joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4097b2
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [ebp + 0xc], 0x2711
push esi
mov esi, ecx
jne 0x4098df
push edi
xor edi, edi
cmp dword [esi + 0x100], edi
jne 0x4098de
push ebx
lea ecx, [esi + 0x48]
call fcn.00414245
push edi
test eax, eax
je 0x409842
push dword [esi + 0x44]
call dword [sym.imp.USER32.dll_GetSubMenu]
cmp dword [ebp + 0x10], 0x205
mov ebx, eax
je 0x409805
cmp dword [ebp + 0x10], 0x202
jne 0x4098dd
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
push dword [esi + 4]
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push edi
push edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x4098dd
push dword [esi + 0x40]
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0x46d5d8
lea ecx, [ebp + 0xc]
mov ebx, eax
call fcn.0040537a
lea ecx, [ebp + 0xc]
cmp dword [esi + 0xfc], edi
je 0x40986c
push 0x87
jmp 0x409871
push 0x84
call fcn.00405c98
push dword [ebp + 0xc]
mov eax, 0x8009
push eax
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_ModifyMenuA]
cmp dword [ebp + 0x10], 0x205
je 0x40989a
cmp dword [ebp + 0x10], 0x202
jne 0x4098d2
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.USER32.dll_GetCursorPos]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push edi
push dword [esi + 4]
push edi
push dword [ebp - 4]
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push edi
push edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageA]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00404f7d
pop ebx
pop edi
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x40a8e3
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x40a931
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x40a942
push 0xd
pop eax
jmp 0x40a96c
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40a945
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8
Function at 0x40b0d7
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.0040a8a2
mov ebx, eax
cmp ebx, esi
je 0x40b147
lea ecx, [ebp - 0x70]
call fcn.0040a82d
mov eax, ebx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429649
add ebp, 0x9c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40b15f
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.0040b0d7
cmp eax, esi
jne 0x40b191
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x40b14f
lea ecx, [ebp - 0x70]
call fcn.0040a82d
push dword [ebp - 0x78]
mov ecx, edi
call fcn.0040a7c3
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.0040a82d
mov eax, esi
jmp 0x40b12d
Function at 0x40c93a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3ac]
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0x3a8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x3b0]
push edi
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x68], ebx
cmp esi, ebx
je 0x40c9d8
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
push 2
push eax
mov dword [ebp - 0x74], eax
lea eax, [ebp - 0x74]
push eax
call fcn.0040a4b3
add esp, 0xc
test eax, eax
jl 0x40c9d8
mov edi, dword [ebp - 0x74]
cmp edi, 0x400
jg 0x40c9c1
push edi
call fcn.0040b05d
pop ecx
test al, al
je 0x40c9c1
mov eax, edi
call fcn.0042edf0
mov eax, esp
jmp 0x40c9ca
push edi
lea ecx, [ebp - 0x70]
call fcn.0040b207
push 3
push edi
push esi
push eax
call fcn.0040a5bf
cmp eax, ebx
jne 0x40ca15
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x40c9e8
lea ecx, [ebp - 0x68]
call fcn.0040af4b
lea ecx, [ebp - 0x70]
call fcn.0040ae09
mov eax, 0x8007000e
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
call fcn.00429649
add ebp, 0x3a0
leave
ret 0x10
push 2
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
jne 0x40ca31
call fcn.0040a6ae
mov esi, eax
jmp 0x40cad7
push dword [ebp - 0x78]
push dword [ebp - 0x6c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x40ca4e
call fcn.0040a6ae
jmp 0x40cace
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x6c], eax
cmp eax, ebx
je 0x40ca44
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x40ca92
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x40ca7e
lea ecx, [ebp - 0x68]
call fcn.0040af4b
mov esi, 0x8007000e
lea ecx, [ebp - 0x70]
call fcn.0040ae09
mov eax, esi
jmp 0x40c9f5
push eax
lea ecx, [ebp - 0x68]
call fcn.0040b820
cmp dword [ebp - 0x68], ebx
jne 0x40caa7
mov esi, 0x8007000e
jmp 0x40cad0
push esi
push dword [ebp - 0x6c]
push esi
push dword [ebp - 0x68]
call fcn.0040a62e
mov eax, dword [ebp - 0x68]
add esp, 0x10
push dword [ebp + 0x3b4]
mov byte [eax + esi], bl
push dword [ebp - 0x68]
lea ecx, [ebp - 0x80]
call fcn.0040c714
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x64]
cmp dword [ebp - 0x68], eax
je 0x40ca83
lea ecx, [ebp - 0x68]
call fcn.0040af4b
jmp 0x40ca83
Function at 0x40d3a8
Capabilities:
Accept command line arguments
Check os version
Move file

