joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4155c0
Capabilities:
Get disk size
Get file size
Write file on windows

Disassembly:
sub esp, 0x258
mov eax, dword [0x45e088]
xor eax, esp
mov dword [esp + 0x254], eax
push ebx
mov ebx, dword [esp + 0x264]
lea eax, [esp + 0x48]
push ebp
push esi
push edi
mov edi, dword [esp + 0x26c]
lea ecx, [esp + 0x40]
mov dword [esp + 0x50], eax
xor eax, eax
push edi
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x14], vtable.RawDiskFileClass.0
mov dword [esp + 0x44], 0
mov dword [esp + 0x48], 0
mov dword [esp + 0x4c], 2
mov dword [esp + 0x50], 0x108
mov word [esp + 0x58], ax
call fcn.00413540
push 0
push 0
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x30]
push eax
push dword [esp + 0x60]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
test eax, eax
je 0x41574d
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
mov ebp, dword [esp + 0x24]
imul ebp, dword [esp + 0x28]
push 0
mov eax, dword [eax + 0x30]
push 3
push 3
push 0xc0000000
push edi
call eax
test al, al
je 0x41574d
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
mov dword [esp + 0x1c], esi
cmp esi, 0xffffffff
jne 0x4156b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4156b2
xorps xmm0, xmm0
movlpd qword [esp + 0x1c], xmm0
mov esi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x20]
lea ecx, [esp + 0x2c]
push 1
push ebp
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 1
mov dword [esp + 0x40], 0
mov dword [esp + 0x44], 0
call fcn.00408ce0
test al, al
je 0x415740
mov eax, esi
or eax, ebx
je 0x415729
test ebx, ebx
jl 0x415706
jg 0x415702
cmp esi, ebp
jbe 0x415706
mov edi, ebp
jmp 0x415708
mov edi, esi
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push dword [esp + 0x48]
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esi, edi
mov eax, esi
sbb ebx, 0
or eax, ebx
jne 0x4156f8
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
lea ecx, [esp + 0x2c]
call fcn.0040be80
mov bl, 1
jmp 0x41577f
lea ecx, [esp + 0x2c]
call fcn.0040be80
mov ebx, dword [esp + 0x18]
test edi, edi
mov esi, str.Function
cmovne esi, edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x415772
mov eax, dword [ebx]
push esi
push str.Error_in___s_
push ebx
call dword [eax + 0x20]
add esp, 0xc
jmp 0x41577d
push 0
push esi
push eax
mov ecx, ebx
call fcn.00414cf0
mov bl, al
lea ecx, [esp + 0x40]
call fcn.0040be80
and dword [esp + 0x40], 0xfffffffc
lea ecx, [esp + 0x10]
mov dword [esp + 0x44], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x10], vtable.HandleClass.0
call fcn.0040fd80
test al, al
je 0x4157c7
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x10]
call dword [eax + 0x1c]
mov ecx, dword [esp + 0x264]
mov al, bl
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420cb2
add esp, 0x258
ret
Function at 0x4164f0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [ecx + 0xc]
mov eax, dword [ecx]
or edx, 0x20006
mov dword [esp], 0
mov dword [esp + 4], 0
push ebx
push esi
mov esi, dword [ecx + 4]
cmp eax, 0x80000004
je 0x416547
cmp eax, 0x80000050
je 0x416547
lea ecx, [esp + 8]
push ecx
push edx
push 0
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41654b
mov ecx, dword [esp + 0x20]
push 0
push esi
push eax
call fcn.00414cf0
