joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475310
Capabilities:
Check for time delay via gettickcount

Disassembly:
cmp byte [esp + 8], 0
je 0x475320
mov eax, esi
call fcn.00453e00
jmp 0x47532d
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov eax, dword [esp + 4]
test eax, eax
js 0x475388
je 0x475388
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call ebp
push 1
push 0x8000012f
mov edi, eax
call fcn.00401290
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call ebx
test eax, eax
je 0x475385
add edi, dword [esp + 0x10]
call ebp
mov ecx, edi
sub ecx, eax
cmp ecx, 5
jle 0x475385
push 1
push 0x8000012f
call fcn.00401290
add esp, 8
push esi
call ebx
test eax, eax
jne 0x475364
pop edi
pop ebp
pop ebx
mov eax, esi
ret
Function at 0x475570
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.00495db0
mov eax, dword [esp + 0x11c70]
push ebx
push ebp
mov ebp, dword [esp + 0x11c74]
push esi
mov esi, ecx
movzx ecx, word [edx]
xor ebx, ebx
cmp ecx, 0x41
je 0x47559c
cmp ecx, 0x61
jne 0x4755f1
cmp word [edx + 2], bx
jne 0x4755f1
cmp word [edi], bx
jne 0x4755f1
cmp word [eax], bx
jne 0x4755f1
cmp word [esi], bx
jne 0x4755f1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
cmp esi, ebx
je 0x4755d2
cmp byte [ebp + 0xe6], bl
jne 0x4755d2
push esi
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4755d2
xor esi, esi
cmp byte [esp + 0x11c84], bl
je 0x4755e5
cmp esi, ebx
je 0x4755e5
mov dword [ebp + 0xc0], esi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
cmp cx, bx
jne 0x475616
cmp word [edi], bx
jne 0x475616
cmp word [eax], bx
jne 0x475616
cmp word [esi], bx
jne 0x475616
mov eax, ebp
call fcn.00475770
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
push esi
push edi
push edx
push ebp
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x102c], 0x49e828
mov byte [esp + 0x1849], bl
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1850], ebx
mov dword [esp + 0x1854], ebx
mov dword [esp + 0x1858], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov dword [esp + 0x186c], ebx
mov dword [esp + 0x1870], ebx
call fcn.00476260
test eax, eax
je 0x475727
test byte [esp + 0x10], 2
mov al, byte [esp + 0x11c80]
mov ecx, dword [esp + 0x11c88]
mov edx, dword [esp + 0x11c8c]
mov byte [esp + 0x1839], al
mov dword [esp + 0x1848], ecx
mov dword [esp + 0x184c], edx
je 0x475733
mov eax, dword [esp + 0x102c]
cmp eax, 0xffff
je 0x4756ff
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x475727
cmp byte [ebp + 0xe6], bl
jne 0x4756f8
mov eax, dword [esp + 0x102c]
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4756f8
mov ecx, dword [esp + 0x102c]
push 0xfffffffffffffff0
push ecx
call dword [sym.imp.USER32.dll_GetWindowLongW]
test eax, 0x40000000
je 0x475727
mov eax, dword [esp + 0x102c]
cmp dword [esp + 0x1860], eax
je 0x475718
lea esi, [esp + 0x10]
mov dword [esp + 0x1860], eax
call fcn.004766c0
push ebx
lea edx, [esp + 0x14]
push edx
call fcn.00476780
test eax, eax
jne 0x475743
xor eax, eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
lea eax, [esp + 0x10]
push eax
push 0x4757e0
call dword [sym.imp.USER32.dll_EnumWindows]
mov eax, dword [esp + 0x1840]
cmp byte [esp + 0x11c84], bl
je 0x47575d
cmp eax, ebx
je 0x47575d
mov dword [ebp + 0xc0], eax
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret
Function at 0x4766c0
Capabilities:
Get graphical window text

Disassembly:
push ecx
mov ecx, dword [esi + 0x1850]
test ecx, ecx
je 0x47677e
mov eax, dword [esi]
test eax, eax
je 0x47677e
push edi
test al, 1
jne 0x4766ea
mov eax, dword [esi + 0x100c]
cmp word [eax], 0
je 0x476706
push 0x7fff
lea edi, [esi + 0x1858]
push edi
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x476706
xor ecx, ecx
mov word [edi], cx
test byte [esi], 4
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
je 0x476721
mov eax, dword [esi + 0x1850]
lea edx, [esi + 0x1854]
push edx
push eax
call edi
test byte [esi], 0x20
je 0x47675f
mov edx, dword [esi + 0x1850]
lea ecx, [esp + 4]
