joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1008ceb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x100e6f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov eax, 0x5a4d
cmp ax, word [edx]
jne 0x1008cefd
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x1008cefd
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x1008cefd
mov edx, dword [ebp + 8]
cmp dword [eax], edx
je 0x1008cf0d
add eax, 4
cmp eax, ecx
jb 0x1008cef2
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100aafe0
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp + 0x1c]
test cl, cl
je 0x1008cf1d
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x1008cf23
mov word [ebp - 0xc], 0x15ff
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0xa], eax
je 0x1008cf8a
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 0x14]
add edi, 0xfffffffa
cmp edi, ebx
jb 0x1008cf75
mov esi, edi
lea eax, [ebp - 0xc]
sub esi, eax
xor eax, eax
lea ecx, [ebp - 0xc]
add ecx, eax
mov dl, byte [ecx]
cmp dl, byte [esi + ecx]
je 0x1008cf56
cmp dl, 0x11
jne 0x1008cf6f
inc eax
cmp eax, 6
jl 0x1008cf45
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100aafe0
mov esp, ebp
pop ebp
ret
dec edi
dec esi
cmp edi, ebx
jae 0x1008cf43
xor edi, edi
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100aafe0
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
push dword [ebp + 0x10]
push 6
push eax
call fcn.1008d680
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
call fcn.100aafe0
mov esp, ebp
pop ebp
ret

Function at 0x1008cfb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100e6f80]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
mov eax, 0x5a4d
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0xc], esi
cmp ax, word [edx]
jne 0x1008d00b
mov ecx, dword [edx + 0x3c]
cmp dword [ecx + edx], 0x4550
jne 0x1008d00b
mov eax, dword [ecx + edx + 0xd8]
mov ecx, dword [ecx + edx + 0xdc]
add eax, edx
add ecx, eax
cmp eax, ecx
jae 0x1008d00b
mov edx, dword [ebp + 0xc]
nop dword [eax]
cmp dword [eax], edx
je 0x1008d030
add eax, 4
cmp eax, ecx
jb 0x1008d000
mov dword [esi], 0
mov eax, esi
mov dword [esi + 4], 0
mov dword [esi + 8], 0
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100aafe0
mov esp, ebp
pop ebp
ret
mov cl, byte [ebp + 0x20]
test cl, cl
je 0x1008d040
mov byte [ebp - 0xc], 0x8b
mov byte [ebp - 0xb], cl
jmp 0x1008d046
mov word [ebp - 0xc], 0x15ff
push dword [ebp + 0x18]
mov dword [ebp - 0xa], eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push dword [ebp + 0x1c]
push 6
push eax
push esi
call fcn.1008ca60
mov ecx, dword [ebp - 4]
add esp, 0x18
mov eax, esi
xor ecx, ebp
pop esi
call fcn.100aafe0
mov esp, ebp
pop ebp
ret
Function at 0x1008d760
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.1008d6b0
add esp, 0x18
test eax, eax
je 0x1008d789
inc eax
cmp byte [eax], 0xcc
je 0x1008d783
pop ebp
ret

Function at 0x1008d990
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0xcccc
push dword [ebp + 8]
call fcn.1008d8d0
add esp, 0x18
test eax, eax
je 0x1008d9b9
inc eax
cmp byte [eax], 0xcc
je 0x1008d9b3
pop ebp
ret

Function at 0x10090a90
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10090c40
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10090b5d
mov edx, dword [ebp - 4]
cmp edx, dword [0x100e6f40]
jb 0x10090ada
mov eax, dword [ebp - 4]
cmp eax, dword [0x100e6f44]
ja 0x10090ada
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10090aaa
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10090b00
jmp 0x10090b5d
cmp dword [ebp - 0x14], 0x10000
jne 0x10090b43
cmp dword [ebp - 0x18], 0x10000
jb 0x10090b43
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10090b36
mov eax, dword [ebp - 8]
jmp 0x10090b5f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10090b58
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10090c40
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10090aaa
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10090b70
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10090c70
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10090c35
mov edx, dword [ebp - 4]
cmp edx, dword [0x100e6f40]
jb 0x10090bb5
mov eax, dword [ebp - 4]
cmp eax, dword [0x100e6f44]
ja 0x10090bb5
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10090b85
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10090bdb
jmp 0x10090c35
cmp dword [ebp - 0x14], 0x10000
jne 0x10090c1e
cmp dword [ebp - 0x18], 0x10000
jb 0x10090c1e
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10090c11
mov eax, dword [ebp - 8]
jmp 0x10090c37
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10090c30
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10090c70
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10090b85
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100ac200
Capabilities:
Get process heap force flags

Disassembly:
call fcn.100ac130
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x100ac22a
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x100ac236
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x100ac240
Capabilities:
Get process heap force flags

Disassembly:
call fcn.100ac130
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x100ac26a
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x100ac4d0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x100e6f80]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x100ac4f7
mov ecx, 5
int 0x29
push 2
call fcn.100aba7d
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x100ac602
test esi, esi
jne 0x100ac602
push 2
call fcn.100aba7d
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100aafe0
mov esp, ebp
pop ebp
ret
Function at 0x100b66e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.1001d2e0
mov esi, dword [ebp + 8]
test al, al
je 0x100b66fe
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.100b6710
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100bab60
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100bab8d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100bab8d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4032a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
lea eax, [eax + eax*8 + 0x414]
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
lea esi, [ecx + eax*4]
mov ebx, 9
lea esp, [esp]
mov ecx, dword [esi - 0x120]
push 0
push ecx
call edi
mov edx, dword [esi]
push 0
push edx
call edi
add esi, 4
dec ebx
jne 0x4032c0
pop edi
pop esi
pop ebx
ret 4

Function at 0x403920
Capabilities:
Identify system language via api

Disassembly:
push esi
push str..AutoPlayLangData_
push 0x425d88
call fcn.00410eec
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test ax, ax
jne 0x40394c
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, eax
and ecx, 0x3ff
dec ecx
cmp ecx, 0x3e
ja case.0x403965.3
movzx edx, byte [ecx + 0x403bdc]
jmp dword [edx*4 + 0x403b50]
and eax, 0xfc00
cmp eax, 0x400
jne 0x403982
push 0x41ef44
jmp 0x403b28
push 0x41ef38
jmp 0x403b28
push 0x41ef2c
jmp 0x403b28
push 0x41ef20
jmp 0x403b28
push 0x41ef14
jmp 0x403b28
and eax, 0xfc00
cmp eax, 0x800
jne 0x4039c0
push 0x41ef08
jmp 0x403b28
push 0x41eefc
jmp 0x403b28
and eax, 0xfc00
cmp eax, 0xc00
jne 0x4039e0
push 0x41eef0
jmp 0x403b28
push 0x41eee4
jmp 0x403b28
push 0x41eed8
jmp 0x403b28
push 0x41eecc
jmp 0x403b28
push 0x41eec0
jmp 0x403b28
push 0x41eeb4
jmp 0x403b28
and eax, 0xfc00
cmp eax, 0x400
jne 0x403a28
push 0x41eea8
jmp 0x403b28
push 0x41ee9c
jmp 0x403b28
and eax, 0xfc00
cmp eax, 0x800
jne 0x403a48
push 0x41ee90
jmp 0x403b28
push 0x41ee84
jmp 0x403b28
push 0x41ee78
jmp 0x403b28
push 0x41ee6c
jmp 0x403b28
push 0x41ee60
jmp 0x403b28
push 0x41ee54
jmp 0x403b28
push 0x41ee48
jmp 0x403b28
push 0x41ee3c
jmp 0x403b28
push 0x41ee30
jmp 0x403b28
push 0x41ee24
jmp 0x403b28
push 0x41ee18
jmp 0x403b28
push 0x41ee0c
jmp 0x403b28
push 0x41ee00
jmp 0x403b28
push 0x41edf4
jmp 0x403b28
push 0x41ede8
jmp 0x403b28
push 0x41eddc
jmp 0x403b28
push 0x41edd0
jmp 0x403b28
cmp esi, 0x41a
je 0x403af2
cmp esi, 0x409
je 0x403af2
cmp esi, 0x81a
jne case.0x403965.3
push 0x41edc4
jmp 0x403b28
push 0x41edb8
jmp 0x403b28
push 0x41edac
jmp 0x403b28
push 0x41eda0
jmp 0x403b28
push 0x41ed94
jmp 0x403b28
push 0x41ed88
jmp 0x403b28
push 0x41ed7c
jmp 0x403b28
push 0x41ed70
jmp 0x403b28
push str.xx_XX
push 0x425d88
call fcn.00410ec2
add esp, 8
push str.lang.dat
push 0x425d88
call fcn.00410ec2
add esp, 8
mov eax, 0x425d88
pop esi
ret
Function at 0x404850
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x1c
mov eax, dword [ecx + 0x4f4]
mov ecx, dword [ecx + 0x4f0]
push ebx
push ebp
push esi
push edi
add eax, 5
push eax
add ecx, 5
push ecx
push 0
push 0
lea edx, [esp + 0x2c]
push edx
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
push edx
push edi
mov esi, eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
mov ebx, eax
push ebx
push esi
mov dword [esp + 0x1c], ebx
call ebp
mov ecx, dword [esp + 0x24]
push 0xff0062
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x2c]
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_PatBlt]
mov eax, dword [esp + 0x34]
test eax, eax
je 0x404929
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edx, dword [esp + 0x34]
mov ebx, eax
push edx
push ebx
call ebp
mov ecx, dword [esp + 0x24]
push 0xcc0020
push 0
push 0
push ebx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x38]
push eax
push ecx
push 0
push 0
push esi
call dword [sym.imp.GDI32.dll_BitBlt]
mov edx, dword [esp + 0x10]
push edx
push ebx
call ebp
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov eax, dword [esp + 0x34]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
push ecx
push esi
call ebp
push esi
call dword [sym.imp.GDI32.dll_DeleteDC]
mov edx, dword [esp + 0x30]
push edi
push edx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
add esp, 0x1c
ret 8
Function at 0x405fc0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
push esi
push edi
mov esi, ecx
xor eax, eax
push eax
mov ecx, 0x82
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push str.INTRO_SCREEN
push str._ConfigInfo_
call fcn.0040af90
mov ecx, eax
call fcn.0040bd70
test al, al
je 0x406045
lea ecx, [esp + 0x210]
push str..AutoPlayResData_
push ecx
call fcn.00410eec
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x21c]
push eax
call fcn.00410ec2
add esp, 0x10
push 0xa010
push 0
push 0
push 0
lea ecx, [esp + 0x220]
push ecx
push 0
call dword [0x425d60]
mov dword [esi + 0xe98], eax
mov edx, dword [esi + 0xe98]
mov eax, dword [esi + 0xe94]
push edx
push eax
mov ecx, esi
call fcn.00404850
test eax, eax
mov dword [esi + 0xe98], eax
je 0x406088
mov ecx, dword [esi + 0xe94]
push eax
push 0
push 0xf7
push ecx
call dword [0x425d70]
mov edx, dword [esi + 0xe94]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40a290
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xe7c]
test eax, eax
jne 0x409ad2
call fcn.00402f60
cmp dword [esi + 0xe7c], 1
jne 0x409ae9
mov ecx, esi
call fcn.00403070
mov byte [esi + 0x80da8], 1
mov al, byte [esi + 0xe80]
test al, al
je 0x409b23
mov eax, dword [0x423050]
test eax, eax
jne 0x409b15
call fcn.00409b70
mov ecx, 0x4a70b8
call fcn.0040b960
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x409b23
mov eax, dword [esi + 0xf18]
push eax
mov ecx, esi
call fcn.00406090
cmp dword [esi + 0xe74], 0xffffffff
je 0x409b54
push edi
mov edi, dword [0x423050]
call fcn.00409b70
mov ecx, dword [eax]
lea edx, [edi + edi*8 + 0x3cc]
add edx, dword [esi + 0xe74]
mov eax, dword [esi + edx*4]
push ecx
push eax
mov ecx, esi
call fcn.00409590
pop edi
pop esi
ret
mov eax, dword [0x42619c]
test eax, eax
jne 0x40a2a3
mov ecx, 0x4261a8
jmp fcn.004011f0
mov eax, dword [esp + 8]
add eax, 0xfffffff7
cmp eax, 0x17
ja case.0x40a2b6.10
movzx eax, byte [eax + 0x40a30c]
jmp dword [eax*4 + 0x40a2fc]
push 0
mov ecx, 0x4261a8
call fcn.00403210
ret
mov ecx, 0x4261a8
jmp 0x409ac0
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x4261a8
push 9
and eax, 0xffff8000
test ax, ax
jne 0x40a2f3
call fcn.00408100
ret
call fcn.00408990
ret
Function at 0x40e690
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x310
push ebx
push ebp
push esi
push edi
push 0
lea eax, [esp + 0x224]
push eax
push str.MAIN_FILE_VERSION
push str._AutoPlay_
mov edi, ecx
mov bl, 1
mov dword [esp + 0x24], 8
call fcn.0040af90
mov ecx, eax
call fcn.0040bd70
test al, al
mov esi, dword [0x425d64]
jne 0x40e6e2
push 0x40
push str.Error
push str.MAIN_FILE_VERSION
push 0
call esi
xor bl, bl
push 0
lea ecx, [esp + 0x124]
push ecx
push str.PRODUCT_REGISTRY_PARENT
push str._Product_
call fcn.0040af90
mov ecx, eax
call fcn.0040bd70
test al, al
jne 0x40e718
push 0x40
push str.Error
push str.PRODUCT_REGISTRY_PARENT
push 0
call esi
xor bl, bl
push 0
lea edx, [esp + 0x24]
push edx
push str.PRODUCT_REGISTRY_KEY
push str._Product_
call fcn.0040af90
mov ecx, eax
call fcn.0040bd70
test al, al
jne 0x40e75a
push 0x40
push str.Error
push str.PRODUCT_REGISTRY_KEY
push 0
call esi
pop edi
pop esi
xor bl, bl
pop ebp
mov al, bl
pop ebx
add esp, 0x310
ret 4
test bl, bl
je 0x40e849
lea eax, [esp + 0x120]
push eax
mov ecx, edi
call fcn.0040e4d0
mov ebp, eax
test ebp, ebp
jne 0x40e795
push 0x40
push str.Error
push str.PRODUCT_REGISTRY_PARENT
push eax
call esi
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x310
ret 4
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
lea edx, [esp + 0x2c]
push edx
push ebp
call dword [0x425cb4]
test eax, eax
jne 0x40e83f
mov al, byte [0x4a70d0]
test al, al
jne 0x40e7ec
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dl, byte [esp + 0x18]
xor ecx, ecx
cmp dl, 0x30
setne cl
lea esi, [edi + 2]
add ecx, 0x30
mov word [esi], cx
jmp 0x40e802
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea esi, [edi + 2]
push esi
push 0
push eax
call dword [0x425cbc]
test eax, eax
jne 0x40e842
cmp word [esi], 0x30
jne 0x40e842
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x324]
push str._auto
push edx
call fcn.00410d3c
add esp, 8
pop edi
neg eax
pop esi
sbb al, al
pop ebp
inc al
pop ebx
add esp, 0x310
ret 4
mov byte [edi], 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
add esp, 0x310
ret 4
Function at 0x4123dd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x4a8088], esi
push edi
jne 0x4123fd
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x4a8084], esi
mov byte [0x4a8080], al
jne 0x412463
mov ecx, dword [0x4a98ec]
test ecx, ecx
je 0x412444
mov eax, dword [0x4a98e8]
sub eax, 4
cmp eax, ecx
jmp 0x41243d
mov eax, dword [eax]
test eax, eax
je 0x41242f
call eax
mov eax, dword [0x4a98e8]
sub eax, 4
cmp eax, dword [0x4a98ec]
mov dword [0x4a98e8], eax
jae 0x412427
mov eax, 0x423034
mov esi, 0x42303c
cmp eax, esi
mov edi, eax
jae 0x412463
mov eax, dword [edi]
test eax, eax
je 0x41245c
call eax
add edi, 4
cmp edi, esi
jb 0x412454
mov eax, 0x423040
mov esi, 0x423048
cmp eax, esi
mov edi, eax
jae 0x412482
mov eax, dword [edi]
test eax, eax
je 0x41247b
call eax
add edi, 4
cmp edi, esi
jb 0x412473
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x41249c
push dword [ebp + 8]
mov dword [0x4a8088], 1
call fcn.00412343
pop ebp
ret
Function at 0x41257a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x420cd0
call fcn.00417bf0
mov edi, 0x94
mov eax, edi
call fcn.00410e00
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, dword [esi + 0x10]
mov dword [0x4a8048], ecx
mov eax, dword [esi + 4]
mov dword [0x4a8054], eax
mov edx, dword [esi + 8]
mov dword [0x4a8058], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x4a804c], esi
cmp ecx, 2
je 0x4125da
or esi, 0x8000
mov dword [0x4a804c], esi
shl eax, 8
add eax, edx
mov dword [0x4a8050], eax
xor esi, esi
push esi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x412615
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x412615
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x41262d
cmp eax, 0x20b
je 0x41261a
mov dword [ebp - 0x1c], esi
jmp 0x412641
cmp dword [ecx + 0x84], 0xe
jbe 0x412615
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x41263b
cmp dword [ecx + 0x74], 0xe
jbe 0x412615
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.00417b9c
pop ecx
test eax, eax
jne 0x41266d
cmp dword [0x4a8094], 1
jne 0x41265a
call fcn.004174c0
push 0x1c
call fcn.00417349
push 0xff
call fcn.00412343
pop ecx
pop ecx
call fcn.004172c1
mov dword [ebp - 4], esi
call fcn.00416bdf
test eax, eax
jge 0x412686
push 0x1b
call fcn.00412555
pop ecx
call fcn.00417ae3
mov dword [0x4a98e0], eax
call fcn.00417979
mov dword [0x4a8090], eax
call fcn.004178e3
test eax, eax
jge 0x4126ab
push 8
call fcn.00412555
pop ecx
call fcn.004176b0
test eax, eax
jge 0x4126bc
push 9
call fcn.00412555
pop ecx
push 1
call fcn.00412373
pop ecx
mov dword [ebp - 0x28], eax
cmp eax, esi
je 0x4126d2
push eax
call fcn.00412555
pop ecx
mov dword [ebp - 0x44], esi
lea eax, [ebp - 0x70]
push eax
call dword [0x425d0c]
call fcn.0041766a
mov dword [ebp - 0x20], eax
test byte [ebp - 0x44], 1
je 0x4126f3
movzx eax, word [ebp - 0x40]
jmp 0x4126f6
push 0xa
pop eax
push eax
push dword [ebp - 0x20]
push esi
push esi
call edi
push eax
call fcn.0040a680
mov edi, eax
mov dword [ebp - 0x2c], edi
cmp dword [ebp - 0x1c], esi
jne 0x412714
push edi
call fcn.0041249e
call fcn.004124c0
jmp 0x412746
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.00417c2b
ret