joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ec3d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003ecee
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003eca1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003ec9f
push 0
push 0x1224
push 0
push 0
push 0x2181
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1003ecec
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003eccf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003ecec
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1000e0ff
mov dword [eax], 4
jmp 0x1003ecc4
jmp 0x1003ed0b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x2c]
push 0x1ae7
push 0x986
call fcn.1003cda3
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1005e555
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006a740]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10050458
mov dword [ebp - 0x14], eax
cmp dword [0x10657ad8], esi
jne 0x1005e648
push 0x800
push esi
push 0x100075e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1005e5d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1005e728
push esi
push esi
push 0x100075e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1005e728
push 0x100075f8
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1005e728
push eax
call ebx
push 0x10007604
push edi
mov dword [0x10657ad8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007614
push edi
mov dword [0x10657adc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007628
push edi
mov dword [0x10657ae0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10657ae8], eax
test eax, eax
je 0x1005e645
push 0x10007644
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x10657ae4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1005e66d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1005e660
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1005e682
push 4
pop eax
jmp 0x1005e72a
cmp dword [ebp - 0x14], esi
je 0x1005e682
push dword [0x10657ad8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1005e667
mov eax, dword [0x10657ae4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1005e6e0
cmp dword [0x10657ae8], edi
je 0x1005e6e0
push eax
call ebx
push dword [0x10657ae8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1005e6e0
test eax, eax
je 0x1005e6e0
call ecx
test eax, eax
je 0x1005e6d5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1005e6d5
test byte [ebp - 8], 1
jne 0x1005e6e0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1005e710
mov eax, dword [0x10657adc]
cmp eax, edi
je 0x1005e70d
push eax
call ebx
test eax, eax
je 0x1005e70d
call eax
mov esi, eax
test esi, esi
je 0x1005e70d
mov eax, dword [0x10657ae0]
cmp eax, edi
je 0x1005e70d
push eax
call ebx
test eax, eax
je 0x1005e70d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x10657ad8]
call ebx
test eax, eax
je 0x1005e728
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1005e72a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004d93b
mov esp, ebp
pop ebp
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.004047b5
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.004047b5
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.004047b5
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.004047b5
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.004047b5
mov dword [0x41203c], eax
call fcn.004047b5
test eax, eax
jge 0x402550
push 8
call fcn.004047b5
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.004047b5
pop ecx
push 1
call fcn.004047b5
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.004047b5
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.004047b5
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.004047b5
jmp 0x402495

Function at 0x4047b5
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x4047c4
pop dword [ebp - 4]
mov eax, 0x80f42a2c
add eax, 0x7f4c1d98
sub dword [ebp - 4], eax
push 0x40
push 0x1000
push 0x34808
push 0
mov eax, 0xe41cac61
sub eax, 0xe3dbcb89
add eax, dword [ebp - 4]
call dword [eax]
mov ecx, 0x3520
xor edx, edx
add edx, eax
mov esi, 0xbefaff50
add esi, 0x41463c74
add esi, dword [ebp - 4]
mov ebx, 0x25215838
mov edi, dword [esi]
xor edi, ebx
mov dword [edx], edi
add edx, 0x30991884
sub edx, 0x30991880
add esi, 4
loop 0x404819
add eax, 0xc753
xor ebx, ebx
add ebx, eax
add eax, 0xdaa3f6f9
add eax, 0x255c090c
mov ecx, 0x400000
add ecx, dword [ebp - 4]
call ebx
leave
ret
Function at 0x4013f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, 0x49b5e8
cmp dword [esi], 0
jne 0x401436
push 0x644
push 0
call sub.KERNEL32.DLL_TerminateProcess
mov ecx, eax
test ecx, ecx
jne 0x401413
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x49b5e4]
mov dword [ecx], eax
mov dword [0x49b5e4], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x401422
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401a7c
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401b32
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x49b5cc
call sub.KERNEL32.DLL_WinExec
cmp byte [0x49b04d], 0
je 0x401aaa
push 0x49b5cc
call sub.KERNEL32.DLL_WriteFile
mov eax, 0x49b5ec
call fcn.00401440
mov eax, 0x49b5fc
call fcn.00401440
mov eax, 0x49b628
call fcn.00401440
push 0xff8
push 0
call sub.KERNEL32.DLL_TerminateProcess
mov dword [0x49b624], eax
cmp dword [0x49b624], 0
je 0x401b11
mov eax, 3
mov edx, dword [0x49b624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401ae7
mov eax, 0x49b60c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x49b618], eax
mov byte [0x49b5c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b39
cmp byte [0x49b04d], 0
je 0x401b31
push 0x49b5cc
call sub.KERNEL32.DLL_lstrcpyA
ret