push ecx
push edx
call edi
test eax, eax
je 0x47675f
movzx eax, byte [esi + 0x1828]
mov ecx, dword [esp + 4]
push eax
lea eax, [esi + 0x11a58]
call fcn.0044f840
add esp, 4
test eax, eax
jne 0x47675f
xor ecx, ecx
mov word [esi + 0x11a58], cx
test byte [esi], 8
pop edi
je 0x47677e
mov eax, dword [esi + 0x1850]
push 0x101
lea edx, [esi + 0x11856]
push edx
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
pop ecx
ret

Function at 0x476e10
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c64
call fcn.00495db0
mov eax, dword [esp + 0x11c68]
mov eax, dword [eax + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x476ebd
mov dword [esp + 0x1848], eax
lea eax, [esp + 8]
push eax
push 0x477540
mov dword [esp + 0x10], ebx
mov dword [esp + 0x101c], 0x49e828
mov byte [esp + 0x1839], bl
mov dword [esp + 0x183c], ebx
mov dword [esp + 0x1840], ebx
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x185c], ebx
mov dword [esp + 0x1860], ebx
mov byte [esp + 0x1854], cl
mov dword [esp + 0x1858], edx
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [esp + 0x1838], ebx
je 0x476ebd
mov ecx, dword [0x4c040c]
mov eax, dword [ecx + 0x54]
cmp eax, 0xffffffff
jle 0x476ebd
push 1
push eax
call fcn.00401290
add esp, 8
mov eax, 1
pop ebx
add esp, 0x11c64
ret 4
Function at 0x476ed0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
cmp dword [edi + 8], 0
jne 0x476eec
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x4c040c]
push eax
push esi
mov ecx, edi
call fcn.00477380
cmp byte [edi], 0
mov dword [esp + 0x10], eax
je 0x476f23
test eax, eax
jne 0x476f27
mov ecx, dword [esp + 0x1c]
push eax
push ecx
push edi
call fcn.00476fe0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
test eax, eax
jne 0x476fa6
test esi, esi
je 0x476fa6
push 0
push 0
push 0x10
push esi
call dword [sym.imp.USER32.dll_PostMessageW]
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
push 1
push 0x8000012f
mov ebx, eax
call fcn.00401290
mov edi, dword [sym.imp.USER32.dll_IsWindow]
add esp, 8
push esi
call edi
test eax, eax
je 0x476f85
mov edi, edi
call ebp
lea ecx, [ebx + 0x1f4]
sub ecx, eax
cmp ecx, 5
jle 0x476f85
push 1
push 0x8000012f
call fcn.00401290
add esp, 8
push esi
call edi
test eax, eax
jne 0x476f60
mov edx, dword [0x4c040c]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x476f9e
push 1
push eax
call fcn.00401290
add esp, 8
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x18]
cmp byte [edi], 0
je 0x476fc0
mov ecx, dword [esp + 0x1c]
push 0
push ecx
push edi
call fcn.00476fe0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
mov edx, dword [esp + 0x1c]
push edx
mov ecx, edi
call fcn.00477150
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x477150
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x11c68
call fcn.00495db0
push ebx
push ebp
push esi
push edi
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 8], ebx
je 0x4772d0
xor cl, cl
mov eax, edi
call fcn.004772f0
test eax, eax
jne 0x477185
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, eax
mov eax, dword [0x4c040c]
push eax
push ebp
mov ecx, edi
call fcn.00477380
test eax, eax
je 0x4771a8
xor eax, eax
mov dword [0x4c5ffc], eax
jmp 0x4771ad
mov eax, dword [0x4c5ffc]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1024], 0x49e828
mov dword [esp + 0x1844], ebx
mov dword [esp + 0x1848], ebx
mov dword [esp + 0x184c], ebx
mov dword [esp + 0x1864], ebx
mov dword [esp + 0x1868], ebx
cmp byte [esp + 0x11c7c], bl
je 0x4771f3
mov byte [esp + 0x1841], bl
cmp eax, ebx
je 0x4771fb
mov byte [esp + 0x1841], 1
mov ecx, dword [0x4c5ff8]
mov edx, dword [edi + 8]
mov esi, dword [sym.imp.USER32.dll_EnumWindows]
mov dword [esp + 0x1854], eax
lea eax, [esp + 0x18]
push eax
push 0x477450
mov dword [esp + 0x1858], ecx
mov dword [esp + 0x1860], edx
call esi
mov eax, dword [esp + 0x1848]
cmp eax, ebx
je 0x4772a8
lea ecx, [esp + 0x10]
push ecx
push 0x476070
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call esi
