joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401230
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
jb 0x40123e
jae 0x40123e
call 0x854857cd
ror byte [edi], 0x8e
inc esi
add dword [eax], eax
add byte [ebx - 0x75], dl
pop ebp
or al, 0x56
mov eax, dword [ebp + 8]
test eax, eax
jle 0x40138f
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp + 0xc], eax
mov ecx, dword [ebx]
mov al, byte [ecx]
cmp al, 0x2d
je 0x401307
cmp al, 0x2f
je 0x401307
push ecx
call fcn.004014f0
add esp, 4
test al, al
je 0x40137c
jb 0x40127c
jae 0x40127c
call 0x45cd260b
or byte [eax - 0x75], dl
cli
mov edx, dword [ebx]
lea eax, [ebp + 8]
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebp - 0xc], 0xc
mov byte [ebp - 0xb], 0x20
mov byte [ebp - 0xa], 0xc
mov byte [ebp - 9], 0x22
mov byte [ebp - 8], 0xc
mov byte [ebp - 7], 0x62
mov byte [ebp - 6], 0x7f
mov byte [ebp - 5], 0xde
mov byte [ebp - 4], 0x15
mov byte [ebp - 3], 0x50
mov dword [ebp + 8], 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.00401530
mov ecx, dword [ebp + 8]
add esp, 0xc
test ecx, ecx
je 0x40137c
push eax
push ecx
lea ecx, [ebp - 0xc]
push 0xa
push ecx
call fcn.00401410
add esp, 0x10
test eax, eax
je 0x4012f2
mov edx, dword [ebp + 8]
push edx
call fcn.004011f0
add esp, 4
mov eax, dword [ebp + 8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x40137c
jb 0x40130c
jae 0x40130c
call 0x35cb4e9b
loopne 0x401316
mov edi, dword [ebx]
mov esi, dword [sym.imp.MSVCRT.dll__strnicmp]
inc edi
push 3
push 0x41385c
inc ecx
add byte [edi + 0x6a], al
add ebp, dword [eax + 0x5c]
cmp byte [ecx], al
push edi
call esi
add esp, 0xc
test eax, eax
jne 0x401341
mov al, byte [edi + 3]
add edi, 3
test al, al
je 0x40137c
push edi
call dword [sym.imp.MSVCRT.dll_atoi]
add esp, 4
mov dword [0x41ba7c], eax
jmp 0x40137c
push 4
push str.cfg:
push edi
call esi
add esp, 0xc
test eax, eax
jne 0x40137c
mov al, byte [edi + 4]
add edi, 4
test al, al
je 0x40137c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x41b62c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 0xc]
add ebx, 4
dec eax
mov dword [ebp + 0xc], eax
jne 0x401252
pop edi
pop esi
pop ebx
mov al, byte [0x41b62c]
test al, al
je 0x401406
mov eax, dword [0x41ba7c]
test eax, eax
je 0x401406
push eax
lea eax, [ebp - 0x34]
push 0x413850
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
lea ecx, [ebp - 0x434]
push 0x400
push ecx
push 0x41b62c
call fcn.004015f0
add esp, 0x18
test eax, eax
je 0x401406
lea edx, [ebp - 0x434]
lea eax, [ebp - 0x34]
push edx
push pe_nt_image_headers32
push 0x41ba80
push 0x41ba2c
push eax
push 0x41384c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [0x41ba80]
test al, al
je 0x401406
mov dword [0x41ba70], 2
mov esp, ebp
pop ebp
ret
Function at 0x4015f0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0x14]
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x4016a0
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameA]
test eax, eax
je 0x4016a0
mov eax, ebx
xor edx, edx
mov cl, byte [eax]
test cl, cl
je 0x401645
cmp cl, 0x5c
je 0x401631
mov cl, byte [eax + 1]
test cl, cl
je 0x40163d
inc eax
inc edx
cmp edx, 0x400
jb 0x40161f
jmp 0x401645
mov byte [eax + 1], 0x5c
mov byte [eax + 2], 0
push edi
mov edi, dword [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..tmp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret
pop esi
xor eax, eax
pop ebx
ret