test al, al
je 0x41657d
jmp 0x41654b
mov dword [esp + 8], eax
push dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
push dword [esp + 0x1c]
push dword [esp + 0x2c]
push 0
push esi
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x416581
mov ecx, dword [esp + 0x20]
push 0
push esi
push eax
call fcn.00414cf0
test al, al
jne 0x416581
xor bl, bl
jmp 0x416583
mov bl, 1
mov eax, dword [esp + 8]
test eax, eax
je 0x416592
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov al, bl
pop ebx
add esp, 8
ret 0x14
Function at 0x4168d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x20]
push ebp
push esi
push edi
mov edx, dword [ebx + 0x20]
mov ebp, ecx
cmp edx, 1
je 0x416a07
cmp edx, 2
je 0x416a07
cmp edx, 7
jne 0x4169e9
mov edx, dword [ebx + 0x28]
xor esi, esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], esi
test edx, edx
je 0x416988
mov ecx, edx
lea edi, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416930
sub ecx, edi
sar ecx, 1
lea edi, [ecx*2 + 2]
test edi, edi
je 0x41698a
push 0
push edi
lea ecx, [esp + 0x18]
call fcn.00410890
mov esi, eax
mov dword [esp + 0x20], esi
test esi, esi
je 0x416969
mov edx, dword [ebx + 0x28]
mov dword [esp + 0x1c], edi
jmp 0x41698a
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
xor bl, bl
call fcn.0040be80
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 0xc
xor edi, edi
push edi
push edx
push esi
mov dword [esp + 0x20], edi
call fcn.00422d00
movzx eax, word [esi]
add esp, 0xc
mov ecx, esi
test ax, ax
je 0x4169be
mov edx, eax
cmp dx, 0xa
jne 0x4169b0
xor eax, eax
mov word [ecx], ax
movzx eax, word [ecx + 2]
add ecx, 2
mov edx, eax
test ax, ax
jne 0x4169a5
push dword [esp + 0x30]
mov ecx, ebp
push edi
push esi
push dword [ebx + 0x20]
push dword [esp + 0x38]
call fcn.004164b0
lea ecx, [esp + 0x10]
mov bl, al
call fcn.0040be80
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x14
ret 0xc
push dword [esp + 0x30]
push dword [ebx + 0x1c]
push dword [ebx + 0x28]
push edx
push dword [esp + 0x38]
call fcn.004164b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
mov esi, dword [ebx + 0x28]
test esi, esi
je 0x416a2b
mov ecx, esi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x416a13
sub ecx, edi
sar ecx, 1
lea ecx, [ecx*2 + 2]
jmp 0x416a2d
xor ecx, ecx
push ecx
push esi
mov esi, dword [esp + 0x30]
push edx
push 0
push esi
push dword [ebp]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x416a5f
mov ecx, dword [esp + 0x30]
push 0
push esi
push eax
call fcn.00414cf0
test al, al
jne 0x416a5f
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 0xc
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x14
ret 0xc

Function at 0x416c50
Capabilities:
Print debug messages

Disassembly:
push esi
push edi
mov edi, ecx
push 0
lea esi, [edi + 0x80050]
push esi
call fcn.0040f920
add esp, 8
test eax, eax
je 0x416c9a
cmp dword [edi + 0x8000c], 0
je 0x416c8f
push 0
push esi
call fcn.0040f920
push eax
push 0x449068
push 0
push 0xffffffffffffffff
push edi
call fcn.004173d0
add esp, 0x1c
jmp 0x416c9a
push str.Messages_missed__likely_during_startup._r_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [edi + 0x8003c]
call fcn.00405f30
lea ecx, [edi + 0x80020]
call fcn.00405d00
lea ecx, [edi + 0x80008]
call fcn.00416cd0
lea ecx, [edi + 0x80008]
call fcn.00408270
mov ecx, edi
pop edi
pop esi
jmp fcn.00405650
Function at 0x418230
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebx, ecx
mov ecx, 0x4e050c
push edi
mov dword [esp + 0x18], ebx
call fcn.0040abd0
cmp dword [0x4e051c], 0
mov byte [esp + 0x13], al
jne 0x41827c
push dword [0x45dc38]
mov ecx, 0x4e0510
call fcn.00417ec0
test al, al
jne 0x418278
push dword [0x45dc3c]
mov ecx, 0x4e0510
call fcn.00417ec0
mov al, byte [esp + 0x13]
test al, al
je 0x41828a
mov ecx, 0x4e050c
call fcn.0040fec0
mov eax, dword [ebx + 0x14]
mov ebp, dword [0x4e051c]
shr eax, 9
and eax, 0xffffff01
mov dword [esp + 0x14], eax
test ebp, ebp
je 0x418465
test al, al
je 0x4183b2
mov ebx, dword [ebx + 0x28]
mov edi, dword [ebp + 0x28]
test ebx, ebx
je 0x41844c
test edi, edi
je 0x41844c
test edi, edi
je 0x41833f
mov eax, dword [edi + 0x18]
cmp eax, dword [ebx + 0x18]
jne 0x418452
mov eax, dword [edi + 0x1c]
cmp eax, dword [ebx + 0x1c]
jne 0x418452
mov eax, dword [edi + 0x20]
cmp eax, dword [ebx + 0x20]
jne 0x418452
lea edx, [ebx + 0x28]
mov esi, 0xc
lea ecx, [edi + 0x28]
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x418452
add ecx, 4
add edx, 4
sub esi, 4
jae 0x418300
lea eax, [ebx + 0x38]
mov esi, 0xc
lea edx, [edi + 0x38]
mov ecx, dword [edx]
cmp ecx, dword [eax]
jne 0x418452
add edx, 4
add eax, 4
sub esi, 4
jae 0x418320
mov ebx, dword [ebx + 4]
mov edi, dword [edi + 4]
test ebx, ebx
jne 0x4182c5
mov ebx, dword [esp + 0x18]
mov eax, dword [ebp + 0x64]
mov ecx, ebp
mov dword [ebx + 0x64], eax
mov eax, dword [ebp + 0x68]
mov dword [ebx + 0x68], eax
call fcn.0040c980
mov dword [ebx + 0x88], eax
mov ecx, ebx
mov eax, dword [ebx]
push dword [ebp + 0x18]
call dword [eax + 0x10]
push dword [ebp + 0x70]
lea ecx, [ebx + 0x70]
call fcn.00413240
push 0
lea ecx, [ebx + 0x78]
call fcn.004078f0
push 0
lea ecx, [ebx + 0x80]
call fcn.004078f0
cmp byte [esp + 0x14], 0
jne 0x4183a8
push 1
lea ecx, [ebx + 0x1c]
call fcn.004086d0
mov edx, dword [ebx + 0x1c]
lea eax, [ebp + 0x1c]
push 1
push eax
lea ecx, [ebx + 0x1c]
call dword [edx + 4]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0xc
ret
mov eax, dword [ebx + 0x70]
cmp word [eax], 0
je 0x418436
push dword [ebp + 0x70]
push eax
call fcn.0040f9c0
add esp, 8
test al, al
je 0x418456
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00417cd0
test al, al
jne 0x418343
mov eax, dword [ebp + 0x34]
cmp eax, dword [ebx + 0x34]
jne 0x418456
mov eax, dword [ebp + 0x3c]
cmp eax, dword [ebx + 0x3c]
jne 0x418456
lea edx, [ebx + 0x44]
mov esi, 0xc
lea ecx, [ebp + 0x44]
nop
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x418456
add ecx, 4
add edx, 4
sub esi, 4
jae 0x418400
lea edx, [ebx + 0x54]
mov esi, 0xc
lea ecx, [ebp + 0x54]
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x418456
add ecx, 4
add edx, 4
sub esi, 4
jae 0x418420
jmp 0x418343
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebx + 0x1c]
call fcn.00417cd0
test al, al
jne 0x418343
jmp 0x418456
mov ebx, dword [esp + 0x18]
jmp 0x41845a
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ebp, dword [ebp + 4]
test ebp, ebp
jne 0x4182a7
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret
Function at 0x419ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
test eax, eax
je 0x419ef4
add eax, eax
lea ecx, [esi + 0x2c]
push eax
call fcn.00410790
test al, al
je 0x41a037
push 0
push 0x8800
lea ecx, [esi + 0x40]
call fcn.00408ce0
test al, al
je 0x41a037
mov ecx, dword [esi + 0x50]
mov eax, dword [esi + 0x14]
add ecx, 0x400
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
lea eax, [ecx + 0x8000]
mov dword [esi + 0x10], 0
mov dword [esi + 0x74], ecx
mov dword [esi + 0x78], eax
mov dword [esi + 0x20], 0
mov dword [esi + 0x6c], 0
mov dword [esi + 0xa8], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0x80], ecx
mov dword [esi + 0x7c], ecx
mov dword [esi + 0xa4], 1
mov dword [esi + 0xc], 1
cmp dword [esi + 0x18], 0
je 0x419fc0
mov ecx, esi
call fcn.0041a4d0
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
sub edx, dword [esi + 0x1c]
je 0x419fb6
mov ecx, dword [esi + 8]
push 0x45b4e0
push edx
push dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xa8]
call eax
test al, al
je 0x419faf
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
shr eax, 0xd
test al, 1
jne 0x419faf
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
jmp 0x419fb6
mov dword [esi + 0x10], 0xffffffff
cmp dword [esi + 0x10], 0
je 0x419f62
nop dword [eax]
mov ecx, esi
call fcn.0041a4d0
mov edx, dword [esi + 0x14]
mov dword [esi + 0x10], eax
sub edx, dword [esi + 0x1c]
je 0x41a015
mov ecx, dword [esi + 8]
push 0x45b4e0
push edx
push dword [esi + 0x3c]
mov eax, dword [ecx]
mov eax, dword [eax + 0xa8]
call eax
test al, al
je 0x41a00e
mov eax, dword [esi + 8]
mov eax, dword [eax + 0x14]
shr eax, 0xd
test al, 1
jne 0x41a00e
mov eax, dword [esi + 0x3c]
mov dword [esi + 4], eax
mov eax, dword [esi + 0x14]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x10]
test eax, eax
je 0x419fc0
jmp 0x41a018
mov dword [esi + 0x10], 0xffffffff
mov eax, dword [esi + 0x10]
test eax, eax
je 0x41a053
cmp eax, 1
je 0x41a053
mov eax, dword [esp + 8]
push dword [esp + 0xc]
push str.Decompression_error_in___s_._File_may_be_corrupted
mov ecx, dword [eax]
push eax
call dword [ecx + 0x20]
add esp, 0xc
mov eax, dword [esi + 0xac]
lea ecx, [esi + 0xac]
mov dword [esi + 0x10], 0xfffffffc
call dword [eax + 0xc]
xor al, al
pop esi
ret 8
mov eax, dword [esi + 0xac]
lea ecx, [esi + 0xac]
call dword [eax + 0xc]
mov al, 1
pop esi
ret 8
Function at 0x41ace0
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 8
push esi
mov esi, ecx
mov al, byte [esi]
test al, al
jne 0x41ae43
mov eax, dword [0x45dcbc]
cmp eax, 0x80040007
jne 0x41ad19
push 0
push 0
push 0
push 3
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
mov dword [0x45dcbc], eax
push ebx
push ebp
mov ebp, dword [esp + 0x18]
push edi
test eax, eax
jns 0x41ad3b
push 0
push str.WMI_error
push eax
mov ecx, ebp
call fcn.00414cf0
test al, al
je 0x41ae2e
mov ecx, dword [esi + 0xc]
lea edi, [esi + 0xc]
test ecx, ecx
je 0x41ad4b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push edi
push 0x44a89c
push 1
push 0
push 0x44d8c8
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov ebx, eax
test ebx, ebx
jns 0x41adbb
push str.WbemLocator
push str.Failed_to_instantiate_COM_object
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x441510
push str._s__Message:___s_
push eax