Function at 0x401b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x49b5c4], 0
je 0x401c1d
xor edx, edx
push ebp
push 0x401c16
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x49b04d], 0
je 0x401b72
push 0x49b5cc
call sub.KERNEL32.DLL_WriteFile
mov byte [0x49b5c4], 0
mov eax, dword [0x49b624]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
xor eax, eax
mov dword [0x49b624], eax
mov ebx, dword [0x49b5ec]
jmp 0x401ba5
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov ebx, dword [ebx]
cmp ebx, 0x49b5ec
jne 0x401b93
mov eax, 0x49b5ec
call fcn.00401440
mov eax, 0x49b5fc
call fcn.00401440
mov eax, 0x49b628
call fcn.00401440
mov eax, dword [0x49b5e4]
test eax, eax
je 0x401beb
mov edx, dword [eax]
mov dword [0x49b5e4], edx
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov eax, dword [0x49b5e4]
test eax, eax
jne 0x401bd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c1d
cmp byte [0x49b04d], 0
je 0x401c0b
push 0x49b5cc
call sub.KERNEL32.DLL_lstrcpyA
push 0x49b5cc
call sub.KERNEL32.DLL_Sleep
ret
pop ebx
pop ebp
ret
Function at 0x402168
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x49b5c4], 0
jne 0x402185
call fcn.00401a7c
test al, al
je 0x40218d
cmp ebx, 0x7ffffff8
jle 0x402197
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022eb
xor ecx, ecx
push ebp
push 0x4022e4
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x49b04d], 0
je 0x4021b8
push 0x49b5cc
call sub.KERNEL32.DLL_WriteFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021c8
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402267
mov eax, ebx
test eax, eax
jns 0x4021dd
add eax, 3
sar eax, 2
mov edx, dword [0x49b624]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402267
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402218
mov eax, ebx
test eax, eax
jns 0x402207
add eax, 3
sar eax, 2
mov ecx, dword [0x49b624]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x40223e
mov ecx, ebx
test ecx, ecx
jns 0x402221
add ecx, 3
sar ecx, 2
mov edi, dword [0x49b624]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x49b5b4]
sub ebx, 4
add dword [0x49b5b8], ebx
call fcn.0040405c
jmp 0x4022eb
cmp ebx, dword [0x49b61c]
jg 0x4022b9
sub dword [0x49b61c], ebx
cmp dword [0x49b61c], 0xc
jge 0x40228b
add ebx, dword [0x49b61c]
xor eax, eax
mov dword [0x49b61c], eax
mov eax, dword [0x49b620]
add dword [0x49b620], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x49b5b4]
sub ebx, 4
add dword [0x49b5b8], ebx
call fcn.0040405c
jmp 0x4022eb
mov eax, ebx
call fcn.00402074
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022eb
cmp byte [0x49b04d], 0
je 0x4022e3
push 0x49b5cc
call sub.KERNEL32.DLL_lstrcpyA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x49b5c8], eax
cmp byte [0x49b5c4], 0
jne 0x402330
call fcn.00401a7c
test al, al
jne 0x402330
mov dword [0x49b5c8], 8
mov dword [ebp - 4], 8
jmp 0x402491
xor ecx, ecx
push ebp
push 0x40248a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x49b04d], 0
je 0x402351
push 0x49b5cc
call sub.KERNEL32.DLL_WriteFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x40236c
mov dword [0x49b5c8], 9
jmp 0x402461
dec dword [0x49b5b4]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x49b5b8], eax
test bl, 1
je 0x4023cc
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40239c
test edx, 0x80000003
je 0x4023ab
mov dword [0x49b5c8], 0xa
jmp 0x402461
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023c3
mov dword [0x49b5c8], 0xa
jmp 0x402461
add ebx, edx
mov esi, eax
call fcn.00401c20
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x49b620]
jne 0x40240c
sub dword [0x49b620], ebx
add dword [0x49b61c], ebx
cmp dword [0x49b61c], 0x3c00
jle 0x4023fd
call fcn.00401f10
xor eax, eax
mov dword [ebp - 4], eax
call fcn.0040405c
jmp 0x402491
mov edx, dword [eax]
test dl, 2
je 0x40242f
and edx, 0x7ffffffc
cmp edx, 4
jge 0x40242a
mov dword [0x49b5c8], 0xb
jmp 0x402461
or dword [eax], 1
jmp 0x402458
mov eax, edi
cmp dword [eax + 4], 0
je 0x402442
cmp dword [eax], 0
je 0x402442
cmp dword [eax + 8], 0xc
jge 0x40244e
mov dword [0x49b5c8], 0xb
jmp 0x402461
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c20
mov edx, ebx
mov eax, esi
call fcn.00401e88
mov eax, dword [0x49b5c8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402491
cmp byte [0x49b04d], 0
je 0x402489
push 0x49b5cc
call sub.KERNEL32.DLL_lstrcpyA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4030b0
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x498008], 0x8088405
inc edx
mov dword [ebx + 0x498008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x403694
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x498024]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40372c
push 0x80000002
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x40370c
xor eax, eax
push ebp
push 0x403705
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403748
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40370c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegOpenKeyExA
ret
mov ax, word [0x498024]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x498024], ax
mov esp, ebp
pop ebp
ret
Function at 0x4043f8
Capabilities:
Get common file path
Get geographical location