Function at 0x4016b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0xc]
or eax, 0xffffffff
xor ecx, ecx
test esi, esi
jbe 0x4016e6
push ebx
push edi
mov edi, dword [esp + 0x10]
xor edx, edx
mov ebx, eax
mov dl, byte [ecx + edi]
and ebx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x410630]
xor eax, edx
inc ecx
cmp ecx, esi
jb 0x4016c4
pop edi
pop ebx
not eax
pop esi
ret
Function at 0x402e00
Capabilities:
Get common file path

Disassembly:
sub esp, 0x22c
mov eax, dword [0x41ba60]
mov dword [esp], str.getaddrinfo
test eax, eax
mov dword [esp + 4], 0x4024a0
mov dword [esp + 8], str.getnameinfo
mov dword [esp + 0xc], 0x402bc0
mov dword [esp + 0x10], str.freeaddrinfo
mov dword [esp + 0x14], 0x402450
je 0x402e5b
mov eax, dword [esp + 0x230]
and eax, 0xffff
mov eax, dword [eax*8 + 0x4138ac]
add esp, 0x22c
ret 4
push ebx
push ebp
push esi
push edi
lea ecx, [esp + 0x134]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x402fa4
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ws2_32
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and ecx, 3
lea eax, [esp + 0x28]
rep movsb byte es:[edi], byte [esi]
push eax
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x402efc
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x402f74
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea edi, [esp + 0x134]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x28]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.wship6
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x28]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
mov esi, eax
test esi, esi
je 0x402fa4
push str.getaddrinfo
push esi
call ebp
test eax, eax
jne 0x402f74
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x402fa4
xor ebx, ebx
lea edi, [esp + 0x14]
mov ecx, dword [edi - 4]
push ecx
push esi
call ebp
test eax, eax
mov dword [edi], eax
je 0x402f6b
inc ebx
add edi, 8
cmp ebx, 3
jl 0x402f7a
xor eax, eax
mov edx, dword [esp + eax + 0x14]
mov dword [eax + 0x4138ac], edx
add eax, 8
cmp eax, 0x18
jl 0x402f92
mov eax, dword [esp + 0x240]
pop edi
and eax, 0xffff
pop esi
pop ebp
mov dword [0x41ba60], 1
mov eax, dword [eax*8 + 0x4138ac]
pop ebx
add esp, 0x22c
ret 4
Function at 0x403440
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
push esi
xor esi, esi
test eax, eax
je 0x40349d
cmp byte [eax], 0
je 0x40349d
mov edx, dword [esp + 8]
lea ecx, [esp + 8]
push ecx
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4034c7
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40348e
mov esi, 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
mov eax, 1
je 0x4034c9
mov eax, esi
pop esi
ret

Function at 0x403520
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x200
push ebx
push ebp
push esi
push edi
push 0
push 0
push 0
push 0xfffffffffffffffd
call dword [sym.imp.USER32.dll_FindWindowExA]
mov ebp, eax
test ebp, ebp
je 0x40360d
mov ebx, dword [esp + 0x214]
lea eax, [esp + 0x10]
push pe_nt_image_headers32
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [esp + 0x110]
push pe_nt_image_headers32
push ecx
push ebp
call dword [sym.imp.USER32.dll_GetClassNameA]
test ebx, ebx
mov edi, 1
je 0x4035b5
mov esi, ebx
lea eax, [esp + 0x110]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4035a4
test cl, cl
je 0x4035a0
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4035a4
add eax, 2
add esi, 2
test cl, cl
jne 0x403580
xor eax, eax
jmp 0x4035a9
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
and ecx, 1
mov edi, ecx
mov esi, dword [esp + 0x218]
test esi, esi
je 0x4035f6
lea eax, [esp + 0x10]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4035e8
test cl, cl
je 0x4035e4
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4035e8
add eax, 2
add esi, 2
test cl, cl
jne 0x4035c4
xor eax, eax
jmp 0x4035ed
sbb eax, eax
sbb eax, 0xffffffff
xor ecx, ecx
test eax, eax
sete cl
and edi, ecx
test edi, edi
jne 0x40361a
push 2
push ebp
call dword [sym.imp.USER32.dll_GetWindow]
mov ebp, eax
test ebp, ebp
jne 0x403549
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x200
ret
lea edx, [esp + 0x10]
lea eax, [esp + 0x110]
push edx
push eax
push ebp
push str._08X__s__s_n
call dword [sym.imp.MSVCRT.dll_printf]
add esp, 0x10
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret
Function at 0x403650
Capabilities:
Read file via mapping