mov dword [esp + 0x24], 0
call fcn.00414640
add esp, 0x10
test al, al
je 0x41adac
push 0
push dword [esp + 0x14]
mov ecx, ebp
push ebx
call fcn.00414cf0
test al, al
je 0x41adac
mov bl, 1
jmp 0x41adae
xor bl, bl
lea ecx, [esp + 0x10]
call fcn.00405f30
test bl, bl
je 0x41ae2e
mov ebx, dword [edi]
lea edi, [esi + 0x14]
mov ecx, dword [edi]
test ecx, ecx
je 0x41adcc
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
push edi
push 0
push 0
push 0
push 0
push 0
push 0
mov dword [edi], 0
mov eax, dword [ebx]
push str.ROOTCIMV2
push ebx
call dword [eax + 0xc]
test eax, eax
jns 0x41ae01
push 0
push str.WMI_error
push eax
mov ecx, ebp
call fcn.00414cf0
test al, al
je 0x41ae2e
push 0
push 0
push 3
push 3
push 0
push 0
push 0xa
push dword [edi]
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
jns 0x41ae3c
push 0
push str.WMI_error
push eax
mov ecx, ebp
call fcn.00414cf0
test al, al
jne 0x41ae3c
pop edi
pop ebp
xor al, al
pop ebx
mov byte [esi], al
pop esi
add esp, 8
ret 4
pop edi
mov al, 1
pop ebp
mov byte [esi], al
pop ebx
pop esi
add esp, 8
ret 4

Function at 0x41b4a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
movzx eax, word [esp + 0xc]
sub esp, 0x150
push ebp
push esi
mov esi, dword [esp + 0x15c]
push edi
push 0xa
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebp, eax
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41b563
push ebx
lea ecx, [esp + 0x10]
xor bl, bl
call fcn.004039b0
push dword [esp + 0x168]
lea ecx, [esp + 0x14]
push 0x400
push dword [esp + 0x178]
call fcn.00408d80
test al, al
je 0x41b546
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [esp + 0x170]
lea ecx, [esp + 0x14]
push dword [esp + 0x16c]
push ecx
push esi
push eax
lea ecx, [esp + 0xbc]
call fcn.00418920
mov ecx, eax
call fcn.00419ec0
lea ecx, [esp + 0xa8]
mov bl, al
call fcn.00418990
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
lea ecx, [esp + 0x10]
call fcn.00405690
mov al, bl
pop ebx
pop edi
pop esi
pop ebp
add esp, 0x150
ret
pop edi
pop esi
xor al, al
pop ebp
add esp, 0x150
ret
Function at 0x41b580
Capabilities:
Delete file

Disassembly:
sub esp, 0x298
mov eax, dword [0x45e088]
xor eax, esp
mov dword [esp + 0x294], eax
push ebx
mov ebx, dword [esp + 0x2a4]
lea eax, [esp + 0x88]
push ebp
mov ebp, dword [esp + 0x2a4]
lea ecx, [esp + 0x78]
push esi
push edi
push 0
push 0x108
push 2
push eax
mov dword [esp + 0x24], ebp
call fcn.00403920
mov eax, dword [esp + 0x90]
xor ecx, ecx
push 0x5c
push ebx
mov word [eax], cx
call fcn.0040c610
mov ecx, eax
add esp, 8
test ecx, ecx
je 0x41b5f7
mov esi, ecx
lea edx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x41b5e6
sub esi, edx
sar esi, 1
jmp 0x41b5f9
xor esi, esi
push 0xffffffffffffffff
push ecx
lea ecx, [esp + 0x88]
call fcn.00413140
cmp esi, 4
jbe 0x41b61b
mov eax, dword [esp + 0x90]
xor ecx, ecx
mov word [eax + esi*2 - 8], cx
lea ecx, [esp + 0x18]
mov esi, 0x115d
call fcn.00404a80
push ebx
push 0
push 0xa
push 0x2be
push ebp
lea ecx, [esp + 0x2c]
call fcn.00409220
test al, al
je 0x41b66a
mov eax, dword [esp + 0x70]
mov ecx, 4
cmp eax, ecx
cmova eax, ecx
push eax
push dword [esp + 0x6c]
lea eax, [esp + 0x18]
push eax
call fcn.00422d00
mov eax, dword [esp + 0x1c]
add esp, 0xc
test eax, eax
cmovne esi, eax