mov esi, dword [esp + 0x14]
cmp esi, ebx
je 0x477265
mov edx, dword [esp + 0x1848]
call fcn.00476b90
mov dword [esp + 0x1848], esi
mov eax, dword [esp + 0x1848]
call fcn.00475040
mov edx, dword [esp + 0x1848]
call fcn.00476b90
mov edx, dword [0x4c040c]
mov eax, dword [edx + 0x54]
cmp eax, 0xffffffff
jle 0x4772d0
push 1
push eax
call fcn.00401290
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x11c68
ret 4
mov eax, dword [0x4c5ffc]
cmp eax, ebx
je 0x4772d0
cmp eax, 1
setg al
mov dword [0x4c5ffc], ebx
cmp al, bl
je 0x4772d0
mov edx, ebp
call fcn.00476b90
push ebx
mov ecx, edi
call fcn.00477150
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x11c68
ret 4
Function at 0x490c56
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bfd70]
jne 0x490c60
repz ret
jmp fcn.004957df

Function at 0x493b70
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4bfd70]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0048e0c2
and dword [ebp - 0x14], 0
cmp dword [0x4c265c], 0
mov dword [ebp - 0x18], eax
jne 0x493c23
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x493ccb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49dfb8
push ebx
call edi
test eax, eax
je 0x493ccb
mov esi, dword [fcn.0048a4a0]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c265c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c2660], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c2664], eax
call edi
push eax
call esi
mov dword [0x4c266c], eax
test eax, eax
je 0x493c23
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c2668], eax
mov eax, dword [0x4c2668]
mov ecx, dword [ebp - 0x18]
mov esi, dword [fcn.0048a4a4]
cmp eax, ecx
je 0x493c7c
cmp dword [0x4c266c], ecx
je 0x493c7c
push eax
call esi
push dword [0x4c266c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x493c7c
test ebx, ebx
je 0x493c7c
call edi
test eax, eax
je 0x493c73
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x493c73
test byte [ebp - 8], 1
jne 0x493c7c
or dword [ebp + 0x10], 0x200000
jmp 0x493caf
mov eax, dword [0x4c2660]
cmp eax, dword [ebp - 0x18]
je 0x493caf
push eax
call esi
test eax, eax
je 0x493caf
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x493caf
mov eax, dword [0x4c2664]
cmp eax, dword [ebp - 0x18]
je 0x493caf
push eax
call esi
test eax, eax
je 0x493caf
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c265c]
call esi
test eax, eax
je 0x493ccb
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x493ccd
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00490c56
leave
ret
Function at 0x499ae1
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [ebx + 0x708b0c40], cl
sbb al, 0xad
cmp byte [eax + 0x1c], 0x18
je 0x499af1
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0049792d
or bh, byte [ebp - 0x7747d7d]
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0049792d
or esi, dword [edi]
pushfd
dec ecx
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x499b1a
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x499b1a
call fcn.0049792d
jle 0x499afa
popal
mov eax, dword [0x3245a8b]
Function at 0x401040
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x431c38]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
xor ecx, ecx
test edi, edi
je 0x4010e1
mov edx, dword [ebp + 0xc]
lea eax, [edx - 1]
test eax, eax
jne 0x4010e1
cmp edx, 1
jne 0x4010d0
push esi
push 0x90
push eax
lea eax, [ebp - 0x94]
push eax
call fcn.00407be0
add esp, 0xc
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
xor esi, esi
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4010c0
mov eax, dword [ebp - 0x94]
cmp eax, 6
ja 0x4010bb
cmp eax, 6
jne 0x4010c0
cmp dword [ebp - 0x90], esi
jbe 0x4010c0
mov esi, 1
shl esi, 0xb
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ecx, eax
pop esi
mov eax, ecx
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406b74
mov esp, ebp
pop ebp
ret
push 0x57
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.00406b74
mov esp, ebp
pop ebp
ret