Disassembly:
push ebp
lea ebp, [esp - 0x230]
sub esp, 0x2b0
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x22c], eax
mov eax, dword [ebp + 0x238]
push esi
push edi
mov edi, 0x9c
xor esi, esi
push edi
mov dword [ebp - 0x7c], eax
lea eax, [ebp - 0x78]
push esi
push eax
mov dword [0x46cd68], esi
call fcn.00429d40
add esp, 0xc
lea eax, [ebp - 0x78]
mov dword [ebp - 0x78], edi
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call edi
test eax, eax
jne 0x40d414
lea eax, [ebp - 0x78]
push eax
mov dword [ebp - 0x78], 0x94
call edi
test eax, eax
jne 0x40d414
xor eax, eax
jmp 0x40d54a
cmp dword [ebp - 0x68], 2
jne 0x40d40d
cmp dword [ebp - 0x74], 4
jbe 0x40d40d
call fcn.0041eb48
test eax, eax
je 0x40d46c
lea eax, [ebp - 0x80]
push eax
mov dword [ebp - 0x80], esi
call fcn.0041ebed
pop ecx
test eax, eax
jl 0x40d40d
cmp dword [ebp - 0x80], esi
jne 0x40d46c
push 0x104
lea eax, [ebp + 0x128]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push esi
push eax
lea eax, [ebp + 0x128]
push eax
push esi
call fcn.0041ee98
add esp, 0x10
jmp 0x40d40d
push ebx
push str.GlobalDCBEBF39_05BB_4826_9BDA_B8DD752EF707
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp ebx, esi
je 0x40d539
cmp eax, 0xb7
je 0x40d539
cmp eax, 5
je 0x40d539
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 4
call fcn.00409f96
pop ecx
push esi
push dword [ebp - 0x7c]
mov edi, 0x46cd6c
push esi
mov ecx, edi
call fcn.0040a2d1
push dword [ebp + 0x244]
push dword [ebp + 0x240]
call fcn.0040c8a7
pop ecx
pop ecx
mov ecx, edi
mov dword [ebp - 0x80], eax
call fcn.0040c833
call dword [sym.imp.ole32.dll_CoUninitialize]
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x46cd68], esi
je 0x40d534
push 0x208
lea eax, [ebp + 0x24]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp + 0x24]
push eax
lea ecx, [ebp - 0x7c]
call fcn.00406052
push 4
push esi
mov esi, dword [ebp - 0x7c]
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esi - 0x10]
call fcn.00404f7d
mov eax, dword [ebp - 0x80]
jmp 0x40d549
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x22c]
pop edi
xor ecx, ebp
pop esi
call fcn.00429649
add ebp, 0x230
leave
ret 0x10
Function at 0x40d878
Capabilities:
Accept command line arguments

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 8]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x9c]
cmp eax, ebx
je 0x40d8b4
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 8], ebx
mov dword [esi + 4], ebx
push 0x103
lea eax, [ebp - 0x73]
push ebx
push eax
mov dword [ebp - 0x80], ebx
mov byte [ebp - 0x74], bl
call fcn.00429d40
add esp, 0xc
cmp edi, ebx
jne 0x40d8d8
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalAlloc]
lea eax, [eax*4 + 4]
push eax
push 0x40
call ebx
push edi
push eax
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [ebp - 0x7c]
call dword [sym.imp.USER32.dll_CharUpperA]
push 0x104
lea eax, [ebp - 0x74]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [edi], 0
lea eax, [ebp - 0x74]
je 0x40d921
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x78], eax
lea eax, [ebp - 0x80]
push eax
lea edi, [esi + 4]
push edi
push 0
push 0
push dword [ebp - 0x78]
mov ecx, esi
call fcn.0040d660
mov eax, dword [edi]
mov ecx, dword [ebp - 0x80]
lea eax, [ecx + eax*4 + 4]
push eax
push 0x40
call ebx
mov dword [esi + 8], eax
test eax, eax
jne 0x40d95b
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x40d97d
lea ecx, [ebp - 0x80]
push ecx
mov ecx, dword [edi]
push edi
lea ecx, [eax + ecx*4]
push ecx
push eax
push dword [ebp - 0x78]
mov ecx, esi
call fcn.0040d660
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x90]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429649
add ebp, 0x94
leave
ret 4