push ebp
push esi
push ebx
call fcn.00420540
add esp, 0xc
lea ecx, [esp + 0x18]
call fcn.00405e20
push 0
push dword [esp + 0x94]
push ebp
call fcn.0041d090
add esp, 0xc
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
call ebp
mov edi, 2
nop dword [eax]
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x88]
call fcn.00413140
lea ecx, [esp + 0x80]
call fcn.0040c5d0
mov esi, eax
sub edi, 1
jne 0x41b6df
push 0x2e
push esi
call fcn.0042226e
add esp, 8
mov esi, eax
test esi, esi
je 0x41b725
mov ecx, esi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41b6f0
sub ecx, edx
lea eax, [esi + 2]
sar ecx, 1
lea ecx, [ecx*2 + 2]
push ecx
push esi
push eax
call fcn.00421c30
add esp, 0xc
mov eax, 0x5f
mov word [esi], ax
push dword [esp + 0x90]
call ebp
test edi, edi
jne 0x41b6b0
push ebx
lea ecx, [esp + 0x84]
call fcn.00413340
lea ecx, [esp + 0x80]
call fcn.0040c5d0
push 0x5f
lea ecx, [esp + 0x84]
mov esi, eax
call fcn.004070a0
push edi
push esi
push dword [esp + 0x1c]
call fcn.0041d090
add esp, 0xc
lea ecx, [esp + 0x80]
push 1
push 0x44a924
call fcn.00412a90
push dword [esp + 0x90]
call ebp
push 0xffffffffffffffff
push ebx
lea ecx, [esp + 0x88]
call fcn.00413140
push 1
push str.snap
lea ecx, [esp + 0x88]
call fcn.00412a90
push dword [esp + 0x90]
call ebp
lea ecx, [esp + 0x80]
call fcn.00408270
mov ecx, dword [esp + 0x2a4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420cb2
add esp, 0x298
ret
Function at 0x41fab0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x244
mov eax, dword [0x45e088]
xor eax, esp
mov dword [esp + 0x240], eax
push ebx
push ebp
mov ebp, dword [esp + 0x254]
push esi
push edi
mov edi, dword [esp + 0x258]
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x41fc20
push 1
lea ecx, [esp + 0x1c]
call fcn.004038f0
push 0
push esi
lea ecx, [esp + 0x20]
call fcn.00408ce0
test al, al
je 0x41fbce
push dword [esp + 0x28]
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x41fbb2
lea eax, [esp + 0x10]
mov dword [esp + 0x14], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0
push eax
push str.StringFileInfo040904B0FileDescription
push dword [esp + 0x34]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x41fb8e
cmp dword [esp + 0x10], 0
je 0x41fb6a
push dword [esp + 0x14]
mov ecx, ebp
call fcn.00413240
lea ecx, [esp + 0x18]
mov bl, al
call fcn.00408270
jmp 0x41fc36
mov eax, dword [vtable.ErrorClass.0]
mov ecx, 0x45b4e0
push str.Could_not_retrieve_File_Description
mov eax, dword [eax + 4]
call eax
lea ecx, [esp + 0x18]
mov bl, al
call fcn.00408270
jmp 0x41fc36
mov eax, dword [vtable.ErrorClass.0]
mov ecx, 0x45b4e0
push str.File_Description_could_not_be_found_in_the_Version_resource
mov eax, dword [eax + 4]
call eax
lea ecx, [esp + 0x18]
mov bl, al
call fcn.00408270
jmp 0x41fc36
push str.Could_not_retrieve_Version_information_for_the_running_binary
mov ecx, 0x45b4e0
call fcn.0040fe80
lea ecx, [esp + 0x18]
mov bl, al
call fcn.00408270
jmp 0x41fc36
lea ecx, [esp + 0x18]
call fcn.00408270
push 0
push 0x108
push 2
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x3c]
call fcn.00403920
mov eax, dword [esp + 0x3c]
xor ecx, ecx
push 0xffffffffffffffff
push edi
mov word [eax], cx
lea ecx, [esp + 0x34]
call fcn.00413140
test al, al