Function at 0x4013d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x101
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], 0
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40143d
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push str.EulaAccepted
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x40143d
xor eax, eax
cmp dword [ebp - 8], eax
setne al
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401730
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
test edi, edi
je 0x4017e0
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4017e0
xor esi, esi
cmp dword [edi], ebx
jle 0x4017be
nop dword [eax]
nop dword [eax + eax]
push 0x4273bc
push dword [eax + esi*4]
call fcn.004102b7
add esp, 8
test eax, eax
je 0x401797
mov eax, dword [ebp + 0x10]
push str._accepteula
push dword [eax + esi*4]
call fcn.004102b7
add esp, 8
test eax, eax
je 0x401797
mov eax, dword [ebp + 0x10]
inc esi
xor ebx, ebx
cmp esi, dword [edi]
jl 0x401760
jmp 0x4017be
mov edx, dword [edi]
mov ebx, 1
lea eax, [edx - 1]
cmp esi, eax
jge 0x4017b9
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx + esi*4 + 4]
mov dword [ecx + esi*4], eax
inc esi
mov edx, dword [edi]
lea eax, [edx - 1]
cmp esi, eax
jl 0x4017a8
lea eax, [edx - 1]
mov dword [edi], eax
push ebx
push dword [ebp + 8]
call fcn.004018e0
add esp, 8
mov ecx, 1
test eax, eax
cmovne ebx, ecx
xor eax, eax
pop edi
test ebx, ebx
pop esi
setne al
pop ebx
pop ebp
ret
push str.CommandLineToArgvW
push 1
push str.Shell32.dll
xor edi, edi
call fcn.00401040
add esp, 8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401884
push 0x432630
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call esi
xor esi, esi
mov ebx, eax
cmp dword [0x432630], esi
jle 0x401884
push 0x42738c
push dword [ebx + esi*4]
call fcn.00409f7a
add esp, 8
test eax, eax
je 0x401856
push 0x4273a4
push dword [ebx + esi*4]
call fcn.00409f7a
add esp, 8
test eax, eax
je 0x401856
inc esi
xor edi, edi
cmp esi, dword [0x432630]
jl 0x401821
jmp 0x401884
mov ecx, dword [0x432630]
mov edi, 1
lea eax, [ecx - 1]
cmp esi, eax
jge 0x40187d
mov eax, dword [ebx + esi*4 + 4]
mov dword [ebx + esi*4], eax
inc esi
mov ecx, dword [0x432630]
lea eax, [ecx - 1]
cmp esi, eax
jl 0x401868
dec ecx
mov dword [0x432630], ecx
push edi
push dword [ebp + 8]
call fcn.004018e0
add esp, 8
mov ecx, 1
test eax, eax
cmovne edi, ecx
xor eax, eax
test edi, edi
pop edi
pop esi
setne al
pop ebx
pop ebp
ret
Function at 0x401e40
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x431c38]
xor eax, ebp
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [ebp - 0x214], ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x210], ecx
cmp dword [edi], 1
jle 0x401ee6
mov esi, 1
nop word [eax + eax]
lea ebx, [ecx + esi*4]
push 0x42759c
push dword [ebx]
call fcn.004102b7
add esp, 8
test eax, eax
je 0x401eb8
push str._nobanner
push dword [ebx]
call fcn.004102b7
add esp, 8
test eax, eax
je 0x401eb8
mov ecx, dword [ebp - 0x210]
inc esi
xor ebx, ebx
cmp esi, dword [edi]
jl 0x401e80
jmp 0x401ee6
mov edx, dword [edi]
mov ebx, 1
mov ecx, dword [ebp - 0x210]
lea eax, [edx - 1]
cmp esi, eax
jge 0x401ee1
nop dword [eax]
mov eax, dword [ecx + esi*4 + 4]
mov dword [ecx + esi*4], eax
inc esi
mov edx, dword [edi]
lea eax, [edx - 1]
cmp esi, eax
jl 0x401ed0
lea eax, [edx - 1]
mov dword [edi], eax
push ecx
push edi
push dword [ebp - 0x214]
call fcn.00401360
add esp, 0xc
test eax, eax
jne 0x402071
push 1
call fcn.0040a4ba
push eax
call fcn.00410c39
push eax
call fcn.00410e85
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 2
je 0x402071
push 1
call fcn.0040a4ba
mov esi, eax
lea eax, [ebp - 0x220]
push eax
push esi
call fcn.00410bde
add esp, 0xc
test eax, eax
jne 0x401f71
mov ecx, dword [ebp - 0x220]
or ecx, dword [ebp - 0x21c]
jne 0x401f71
push 0x20000
push esi
call fcn.00410c39
add esp, 4
push eax
call fcn.00410f2c
push 0x4276cc
push esi
call fcn.004021f0
add esp, 0x10
test ebx, ebx
jne 0x40207a
