joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409610
Capabilities:
Connect to wmi namespace via wbemlocator

Disassembly:
sub esp, 0x28
push esi
xor esi, esi
push esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
test eax, eax
jl 0x409753
push esi
push esi
push esi
push 3
push esi
push esi
push esi
push 0xffffffffffffffff
push esi
call dword [sym.imp.ole32.dll_CoInitializeSecurity]
test eax, eax
jl 0x40974d
lea eax, [esp + 8]
push eax
push 0x440888
push 1
push esi
push 0x440958
mov dword [esp + 0x1c], esi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40974d
mov eax, dword [esp + 8]
lea edx, [esp + 4]
push edx
push esi
push esi
push esi
push esi
push esi
push esi
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
push str.ROOTCIMV2
push eax
mov eax, dword [ecx + 0xc]
call eax
test eax, eax
jl 0x4096d2
mov eax, dword [esp + 4]
push esi
push esi
push 3
push 3
push esi
push esi
push 0xa
push eax
call dword [sym.imp.ole32.dll_CoSetProxyBlanket]
test eax, eax
mov eax, dword [esp + 4]
jl 0x4096ca
lea edx, [esp + 0xc]
push edx
push esi
push 0x30
push str.SELECT_Caption_Name_ProcessorId_NumberOfCores_NumberOfLogicalProcessors_CurrentClockSpeed_FROM_Win32_Processor
mov dword [esp + 0x1c], esi
mov ecx, dword [eax]
push 0x44a868
push eax
mov eax, dword [ecx + 0x50]
call eax
test eax, eax
jge 0x4096e9
mov eax, dword [esp + 4]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 8]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
add esp, 0x28
ret
mov eax, dword [esp + 0xc]
mov dword [esp + 0x10], esi
cmp eax, esi
je 0x40974d
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
lea edx, [esp + 0x18]
push edx
push 1
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp dword [esp + 0x10], esi
je 0x40974d
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x14]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
push esi
push str.Name
push eax
call edx
test eax, eax
jl 0x409742
mov edx, dword [esp + 0x20]
call fcn.0040a780
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop esi
add esp, 0x28
ret
Function at 0x409760
Capabilities:
Get system information on windows

Disassembly:
push 0xffffffffffffffff
push 0x43d8a8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
push ebx
push esi
push edi
mov eax, dword [0x4541fc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor ebx, ebx
cmp dword [esp + 0x30], 2
jne 0x409844
mov edx, dword [0x45fb64]
mov eax, dword [edx + 0xc]
mov ecx, 0x45fb64
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea edi, [esp + 0x14]
mov dword [esp + 0x48], ebx
call fcn.00409610
mov ecx, dword [esp + 0x14]
cmp dword [ecx - 0xc], ebx
je 0x40981c
call fcn.0040a8b0
mov esi, dword [esp + 0x14]
cmp dword [esi - 0xc], ebx
jl 0x409813
push str.pentium
push esi
call fcn.00419a21
add esp, 8
cmp eax, ebx
je 0x4097f1
sub eax, esi
sar eax, 1
jns 0x40980e
cmp dword [esi - 0xc], ebx
jl 0x409813
push 0x44a88c
push esi
call fcn.00419a21
add esp, 8
cmp eax, ebx
je 0x409813
sub eax, esi
sar eax, 1
js 0x409813
mov ebx, 1
lea esi, [esp + 0x14]
call fcn.0040a050
mov dword [esp + 0x48], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x409844
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x3c
ret
Function at 0x40c870
Capabilities:
Get number of processors
Hide graphical window

Disassembly:
push 0xffffffffffffffff
push 0x43d400
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push ebp
push edi
mov eax, dword [0x4541fc]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor edi, edi
mov dword [esi + 0x74], 1
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], 0x424
mov dword [esp + 0x24], 0x320
cmp dword [0x45f910], edi
jne 0x40c8c9
mov dword [0x45f910], str.AtlAxWin90
mov eax, dword [esp + 0x10]
push eax
lea ecx, [esi + 0x20]
push ecx
mov ebx, 0x45f8e0
call fcn.0040bd20
add esp, 8
push edi
push 0
push 0xfd0000
movzx ebx, ax
push 0x44ae34
lea edx, [esp + 0x28]
push edx
mov eax, esi
call fcn.0040df60
xor ebx, ebx
mov dword [esi + 0x68], eax
cmp eax, ebx
je 0x40ca89
cmp dword [0x461038], ebx
jne 0x40c968
push 0x461038
push 0x44acfc
push 0x17
push ebx
push 0x43f5a4
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, ebx
jge 0x40c95c
mov eax, dword [0x461038]
cmp eax, ebx
je 0x40ca89
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [0x461038], ebx
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x24
ret
cmp dword [0x461038], ebx
je 0x40ca89
push esi
call fcn.0040d5b0
mov edi, eax
mov dword [esp + 0x14], edi
cmp edi, ebx
je 0x40c980
mov eax, dword [edi]
mov ecx, dword [eax + 4]
push edi
call ecx
mov dword [esp + 0x30], ebx
cmp edi, ebx
je 0x40ca89
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x10]
push eax
mov byte [esp + 0x34], 1
mov edx, dword [edi]
mov ecx, dword [edx]
push 0x43f5f4
push edi
call ecx
cmp eax, ebx
mov eax, dword [esp + 0x10]
jl 0x40ca69
cmp eax, ebx
je 0x40ca69
call fcn.0040c370
mov ecx, dword [esp + 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0xc]
lea ebp, [esi + 0x64]
push ebp
push 0x43f5f4
push ecx
push eax
call edx
cmp eax, ebx
jl 0x40ca30
cmp dword [ebp], ebx
je 0x40ca30
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40c9f2
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
mov edx, dword [esi + 0x68]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x24
ret
mov byte [esp + 0x30], bl
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40ca44
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov dword [esp + 0x30], 0xffffffff
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push edi
call ecx
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x24
ret
mov byte [esp + 0x30], bl
cmp eax, ebx
je 0x40ca79
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov dword [esp + 0x30], 0xffffffff
mov ecx, dword [edi]
mov edx, dword [ecx + 8]
push edi
call edx
xor eax, eax
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebp
pop ebx
add esp, 0x24
ret
Function at 0x40cd20
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [esp + 8]
cmp dword [edi + 0x60], 0
je 0x40cd39
mov eax, dword [esp + 0x10]
mov dword [eax], 1
pop edi
ret 0x18
mov eax, dword [edi + 0x5c]
push esi
test eax, eax
je 0x40cdd3
mov eax, dword [eax + 0x64]
push eax
call fcn.0040c3b0
mov esi, eax
test esi, esi
je 0x40cd5c
mov ecx, dword [esi]
mov edx, dword [ecx + 4]
push esi
call edx
mov eax, dword [edi + 0x5c]
mov ecx, dword [eax + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [edi + 0x5c], 0
test esi, esi
je 0x40cdd3
mov edx, dword [esi]
mov ecx, dword [edx + 0x3c]
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0
call ecx
test eax, eax
mov eax, dword [esp + 0xc]
jl 0x40cdbf
test eax, eax
je 0x40cdcb
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [edx], eax
mov dword [ecx], 0
inc dword [edi + 0x6c]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
call eax
mov ecx, dword [esi]
mov edx, dword [ecx + 8]
push esi
call edx
pop esi
pop edi
ret 0x18
test eax, eax
je 0x40cdcb
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esi]
mov ecx, dword [eax + 8]
push esi
call ecx
mov edx, dword [esp + 0x14]
pop esi
mov dword [edx], 1
pop edi
ret 0x18
Function at 0x40e6e0
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [sym.imp.WININET.dll_FindNextUrlCacheEntryA]
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], edi
xor esi, esi
mov ebx, 0x1000
mov eax, 0x7a
nop
test eax, eax
je 0x40e755
cmp eax, 0x7a
jne 0x40e836
push esi
call fcn.00419b78
push ebx
call fcn.00416231
mov esi, eax
add esp, 8
mov dword [esi], ebx
mov dword [esp + 0x10], ebx
test edi, edi
jne 0x40e740
lea eax, [esp + 0x10]
push eax
push esi
push edi
call dword [sym.imp.WININET.dll_FindFirstUrlCacheEntryA]
mov edi, eax
xor eax, eax
test edi, edi
setne al
jmp 0x40e749
lea ecx, [esp + 0x10]
push ecx
push esi
push edi
call ebp
test eax, eax
je 0x40e827
xor eax, eax
jmp 0x40e700
mov eax, dword [esi + 4]
push str..sogou.com
push eax
call fcn.00419420
add esp, 8
test eax, eax
jne 0x40e80f
mov eax, dword [esi + 4]
push str.bing.com
push eax
call fcn.00419420
add esp, 8
test eax, eax
jne 0x40e80f
mov eax, dword [esi + 4]
push str.www.2345.com
push eax
call fcn.00419420
add esp, 8
test eax, eax
jne 0x40e80f
mov eax, dword [esi + 4]
push str._2345.com
push eax
call fcn.00419420
add esp, 8
test eax, eax
jne 0x40e80f
mov eax, dword [esi + 4]
push str.www.baidu.com
push eax
call fcn.00419420
add esp, 8
test eax, eax
jne 0x40e80f
mov eax, dword [esi + 4]
push str._baidu.com
push eax
call fcn.00419420
add esp, 8
test eax, eax
jne 0x40e80f
mov eax, dword [esi + 4]
push str.www.hao123.com
push eax
call fcn.00419420
add esp, 8
test eax, eax
jne 0x40e80f
mov eax, dword [esi + 4]
push str._hao123.com
push eax
call fcn.00419420
add esp, 8
test eax, eax
jne 0x40e80f
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.WININET.dll_DeleteUrlCacheEntryA]
lea eax, [esp + 0x10]
push eax
push esi
push edi
mov dword [esp + 0x1c], ebx
call ebp
test eax, eax
je 0x40e827
xor eax, eax
jmp 0x40e700
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x10]
jmp 0x40e700
cmp eax, 0x103
jne 0x40e845
mov dword [esp + 0x14], 1
push esi
call fcn.00419b78
add esp, 4
test edi, edi
je 0x40e859
push edi
call dword [sym.imp.WININET.dll_FindCloseUrlCache]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x4115d0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x10
push ebp
push esi
push edi
lea eax, [esp + 0xc]
push eax
push 0xf003f
xor esi, esi
push esi
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
push reloc.OLEAUT32.dll_SysReAllocString
xor edi, edi
mov dword [esp + 0x28], esi
mov dword [esp + 0x20], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x411653
mov eax, dword [esp + 0xc]
mov dword [esp + 0x14], esi
push eax
mov edx, str.FEATURE_BROWSER_EMULATION
lea esi, [esp + 0x14]
mov dword [esp + 0x14], eax
call fcn.00401710
mov esi, dword [esp + 0x10]
test eax, eax
jne 0x41164a
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
push 4
lea edx, [esp + 0x10]
push edx
push 4
push edi
push eax
push esi
mov dword [esp + 0x24], ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, eax
test esi, esi
je 0x411653
push esi
call ebp
xor esi, esi
xor ecx, ecx
test edi, edi
sete cl
mov edi, ecx
test esi, esi
je 0x411663
push esi
call ebp
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x411683
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, edi
pop edi
pop esi
pop ebp
add esp, 0x10
ret
Function at 0x411690
Capabilities:
Set registry value

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebp
push esi
push edi
mov edi, eax
lea eax, [esp + 0x14]
push eax
push 0xf003f
xor ebp, ebp
push ebp
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
push edi
xor esi, esi
mov dword [esp + 0x28], ebp
call ebx
cmp eax, ebp
jne 0x4116c4
mov esi, dword [esp + 0x14]
jmp 0x4116fe
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push ebp
push str.SoftwareMicrosoftInternet_ExplorerMain
push edi
mov dword [esp + 0x28], ebp
call ebx
cmp eax, ebp
jne 0x41170b
mov eax, dword [esp + 0x14]
push eax
mov edx, str.FeatureControl
lea esi, [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], ebp
call fcn.00401710
mov esi, dword [esp + 0x18]
cmp esi, ebp
je 0x41170b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea edx, [esp + 0x14]
push edx
push 0xf003f
push ebp
push str.SoftwareMicrosoftInternet_ExplorerMainFeatureControl
push edi
mov dword [esp + 0x30], ebp
mov dword [esp + 0x28], ebp
call ebx
cmp eax, ebp
jne 0x411797
xor eax, eax
cmp esi, ebp
je 0x411737
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], ebp
cmp eax, ebp
jne 0x411797
mov edx, dword [esp + 0x28]
push esi
lea esi, [esp + 0x1c]
call fcn.00401710
mov esi, dword [esp + 0x18]
test eax, eax
jne 0x411797
mov ecx, dword [esp + 0x2c]
mov ebx, dword [esp + 0x30]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea eax, [esp + 0x18]
push eax
push 4
push ebp
push ecx
push esi
mov dword [esp + 0x2c], ebx
call edi
mov eax, dword [esp + 0x34]
cmp eax, ebp
je 0x411797
push 4
lea edx, [esp + 0x18]
push edx
push 4
push ebp
push eax
push esi
mov dword [esp + 0x2c], ebx
call edi
cmp esi, ebp
je 0x4117a2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x4117b0
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push ebp
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0xf003f
xor edi, edi
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push SysReAllocStringLen
xor esi, esi
mov dword [esp + 0x24], edi
call ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, edi
jne 0x41180d
mov esi, dword [esp + 0x10]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push edi
push str.1601
push esi
mov dword [esp + 0x2c], edi
call ebp
cmp esi, edi
je 0x41180d
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea edx, [esp + 0x14]
push edx
push 0xf003f
push edi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], edi
call ebx
cmp eax, edi
jne 0x411857
xor eax, eax
cmp esi, edi
je 0x411839
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
cmp eax, edi
jne 0x411857
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push edi
push str.1601
push esi
mov dword [esp + 0x30], edi
call ebp
cmp esi, edi
je 0x411862
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret

Function at 0x411870
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x410
mov eax, dword [0x4541fc]
xor eax, esp
mov dword [esp + 0x40c], eax
lea eax, [esp + 8]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftInternet_Explorer_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4118c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.00418dd5
add esp, 0x410
ret
push esi
push 0x400
lea ecx, [esp + 0x14]
push 0
push ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x400
call fcn.0041a740
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0xc]
push ecx
push 0
push str.svcVersion
push edx
call esi
test eax, eax
je 0x41194e
push 0x400
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0041a740
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push str.Version
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x20], 0x400
call esi
xor ecx, ecx
mov al, 0x2e
pop esi
cmp byte [esp + ecx + 0xc], al
je 0x411964
inc ecx
cmp ecx, 0x400
jl 0x411953
jmp 0x411969
mov byte [esp + ecx + 0xc], 0
dec ecx
xor eax, eax
cmp ecx, 1
ja 0x41197e
lea edx, [esp + 0xc]
push edx
call fcn.00419fd4
add esp, 4
mov ecx, dword [esp + 0x40c]
xor ecx, esp
call fcn.00418dd5
add esp, 0x410
ret
Function at 0x412100
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x4541fc]
xor eax, esp
mov dword [esp + 0x140], eax
push esi
lea eax, [esp + 4]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
lea ecx, [esp + 0x28]
push ecx
mov dword [esp + 0x2c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x412186
mov eax, dword [esp + 0x2c]
sub eax, 5
je 0x41216b
sub eax, 1
jne 0x412186
call fcn.004120c0
neg eax
sbb eax, eax
neg eax
add eax, 2
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00418dd5
add esp, 0x144
ret
mov eax, 1
pop esi
mov ecx, dword [esp + 0x140]
xor ecx, esp
call fcn.00418dd5
add esp, 0x144
ret
mov ecx, dword [esp + 0x144]
mov eax, esi
pop esi
xor ecx, esp
call fcn.00418dd5
add esp, 0x144
ret

Function at 0x4121b0
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x43dad1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4541fc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x44]
xor edi, edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x20], edi
mov ebx, dword [esp + 0x40]
push ebx
mov ecx, 0x44a470
call fcn.0040a640
lea eax, [esp + 0x2c]
push eax
mov dword [esp + 0x3c], edi
push ebp
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], edi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
jbe 0x4122ee
push esi
call fcn.00416231
push esi
mov ebx, eax
push edi
push ebx
call fcn.0041a740
add esp, 0x10
cmp ebx, edi
je 0x4122d6
push ebx
push esi
push edi
push ebp
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4122cd
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x28]
push edx
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4122cd
test dword [esp + 0x18], 0xfffffffc
jbe 0x4122cd
lea esi, [esp + 0x14]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x28], edi
call fcn.0040a620
mov dword [esp + 0x38], 1
mov eax, dword [esp + 0x24]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
push str.StringFileInfo_04x_04xCompanyName
mov edi, esi
call fcn.0040be80
add esp, 0xc
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x20]
push ecx
call fcn.0040a0b0
push eax
push ebx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4122c4
mov edx, dword [esp + 0x1c]
mov edi, dword [esp + 0x40]
call fcn.0040a780
lea eax, [esp + 0x14]
call fcn.0040abc0
push ebx
call fcn.00418dca
add esp, 4
mov eax, dword [esp + 0x40]
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
mov eax, ebx
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x4126f0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 8
push ebx
push esi
push edi
push 1
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
jne 0x41271e
push str.ntdll.dll
call ebx
mov esi, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.ZwCreateProcessEx
push esi
call edi
mov dword [0x460fe0], eax
test eax, eax
jne 0x41273e
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 8
ret
call fcn.00416b00
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.00417380
push str.LdrLoadDll
push esi
call edi
mov dword [0x460fe8], eax
test eax, eax
je 0x41276f
push 0x412310
push 0x460fe8
call fcn.00417440
push 0x411e50
push 0x460fe0
call fcn.00417440
push str.ZwCreateProcess
push esi
call edi
mov dword [0x460fe4], eax
test eax, eax
je 0x41279e
push 0x411e50
push 0x460fe4
call fcn.00417440
push 0x4120b0
push 0x46105c
call fcn.00417440
push 0x4120b0
push 0x461078
call fcn.00417440
push method.ATL::CComObject_class_ATL::CAxFrameWindow_.virtual_0
push 0x461074
call fcn.00417440
push method.ATL::CComObject_class_ATL::CAxFrameWindow_.virtual_0
push 0x461088
call fcn.00417440
push method.ATL::CRegObject.virtual_8
push 0x461084
call fcn.00417440
push method.ATL::CRegObject.virtual_8
push 0x461060
call fcn.00417440
push 0x411de0
push 0x461064
call fcn.00417440
push 0x411e10
push 0x46106c
call fcn.00417440
push str.DirectSoundCreate
push str.DSound.dll
call ebx
push eax
call edi
mov dword [esp + 0xc], eax
test eax, eax
je 0x41283c
push method.ATL::CComObject_class_ATL::CAxFrameWindow_.1.virtual_56
lea eax, [esp + 0x10]
push eax
call fcn.00417440
push str.DirectSoundCreate8
push str.DSound.dll
call ebx
push eax
call edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x412862
push method.ATL::CComObject_class_ATL::CAxFrameWindow_.1.virtual_56
lea ecx, [esp + 0x14]
push ecx
call fcn.00417440
push 0x411e60
push 0x461054
call fcn.00417440
push 0x412010
push 0x461058
call fcn.00417440
push 0x412060
push 0x46107c
call fcn.00417440
call fcn.00416d80
test eax, eax
jne 0x412735
call fcn.00412100
cmp eax, 2
je 0x4128ab
cmp eax, 3
jne 0x4128d3
call fcn.00410d30
push 1
mov dword [0x460fd0], 0
call fcn.00410bd0
add esp, 4
call fcn.00410e00
push 0
push 0
call dword [sym.imp.WINMM.dll_waveOutSetVolume]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret
Function at 0x416110
Capabilities:
Delete file

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
test ebp, ebp
je 0x416192
test edi, edi
je 0x416192
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov dword [esp + 0x18], 0
call ebx
push 0
push 2
push 2
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
test esi, esi
je 0x416192
cmp esi, 0xffffffff
je 0x416192
push ecx
mov eax, esp
mov dword [esp + 0x10], esp
push eax
mov ecx, 0x44a470
call fcn.0040a640
push esi
push 1
lea ecx, [esp + 0x20]
mov edx, ebp
call fcn.00415da0
add esp, 0xc
push esi
test eax, eax
je 0x416189
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x14]
pop esi
pop ebp
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call ebx
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret

Function at 0x41643f
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x45fac0], 0
push esi
jne 0x4163b2
call fcn.004162d8
test eax, eax
je 0x4163f5
mov eax, dword [0x45fac0]
cmp eax, 1
jne 0x4163d3
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4163f5
pop esi
ret
push eax
call dword [0x45fac8]
test eax, eax
jne 0x41643d
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x4163f9
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x45fac0]
call dword [0x45fac8]
mov edi, eax
test edi, edi
je 0x41641e
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41643a
mov edi, esi
add esi, 0xff0
push edi
push dword [0x45fac0]
call dword [0x45fac4]
add edi, 0x10
cmp edi, esi
jb 0x416426
mov eax, edi
pop edi
pop esi
ret
jmp 0x41639f