joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad700
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4caca0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.004a2528
mov eax, dword [0x4e6e48]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.004a245a
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.004ae1a0
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x4ad7a7
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4ad79e
cmp al, 0xff
je 0x4ad79e
dec al
mov byte [ecx], al
jmp 0x4ad7a7
push ecx
call fcn.004b7765
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x4ad7d8
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x4ad7cf
cmp al, 0xff
je 0x4ad7cf
dec al
mov byte [ecx], al
jmp 0x4ad7d8
push ecx
call fcn.004b7765
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x4b9eb5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4b9eed
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004b7ea2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004b7e7a
jmp 0x4b9ef9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4bb5a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4bb5ea
call fcn.004c1394
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4bb5ea
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4bb5e1
xor eax, eax
jmp 0x4bb5f2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004bb5f8
pop edi
pop esi
pop ebx
ret 4

Function at 0x4c18c4
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4c18f2
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4c1910
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004c182a
jmp 0x4c1910
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4c1910
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004c182a
test edi, edi
mov eax, edi
jne 0x4c18fa
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x41f015
Capabilities:
Packed with generic packer

Disassembly:
pushal
call 0x41f01b
mov ebp, dword [esp]
add esp, 4
cmp dword [esp + 0x28], 1
jne 0x41f034
mov eax, dword [esp + 0x24]
mov dword [ebp + 0x5d6], eax
jmp 0x41f040
mov eax, dword [ebp + 0x5d2]
mov dword [ebp + 0x5d6], eax
call fcn.0041f191
lea esi, [ebp + 0x5fe]
lea ebx, [ebp + 0x485]
xor edi, edi
call fcn.0041f1cf
jmp 0x41f075
mov eax, dword [ebp + 0x5d6]
push dword [edi + esi + 4]
add dword [esp], eax
push dword [edi + esi]
add dword [esp], eax
call ebx
add esp, 8
add edi, 8
cmp dword [edi + esi], 0
jne 0x41f05a
cmp dword [ebp + 0x5e2], 0
je 0x41f092
cmp dword [ebp + 0x5e6], 0
je 0x41f092
call fcn.0041f2a7
lea esi, [edi + esi + 4]
push ebx
push 0x40
push 0x1000
push 0x2b0
push 0
call dword [ebp + 0x56b]
mov dword [ebp + 0x5fa], eax
pop ebx
push dword [ebp + 0x5fa]
push esi
call ebx
add esp, 8
mov esi, dword [ebp + 0x5fa]
mov eax, esi
jmp 0x41f0c9
inc eax
cmp byte [eax], 1
jne 0x41f0c8
inc eax
mov edi, dword [eax]
add edi, dword [ebp + 0x5d6]
add eax, 4
mov dword [ebp + 0x5f6], eax
jmp 0x41f150
push esi
call dword [ebp + 0x563]
or eax, eax
jne 0x41f0f2
call fcn.0041f3fa
test eax, eax
je 0x41f18f
mov dword [ebp + 0x5f2], eax
mov eax, esi
jmp 0x41f12e
mov eax, dword [ebp + 0x5f6]
mov eax, dword [eax]
push eax
push dword [ebp + 0x5f2]
call fcn.0041f368
test eax, eax
je 0x41f18f
mov dword [edi], eax
add dword [ebp + 0x5f6], 4
add edi, 4
mov eax, dword [ebp + 0x5f6]
cmp dword [eax], 0
jne 0x41f104
jmp 0x41f136
inc esi
cmp byte [esi], 0
jne 0x41f135
inc esi
add eax, 4
mov edi, dword [eax]
add edi, dword [ebp + 0x5d6]
add eax, 4
mov dword [ebp + 0x5f6], eax
cmp byte [esi], 1
jne 0x41f0e2
push 0x4000
push 0x2b0
push dword [ebp + 0x5fa]
call dword [ebp + 0x56f]
push 0x8000
push 0
push dword [ebp + 0x5fa]
call dword [ebp + 0x56f]
call fcn.0041f223
call fcn.0041f323
popal
jmp 0x40de60
popal
ret

Function at 0x41f3b5
Capabilities:
Encode data using xor
Resolve function by parsing pe exports

