joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402130
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str.RealPlayer_CommandLine_Mutex
mov ebx, ecx
push 1
push eax
inc ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x40223e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402180
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [0x439068]
mov ecx, 0x1f
mov byte [ebp - 0x8c], al
xor eax, eax
lea edi, [ebp - 0x8b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x8c]
push str.RealPlayer_CommandLine_Shmem__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x8c]
push edx
push ebx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
mov dword [ebp - 4], edi
je 0x402230
push ebx
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x402229
mov esi, dword [ebp + 0xc]
mov ecx, ebx
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 8]
push eax
push 0x590
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402740
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [str.SoftwareRealNetworksRealJukebox1.0Preferences]
lea ecx, [ebp - 0xc]
push eax
push ecx
push 1
push str.ClearLibCorruptionOnShutdown
mov dword [ebp - 0xc], 1
call fcn.0040b710
mov eax, dword [ebp - 0xc]
add esp, 0x10
test eax, eax
je 0x4027ca
lea edx, [ebp - 0x110]
push 0x104
push edx
call fcn.004027d0
mov al, byte [ebp - 0x110]
add esp, 8
test al, al
je 0x4027ca
lea ecx, [ebp - 8]
call fcn.004069f0
lea eax, [ebp - 0x110]
lea ecx, [ebp - 8]
push eax
push str._scpt
push ecx
call fcn.00407370
mov al, byte [ebp - 1]
add esp, 0xc
cmp al, 0xff
lea eax, [ebp - 8]
jne 0x4027bb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 8]
call fcn.00406b20
mov esp, ebp
pop ebp
ret
Function at 0x4028b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov edi, 0x410714
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40294b
lea eax, [ebp - 0x104]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.PNCRT.dll_strrchr]
lea ecx, [ebp - 0x104]
push 0x5c
push ecx
call esi
add esp, 8
test eax, eax
jne 0x402912
lea edx, [ebp - 0x104]
push 0x2f
push edx
call esi
add esp, 8
test eax, eax
jne 0x402912
lea eax, [ebp - 0x104]
jmp 0x402913
inc eax
push 0x104
push 0x410714
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x40294b
mov edi, 0x410828
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x410714
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x410714
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4039c0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
test ebx, ebx
mov esi, ecx
mov dword [ebp - 4], eax
je 0x403ae2
push edi
push str.PATH
call dword [sym.imp.PNCRT.dll_getenv]
add esp, 4
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.004069f0
test edi, edi
je 0x403a00
push edi
lea ecx, [ebp - 0x14]
call fcn.00406c40
mov al, byte [esi + 0x2b]
add esi, 0x24
cmp al, 0xff
pop edi
je 0x403a68
xor ecx, ecx
cmp al, 7
sete cl
mov eax, ecx
test eax, eax
je 0x403a3d
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
push edx
push 0x410a88
push eax
call fcn.00406cf0
add esp, 0xc
mov ecx, esi
push eax
call fcn.00406bd0
lea ecx, [ebp - 0x1c]
call fcn.00406b20
push 0x410a88
lea ecx, [ebp - 0xc]
call fcn.00406b30
push ebx
lea ecx, [ebp - 0xc]
call fcn.00407050
mov ax, word [ebp - 0xe]
cmp ah, 0xff
je 0x403a7f
xor ecx, ecx
cmp ah, 7
sete cl
mov eax, ecx
jmp 0x403a90
mov al, byte [esi + 4]
test al, al
jne 0x403a3d
mov al, byte [esi + 5]
test al, al
jne 0x403a3d
mov al, byte [esi + 6]
test al, al
je 0x403a18
jmp 0x403a3d
mov ecx, dword [ebp - 0x10]
test cl, cl
jne 0x403a94
test ch, ch
jne 0x403a94
test al, al
je 0x403aad
jmp 0x403a94
test eax, eax
jne 0x403aad
push 0x410a84
lea ecx, [ebp - 0xc]
call fcn.00407050
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0xc]
push edx
call fcn.004070b0
mov al, byte [ebp - 5]
cmp al, 0xff
lea eax, [ebp - 0xc]
jne 0x403aba
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.PNCRT.dll__putenv]
add esp, 4
mov esi, 0x80004005
test eax, eax
jne 0x403ad0
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00406b20
lea ecx, [ebp - 0x14]
call fcn.00406b20
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405920
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
or ebx, 0xffffffff
push eax