Function at 0x40dd25
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [esi], 0
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40dd7f
cmp dword [ebp + 0x10], 1
je 0x40dd64
cmp dword [ebp + 0x10], 2
je 0x40dd64
push 0xd
pop eax
jmp 0x40dd7f
mov eax, dword [ebp - 4]
test edi, edi
je 0x40dd7b
test eax, eax
je 0x40dd78
cmp byte [eax + edi - 1], 0
je 0x40dd7b
jmp 0x40dd5f
mov byte [edi], 0
mov dword [esi], eax
xor eax, eax
pop edi
pop esi
leave
ret 0xc
Function at 0x40e0aa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x94], eax
push ebx
mov ebx, dword [ebp + 0xa0]
push esi
push edi
mov esi, 0x45f7fc
mov edi, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x74]
push eax
push 0x20019
movsd dword es:[edi], dword [esi]
xor esi, esi
push esi
push str.CLSIDCAA2D3B1_4BB5_4a45_A17A_122773379D99
push SysReAllocStringLen
mov dword [ebp - 0x7c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e150
push 0x103
mov byte [ebp - 0x70], al
lea eax, [ebp - 0x6f]
push esi
push eax
call fcn.00429d40
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
mov dword [ebp - 0x78], esi
mov esi, dword [ebp - 0x7c]
push dword [esi + 0x10]
mov dword [ebp - 0x80], 0x104
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e147
push ebx
lea eax, [ebp - 0x70]
push eax
mov ecx, esi
call fcn.0040df9b
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x94]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00429649
add ebp, 0x98
leave
ret 4

Function at 0x40e16c
Capabilities:
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x98], eax
push ebx
push esi
push edi
lea esi, [ebp + 0xa4]
lea edi, [ebp - 0x7c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x103
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x6b]
push 0
push eax
mov ebx, ecx
movsd dword es:[edi], dword [esi]
mov byte [ebp - 0x6c], 0
call fcn.00429d40
add esp, 0xc
push 0x104
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x7c]
push eax
mov ecx, ebx
call fcn.0040df48
test eax, eax
je 0x40e227
lea eax, [ebp - 0x80]
push eax
mov edi, str.CLSIDCAA2D3B1_4BB5_4a45_A17A_122773379D99
push edi
mov esi, SysReAllocStringLen
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40e1f2
lea eax, [ebp - 0x80]
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x40e227
lea eax, [ebp - 0x6c]
xor esi, esi
push eax
inc esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push 0
push dword [ebx + 0x10]
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40e21a
xor esi, esi
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x40e229
xor eax, eax
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00429649
add ebp, 0x9c
leave
ret 0x10
Function at 0x40e3af
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x88], eax
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x7f]
push 0
push eax
mov byte [ebp - 0x80], 0
call fcn.00429d40
add esp, 0xc
push esi
push edi
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 0x5c
lea eax, [ebp - 0x80]
push eax
jmp 0x40e40d
push 0
lea eax, [ebp - 0x80]
push eax
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call fcn.0042df84
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x40e3f7
mov ecx, dword [ebp + 0x88]
xor ecx, ebp
pop esi
call fcn.00429649
add ebp, 0x8c
leave
ret

Function at 0x40e44b
Capabilities:
Get file version info

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x90], eax
push ebx
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x73]
push ebx
push eax
mov byte [ebp - 0x74], bl
call fcn.00429d40
add esp, 0xc
push str.WININET.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x7c], ebx
cmp eax, ebx
jne 0x40e494
xor eax, eax
jmp 0x40e4e7
push 0x104
lea ecx, [ebp - 0x74]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x40e490
push esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
ja 0x40e4c0
xor eax, eax
jmp 0x40e4e6
push edi
push esi
call fcn.00429ad5
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x7c]
lea eax, [ebp - 0x74]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40e4fd
push edi
call fcn.0042892c
pop ecx
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp + 0x90]
xor ecx, ebp
pop ebx
call fcn.00429649
add ebp, 0x94
leave
ret
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x45d730
push edi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x80], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40e527
xor esi, esi
push edi
call fcn.0042892c
pop ecx
mov eax, esi
jmp 0x40e4e5
mov eax, dword [ebp - 0x78]
movzx esi, word [eax + 0xa]
jmp 0x40e51c
Function at 0x40e530
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xa0
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
mov esi, 0x9c
push esi
xor edi, edi
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.00429d40
add esp, 0xc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push eax
call esi
test eax, eax
jne 0x40e580
lea eax, [ebp - 0x28]
push eax
mov dword [ebp - 0x28], 0x94
call esi
test eax, eax
je 0x40e5be
mov eax, dword [ebp - 0x18]
sub eax, edi
je 0x40e5be
dec eax
je 0x40e5fb
dec eax
jne 0x40e5be
push 5
pop eax
cmp dword [ebp - 0x24], eax
jne 0x40e5d2
cmp dword [ebp - 0x20], edi
jne 0x40e59e
push 4
jmp 0x40e5c0
cmp dword [ebp - 0x20], 1
jne 0x40e5b8
mov eax, 0x200
test word [ebp + 0x70], ax
push 0
pop eax
setne al
add eax, 0x3d
jmp 0x40e5c1
cmp dword [ebp - 0x20], 2
je 0x40e5c1
push 0x64
pop eax
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.00429649
add ebp, 0x78
leave
ret
cmp dword [ebp - 0x24], 6
jne 0x40e5be
cmp dword [ebp - 0x20], edi
jne 0x40e5f1
mov eax, 0x200
test word [ebp + 0x70], ax
push 0
pop eax
setne al
add eax, 0x47
jmp 0x40e5c1
cmp dword [ebp - 0x20], 1
jne 0x40e5be
push 8
jmp 0x40e5c0
cmp dword [ebp - 0x24], 4
jne 0x40e5be
cmp dword [ebp - 0x20], edi
jne 0x40e60b
xor eax, eax
inc eax
jmp 0x40e5c1
cmp dword [ebp - 0x20], 0xa
jne 0x40e615
push 2
jmp 0x40e5c0
cmp dword [ebp - 0x20], 0x5a
jne 0x40e5be
push 3
jmp 0x40e5c0

Function at 0x40e66b
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 0x64]
test eax, eax
jne 0x40e673
ret
push eax
mov dword [ecx + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_SuspendThread]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x40e786
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e79e
test al, 0x10
je 0x40e79e
xor eax, eax
inc eax
jmp 0x40e7a0
xor eax, eax
ret 4

Function at 0x40e7a3
Capabilities:
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x46a470]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push 0
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40e7ef
xor eax, eax
jmp 0x40e84b
mov eax, 0x5a4d
cmp ax, word [ebp - 0x404]
jne 0x40e7eb
mov eax, dword [ebp - 0x3c8]
cmp dword [ebp + eax - 0x404], 0x4550
jne 0x40e7eb
lea eax, [ebp + eax - 0x400]
movzx edx, word [eax + 2]
xor ecx, ecx
cmp cx, dx
jae 0x40e848
lea ecx, [eax + 0x104]
movzx edi, dx
mov eax, dword [ecx + 4]
add eax, dword [ecx]
xor edx, edx
cmp edx, dword [esi + 4]
jb 0x40e842
ja 0x40e83d
cmp eax, dword [esi]
jbe 0x40e842
mov dword [esi], eax
mov dword [esi + 4], edx
add ecx, 0x28
dec edi
jne 0x40e82b
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00429649
leave
ret 8
Function at 0x40e85b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push dword [ebp + 8]
call fcn.00428940
push dword [ebp + 0xc]
mov esi, eax
call fcn.00428940
add esi, eax
lea eax, [esi + esi + 4]
push eax
call fcn.00429ad5
mov ebx, eax
xor esi, esi
add esp, 0xc
mov dword [ebp - 4], ebx
cmp ebx, esi
jne 0x40e896
xor eax, eax
jmp 0x40e925
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push dword [ebp + 8]
push str.__s___s
push eax
call fcn.0040dc40
push 0x44
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.00429d40
add esp, 0x1c
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x58], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push 0x10
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.00429d40
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push ebx
test eax, eax
jne 0x40e8fc
call fcn.0042acf4
pop ecx
jmp 0x40e88f
call fcn.0042acf4
pop ecx
cmp dword [ebp + 0x10], esi
je 0x40e912
push 0xffffffffffffffff
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x14]
call esi
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 0xc

Function at 0x40e92b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push esi
call fcn.0040e243
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ecx
xor ebx, ebx
push esi
call edi
cmp eax, 0xffffffff
je 0x40e961
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.0040e243
inc ebx
cmp ebx, 0xa
pop ecx
jl 0x40e941
push esi
call edi
inc eax
neg eax
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
ret 4

Function at 0x40f937
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esi + 0x70], 1
call fcn.00404d5c
mov ecx, esi
pop esi
jmp fcn.0040e64d