Disassembly:
sub esp, 8
push esi
push edi
xor edi, edi
push str.GlobalWINPOPUP_MEMORY
push edi
push 4
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov esi, eax
test esi, esi
mov dword [esp + 0xc], esi
je 0x403762
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebp
push 4
push edi
push edi
push 4
push esi
call ebx
test eax, eax
je 0x403751
mov ebp, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp ebp, 0x110
jne 0x403751
push ebp
push edi
push edi
push 4
push esi
call ebx
mov ebp, eax
test ebp, ebp
je 0x403751
push 0x110
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x40374a
mov ecx, 0x44
mov esi, ebp
mov edi, ebx
push 0
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebx + 4]
push 0xa
push str._f__f__fb
lea esi, [ebx + 8]
push eax
push 0x108
push esi
call fcn.00405860
mov edi, dword [esi]
push 0x110
push ebx
mov dword [esi], 0
call fcn.004016b0
add esp, 0x20
cmp edi, eax
jne 0x403738
mov ecx, dword [ebx + 0xc]
lea edx, [ebx + 0x10]
push pe_nt_image_headers32
push edx
push 0x41ba80
mov dword [0x41ba7c], ecx
call fcn.0040ae90
mov eax, 1
add esp, 0xc
mov dword [0x41ba70], eax
mov dword [esp + 0x10], eax
push ebx
call dword [sym.imp.MSVCRT.dll_free]
mov esi, dword [esp + 0x18]
mov edi, dword [esp + 0x14]
add esp, 4
push ebp
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
add esp, 8
ret
mov eax, edi
pop edi
pop esi
add esp, 8
ret

Function at 0x4039b0
Capabilities:
Resolve dns

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x4039ed
cmp byte [esi], 0
je 0x4039ed
push esi
call fcn.00403120
add esp, 4
test eax, eax
jne 0x4039d8
push esi
call fcn.00403120
add esp, 4
test eax, eax
je 0x4039e4
push eax
push esi
call fcn.00403860
add esp, 8
pop esi
ret
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x404b80
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x404bba
cmp word [edx], 0x5a4d
jne 0x404bba
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x404bba
mov ecx, dword [eax + 0x80]
test ecx, ecx
je 0x404bba
push esi
mov esi, dword [eax + 0x84]
test esi, esi
pop esi
je 0x404bba
test ecx, ecx
je 0x404bba
lea eax, [ecx + edx]
ret
xor eax, eax
ret