je 0x41fc3e
lea ecx, [esp + 0x2c]
call fcn.0040c5d0
push eax
mov ecx, ebp
call fcn.00413240
test al, al
je 0x41fc3e
mov bl, 1
jmp 0x41fc40
mov eax, dword [vtable.ErrorClass.0]
mov ecx, 0x45b4e0
push str.Version_resource_is_not_present_in_the_running_binary
mov eax, dword [eax + 4]
call eax
mov bl, al
test bl, bl
je 0x41fbd7
mov al, 1
jmp 0x41fc4b
xor bl, bl
lea ecx, [esp + 0x2c]
call fcn.00408270
mov al, bl
mov ecx, dword [esp + 0x250]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00420cb2
add esp, 0x244
ret
Function at 0x41fc70
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 0x18
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], vtable.SmartCOMPointer_struct_INetFwMgr_.0
push eax
push 0x44d5e4
push 1
push 0
push 0x44cf5c
mov ebp, ecx
mov dword [esp + 0x30], 0
mov dword [esp + 0x24], vtable.SmartCOMPointer_struct_INetFwPolicy_.0
mov dword [esp + 0x28], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov edi, dword [esp + 0x2c]
mov esi, eax
test esi, esi
jns 0x41fd15
push str.Windows_Firewall_Manager
push str.Failed_to_instantiate_COM_object
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x441510
push str._s__Message:___s_
push eax
mov dword [esp + 0x34], 0
call fcn.00414640
add esp, 0x10
test al, al
je 0x41fd02
push 0
push dword [esp + 0x24]
mov ecx, edi
push esi
call fcn.00414cf0
test al, al
je 0x41fd02
mov bl, 1
jmp 0x41fd04
xor bl, bl
lea ecx, [esp + 0x20]
call fcn.00405f30
test bl, bl
je 0x41fe11
mov ecx, dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
test ecx, ecx
je 0x41fd27
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esp + 0x14], 0
lea ecx, [esp + 0x14]
mov eax, dword [esi]
push ecx
push esi
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jns 0x41fd95
push str.Windows_Firewall_Local_Policy
push str.COM_error_occurred
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x441510
push str._s__Message:___s_
push eax
mov dword [esp + 0x34], 0
call fcn.00414640
add esp, 0x10
test al, al
je 0x41fd86
push 0
push dword [esp + 0x24]
mov ecx, edi
push esi
call fcn.00414cf0
test al, al
je 0x41fd86
mov bl, 1
jmp 0x41fd88
xor bl, bl
lea ecx, [esp + 0x20]
call fcn.00405f30
test bl, bl
je 0x41fe11
mov ecx, dword [ebp + 4]
lea esi, [ebp + 4]
mov ebx, dword [esp + 0x14]
test ecx, ecx
je 0x41fda9
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [esi], 0
mov eax, dword [ebx]
push esi
push ebx
call dword [eax + 0x1c]
mov esi, eax
test esi, esi
jns 0x41fe15
push str.Windows_Firewall_Profile
push str.COM_error_occurred
lea eax, [esp + 0x28]
mov dword [esp + 0x28], 0x441510
push str._s__Message:___s_
push eax
mov dword [esp + 0x34], 0
call fcn.00414640
add esp, 0x10
test al, al
je 0x41fe02
push 0
push dword [esp + 0x24]
mov ecx, edi
push esi
call fcn.00414cf0
test al, al
je 0x41fe02
mov bl, 1
jmp 0x41fe04
xor bl, bl
lea ecx, [esp + 0x20]
call fcn.00405f30
test bl, bl
jne 0x41fe15
xor bl, bl
jmp 0x41fe17
mov bl, 1
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], vtable.SmartCOMPointer_struct_INetFwPolicy_.0
test ecx, ecx
je 0x41fe2d
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], vtable.SmartCOMPointer_struct_INetFwMgr_.0
test eax, eax
je 0x41fe43
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x18
ret 4