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], 0
mov dword [ebp - 0xcc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dx, word [ebp - 0xc0]
mov esi, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
mov word [ebp - 0x10], dx
xor edx, edx
cmp esi, 2
mov di, ax
sete dl
mov esi, edx
mov word [ebp - 0x14], di
test esi, esi
mov word [ebp - 0x12], cx
je 0x40599f
mov ebx, 8
jmp 0x4059c0
cmp ax, 4
jae 0x4059ac
mov ebx, 2
jmp 0x4059c0
jne 0x4059c3
cmp cx, 0xa
sbb ebx, ebx
and ebx, 0xfffffc04
add ebx, 0x400
mov dword [ebp - 0xe], ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x405aae
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
and eax, 0xffff
cmp eax, 3
ja case.default.0x4059e9
jmp dword [eax*4 + 0x405ab8]
test esi, esi
je 0x405a45
cmp di, 3
ja 0x405a03
jne 0x405a45
cmp word [ebp - 0x12], 0x32
jb 0x405a45
mov eax, dword [ebp - 0x18]
and eax, 0xffff
sub eax, 4
jns 0x405a19
mov dword [ebp - 0xa], 0xfffffffe
jmp 0x405a84
test eax, eax
jne 0x405a26
mov dword [ebp - 0xa], 1
jmp 0x405a84
cmp eax, 1
jne 0x405a34
mov dword [ebp - 0xa], 2
jmp 0x405a84
sub eax, 2
neg eax
sbb eax, eax
and al, 0xfb
add eax, 4
mov dword [ebp - 0xa], eax
jmp 0x405a84
mov eax, dword [ebp - 0x20]
sub eax, 0x182
je 0x405a10
sub eax, 0x64
je 0x405a1d
sub eax, 0x64
jne case.default.0x4059e9
mov dword [ebp - 0xa], 2
jmp 0x405a84
mov dword [ebp - 0xa], 0x40
jmp 0x405a84
mov dword [ebp - 0xa], 0x20
jmp 0x405a84
mov dword [ebp - 0xa], 8
jmp 0x405a84
mov dword [ebp - 0xa], 0xffffffff
call fcn.00405ad0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 6], eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov cx, word [ebp - 4]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405ad0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x7fffffff
jne 0x405ae9
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 0
jne 0x405b29
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemFloatingPointProcessor
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405b1f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x406110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
test eax, eax
je 0x406218
mov esi, dword [ebp + 8]
test esi, esi
je 0x406218
cmp byte [esi], 0
je 0x406218
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x406218
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0
test eax, eax
jne 0x40616c
mov ecx, dword [edi + 8]
push 0
lea eax, [ebp + 0x10]
push 0
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406218
mov eax, dword [ebp + 0x10]
dec eax
je 0x4061d8
sub eax, 3
je 0x4061ac
sub eax, 3
jne 0x406208
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x406204
mov edx, dword [edi + 8]
mov ecx, eax
push edx
push esi
call fcn.004065f0
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x406204
mov ecx, dword [edi + 8]
push ecx
push esi
mov ecx, eax
call fcn.004064e0
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x406204
mov edx, dword [edi + 8]
mov ecx, eax
push edx
push esi
call fcn.00406310
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
xor eax, eax
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x4090c0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0xc]
push eax
push 0
push ecx
push 0x409090
push 0
push 0
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x409129
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x409120
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409138
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push edx
push eax
mov ecx, edi
call fcn.00409180
mov ecx, dword [edi + 0xc04]
xor eax, eax
test ecx, ecx
je 0x409151
mov edx, dword [edi + 0xc08]
push edx
push ebx
call ecx
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x409c40
mov al, byte [0x439068]
push edi
mov byte [ebp - 0x400], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
lea eax, [ebp - 0x400]
push edx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.PNCRT.dll_vsprintf]
add esp, 0xc
cmp eax, ebx
pop edi
jle 0x409c40
lea ecx, [ebp + 8]
push ebx
push ecx
push eax
mov eax, dword [esi + 4]
lea edx, [ebp - 0x400]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a090
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a11e
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x40a11e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a11e