Function at 0x404bc0
Capabilities:
Parse pe header

Disassembly:
mov edx, dword [esp + 4]
test edx, edx
je 0x404bfa
cmp word [edx], 0x5a4d
jne 0x404bfa
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x404bfa
mov ecx, dword [eax + 0xe0]
test ecx, ecx
je 0x404bfa
push esi
mov esi, dword [eax + 0xe4]
test esi, esi
pop esi
je 0x404bfa
test ecx, ecx
je 0x404bfa
lea eax, [ecx + edx]
ret
xor eax, eax
ret
Function at 0x405e10
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10
test eax, eax
push ebx
push ebp
je 0x405e99
mov ebp, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp + 0xc]
push 0xc
push ecx
push eax
call ebp
push eax
call sub.PSAPI.DLL_GetModuleInformation
test eax, eax
je 0x405e99
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.MSVCRT.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x405e99
mov ecx, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
mov eax, ecx
push edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
push 0x40
push edx
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov eax, dword [esp + 0x28]
pop edi
test eax, eax
pop esi
je 0x405e8e
mov ecx, dword [esp + 0x1c]
mov dword [eax + 4], ebx
mov dword [eax], ecx
pop ebp
mov eax, 1
pop ebx
add esp, 0x10
ret
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x406520
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
push esi
mov esi, dword [esp + 0xc]
lea ecx, [ebp + 2]
test ecx, ecx
jl 0x406657
mov eax, 0x55555556
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp edx, 0x40000000
jae 0x406657
lea ecx, [edx*4 + 1]
push ebx
push ecx
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov ebx, eax
cmp ebp, 2
mov ecx, ebx
jle 0x4065e0
mov eax, 0xaaaaaaab
push edi
mul ebp
mov edi, edx
shr edi, 1
lea edx, [edi*4]
sub edx, edi
neg edx
add ebp, edx
xor eax, eax
mov al, byte [esi]
add esi, 3
shr eax, 2
inc ecx
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], dl
mov al, byte [esi - 3]
xor edx, edx
and eax, 3
mov dl, byte [esi - 2]
shl eax, 4
shr edx, 4
inc ecx
mov al, byte [eax + edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [esi - 2]
xor eax, eax
and edx, 0xf
mov al, byte [esi - 1]
shr eax, 6
inc ecx
mov dl, byte [eax + edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], dl
mov al, byte [esi - 1]
and eax, 0x3f
inc ecx
dec edi
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], dl
jne 0x406583
pop edi
test ebp, ebp
je 0x406640
xor eax, eax
mov al, byte [esi]
shr eax, 2
inc ecx
cmp ebp, 1
mov dl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], dl
jle 0x406626
mov al, byte [esi]
xor edx, edx
mov dl, byte [esi + 1]
and eax, 3
shl eax, 4
shr edx, 4
inc ecx
mov al, byte [eax + edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov dl, byte [esi + 1]
and edx, 0xf
mov al, byte [edx*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
jmp 0x40663b
mov dl, byte [esi]
and edx, 3
shl edx, 4
inc ecx
mov al, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx - 1], al
mov byte [ecx], 0x3d
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40664e
mov edx, ecx
sub edx, ebx
mov dword [eax], edx
mov eax, ebx
pop ebx
pop esi
mov byte [ecx], 0
pop ebp
ret
mov eax, dword [esp + 0x14]
test eax, eax
je 0x406665
mov dword [eax], 0
pop esi
xor eax, eax
pop ebp
ret

Function at 0x406bc0
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
neg eax
sbb eax, eax
inc eax
add esp, 0x190
ret
Function at 0x407c80
Capabilities:
Check os version
Enumerate process modules

Disassembly:
sub esp, 0x224
push esi
call fcn.004049a0
call fcn.00407dd0
push str.User32.dll
call fcn.00405df0
push str.ntdll.dll
mov dword [0x41cd04], eax
call fcn.00405df0
mov esi, eax
push str.KiUserApcDispatcher
push esi
call fcn.00406130
push str.KiUserCallbackDispatcher
push esi
mov dword [0x41cd0c], eax
call fcn.00406130
push str.KiUserExceptionDispatcher
push esi
mov dword [0x41cd10], eax
call fcn.00406130
add esp, 0x20
mov dword [0x41cd14], eax
mov dword [0x41cc70], 0x94
push 0x41cc70
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [0x41cc74], 6
jb 0x407d28
push str.RtlUserThreadStart
push esi
call fcn.00406130
add esp, 8
test eax, eax
je 0x407d28
mov cl, byte [eax + 8]
add eax, 8
cmp cl, 0xe9
jne 0x407d28
mov ecx, dword [eax + 1]
inc eax
lea edx, [ecx + eax + 4]
mov dword [0x41cd18], edx
push str.kernel32.dll
call fcn.00405df0
push str.ExitThread
push eax
call fcn.00406130
add esp, 0xc
mov dword [0x41cd1c], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
test esi, esi
je 0x407db4
lea eax, [esp + 4]
mov dword [esp + 4], 0x224
push eax
push esi
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x407dad
mov ecx, dword [esp + 0x20]
push 0
push 0x41cd20
push 0x407270
push str.LdrLoadDll
push str.ntdll.dll
push ecx
call fcn.00404c00
mov edx, dword [esp + 0x38]
push edx
call fcn.00407870
add esp, 0x1c
lea eax, [esp + 4]
push eax
push esi
call sub.KERNEL32.dll_Module32Next
cmp eax, 1
je 0x407d70
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.00406c50
pop esi
add esp, 0x224
ret