Disassembly:
pushal
mov ebx, dword [esp + 0x24]
mov ecx, ebx
add ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + 0x78]
add ebx, ecx
mov edi, dword [ebx + 0x20]
add edi, ecx
xor esi, esi
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
xor eax, eax
rol eax, 7
xor al, byte [edx]
inc edx
cmp byte [edx], 0
jne 0x41f3d4
cmp eax, dword [esp + 0x28]
je 0x41f3eb
inc esi
cmp esi, dword [ebx + 0x18]
jb 0x41f3cb
lea edx, [edi + esi*4]
mov edx, dword [edx]
add edx, ecx
mov dword [esp + 0x1c], edx
popal
ret 8
Function at 0x401500
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x1a0
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x198], eax
push esi
lea eax, [esp + 8]
push eax
push 2
call sub.WS2_32.dll_WSAStartup
test eax, eax
jne 0x40154d
mov eax, dword [0x4fd5d0]
test eax, eax
jne 0x401565
push str.inetmib1.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x4fd5d0], eax
cmp eax, 0x20
jae 0x401565
mov dword [0x4fd5d0], 0
xor al, al
pop esi
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00497c58
add esp, 0x1a0
ret
cmp dword [0x4fd5d4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
jne 0x401585
push str.SnmpExtensionInit
push eax
call esi
mov dword [0x4fd5d4], eax
test eax, eax
je 0x40154d
push 0x4fd5a4
push 0x4fd5a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call dword [0x4fd5d4]
cmp dword [0x4fd5d8], 0
jne 0x4015bc
mov ecx, dword [0x4fd5d0]
push str.SnmpExtensionInitEx
push ecx
call esi
mov dword [0x4fd5d8], eax
test eax, eax
je 0x40154d
cmp dword [0x4fd5dc], 0
jne 0x4015e0
mov edx, dword [0x4fd5d0]
push str.SnmpExtensionQuery
push edx
call esi
mov dword [0x4fd5dc], eax
test eax, eax
je 0x40154d
cmp dword [0x4fd5e0], 0
jne 0x401603
mov eax, dword [0x4fd5d0]
push str.SnmpExtensionTrap
push eax
call esi
mov dword [0x4fd5e0], eax
test eax, eax
je 0x40154d
mov ecx, dword [esp + 0x19c]
pop esi
xor ecx, esp
mov al, 1
call fcn.00497c58
add esp, 0x1a0
ret

Function at 0x401e30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x94
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x90], eax
mov eax, dword [esp + 0x9c]
mov dword [esp + 8], eax
push ebp
mov ebp, dword [esp + 0x9c]
xor eax, eax
push esi
cmp dword [edi + 0x120], eax
je 0x401e68
mov dword [edi + 0x120], eax
lea esi, [edi + 8]
mov ecx, 1
mov dword [edi + 4], eax
call fcn.004495a0
cmp byte [esi + 0x114], 0
je 0x401e86
add esi, 4
jmp 0x401e88
mov esi, dword [esi]
lea edx, [esp + 8]
push edx
xor ecx, ecx
push 1
push ecx
push ebx
mov word [esi + 4], cx
push ebp
mov dword [esp + 0x1c], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
pop esi
pop ebp
test eax, eax
jne 0x401f25
push 0x7e
push eax
lea ecx, [esp + 0x1a]
push ecx
mov word [esp + 0x1c], ax
call fcn.0049ca10
add esp, 0xc
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ecx
push 0
push edx
push eax
mov dword [esp + 0x24], 0x80
mov dword [esp + 0x1c], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401f1b
lea ecx, [esp + 0x10]
push ecx
push 0x4d65ac
mov edx, edi
call fcn.00448ff0
add esp, 8
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00497c58
add esp, 0x94
ret
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x90]
xor ecx, esp
call fcn.00497c58
add esp, 0x94
ret
Function at 0x403e80
Capabilities:
Compare security identifiers

