joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4120d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4121eb
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x43a2ec], 0
je 0x41210f
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00411f3c
mov edx, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x1c]
jmp 0x4121d5
mov eax, 0x4000
call fcn.004025b0
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x4121ce
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040cddc
xor eax, eax
push ebp
push 0x4121b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
push 0x4000
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
push 0
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
je 0x41219b
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jmp 0x412193
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
call fcn.00403768
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00407138
inc eax
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp byte [eax], 0
jne 0x412171
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4121b8
mov eax, dword [ebp - 8]
call fcn.0040ce98
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4121f2
lea eax, [ebp - 0x14]
call fcn.004035b4
ret
Function at 0x4121f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x412321
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x43a2ec], 0
je 0x41223e
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00411f3c
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0x18]
jmp 0x41230b
mov eax, 0x4000
call fcn.004025b0
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x412304
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.0040cddc
xor eax, eax
push ebp
push 0x4122e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
push 0x4000
mov eax, dword [ebp - 0x10]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
test eax, eax
je 0x4122d1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
jmp 0x4122c9
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00403768
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x14]
call fcn.00407138
inc eax
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
cmp byte [eax], 0
jne 0x4122a7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4122ee
mov eax, dword [ebp - 0xc]
call fcn.0040ce98
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412328
lea eax, [ebp - 0x18]
call fcn.004035b4
ret

Function at 0x4127f8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41289b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x412822
mov byte [ebp - 5], 1
jmp 0x412885
mov byte [ebp - 5], 0
push 0
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x412885
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 0x10]
call fcn.00403b60
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004039f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
test eax, eax
je 0x412885
mov eax, dword [ebp - 0xc]
call fcn.004039f4
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00403768
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4128a2
lea eax, [ebp - 0xc]
call fcn.004035b4
ret
Function at 0x4128ac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x412968
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00412714
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x14]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x412952
xor eax, eax
push ebp
push 0x41294b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412952
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41296f
lea eax, [ebp - 0x14]
call fcn.004035b4
ret

Function at 0x412d78
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x412eb8
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00412714
mov eax, dword [ebp - 8]
call fcn.0040cddc
xor eax, eax
push ebp
push 0x412e90
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x412e7a
xor eax, eax
push ebp
push 0x412e73
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x400
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x412e56
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x420]
call fcn.00403768
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0
je 0x412e04
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e7a
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412e97
mov eax, dword [ebp - 8]
call fcn.0040ce98
ret
Function at 0x412ec4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x412f7b
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00412714
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
jne 0x412f61
xor eax, eax
push ebp
push 0x412f5a
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412f65
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412f82
lea eax, [ebp - 0x14]
call fcn.004035b4
ret

Function at 0x4133fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41348f
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412714
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413475
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x413479
mov byte [ebp - 9], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413496
lea eax, [ebp - 0x10]
call fcn.004035b4
ret
Function at 0x4134a0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x413529
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412714
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0x10]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x413513
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413530
lea eax, [ebp - 0x10]
call fcn.004035b4
ret

Function at 0x413538
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4136af
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
mov dl, 1
mov eax, dword [0x40bbe4]
call fcn.00402c4c
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x413680
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 5], 0
je 0x4135e3
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00412d78
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4135e3
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0041665c
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.00403838
mov eax, dword [ebp - 0x28]
mov dl, 1
call fcn.00413538
inc dword [ebp - 0x20]
dec dword [ebp - 0x24]
jne 0x4135ab
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.004167b8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00406f0c
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.00406e44
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.004167b8
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.0040364c
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00412714
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0xc]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x41366a
mov eax, dword [ebp - 0x10]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 6]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413687
mov eax, dword [ebp - 0x1c]
call fcn.00402c74
ret
Function at 0x413738
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4137f3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412714
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4137dd
xor eax, eax
push ebp
push 0x4137d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4137bf
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4137dd
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4137fa
lea eax, [ebp - 0x10]
call fcn.004035b4
ret