Function at 0x4088d0
Capabilities:
Get file version info

Disassembly:
sub esp, 8
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x10]
push esi
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x4088f2
pop edi
pop esi
pop ebx
add esp, 8
ret
push esi
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
test edi, edi
jne 0x408909
pop edi
pop esi
pop ebx
add esp, 8
ret
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40891e
pop edi
pop esi
pop ebx
add esp, 8
ret
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
push edx
push 0x4170a0
push edi
mov dword [esp + 0x28], 0
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x408946
pop edi
pop esi
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x408955
pop edi
pop esi
pop ebx
add esp, 8
ret
mov edx, dword [eax + 8]
mov ecx, dword [esp + 0x1c]
shr edx, 0x10
mov word [ecx + 6], dx
mov dx, word [eax + 8]
mov word [ecx + 4], dx
mov edx, dword [eax + 0xc]
shr edx, 0x10
mov word [ecx + 2], dx
mov ax, word [eax + 0xc]
pop edi
mov word [ecx], ax
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x408990
Capabilities:
Get file version info

Disassembly:
sub esp, 0x44
lea eax, [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x50]
push esi
push edi
push eax
push ebp
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
xor esi, esi
cmp ebx, esi
jne 0x4089b8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret
push ebx
call dword [sym.imp.MSVCRT.dll_malloc]
mov edi, eax
add esp, 4
cmp edi, esi
jne 0x4089d2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret
push edi
push ebx
push esi
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x4089e7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
lea ecx, [esp + 0x10]
lea edx, [esp + 0x14]
push ecx
push edx
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x408b11
cmp dword [esp + 0x10], 4
jb 0x408b11
mov eax, dword [esp + 0x5c]
xor ecx, ecx
push eax
mov eax, dword [esp + 0x18]
xor edx, edx
mov cx, word [eax + 2]
mov dx, word [eax]
push ecx
push edx
lea eax, [esp + 0x2c]
push str.StringFileInfo_04x_04x_s
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0x14
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x58]
lea eax, [esp + 0x20]
push ecx
push edx
push eax
push edi
mov dword [esp + 0x68], esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x408b11
mov edi, dword [esp + 0x58]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x5c], edi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x408a78
call dword [sym.imp.MSVCP60.dll_void___cdecl_std::_Xlen_void_]
mov ebp, dword [esp + 0x60]
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x408aaf
mov al, byte [ecx - 1]
test al, al
je 0x408aaf
cmp al, 0xff
je 0x408aaf
cmp ebx, esi
jne 0x408ae2
dec al
pop edi
mov byte [ecx - 1], al
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
mov esi, 1
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
cmp ebx, esi
jne 0x408acc
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
mov esi, 1
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x408ad8
cmp eax, ebx
jae 0x408aeb
push 1
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Tidy_bool_]
push ebx
mov ecx, ebp
call dword [sym.imp.MSVCP60.dll_private:_void___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Copy_unsigned_int_]
mov esi, dword [esp + 0x5c]
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
mov esi, 1
mov byte [eax + ebx], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x44
ret