Disassembly:
sub esp, 0x818
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x814], eax
lea eax, [esp]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403fb6
mov eax, dword [esp]
push ebx
lea ecx, [esp + 0xc]
push ecx
push 0x800
lea edx, [esp + 0x20]
push edx
push 2
xor ebx, ebx
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x403ef3
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor al, al
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.00497c58
add esp, 0x818
ret
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 8]
push edx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [esp + 0x38]
push eax
mov byte [esp + 0x3c], bl
mov byte [esp + 0x3d], bl
mov byte [esp + 0x3e], bl
mov byte [esp + 0x3f], bl
mov byte [esp + 0x40], bl
mov byte [esp + 0x41], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x403edb
push esi
xor esi, esi
cmp dword [esp + 0x1c], ebx
jle 0x403f92
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_EqualSid]
push edi
lea edi, [esp + 0x28]
nop
mov ecx, dword [edi]
mov edx, dword [esp + 0x14]
push ecx
push edx
call ebp
test eax, eax
jne 0x403f8e
inc esi
add edi, 8
cmp esi, dword [esp + 0x24]
jl 0x403f50
mov eax, dword [esp + 0x14]
pop edi
pop ebp
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.00497c58
add esp, 0x818
ret
pop edi
mov bl, 1
pop ebp
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop esi
mov al, bl
pop ebx
mov ecx, dword [esp + 0x814]
xor ecx, esp
call fcn.00497c58
add esp, 0x818
ret
mov ecx, dword [esp + 0x814]
xor ecx, esp
xor al, al
call fcn.00497c58
add esp, 0x818
ret
Function at 0x403fd0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
xor esi, esi
push eax
mov dword [esp + 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [esp + 0xc]
mov ebp, eax
push ebp
mov dword [0x4fd5f4], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
push ecx
lea esi, [esp + 0x18]
xor bl, bl
call fcn.00409960
cmp eax, 0xffffffff
je 0x404104
lea esp, [esp]
test bl, bl
jne 0x404104
add eax, 0xffffffc1
cmp eax, 0x38
ja case.0x40403b.64
movzx edx, byte [eax + 0x404178]
jmp dword [edx*4 + 0x40414c]
or dword [0x4fd5f4], 0x1000
or dword [edi], 0x1000
jmp case.0x40403b.64
or dword [0x4fd5f4], 1
or dword [edi], 1
jmp case.0x40403b.64
or dword [0x4fd5f4], 2
or dword [edi], 2
jmp case.0x40403b.64
or dword [0x4fd5f4], 4
or dword [edi], 4
jmp case.0x40403b.64
or dword [0x4fd5f4], 0x10
or dword [edi], 0x10
jmp case.0x40403b.64
or dword [0x4fd5f4], 0x100
or dword [edi], 0x100
jmp case.0x40403b.64
or dword [edi], 0x80
jmp case.0x40403b.64
or dword [0x4fd5f4], 0x200
or dword [edi], 0x200
jmp case.0x40403b.64
mov ecx, dword [esp + 0x20]
call fcn.00447720
mov esi, eax
push 0x4d5b4c
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
mov eax, dword [esp + 0x1c]
mov ecx, dword [ebp + eax*4 - 4]
push ecx
push 0x4d65ac
mov edx, esi
call fcn.00448ff0
add esp, 0x10
mov bl, 1
mov edx, dword [esp + 0xc]
push ebp
push edx
lea esi, [esp + 0x18]
call fcn.00409960
cmp eax, 0xffffffff
jne 0x404020
push ebp
call dword [sym.imp.KERNEL32.dll_LocalFree]
test bl, bl
je 0x404142
mov ecx, dword [esp + 0x20]
call fcn.00447720
push 0x4d5b58
push 0x4d65ac
mov edx, eax
call fcn.00448ff0
add esp, 8
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x10
ret
push ebp
mov dword [edi], 0x201
call dword [sym.imp.KERNEL32.dll_LocalFree]
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x10
ret
Function at 0x405380
Capabilities:
Get hostname
Resolve dns

Disassembly:
sub esp, 0x104
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
xor ebx, ebx
push 0xfe
lea eax, [esp + 9]
push ebx
push eax
mov byte [esp + 0x10], bl
call fcn.0049ca10
add esp, 0xc
push 0xff
lea ecx, [esp + 8]
push ecx
call sub.WS2_32.dll_gethostname
test eax, eax
jne 0x405424
lea edx, [esp + 4]
push edx
call sub.WS2_32.dll_gethostbyname
cmp eax, ebx
je 0x405424
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
cmp al, 0xa
je 0x40540c
mov edx, eax
and edx, 0xf0ff
cmp edx, 0x10ac
je 0x40540c
movzx eax, ax
cmp eax, 0xa8c0
je 0x40540c
xor al, al
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00497c58
add esp, 0x104
ret
mov al, 1
pop ebx
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00497c58
add esp, 0x104
ret
mov ecx, dword [esp + 0x104]
mov al, bl
pop ebx
xor ecx, esp
call fcn.00497c58
add esp, 0x104
ret

Function at 0x407350
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4073be
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x40738f
cmp eax, 2
jne 0x4073aa
mov eax, dword [esp]
test esi, esi
je 0x4073b8
test eax, eax
je 0x4073b3
test al, 1
jne 0x4073aa
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x4073b8
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x408080
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4b9e36
mov eax, dword fs:[0]
push eax
sub esp, 0x334
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x330], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4f36a0]
xor eax, esp
push eax
lea eax, [esp + 0x348]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x358]
mov ecx, ebp
call fcn.00443d50
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x146]
push ecx
mov word [esp + 0x148], ax
call fcn.0049ca10
add esp, 0xc
lea edx, [esp + 0x13c]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jbe 0x4081f7
lea eax, [esp + 0x13c]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408110
sub eax, edx
sar eax, 1
cmp word [esp + eax*2 + 0x13a], 0x5c
jne 0x40814d
lea eax, [esp + 0x13c]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408134
sub eax, edx
sar eax, 1
xor ecx, ecx
mov word [esp + eax*2 + 0x13a], cx
lea ecx, [esp + 0x18]
call fcn.00448930
lea ebx, [esp + 0x13c]
mov edx, ebx
test edx, edx
jne 0x408168
mov ebx, 0x4d6464
mov eax, ebx
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408170
sub eax, edx
sar eax, 1
lea edi, [eax + 1]
mov ecx, edi
lea esi, [esp + 0x20]
mov dword [esp + 0x1c], eax
call fcn.004495a0
cmp byte [esp + 0x134], 0
lea eax, [esp + 0x24]
jne 0x4081a3
mov eax, dword [esp + 0x20]
lea ecx, [edi + edi]
push ecx
add eax, 4
push ebx
push eax
call fcn.0049c670
add esp, 0xc
cmp byte [esp + 0x134], 0
lea eax, [esp + 0x24]
jne 0x4081c6
mov eax, dword [esp + 0x20]
add eax, 4
mov edx, ebp
call fcn.00448b50
cmp byte [esp + 0x134], 0
mov dword [esp + 0x18], vtable.t_str.0
jne 0x4081f7
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x24]
cmp eax, edx
je 0x4081f7
push eax
call fcn.00498f5b
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x348]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x330]
xor ecx, esp
call fcn.00497c58
add esp, 0x340
ret 4
Function at 0x4083d0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x250
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
mov ebp, dword [esp + 0x25c]
push esi
mov esi, ecx
cmp byte [esi + 0x11c], 0
lea eax, [esi + 0xc]
jne 0x4083ff
mov eax, dword [esi + 8]
lea ecx, [esp + 0x18]
push ecx
add eax, 4
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
jbe 0x408544
push edi
push ebx
call fcn.00498670
add esp, 4
cmp byte [esi + 0x11c], 0
mov edi, eax
je 0x408431
add esi, 0xc
jmp 0x408434
mov esi, dword [esi + 8]
push edi
push ebx
push 0
add esi, 4
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40853a
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x14]
push eax
push 0x4d6528
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40853a
push 0x30
lea ecx, [esp + 0x28]
push 0
push ecx
mov dword [esp + 0x2c], 0
call fcn.0049ca10
mov edx, dword [esp + 0x1c]
push 0x34
push edx
lea eax, [esp + 0x34]
push 0x34
push eax
call fcn.00498360
add esp, 0x1c
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
push 0x4d652c
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40853a
mov edx, dword [esp + 0x10]
push 4
xor eax, eax
push edx
mov word [esp + 0x1c], ax
lea eax, [esp + 0x1c]
xor ecx, ecx
push 4
push eax
mov word [esp + 0x26], cx
call fcn.00498360
xor ecx, ecx
push 0x206
push ecx
lea edx, [esp + 0x6e]
push edx
mov word [esp + 0x70], cx
call fcn.0049ca10
movzx eax, word [esp + 0x32]
movzx ecx, word [esp + 0x30]
push eax
push ecx
push str.StringFileInfo_04x_04xFileVersion
lea edx, [esp + 0x7c]
push 0x104
push edx
call fcn.00497cff
add esp, 0x30
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x5c]
push edx
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x268]
push eax
push 0x4d65ac
push ecx
push ebp
call fcn.00497cff
add esp, 0x10
push edi
call fcn.00498355
add esp, 4
pop edi
mov ecx, dword [esp + 0x258]
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00497c58
add esp, 0x250
ret
Function at 0x409ab0
Capabilities:
Access firewall settings via inetfwmgr

Disassembly:
sub esp, 8
push esi
lea eax, [esp + 8]
push eax
push 0x4dbd40
push 1
push 0
push 0x4dbd30
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [edi], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
test esi, esi
jl 0x409b0f
mov eax, dword [esp + 8]
mov ecx, dword [eax]
lea edx, [esp + 4]
push edx
push eax
mov eax, dword [ecx + 0x1c]
call eax
mov esi, eax
test esi, esi
jl 0x409b0f
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push edi
push eax
call edx
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x409b1f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
test eax, eax
je 0x409b2f
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x40a2e0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x110
lea eax, [esp + 8]
push 0
push eax
call fcn.0049ca10
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x40a34a
mov eax, dword [esp + 4]
cmp eax, 5
jae 0x40a333
cmp eax, 4
jne 0x40a34a
cmp dword [esp + 8], 0x5a
jb 0x40a34a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.00497c58
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.00497c58
add esp, 0x118
ret
Function at 0x40af10
Capabilities:
Create thread
Hide graphical window

Disassembly:
sub esp, 8
cmp byte [edi + 0x6fa], 0
push ebp
push esi
jne 0x40b046
cmp dword [edi + 0x7e4], 0
je 0x40b036
cmp byte [esp + 0x14], 0
lea ebp, [edi + 0x6b4]
push ebp
je 0x40af83
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 0x7e4]
call fcn.00423b20
mov ecx, dword [edi + 4]
push 0
push 0
push 0x10
push ecx
mov dword [edi + 0x7e4], 0
call dword [sym.imp.USER32.dll_PostMessageW]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
add esp, 8
ret 4
mov dword [esp + 0xc], ebp
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov edx, dword [edi + 0x7e4]
cmp byte [edx + 0x88], 0
mov byte [esp + 0xc], 1
jne 0x40afcd
mov eax, dword [edi + 4]
push 4
push 0x4dbda0
push str._fTnx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
je 0x40afcd
lea ecx, [esp + 8]
call fcn.0040e260
pop esi
pop ebp
add esp, 8
ret 4
mov ecx, dword [edi + 4]
push 0
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [edi + 0x7e4]
call fcn.00423b20
mov eax, dword [edi + 0x804]
push 0
push 0
push eax
push 0x40fbc0
push 0
push 0
mov dword [edi + 0x7e4], 0
call fcn.00499be7
mov edx, dword [edi + 4]
add esp, 0x18
push 0
push 0
push 0x10
push edx
mov esi, eax
call dword [sym.imp.USER32.dll_PostMessageW]
test esi, esi
je 0x40b027
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebp
add esp, 8
ret 4
mov eax, dword [edi + 4]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
pop ebp
add esp, 8
ret 4

Function at 0x40b0c0
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
cmp eax, 2
jne 0x40b0f2
mov eax, dword [edi + 4]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 4]
push 0
push 0
push 0x10
push ecx
mov dword [edi + 0x7e4], 0
call dword [sym.imp.USER32.dll_PostMessageW]
xor eax, eax
pop edi
ret
test eax, eax
setne dl
movzx eax, dl
push eax
call fcn.0040af10
xor eax, eax
pop edi
ret

Function at 0x40b1a0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x14
cmp dword [esi + 0x6ac], 0
je 0x40b1f6
mov eax, dword [esi + 0x5c]
push 5
push eax
mov dword [esi + 0x6ac], 0
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi + 0x5c]
lea ecx, [esp]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 4]
mov ecx, dword [esp + 8]
sub ecx, dword [esp]
mov edx, dword [esi + 4]
push 0x12
add eax, 0x29
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
add esp, 0x14
ret
Function at 0x40b940
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, dword [eax + 0x7e4]
cmp dword [esi + 0x28], 1
lea eax, [esi + 0x28]
jne 0x40b97a
push 0
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
mov ecx, dword [esi + 0x40]
test ecx, ecx
je 0x40b970
call fcn.0040d7c0
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
ret

Function at 0x40b980
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x3b0
mov eax, dword [0x4f36a0]
xor eax, esp
mov dword [esp + 0x3ac], eax
mov eax, dword [esp + 0x3b4]
cmp eax, 0x203
je 0x40b9b0
cmp eax, 0x201
je 0x40b9b0
cmp eax, 0x405
jne 0x40b9f3
mov eax, dword [esi + 4]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x3a4
lea ecx, [esp + 8]
push 0
push ecx
call fcn.0049ca10
mov edx, dword [esi + 4]
add esp, 0xc
lea eax, [esp]
push eax
push 2
mov dword [esp + 8], 0x3a8
mov dword [esp + 0xc], edx
mov dword [esp + 0x10], 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov ecx, dword [esp + 0x3ac]
xor ecx, esp
xor eax, eax
call fcn.00497c58
add esp, 0x3b0
ret 4