Disassembly:
push ecx
cmp byte [0x49b04c], 0
je 0x404459
cmp word [0x49b220], 0xd7b2
jne 0x404421
cmp dword [0x49b228], 0
jbe 0x404421
mov eax, 0x49b21c
call dword [0x49b238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x498074
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetTempFileNameA
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x404480
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetTempFileNameA
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
pop edx
ret
cmp byte [0x498034], 0
jne 0x404475
push 0
push 0x49806c
push 0x498074
push 0
call sub.KERNEL32.DLL_GetLocaleInfoA
pop edx
ret

Function at 0x4059fc
Capabilities:
Resume thread

Disassembly:
add esp, 0xffffffe4
push 0x1c
lea edx, [esp + 4]
push edx
push eax
call sub.KERNEL32.DLL_ResumeThread
cmp dword [esp + 0x10], 0x1000
jne 0x405a1c
mov eax, dword [esp + 4]
jmp 0x405a1e
xor eax, eax
add esp, 0x1c
ret
Function at 0x405c68
Capabilities:
Extract resource via kernel32 functions
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_InitializeCriticalSection
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e98
push 0x80000001
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405ceb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405e98
push 0x80000002
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x405ceb
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x405eb4
push 0x80000001
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x405d74
xor eax, eax
push ebp
push 0x405d6d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.00405ab0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x405d52
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x405ed4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x405d52
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405d74
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MultiByteToWideChar
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_LockResource
push eax
call sub.KERNEL32.DLL_GlobalUnlock
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x405e8e
cmp byte [ebp - 0xd], 0
jne 0x405dbb
cmp byte [ebp - 0x12], 0
je 0x405e8e
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x405dd4
dec ebx
cmp byte [ebx], 0x2e
je 0x405de3
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x405dd3
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x405e8e
inc ebx
cmp byte [ebp - 0x12], 0
je 0x405e20
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_MultiByteToWideChar
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MulDiv
mov esi, eax
test esi, esi
jne 0x405e8e
cmp byte [ebp - 0xd], 0
je 0x405e8e
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_MultiByteToWideChar
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MulDiv
mov esi, eax
test esi, esi
jne 0x405e8e
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_MultiByteToWideChar
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_MulDiv
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40ce00
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40ced6
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404690
lea eax, [ebp - 8]
call fcn.00404b08
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ab8
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40cec0
mov eax, ebx
call fcn.0040273c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40ceb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404ab8
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40cea3
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40cee8
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40cea3
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cec0
mov eax, dword [ebp - 0x10]
call fcn.0040275c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cedd
lea eax, [ebp - 8]
call fcn.004045f8
ret

Function at 0x40def4
Capabilities:
Delete file

Disassembly:
mov edx, dword [eax + 0x18]
push edx
mov eax, dword [eax + 0x14]
push eax
call sub.KERNEL32.DLL_DeleteFileA
ret

Function at 0x40e190
Capabilities:
Accept command line arguments
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov ebx, eax
push edx
call sub.KERNEL32.DLL_TlsGetValue
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40e202
push dword fs:[eax]
mov dword fs:[eax], esp
fnstcw word [ebp - 2]
xor eax, eax
push ebp
push 0x40e1e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00404ab8
push eax
call sub.KERNEL32.DLL_GetCommandLineA
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e1eb
fnclex
fldcw word [ebp - 2]
ret

Function at 0x41ef0c
Capabilities:
Delete file

Disassembly:
push ebx
push esi
add esp, 0xffffffd8
mov esi, eax
mov eax, dword [esi + 4]
mov dword [esp + 4], eax
call fcn.00406a78
mov edx, dword [0x49aa7c]
cmp eax, dword [edx]
jne 0x41ef81
xor ebx, ebx
mov eax, dword [0x49b854]
mov dword [esp + 8], eax
cmp ebx, 2
jne 0x41ef4b
push 0
push 0
push 0
push 0
lea eax, [esp + 0x1c]
push eax
call fcn.004071e8
push pe_nt_image_headers32
push 0x3e8
push 0
lea eax, [esp + 0x10]
push eax
push 2
call fcn.004071d0
mov ebx, eax
cmp ebx, 0xffffffff
setne dl
mov eax, esi
call fcn.0041ed34
cmp ebx, 1
jne 0x41ef7b
xor eax, eax
call fcn.0041e92c
test ebx, ebx
jne 0x41ef34
jmp 0x41ef8d
push 0xffffffffffffffff
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_DeleteFileA
push esp
mov eax, dword [esp + 8]
push eax
call fcn.00406a90
cmp eax, 1
sbb edx, edx
inc edx
mov eax, esi
call fcn.0041ed34
mov eax, dword [esp]
add esp, 0x28
pop esi
pop ebx
ret