
push ebx
push eax
call fcn.004320f0
add esp, 0xc
lea ecx, [ebp - 0x10bc]
push 1
push 0x40
push 1
push edi
call fcn.00406aee
push 1
push 0x40
push 2
push esi
lea ecx, [ebp - 0x116c]
call fcn.00406bc8
jmp 0x407145
mov eax, dword [ebp - 0x116c]
mov eax, dword [eax + 4]
cmp dword [ebp + eax - 0x1160], ebx
jne 0x40715e
test byte [ecx], 1
jne 0x40715e
push ebx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x10bc]
call fcn.004077bb
lea eax, [ebp - 0x1004]
push str.check
push eax
call fcn.004336c0
pop ecx
pop ecx
test eax, eax
je 0x40710c
lea eax, [ebp - 0x1004]
push str._trate_
push eax
call fcn.004336c0
pop ecx
pop ecx
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x407115
sub ecx, edx
lea eax, [ebp - 0x1004]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x116c]
call fcn.0040802a
push ebx
push 2
push 0x467e04
lea ecx, [ebp - 0x116c]
call fcn.0040802a
mov eax, dword [ebp - 0x10bc]
lea ecx, [ebp - 0x10b0]
mov eax, dword [eax + 4]
add ecx, eax
cmp dword [ecx], ebx
je 0x4070ab
lea ecx, [ebp - 0x10bc]
call fcn.004075bc
lea ecx, [ebp - 0x116c]
call fcn.004075ee
lea ecx, [ebp - 0x116c]
call fcn.00406e87
lea ecx, [ebp - 0x10bc]
call fcn.00406e41
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041439b
leave
ret
Function at 0x4080f8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x40811a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004081d6
jmp 0x4081d1
mov eax, dword [edi + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov eax, dword [eax]
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x40813b
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x40813d
xor eax, eax
cdq
mov dword [ebp + 0x10], eax
mov ecx, edx
mov dword [ebp - 4], ecx
test ebx, ebx
jl 0x4081c5
jg 0x408150
test esi, esi
je 0x4081c5
test ecx, ecx
jl 0x408192
jg 0x40815a
test eax, eax
je 0x408192
cmp ebx, ecx
jg 0x40816c
jl 0x408164
cmp esi, eax
jae 0x40816c
mov eax, esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 4], ebx
push eax
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.00431380
mov ecx, dword [ebp + 0x10]
add esp, 0xc
mov eax, dword [edi + 0x2c]
add dword [ebp + 8], ecx
sub esi, ecx
sbb ebx, dword [ebp - 4]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x408198
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
test ebx, ebx
jl 0x4081c5
jg 0x4081a2
test esi, esi
je 0x4081c5
cmp dword [edi + 0x4c], 0
je 0x4081c5
mov ecx, edi
call fcn.004074d0
push dword [edi + 0x4c]
push esi
push 1
push dword [ebp + 8]
call fcn.0043acad
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
sub eax, esi
pop esi
sbb edx, ebx
pop ebx
pop edi
leave
ret 0xc

Function at 0x4084a9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47f0a8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
xor esi, esi
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40850e
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push 0x467e4c
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 2
push eax
push esi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041439b
leave
ret 4