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x20c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
push esi
call fcn.0040a096
add esp, 4
mov edi, eax
lea eax, [ebp - 0x20c]
push edi
push esi
push ebx
push eax
call sub.VERSION.dll_GetFileVersionInfoW
push 0x4275b4
push edi
call fcn.00402300
push 0x4275d0
push edi
mov esi, eax
call fcn.00402300
push 0x4275e8
push edi
mov dword [ebp - 0x214], eax
call fcn.00402300
push 0x427608
push edi
mov dword [ebp - 0x218], eax
call fcn.00402300
push 0x427628
push edi
mov dword [ebp - 0x210], eax
call fcn.00402300
add esp, 0x28
mov edi, eax
call fcn.004014f0
push edi
push dword [ebp - 0x210]
push dword [ebp - 0x218]
push dword [ebp - 0x214]
push esi
push 0x427640
test eax, eax
je 0x40204f
push 1
call fcn.0040a4ba
add esp, 4
push eax
call fcn.00402220
push 1
call fcn.0040a4ba
push eax
call fcn.00410b8b
add esp, 0x24
jmp 0x40207a
push 2
call fcn.0040a4ba
add esp, 4
push eax
call fcn.00402220
push 2
call fcn.0040a4ba
push eax
call fcn.00410b8b
add esp, 0x24
jmp 0x40207a
push ebx
call fcn.004020a0
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.00406b74
mov esp, ebp
pop ebp
Function at 0x4020a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x431c38]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
jne 0x4021a4
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x108]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
push esi
call fcn.0040a096
add esp, 4
mov edi, eax
lea eax, [ebp - 0x108]
push edi
push esi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
push 0x42766c
push edi
call fcn.00402250
push 0x42767c
push edi
mov esi, eax
call fcn.00402250
push 0x427688
push edi
mov ebx, eax
call fcn.00402250
push 0x427698
push edi
mov dword [ebp - 0x110], eax
call fcn.00402250
push 0x4276a8
push edi
mov dword [ebp - 0x10c], eax
call fcn.00402250
add esp, 0x28
mov edi, eax
call fcn.004014f0
push edi
push dword [ebp - 0x10c]
push dword [ebp - 0x110]
push ebx
push esi
push str._n_s_v_s____s_n_s_n_s_n_n
test eax, eax
je 0x402181
push 1
call fcn.0040a4ba
add esp, 4
push eax
call fcn.004021c0
push 1
jmp 0x402193
push 2
call fcn.0040a4ba
add esp, 4
push eax
call fcn.004021c0
push 2
call fcn.0040a4ba
push eax
call fcn.00410b8b
add esp, 0x24
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406b74
mov esp, ebp
pop ebp
ret
Function at 0x4024d0
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x431c38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], 0
push edi
test esi, esi
je 0x4025ad
cmp dword [ebp + 0x10], 0
je 0x4025ad
mov ecx, esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402503
sub ecx, edx
lea eax, [ecx + 1]
call fcn.00406b90
mov edi, esp
mov ecx, edi
sub ecx, esi
nop word [eax + eax]
mov al, byte [esi]
lea esi, [esi + 1]
mov byte [ecx + esi - 1], al
test al, al
jne 0x402520
push 0x5c
push edi
call fcn.0041146a
add esp, 8
test eax, eax
je 0x402544
mov byte [eax], 0
mov ecx, edi
inc eax
jmp 0x40254b
mov ecx, 0x427784
mov eax, edi
lea edx, [ebp - 8]
push edx
push 3
push 9
push dword [ebp + 0x10]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test al, al
jne 0x40258d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push dword [ebp + 8]
push str.Cannot_log_on_to__s:_n
push 2
call fcn.0040a4ba
add esp, 4
push eax
call fcn.004027c0
push esi
call fcn.00402730
add esp, 0x10
jmp 0x4025f7
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test al, al
jne 0x4025ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40256a
push dword [ebp + 0x18]
mov edi, dword [ebp + 8]
push dword [ebp + 0x14]
push edi
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryA]
mov esi, eax
test esi, esi
je 0x4025e2
push edi
push str.Cannot_connect_to_remote_registry_on__s:_n
push 2
call fcn.0040a4ba
add esp, 4
push eax
call fcn.004027c0
push esi
call fcn.00402730
add esp, 0x10
cmp dword [ebp - 8], 0
je 0x4025f7
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
lea esp, [ebp - 0x10]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00406b74
mov esp, ebp
pop ebp
ret