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
mov dword [ebp + 8], 0
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x40a11e
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x40a106
mov edx, esi
cmp edi, ebx
jb 0x40a110
add edx, ebx
cmp edi, edx
jbe 0x40a129
mov edx, dword [ebp + 8]
add eax, 0x28
inc edx
cmp edx, ecx
mov dword [ebp + 8], edx
jb 0x40a0f8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
inc edx
sub edi, ebx
mov dword [eax], edx
mov dword [ecx], edi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40a6e0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0x40a81f
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x40a814
push str.EnumProcesses
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x664]
test edx, edx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
je 0x40a814
lea eax, [ebp - 4]
lea ecx, [ebp - 0x664]
push eax
push 0x400
push ecx
call edx
test eax, eax
mov dword [ebp - 8], eax
je 0x40a811
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
shr eax, 2
mov dword [ebp - 4], eax
je 0x40a811
lea ebx, [ebp - 0x664]
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [ebx]
mov dword [ebp - 0x264], 0x128
push eax
push 0
push 0x410
mov dword [ebp - 0x25c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a7ee
mov edx, dword [esi + 0x10]
push str.EnumProcessModules
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], ecx
je 0x40a7e7
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xc]
push ecx
push 4
push edx
push edi
call eax
test eax, eax
je 0x40a7e7
mov eax, dword [esi + 0x10]
push str.GetModuleBaseNameA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a7e7
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0x240]
push 0x103
push ecx
push edx
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x264]
push eax
push esi
call dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add esp, 8
inc eax
add ebx, 4
cmp eax, ecx
mov dword [ebp - 0x10], eax
jb 0x40a760
mov ebx, dword [ebp - 8]
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x40a8c4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Process32First
push eax
call edi
mov ecx, dword [esi + 8]
push str.Process32Next
push ecx
mov ebx, eax
call edi
test ebx, ebx
mov dword [ebp - 8], eax
je 0x40a8c4
test eax, eax
je 0x40a8c4
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x13c]
lea edx, [ebp - 0x13c]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push edx
push eax
mov dword [ebp - 0x13c], 0x128
call ebx
mov ebx, dword [ebp + 8]
mov edi, eax
test edi, edi
je 0x40a88b
lea ecx, [ebp - 0x13c]
push ecx
push esi
call ebx
add esp, 8
test edi, edi
je 0x40a8b9
mov eax, dword [esi]
lea edx, [ebp - 0x13c]
push edx
push eax
mov dword [ebp - 0x13c], 0x128
call dword [ebp - 8]
test eax, eax
je 0x40a8b9
lea ecx, [ebp - 0x13c]
push ecx
push esi
call ebx
add esp, 8
jmp 0x40a88f
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b040
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcb0
push ebx
push esi
push edi
mov esi, ecx
call fcn.00409a20
push str._Process_Info__r_n
push esi
call fcn.00409bd0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.ProcessId:__lu_r_n
push esi
call fcn.00409bd0
mov al, byte [0x439068]
mov ecx, 0xff
mov byte [ebp - 0x4b0], al
xor eax, eax
lea edi, [ebp - 0x4af]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x4b0]
push 0x400
xor ebx, ebx
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x4b0]
push edx
push str.Name:__s_r_n
push esi
call fcn.00409bd0
mov dl, byte [0x439068]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xcaf]
mov byte [ebp - 0xcb0], dl
mov byte [ebp - 0xb0], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0xaf]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xcb0]
lea ecx, [ebp - 0x4b0]
push eax
push 0x800
push ebx
push ecx
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40b167
lea edx, [ebp - 8]
lea eax, [ebp - 4]
push edx
push eax
lea ecx, [ebp - 0xcb0]
push 0x41070c
push ecx
mov dword [ebp - 8], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40b167
mov eax, dword [ebp - 4]
xor edx, edx
mov dx, word [eax + 0xc]
mov ecx, dword [eax + 0xc]
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
