joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488ed8
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4b7194]
cmp dword [eax + 0x30], 0
je 0x488f82
cmp dword [ebx + 0x94], 0
jne 0x488f7c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x488e68
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x488f7c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x488f42
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x488f7c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.0041a9d0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x488f51
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x489ae4
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x489b19
push 0x100
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004049e8
jmp 0x489b26
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040494c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x48ab88
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x48abc9
mov eax, esi
call fcn.00471474
test al, al
je 0x48abc9
mov eax, dword [ebx + 0x84]
call fcn.00471170
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x48abc9
push 0
mov eax, dword [ebx + 0x84]
call fcn.00471170
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x48df28
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x2001f
push 0
push 0x48dfbc
push 0
mov eax, ebx
call fcn.00404dd4
push eax
mov eax, dword [ebp + 8]
push eax
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x48df97
mov eax, esi
call fcn.00404bd4
inc eax
push eax
mov eax, esi
call fcn.00404dd4
push eax
push 1
push 0
mov eax, edi
call fcn.00404dd4
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
test ebx, ebx
je 0x48dfb2
mov ecx, dword [0x4b45d0]
mov dl, 1
mov eax, dword [0x48c380]
call fcn.0040d214
call fcn.00404290
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4

Function at 0x491770
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
xor ebx, ebx
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x491784
mov ebx, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x491793
or ebx, 2
push 0x12
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4917a2
or ebx, 4
mov eax, ebx
pop ebx
ret
Function at 0x40a0f5
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x40dcb8
call fcn.0040a2f4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40a135
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40a135
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40a14d
cmp eax, 0x20b
je 0x40a13a
mov dword [ebp - 0x1c], ebx
jmp 0x40a161
cmp dword [ecx + 0x84], 0xe
jbe 0x40a135
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40a15b
cmp dword [ecx + 0x74], 0xe
jbe 0x40a135
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x410d50], 0xffffffff
or dword [0x410d54], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x410cf0]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x410cec]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x410d4c], eax
call fcn.0040a4a8
call fcn.0040a548
cmp dword [0x4102e0], ebx
jne 0x40a1c1
push fcn.0040a548
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0040a536
push 0x410024
push 0x410020
call sub.MSVCR71.dll__initterm
push 0x40a4ec
call fcn.0040a0e3
mov eax, dword [0x410ce8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x410ce4]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x40a215
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x41001c
push 0x410000
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40a293
cmp al, bl
je 0x40a23f
cmp dword [ebp - 0x20], ebx
jne 0x40a293
mov al, byte [esi]
cmp al, bl
je 0x40a24f
cmp al, 0x20
ja 0x40a24f
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40a23f
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x40a26b
movzx eax, word [ebp - 0x54]
jmp 0x40a26e
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.0040ab30
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x40a28b
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x40a2e8
cmp al, 0x22
jne 0x40a2a2
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x40a2b5
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x40a22d
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040a32f
ret
Function at 0x4e25e5
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push edi
mov edi, ecx
shr edi, 0x10
and ecx, 0xffff
cmp ebx, 1
jne 0x4e2631
mov eax, dword [ebp + 0xc]
movzx edx, byte [eax]
add ecx, edx
cmp ecx, 0xfff1
jb 0x4e2616
sub ecx, 0xfff1
add edi, ecx
cmp edi, 0xfff1
jb 0x4e2626
sub edi, 0xfff1
mov eax, edi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
jne 0x4e2641
lea eax, [esi + 1]
pop esi
pop edi
pop ebx
pop ebp
ret
cmp ebx, 0x10
jae 0x4e2680
test ebx, ebx
je 0x4e2655
movzx eax, byte [esi]
add ecx, eax
inc esi
add edi, ecx
dec ebx
jne 0x4e264a
cmp ecx, 0xfff1
jb 0x4e2663
sub ecx, 0xfff1
mov eax, 0x80078071
mul edi
shr edx, 0xf
mov eax, edx
shl eax, 4
sub eax, edx
add eax, edi
pop esi
shl eax, 0x10
pop edi
or eax, ecx
pop ebx
pop ebp
ret
cmp ebx, 0x15b0
jb 0x4e276b
mov eax, 0x5e6ea9af
mul ebx
shr edx, 0xb
mov dword [ebp + 8], edx
jmp 0x4e26a5
Function at 0x4ed5b5
Capabilities:
Encode data using xor

Disassembly:
cmpsd dword [esi], dword es:[edi]
or ebp, ecx
pushal
add eax, dword [0x7ac75f37]
mov edi, 0xf65fcb6a
neg byte [eax]
out 0xb3, al
push eax
neg byte [eax]
out 0xb3, al
push eax
cld
xchg dword [eax], ebx
adc eax, 0x50f686c0
inc ecx
add dword [edx], ebx
sahf
add byte [edi], ah
xor esp, eax
and esi, esp
dec esp
inc esp
jnp 0x4ed5a7
out dx, eax
xor eax, dword [esi - 0x3f7079ab]
cmpsd dword [esi], dword es:[edi]
pop ds
add dword [edi - 0x1b2fdf61], esi
sub dh, byte [esi]
retf 0xc800

Function at 0x4f8b95
Capabilities:
Encrypt data using rc4 prga

Disassembly:
in al, 0xe8
mov edi, 0xaaeb728e
jbe 0x4f8bae
inc byte [0x5e2c3140]
cmp dword [ebx - 0x24], 0x78
xlatb
xor eax, 0x613c60eb
popal
xchg ebp, eax
fbld tbyte [ebp - 0x74]
aad 0x16
inc edx
and al, 0xff
loop 0x4f8c21
in eax, dx
inc ecx
sub dword [eax - 0x572a085], 0xffffffd1
inc esp
fstp dword [edi + 0x60]
aaa
outsb dx, byte [esi]
inc ebx
xchg edx, eax
jbe 0x4f8c2c
adc edi, dword [edx + 0x16f23210]
xlatb
xchg ebp, eax
hlt
sbb eax, 0x934f1619
cwde
in al, 0x59
add byte [ebp + 0x6e71b0f], al
sbb esp, edi
push es
mov ch, 0x3f
nop
mov eax, dword [0x74319750]
xchg edi, eax
xor dword [edx - 0x71], esi
Function at 0x5e1e75
Capabilities:
Encode data using xor

Disassembly:
invalid
in al, 0xd
cld
xchg ebx, eax
cmp dh, byte [ecx]
jnp 0x5e1ecb
lodsd eax, dword [esi]
jne 0x5e1e37
test eax, 0x57cd4845
cli
aam 0xf8
hlt
outsd dx, dword [esi]
fistp qword [ecx]
inc edx
inc ecx
and bh, byte [esp - 0x61]
xor eax, 0x716505d5
jecxz 0x5e1f12
jno 0x5e1eb0
inc esp
enter 0x470b, 0xffffffffffffffa4
push ecx
mov ah, 0xa8
or edi, dword [ecx]
mov cl, 0xb8
xchg esp, eax
cmp ecx, dword [ecx + ebx - 0x42247f6a]
js 0x5e1ebe
xor byte [edi + 0x7f449f24], bl
sal dword [ebp + 0x34], 0xb1
pmulhw mm3, qword [ebx + ebx*2]
js 0x5e1f6b
and byte [edi], cl
xchg byte [ecx], bl
sub eax, 0x95575e85
daa
pop esp
dec edi
ror byte [eax + 0x133a1858], 1
call [ecx - 0x37941d8e]
jo 0x5e1ef5
or eax, 0x27fc4cf9
adc ecx, dword [edi]
cmp al, 0xc7
sahf
test ecx, edx
scasd eax, dword es:[edi]
cwde
xchg edi, eax
dec esi
pop ss
js 0x5e1f32
out 0x26, eax
xchg edi, eax
aad 0x7d
push es
mov edi, 0x6fb33cc8
and dh, byte [0xa5f2d5e8]
aam 0x35
adc dword [ebx + 0x61], esi
scasd eax, dword es:[edi]
xor eax, 0xaf617311
mov ah, 0x69
test byte [ebp + 0x64], dh
mov ebp, 0xb1b5fd94
jmp 0x22d6e583
sbb ah, dl
mov dh, byte [ecx]
invalid
Function at 0x402350
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [esp + 4]
push esi
mov esi, ecx
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0xc]
push edi
mov dword [esi + 0xdc], eax
mov eax, dword [esp + 0x1c]
mov dword [esi + 0xe0], ecx
mov ecx, dword [esp + 0x20]
mov dword [esi + 0x44], eax
mov al, byte [esp + 0x24]
mov dword [esi + 0x48], ecx
xor cl, cl
test al, al
mov dword [esi + 0x40], edx
mov byte [esi + 0x4c], al
mov byte [esp + 0xc], cl
jbe 0x4023b4
mov eax, dword [esp + 0xc]
and eax, 0xff
inc cl
mov byte [esp + 0xc], cl
mov edx, dword [esp + eax*8 + 0x28]
mov dword [esi + eax*8 + 0x50], edx
mov edx, dword [esp + eax*8 + 0x2c]
mov dword [esi + eax*8 + 0x54], edx
mov al, byte [esi + 0x4c]
cmp cl, al
jb 0x40238e
mov eax, dword [esi + 0x48]
mov ecx, dword [esp + 0x14]
inc eax
cmp ecx, eax
jae 0x4023c8
mov dword [esi + 0x104], ecx
jmp 0x4023ce
mov dword [esi + 0x104], eax
mov edi, dword [esi + 0x104]
mov ecx, dword [esi + 0x11c]
mov eax, edi
xor edx, edx
div ecx
mov dword [esi + 0x108], edi
test edx, edx
je 0x4023fa
mov eax, edi
xor edx, edx
div ecx
inc eax
imul eax, ecx
mov dword [esi + 0x104], eax
mov eax, dword [esi + 0x44]
xor edx, edx
div ecx
imul eax, ecx
cmp dword [esi + 0xd4], eax
jae 0x402412
mov dword [esi + 0xd4], eax
mov eax, dword [esi + 0x104]
mov edi, 1
cmp eax, 0x100000
mov dword [esi + 0x10c], edi
ja 0x402432
mov dword [esi + 0xd8], edi
jmp 0x40249b
cmp eax, 0x200000
ja 0x402445
mov dword [esi + 0xd8], 2
jmp 0x40249b
cmp eax, 0x400000
ja 0x402458
mov dword [esi + 0xd8], 4
jmp 0x40249b
cmp eax, 0x800000
ja 0x40246b
mov dword [esi + 0xd8], 8
jmp 0x40249b
cmp eax, 0x1000000
ja 0x40247e
mov dword [esi + 0xd8], 0x10
jmp 0x40249b
cmp eax, 0x2000000
ja 0x402491
mov dword [esi + 0xd8], 0x20
jmp 0x40249b
mov dword [esi + 0xd8], 0x40
mov eax, dword [esi + 0x124]
test eax, eax
jne 0x4024bb
mov ecx, esi
call fcn.00403290
mov eax, dword [esi + 0x20]
push edi
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_RedrawWindow]
pop edi
pop esi
ret 0x9c

Function at 0x405190
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x40b120
Capabilities:
Read file via mapping

Disassembly:
mov eax, dword [0x4130b8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x40b173
push str.PRf48PInfFile
push 0x838
push 0
push 4
push 0
push 0xffffffffffffffff
call esi
test eax, eax
mov dword [0x4130b8], eax
jne 0x40b160
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
push 0x838
push 0
push 0
push 6
push eax
call edi
mov dword [0x412fc4], eax
mov eax, dword [0x4130b4]
test eax, eax
jne 0x40b1bd
push str.PRf48PBufFile
push 0x1000000
push 0
push 4
push 0
push 0xffffffffffffffff
call esi
test eax, eax
mov dword [0x4130b4], eax
jne 0x40b1a5
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
ret
push 0x1000000
push 0
push 0
push 6
push eax
call edi
mov dword [0x412fcc], eax
mov dword [0x412fc8], eax
pop edi
mov eax, 1
pop esi
ret
Function at 0x4024e0
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x54de3b
mov eax, dword fs:[0]
push eax
sub esp, 0x21c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x218], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x230]
mov dword fs:[0], eax
mov eax, dword [esp + 0x240]
mov esi, ecx
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], eax
call fcn.00408e50
xor ebx, ebx
mov dword [esp + 0x238], ebx
mov ebp, 7
xor ecx, ecx
mov dword [esi + 0x30], ebp
mov dword [esi + 0x2c], ebx
mov word [esi + 0x1c], cx
xor edx, edx
mov dword [esi + 0x4c], ebp
mov dword [esi + 0x48], ebx
mov word [esi + 0x38], dx
xor eax, eax
mov dword [esi + 0x74], ebp
mov dword [esi + 0x70], ebx
mov word [esi + 0x60], ax
lea ecx, [esi + 0x80]
mov byte [esp + 0x238], 3
push ecx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
call fcn.00402020
lea edx, [esi + 0x330]
mov byte [esp + 0x238], 4
push edx
mov dword [esi + 0x32c], ebx
call fcn.0043a3a0
mov dword [esi + 0x34c], ebx
xor eax, eax
mov dword [esi + 0x368], ebp
mov dword [esi + 0x364], ebx
mov word [esi + 0x354], ax
lea edi, [esi + 0x37c]
mov dword [esi + 0x370], ebx
mov dword [esi + 0x374], ebx
xor ecx, ecx
mov dword [edi + 0x18], ebp
mov dword [edi + 0x14], ebx
mov word [edi + 4], cx
mov edx, dword [esp + 0x244]
mov byte [esp + 0x238], 8
push 0x88
mov dword [esi + 0x58], edx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x398], ebx
mov dword [esi + 0x39c], ebx
call fcn.00450bec
add esp, 4
mov dword [esp + 0x20], eax
mov ebp, dword [esp + 0x18]
mov byte [esp + 0x238], 9
cmp eax, ebx
je 0x40261f
push ebp
mov ecx, eax
call fcn.004119d0
jmp 0x402621
xor eax, eax
mov byte [esp + 0x238], 8
push 0x206
mov dword [esi + 0x328], eax
lea ecx, [esp + 0x2a]
xor eax, eax
push ebx
push ecx
mov byte [esi + 0x378], bl
mov word [esp + 0x30], ax
call fcn.00523d70
add esp, 0xc
lea edx, [esp + 0x24]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [esp + 0x24]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
cmp cx, bx
jne 0x402666
mov ecx, dword [str.7z.dll]
mov edx, dword [0x589228]
mov dword [eax], ecx
mov ecx, dword [0x58922c]
mov dword [eax + 4], edx
mov dx, word [0x589230]
mov dword [eax + 8], ecx
mov word [eax + 0xc], dx
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [esi + 0x348], eax
mov eax, ebp
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4026b0
sub eax, edx
sar eax, 1
push eax
push ebp
mov ecx, edi
call fcn.0040c670
call fcn.00403d70
mov ecx, esi
call fcn.00403e10
mov edi, esi
call fcn.00404680
mov eax, esi
mov ecx, dword [esp + 0x230]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x218]
xor ecx, esp
call fcn.00523c4c
add esp, 0x228
ret 8
Function at 0x403d70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x48], eax
cmp dword [esi + 0x394], 8
push edi
jb 0x403d96
mov eax, dword [esi + 0x380]
jmp 0x403d9c
lea eax, [esi + 0x380]
push 0x589388
push eax
call fcn.00529763
mov edi, eax
add esp, 8
test edi, edi
je 0x403dfb
xor eax, eax
push 0x3e
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.00523d70
push edi
push 0x40
lea edx, [esp + 0x1c]
push 1
push edx
call fcn.00529a1a
push edi
call fcn.00529aae
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
add esp, 0x20
mov dword [esi + 0x370], eax
or eax, ecx
mov dword [esi + 0x374], ecx
je 0x403dfb
mov byte [esi + 0x378], 1
mov ecx, dword [esp + 0x4c]
pop edi
xor ecx, esp
call fcn.00523c4c
mov esp, ebp
pop ebp
ret
Function at 0x404b10
Capabilities:
Create thread

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
push 0xb2c
mov ebx, eax
mov edi, ecx
call fcn.00524d89
add esp, 4
push 0xb2c
mov esi, eax
push 0
push esi
call fcn.00523d70
mov edx, esi
add esp, 0xc
mov eax, edi
sub edx, edi
nop
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404b40
test ebx, ebx
je 0x404b7a
mov eax, ebx
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x404b53
sub eax, edx
je 0x404b7a
mov ecx, esi
sub ecx, ebx
mov eax, ebx
lea edx, [ecx + 0x104]
lea ebx, [ebx]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x404b70
push esi
push 0
push 0x404c00
call fcn.005245c5
mov esi, dword [esp + 0x28]
mov ecx, dword [esi + 0x33c]
add esi, 0x330
add esp, 0xc
mov dword [esp + 0xc], eax
test ecx, ecx
jne 0x404ba6
xor edx, edx
jmp 0x404bae
mov edx, dword [esi + 0x14]
sub edx, ecx
sar edx, 2
mov edi, dword [esi + 0x10]
mov ebx, edi
sub ebx, ecx
sar ebx, 2
cmp ebx, edx
jae 0x404bcd
mov dword [edi], eax
add edi, 4
mov dword [esi + 0x10], edi
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
cmp ecx, edi
jbe 0x404bd6
call fcn.00524192
mov eax, dword [esi]
push edi
push eax
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x1c]
push eax
mov eax, esi
call fcn.0040ae40
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4
Function at 0x4066c0
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x54e6e0
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
push edi
mov eax, dword [0x5b0630]
xor eax, esp
push eax
lea eax, [esp + 0x50]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
xor edi, edi
xor eax, eax
mov word [esp + 0x30], ax
mov eax, esi
mov ebx, ecx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], edi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x406716
sub eax, edx
sar eax, 1
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.0040c670
lea ecx, [esp + 0x2c]
mov dword [esp + 0x58], edi
push ecx
lea edi, [esp + 0x14]
call fcn.004162e0
add esp, 4
mov byte [esp + 0x58], 1
mov eax, dword [esp + 0x14]
mov edi, 0x10
cmp dword [esp + 0x28], edi
jae 0x40675d
lea eax, [esp + 0x14]
push ebx
mov ecx, str.12990103
call fcn.00404b10
mov eax, dword [ebx + 0x58]
test eax, eax
je 0x406779
mov edx, dword [ebp + 8]
push esi
push edx
call eax
add esp, 8
cmp dword [esp + 0x28], edi
jb 0x40678c
mov eax, dword [esp + 0x14]
push eax
call fcn.00450c1b
add esp, 4
cmp dword [esp + 0x44], 8
mov dword [esp + 0x28], 0xf
mov dword [esp + 0x24], 0
mov byte [esp + 0x14], 0
jb 0x4067b5
mov ecx, dword [esp + 0x30]
push ecx
call fcn.00450c1b
add esp, 4
mov ecx, dword [esp + 0x50]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00523c4c
mov esp, ebp
pop ebp
ret 8
Function at 0x406ae0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x31c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x318], eax
push ebp
push esi
xor esi, esi
push 0x103
lea eax, [esp + 0x19]
push esi
mov dword [esp + 0x10], esi
push eax
mov byte [esp + 0x20], 0
call fcn.00523d70
add esp, 0xc
push 0x208
lea ecx, [esp + 0x11c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x11c]
push eax
mov dword [esp + 0x14], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebp, eax
cmp ebp, esi
je 0x406bce
push edi
push ebp
push 2
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ecx, dword [esp + 0x10]
mov edi, eax
push edi
push ebp
push ecx
lea edx, [esp + 0x128]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x10]
push ecx
push 0x5892a0
push edi
call sub.VERSION.dll_VerQueryValueW
mov eax, dword [esp + 0xc]
mov cx, word [eax + 0x12]
mov dx, word [eax + 0x10]
mov di, word [eax + 0x16]
movzx eax, word [eax + 0x14]
push eax
movzx eax, di
push eax
movzx edx, dx
movzx eax, cx
push edx
push eax
lea ecx, [esp + 0x28]
push str._d._d._d._d
push ecx
call fcn.00529365
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
pop edi
mov dword [ebx + 0x14], esi
lea eax, [esp + 0x14]
pop esi
mov dword [ebx + 0x18], 0xf
mov byte [ebx + 4], 0
lea edx, [eax + 1]
pop ebp
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x406be5
sub eax, edx
push eax
lea edx, [esp + 0x10]
push edx
mov ecx, ebx
call fcn.0040c040
mov ecx, dword [esp + 0x318]
xor ecx, esp
mov eax, ebx
call fcn.00523c4c
add esp, 0x31c
ret

Function at 0x406c20
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.00523d70
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
mov ecx, dword [esp + 0x114]
sbb eax, eax
xor ecx, esp
inc eax
call fcn.00523c4c
add esp, 0x118
ret
Function at 0x406c80
Capabilities:
Create shortcut via ishelllink

Disassembly:
sub esp, 0x21c
mov eax, dword [0x5b0630]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [esp + 0x220]
push ebp
mov ebp, dword [esp + 0x228]
push esi
push 0
mov esi, ecx
mov dword [esp + 0x14], eax
call dword [sym.imp.ole32.dll_CoInitialize]
lea ecx, [esp + 8]
push ecx
push 0x589204
push 1
push 0
push 0x588a08
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x406cf4
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov edx, dword [edx]
lea ecx, [esp + 0xc]
push ecx
push 0x552c5c
push eax
call edx
test eax, eax
mov eax, dword [esp + 8]
mov ecx, dword [eax]
jge 0x406cfb
mov edx, dword [ecx + 8]
push eax
call edx
xor al, al
jmp 0x406dad
test esi, esi
jne 0x406d0e
mov edx, dword [0x5b79f8]
push edx
push eax
mov eax, dword [ecx + 0x50]
call eax
jmp 0x406d15
mov edx, dword [ecx + 0x50]
push esi
push eax
call edx
test edi, edi
je 0x406d3e
mov eax, edi
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406d20
sub eax, edx
sar eax, 1
je 0x406d3e
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push edi
push eax
call edx
test ebx, ebx
je 0x406d4f
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x24]
push ebx
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 0
push eax
call edx
test ebp, ebp
je 0x406d79
mov eax, dword [esp + 0x10]
push ebp
push eax
lea ecx, [esp + 0x20]
push str._s_s
push ecx
call fcn.00523e21
add esp, 0x10
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
mov edx, dword [edx + 0x18]
push 1
lea ecx, [esp + 0x1c]
push ecx
push eax
call edx
mov esi, eax
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
xor eax, eax
test esi, esi
setge al
mov ecx, dword [esp + 0x220]
pop esi
pop ebp
xor ecx, esp
call fcn.00523c4c
add esp, 0x21c
ret 8