Function at 0x413804
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4138bf
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.00412714
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4138a9
xor eax, eax
push ebp
push 0x4138a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x41388b
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4138a9
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4138c6
lea eax, [ebp - 0x10]
call fcn.004035b4
ret
Function at 0x414b8c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x414bfd
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.00403b60
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004039f4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x414bf3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004039f4
call fcn.00407138
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00403b60
jmp 0x414bfd
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00403b60
mov esp, ebp
pop ebp
ret

Function at 0x414d58
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [0x43b9ec]
cmp dword [eax], 2
jne 0x414dc5
test byte [ebp - 4], 0xb
je 0x414dc5
lea eax, [ebp - 0xc]
push eax
push 0x20
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x414dc5
lea eax, [ebp - 0x18]
push eax
push 0x414de0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x414dc5
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x414dd9
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x414e18
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406a8c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x414f01
xor eax, eax
push ebp
push 0x414efa
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
lea edx, [ebp - 0x54]
mov ecx, 0x40
mov eax, dword [ebp - 0x10]
call fcn.00406af0
cmp eax, 0x40
je 0x414e79
call fcn.0040316c
jmp 0x414f01
cmp word [ebp - 0x54], 0x5a4d
jne 0x414e87
cmp dword [ebp - 0x18], 0
jne 0x414e8e
call fcn.0040316c
jmp 0x414f01
mov eax, dword [ebp - 4]
call fcn.00416708
cmp eax, dword [ebp - 0x18]
jg 0x414ea2
call fcn.0040316c
jmp 0x414f01
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00406b48
inc eax
jne 0x414eb9
call fcn.0040316c
jmp 0x414f01
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00406af0
cmp eax, 4
je 0x414ed5
call fcn.0040316c
jmp 0x414f01
cmp dword [ebp - 0x14], 0x4550
jne 0x414ee4
mov eax, dword [ebp - 8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414f01
mov eax, dword [ebp - 0x10]
call fcn.00406b54
ret
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x4156d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x4157e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x24]
mov dl, 0x22
mov eax, dword [ebp - 4]
call fcn.0040f1d0
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040364c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4157c8
mov eax, dword [ebp - 0x14]
inc eax
call fcn.004025b0
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4157c1
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x4157f8
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x415791
call fcn.0040316c
jmp 0x4157c8
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4157c8
mov eax, dword [ebp - 0x1c]
call fcn.004025c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4157ed
lea eax, [ebp - 0x24]
call fcn.004035b4
lea eax, [ebp - 4]
call fcn.004035b4
ret
Function at 0x415c18
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x415e88
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e0]
call fcn.004188a8
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x1e0]
call fcn.00406e44
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x1d8]
call fcn.004167b8
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.00406e44
push 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x415e9c
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.00416154
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.0040387c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404c2e
lea eax, [ebp - 0x1cc]
call fcn.00404eb6
call fcn.00402674
push ebp
mov eax, 0x415eac
call fcn.00415ba8
pop ecx
push ebp
push 0x415ebc
push dword [ebp - 0x1e0]
push 0x415ecc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00415ba8
pop ecx
push ebp
push 0x415ed8
push dword [ebp - 0x1e0]
push 0x415ecc
push 0x415eec
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00415ba8
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x415d87
push ebp
push 0x415f00
push dword [ebp - 0x1d8]
push 0x415ecc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00415ba8
pop ecx
push ebp
push 0x415ebc
push dword [ebp - 0x1d4]
push 0x415ecc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00415ba8
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404cd0
call fcn.00402674
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x44
call fcn.004029a4
mov dword [ebp - 0x208], 1
mov word [ebp - 0x204], 0
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.004039f4
push eax
push 0
push 0x8000040
push 0
push 0
push 0
push 0x415ecc
push dword [ebp - 0x1d4]
push 0x415ecc
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.004039f4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x415e5f
mov eax, dword [ebp - 0x1ec]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
mov eax, dword [ebp - 0x1f0]
push eax
call sub.KERNEL32.DLL_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415e8f
lea eax, [ebp - 0x238]
call fcn.004035b4
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.004035d8
ret

Function at 0x415fc0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00415f9c
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize_1
cmp ebx, eax
jge 0x415fe9
mov byte [ebp - 5], 0
jmp 0x415fed
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret