joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100f3050
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
lea eax, [ecx - 0xc8]
xor edi, edi
mov ebx, dword [esi + 0xc]
cmp eax, 0x64
jb 0x100f3080
push str.Couldnt_set_desired_mode
push esi
call fcn.100d4bc0
add esp, 8
lea eax, [edi + 0x11]
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x100f3097
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push esi
call fcn.100d4c80
add esp, 0xc
mov eax, dword [esp + 0x18]
push ebp
cmp eax, 0x13
jne 0x100f30b2
push ebx
push esi
call fcn.100f2f50
add esp, 8
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x100f31c3
mov edi, dword [esi + 0xc]
xor ebx, ebx
cmp dword [esi + 0x4f8], 2
mov dword [esp + 0x18], edi
jne 0x100f3131
mov eax, dword [esi + 0x13c]
mov eax, dword [eax]
test eax, eax
je 0x100f3131
push 3
push ebx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push ecx
push ebx
push eax
push esi
call fcn.100eb6c0
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x100f31f0
push 0x2f
push dword [esp + 0x18]
call sub.VCRUNTIME140.dll_strrchr
add esp, 8
test eax, eax
je 0x100f3120
mov ebx, dword [esp + 0x14]
mov ecx, 1
sub eax, ebx
cmovne ecx, eax
mov byte [ecx + ebx], 0
jmp 0x100f312d
push dword [esp + 0x14]
call dword [0x1013b004]
add esp, 4
mov edi, dword [esp + 0x18]
mov ecx, dword [esi + 0x53c]
test ecx, ecx
jne 0x100f314f
cmp byte [esi + 0x6f1], 0
mov ecx, str.NLST
mov eax, str.LIST
cmove ecx, eax
mov edx, 0x101278e6
test ebx, ebx
mov eax, edx
cmovne eax, ebx
push eax
mov eax, 0x1012a9f0
cmove eax, edx
push eax
push ecx
push 0x1011e338
call fcn.100d87c0
push ebx
mov ebp, eax
call dword [0x1013b004]
add esp, 0x14
test ebp, ebp
jne 0x100f318c
mov edi, 0x1b
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
push ebp
push 0x10122714
lea eax, [edi + 0x430]
push eax
push esi
call fcn.10108740
push ebp
mov edi, eax
call dword [0x1013b004]
add esp, 0x14
test edi, edi
jne 0x100f31f0
mov eax, dword [esi + 0xc]
pop ebp
mov dword [eax + 0x4b4], 0x1f
mov eax, edi
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x100f31dc
push 0xd
push 1
push esi
call fcn.100f2ae0
add esp, 0xc
mov edi, eax
pop ebp
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x100f31f0
push 0xe
push 1
push esi
call fcn.100f2ae0
add esp, 0xc
mov edi, eax
pop ebp
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x100f91c0
Capabilities:
Send data
Send data on socket

Disassembly:
mov ecx, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
push 0
mov byte [esp + 0x12], cl
lea ecx, [esp + 0x10]
push 3
mov eax, dword [esi + 0xc]
push ecx
mov byte [esp + 0x18], 0xff
mov byte [esp + 0x19], bl
push dword [eax + 0x158]
call dword [sym.imp.WS2_32.dll_send]
test eax, eax
jns 0x100f920c
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.Sending_data_failed___d_
push esi
call fcn.100d4bc0
add esp, 0xc
push dword [esp + 0x14]
push ebx
push str.SENT
push esi
call fcn.100f8dd0
add esp, 0x10
pop esi
pop ebx
ret

Function at 0x100f9360
Capabilities:
Send data
Send data on socket

Disassembly:
push ecx
cmp dword [esp + 0xc], 0x1f
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov eax, dword [ebx + 0xc]
mov ebp, dword [ebx + 0x13c]
mov dword [esp + 8], eax
jne 0x100f94af
push esi
push edi
lea eax, [ebp + 0x1cb4]
lea edi, [ebp + 0x1eb4]
mov dword [edi], eax
cmp eax, edi
jae 0x100f93ad
mov byte [eax], 0xff
inc eax
mov dword [edi], eax
cmp eax, edi
jae 0x100f93ad
mov byte [eax], 0xfa
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100f93ad
mov byte [eax], 0x1f
inc dword [edi]
movzx eax, word [ebp + 0x1ca8]
mov esi, dword [sym.imp.WS2_32.dll_htons]
push eax
call esi
movzx eax, ax
mov dword [esp + 0x18], eax
movzx eax, word [ebp + 0x1caa]
push eax
call esi
mov edx, dword [esp + 0x18]
movzx ecx, ax
mov eax, dword [edi]
cmp eax, edi
jae 0x100f9417
mov byte [eax], dl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100f9417
mov byte [eax], dh
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100f9417
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100f9417
shr ecx, 8
mov byte [eax], cl
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100f9417
mov byte [eax], 0xff
inc dword [edi]
mov eax, dword [edi]
cmp eax, edi
jae 0x100f9417
mov byte [eax], 0xf0
mov eax, dword [edi]
inc eax
mov dword [ebp + 0x1eb8], eax
lea esi, [ebp + 0x1cb4]
sub eax, esi
mov dword [edi], esi
sub eax, 2
push eax
lea eax, [ebp + 0x1cb6]
push eax
push 0x3e
push ebx
call fcn.100f8ed0
mov eax, dword [esp + 0x20]
add esp, 0x10
mov edi, dword [sym.imp.WS2_32.dll_send]
push 0
push 3
push esi
push dword [eax + 0x158]
call edi
mov esi, dword [sym.imp.WS2_32.dll_WSAGetLastError]
test eax, eax
jns 0x100f946f
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.100d4bc0
add esp, 0xc
push 4
lea eax, [ebp + 0x1cb7]
push eax
push ebx
call fcn.100f9230
add esp, 0xc
lea eax, [ebp + 0x1cbb]
push 0
push 2
push eax
mov eax, dword [esp + 0x1c]
push dword [eax + 0x158]
call edi
test eax, eax
jns 0x100f94ad
call esi
push eax
push str.Sending_data_failed___d_
push ebx
call fcn.100d4bc0
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100fa940
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub esp, 0x88
mov eax, dword [0x1013b040]
xor eax, esp
mov dword [esp + 0x84], eax
push ebx
mov ebx, dword [esp + 0x90]
push ebp
push esi
push edi
mov eax, dword [ebx + 0xc]
mov edi, dword [eax + 0x430]
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x80
lea eax, [esp + 0x18]
push eax
mov eax, dword [edi + 0x14c]
push 0
add eax, 4
push eax
push dword [edi + 0x158]
push dword [edi + 0x14]
call dword [sym.imp.WS2_32.dll_recvfrom]
cmp dword [edi + 0x140], 0
mov dword [edi + 0x144], eax
jne 0x100fa9c6
push dword [esp + 0x10]
lea eax, [esp + 0x18]
push eax
lea eax, [edi + 0xc0]
push eax
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov dword [edi + 0x140], eax
mov esi, dword [edi + 0x144]
cmp esi, 4
jge 0x100faa01
push str.Received_too_short_packet
push ebx
call fcn.100d4bc0
add esp, 8
mov dword [edi + 0xc], 7
xor eax, eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1010d3ac
add esp, 0x88
ret
mov edx, dword [edi + 0x158]
movzx eax, byte [edx]
movzx ecx, byte [edx + 1]
shl eax, 8
or ecx, eax
mov dword [edi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x100faa20.1
jmp dword [ecx*4 + 0x100fab2c]
cmp esi, 4
jle case.0x100faa20.4
movzx ecx, byte [edx + 2]
movzx eax, byte [edx + 3]
shl ecx, 8
or ecx, eax
movzx eax, word [edi + 0x154]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x100faa20.4
lea eax, [esi - 4]
push eax
lea eax, [edx + 4]
push eax
push 1
push ebx
call fcn.100d4af0
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100faa7b
push 5
push edi
call fcn.100fb4d0
add esp, 8
mov eax, esi
jmp 0x100fa9e8
mov eax, dword [edi + 0x144]
sub eax, 4
cdq
add dword [ebx + 0x98], eax
adc dword [ebx + 0x9c], edx
push dword [ebx + 0x9c]
push dword [ebx + 0x98]
push ebx
call fcn.100e3b10
jmp 0x100fab01
movzx ecx, byte [edx + 2]
lea ebp, [edx + 4]
movzx eax, byte [edx + 3]
add esi, 0xfffffffc
shl ecx, 8
or ecx, eax
push esi
push ebp
mov dword [edi + 8], ecx
call fcn.100fb540
add esp, 8
cmp eax, esi
jae case.0x100faa20.4
push ebp
push str.TFTP_error:__s_n
push ebx
call fcn.100d4c80
jmp 0x100fab01
lea eax, [esi - 2]
push eax
lea eax, [edx + 2]
push eax
push edi
call fcn.100fa6d0
add esp, 0xc
test eax, eax
je case.0x100faa20.4
jmp 0x100fa9e8
push str.Internal_error:_Unexpected_packet
push 0x10122714
push ebx
call fcn.100d4bc0
add esp, 0xc
push ebx
call fcn.100e3ef0
add esp, 4
test eax, eax
je 0x100fa9e6
push 5
push edi
call fcn.100fb4d0
add esp, 8
mov eax, 0x2a
jmp 0x100fa9e8
Function at 0x1010b2d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [section..data]
mov edi, eax
add esp, 4
test edi, edi
jne 0x1010b2f7
pop edi
pop esi
pop ecx
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [esp + 0x1c]
mov dword [edi + 8], eax
push ebp
cmp ebx, dword [esi + 0x10]
jbe 0x1010b342
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [esp + 0x24]
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x20], ebx
jmp 0x1010b346
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x28]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1010b3a6
mov dword [esp + 0x10], eax
mov ebx, eax
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x18], al
lea eax, [esp + 0x18]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x24], al
lea eax, [esp + 0x24]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x1010b365
mov ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0x10]
jae 0x1010b3d7
nop dword [eax + eax]
mov eax, dword [esi + 4]
push 1
push 0x1012741c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x1012741d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x1010b3b0
pop ebp
pop ebx
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x1010b3e0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x20]
call fcn.100d7410
mov esi, dword [esp + 0x1c]
mov ebx, eax
mov ebp, dword [esp + 0x20]
mov dword [esp + 0x14], ebx
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea ecx, [ecx + edx*2]
add ecx, 0xc
push ecx
call dword [section..data]
mov edi, eax
add esp, 8
test edi, edi
je 0x1010b548
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x1010b45c
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push ebp
push dword [edi + 4]
call eax
mov ebp, dword [edi + 8]
push dword [edi + 4]
add ebp, dword [esi + 0xc]
mov eax, dword [esi + 8]
push ebp
call eax
mov eax, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [esp + 0x10], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [esp + 0x18]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x1010b4c1
mov dword [esp + 0x18], eax
mov ebx, eax
nop dword [eax + eax]
movzx eax, byte [ebp]
xor al, 0x36
mov byte [esp + 0x1c], al
lea eax, [esp + 0x1c]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebp]
lea ebp, [ebp + 1]
xor al, 0x5c
mov byte [esp + 0x28], al
lea eax, [esp + 0x28]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub ebx, 1
jne 0x1010b480
mov ebx, dword [esp + 0x18]
cmp ebx, dword [esi + 0x10]
jae 0x1010b4ed
mov eax, dword [esi + 4]
push 1
push 0x1012741c
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x1012741d
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x1010b4c6
push dword [esp + 0x28]
call fcn.100d7410
mov ecx, dword [edi]
push eax
push dword [esp + 0x2c]
push dword [edi + 4]
mov eax, dword [ecx + 4]
call eax
mov esi, dword [esp + 0x3c]
add esp, 0x10
mov ebx, dword [edi]
test esi, esi
jne 0x1010b518
mov esi, dword [ebx + 0xc]
add esi, dword [edi + 8]
push dword [edi + 4]
mov eax, dword [ebx + 8]
push esi
call eax
push dword [ebx + 0x14]
mov eax, dword [ebx + 4]
push esi
push dword [edi + 8]
call eax
push dword [edi + 8]
mov eax, dword [ebx + 8]
push esi
call eax
push edi
call dword [0x1013b004]
add esp, 0x20
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
mov eax, 0x1b
pop ebx
pop ecx
ret
Function at 0x40125e
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0xe8
push ebx
push esi
mov esi, dword [ebp + 0x78]
push edi
push dword [ebp + 0x7c]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [esi + 0x18]
call edi
push 9
push dword [esi + 0x18]
mov dword [ebp + 0x6c], eax
call edi
mov dword [ebp + 0x78], eax
push 0x64
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x6c]
xor ebx, ebx
mov word [ebp - 0x78], bx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x78]
push eax
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_SetWindowTextW]
lea eax, [ebp + 0x64]
push eax
push dword [esi + 0x18]
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x68], ebx
call dword [sym.imp.USER32.dll_ClientToScreen]
xor eax, eax
lea edi, [ebp + 0x54]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp + 0x54]
push eax
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [ebp + 0x58]
mov eax, dword [ebp + 0x54]
mov edi, dword [ebp + 0x60]
mov esi, dword [ebp + 0x5c]
push 4
sub edi, ecx
sub ecx, dword [ebp + 0x68]
push edi
sub esi, eax
sub eax, dword [ebp + 0x64]
push esi
push ecx
push eax
push ebx
push dword [ebp + 0x78]
mov dword [ebp + 0x54], eax
mov dword [ebp + 0x58], ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push edi
push esi
push dword [ebp + 0x58]
push dword [ebp + 0x54]
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_MoveWindow]
push ebx
push dword [ebp + 0x6c]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebx
add ebp, 0x70
leave
ret
Function at 0x402d71
Capabilities:
Get common file path
Query environment variable

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi]
push edi
xor edi, edi
test eax, eax
je 0x402d88
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
push 0x2d0
mov ecx, esi
call fcn.004371c5
test edi, edi
jg 0x402e13
mov eax, dword [esi]
and word [eax], 0
mov eax, dword [esi]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push ebp
mov ebp, 0x208
push ebp
push eax
push 0x497a74
call ebx
mov edi, eax
test edi, edi
jg 0x402e01
mov eax, dword [esi]
push ebp
push eax
push 0x497a68
call ebx
mov edi, eax
test edi, edi
jg 0x402e01
push 0
push 0x24
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
test edi, edi
jle 0x402e11
mov eax, dword [esi]
push 0x497a5c
lea eax, [eax + edi*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
add edi, 5
test edi, edi
jle 0x402e11
mov eax, dword [esi]
mov word [eax + edi*2], 0x5c
mov eax, dword [esi]
inc edi
and word [eax + edi*2], 0
pop ebp
pop ebx
push dword [esi]
call fcn.0041a353
test edi, edi
pop ecx
jle 0x402e2b
push dword [esi]
call fcn.00482b55
test eax, eax
pop ecx
jne 0x402e58
push 0
push 0x24
push dword [esi]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.TEMP_
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push dword [esi]
call fcn.0041a353
pop ecx
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
mov eax, edi
pop edi
pop esi
ret
Function at 0x40320d
Capabilities:
Get geographical location
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
and word [ebp - 0x44], 0
push 0x20
lea eax, [ebp - 0x44]
push eax
push str.LC_ALL
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp word [ebp - 0x44], 0
jne 0x403243
push 0x20
lea eax, [ebp - 0x44]
push eax
push 0xb
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
cmp word [ebp - 0x44], 0
lea eax, [ebp - 0x44]
jne 0x403252
mov eax, 0x497c6c
push eax
mov ecx, 0x4afbfc
call fcn.00441a80
push dword [0x4afbfc]
call fcn.00437c70
cmp eax, 1
pop ecx
jle 0x403274
mov word [0x4b3010], ax
leave
ret

Function at 0x40337d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetLastInputInfo]
lea eax, [ebp - 8]
xor ebx, ebx
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], ebx
call edi
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x4afb9c]
test ecx, ecx
jle 0x4033b0
mov dword [0x4afb9c], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [0x4afb9c], eax
jmp 0x4033e8
lea eax, [ebp - 8]
push eax
mov dword [ebp - 4], ebx
call edi
call esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jb 0x4033e0
sub eax, dword [0x4afb9c]
cmp eax, dword [ebp + 8]
jae 0x4033f0
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x4ae290], bl
jg 0x4033c0
mov eax, dword [ebp - 4]
mov ecx, eax
sub ecx, dword [0x4afb9c]
pop esi
test ecx, ecx
jle 0x403405
mov dword [0x4afb9c], eax
xor eax, eax
cmp byte [0x4ae290], bl
pop edi
setg al
pop ebx
leave
ret

Function at 0x4035da
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x10], ebx
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xf
xor eax, eax
cmp byte [ebp + 0x10], bl
pop ecx
lea edi, [ebp - 0x4c]
mov dword [ebp - 0x54], 0x44
mov dword [ebp - 0x50], ebx
rep stosd dword es:[edi], eax
je 0x403610
or dword [ebp - 0x28], 1
mov word [ebp - 0x24], bx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
push dword [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40364f
push esi
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
cmp byte [ebp + 0xc], bl
je 0x403649
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
call esi
pop esi
pop edi
pop ebx
leave
ret

Function at 0x403653
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push 0x3ff
lea eax, [ebp - 0x400]
push eax
push str.SHOWEWFMSG
mov byte [ebp - 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
cmp byte [ebp - 0x400], 0x31
jne 0x403695
push 0
push 0x497cc0
push dword [ebp + 8]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
Function at 0x403697
Capabilities:
Terminate process

Disassembly:
cmp byte [0x4ae290], 2
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x14
pop esi
je 0x4036ae
push esi
call edi
cmp dword [0x4afba8], 0
je 0x4036c9
push 0x1e
pop esi
jmp 0x4036c9
cmp dword [0x4afba0], 0
je 0x4036cc
push 0xa
call edi
dec esi
jns 0x4036bc
mov eax, dword [0x4afba0]
test eax, eax
pop edi
pop esi
je 0x4036ea
push 0
push eax
mov dword [0x4afba0], 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov byte [0x4ae290], 0xff
ret

Function at 0x4036f2
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 0xc]
mov esi, 0x8000004
push 0x64
push ebx
push esi
push ebx
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
cmp edi, ebx
mov byte [ebp - 1], 1
je 0x403733
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403744
mov byte [ebp - 1], bl
jmp 0x403744
push dword [ebp + 0xc]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov edi, eax
cmp edi, ebx
je 0x403780
push ebx
push ebx
push ebx
push 6
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push edi
mov dword [0x4afbb0], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x4afbb0]
cmp eax, ebx
je 0x403780
cmp byte [ebp - 1], bl
je 0x40377b
push 0x64
push ebx
push eax
call fcn.004832e0
mov eax, dword [0x4afbb0]
add esp, 0xc
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4039cd
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push 0x169
lea ecx, [ebp - 4]
call fcn.0043719c
mov ebx, dword [ebp - 4]
push 0x104
push dword [ebp + 0xc]
add ebx, 0xc8
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
lea eax, [ebp - 8]
push eax
xor esi, esi
push ebx
mov dword [ebp - 8], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, esi
mov dword [ebp - 0x10], eax
je 0x403a8b
push edi
push eax
push 2
mov dword [ebp - 0x14], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
push edi
push dword [ebp - 0x10]
push dword [ebp - 8]
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x497cfc
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [ebp - 0xc]
mov cx, word [eax + 0xa]
mov dx, word [eax + 8]
mov di, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
movzx eax, di
push eax
movzx eax, dx
push eax
movzx eax, cx
push eax
push 0x497ce4
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
mov eax, dword [ebp - 4]
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
mov dword [esi], eax
call fcn.00431c4c
mov eax, esi
pop esi
pop ebx
leave
ret