shr ecx, 0x10
push ecx
push edx
shr eax, 0x10
push eax
lea ecx, [ebp - 0xb0]
push str._lu._lu._lu._lu
push ecx
call dword [sym.imp.PNCRT.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0xb0]
push edx
push str.Version:__s_r_n
push esi
call fcn.00409bd0
mov eax, dword [esi + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x40b1d8
push str.GetProcessMemoryInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40b1d8
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x30]
push 0x28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x40b1d8
mov ecx, dword [ebp - 0x24]
push ecx
push str.WorkingSetSize:__lu_Bytes_r_n
push esi
call fcn.00409bd0
mov edx, dword [ebp - 0x10]
add esp, 0xc
push edx
push str.PagefileUsage:__lu_Bytes_r_n
push esi
call fcn.00409bd0
add esp, 0xc
push 0x411350
push esi
call fcn.00409bd0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b2d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
test eax, eax
je 0x40b2e6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
mov ebx, dword [ebp + 8]
push eax
push esi
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40b33c
push esi
push 0x2001f
push 0
push edi
push ebx
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b33c
xor edx, edx
mov dword [esi], 0
test eax, eax
sete dl
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 4], 1
jne 0x40b363
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40b363
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edx, edx
pop edi
test eax, eax
sete dl
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40b3d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 4], 0
cmp dword [ebx], 0
jne 0x40b3ee
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
lea edi, [esi + 1]
push edi
call dword [sym.imp.PNCRT.dll_malloc]
mov dword [ebp - 8], edi
xor edi, edi
add esp, 4
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x40b4d1
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
push ecx
mov ecx, dword [ebx]
push eax
mov eax, dword [ebp + 8]
push edx
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp + 0x14]
mov ecx, ebx
push edx
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], edi
call fcn.0040b5c0
cmp dword [ebp - 0x10], 1
jne 0x40b4af
cmp dword [ebp + 0x14], edi
jbe 0x40b4af
mov ebx, dword [ebp + 0x10]
mov ecx, esi
mov edx, ecx
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b471
mov eax, dword [ebp - 8]
cmp esi, eax
jb 0x40b46a
mov esi, eax
mov eax, dword [ebp - 0xc]
push esi
push eax
jmp 0x40b496
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jae 0x40b488
mov ecx, esi
jmp 0x40b494
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call dword [sym.imp.PNCRT.dll_strncpy]
mov eax, dword [ebp + 8]
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 4], ecx
jmp 0x40b4c4
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push esi
push edx
push eax
call dword [sym.imp.PNCRT.dll_strncpy]
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.PNCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b600
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push edi
mov dword [ebp - 0x14], ecx
push ebx
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
je 0x40b6e9
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 0x2001f
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b6f7
push eax
push eax
mov edx, dword [ebp - 4]
push eax
push eax
push eax
push eax
lea ecx, [ebp - 0xc]
push eax
push ecx
push eax
push eax
push eax
push edx
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x40b6f7
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
lea esi, [eax - 1]
test esi, esi
jl 0x40b6c9
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, 0x400
mov eax, dword [ebp - 4]
push 0
push 0
push 0
lea ecx, [ebp - 0x10]
push 0
lea edx, [ebp - 0x414]
push ecx
push edx
push esi
push eax
mov dword [ebp - 0x10], ebx
call edi
cmp eax, 0x103
je 0x40b6c3
test eax, eax
jne 0x40b6c0
mov edx, dword [ebp - 4]
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp - 0x14]
push edx
call fcn.0040b600
mov dword [ebp - 8], eax
dec esi
jns 0x40b682
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
test eax, eax
mov eax, dword [ebp - 8]
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8