joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416ce0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
xor esi, esi
cmp dword [0x4298dc], esi
push edi
mov edi, dword [ebp + 8]
mov ebx, 0x201
jbe 0x416e07
test dword [0x4298e8], edi
je 0x416e07
cmp edi, 0x10002
je 0x416d4c
cmp edi, 0x20002
je 0x416d49
cmp edi, 0x40002
je 0x416d45
cmp edi, 0x80002
je 0x416d40
xor eax, eax
cmp edi, 0x100002
setne al
add eax, 4
mov esi, eax
jmp 0x416d4c
push 3
pop esi
jmp 0x416d4c
push 2
jmp 0x416d42
xor esi, esi
inc esi
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [esi*4 + 0x4276e4]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
push 0x429878
push 0x404104
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.00416a9f
add esp, 0x28
test eax, eax
jl 0x416e9f
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00416a1f
test eax, eax
jl 0x416e9f
mov eax, dword [ebp - 4]
cmp eax, ebx
jae 0x416e9f
lea ecx, [ebp + 0x10]
push ecx
push dword [ebp + 0xc]
mov ecx, ebx
sub ecx, eax
push ecx
lea eax, [ebp + eax - 0x218]
push eax
call fcn.00416a84
test eax, eax
jge 0x416de8
cmp eax, 0x7a
jne 0x416e9f
push 0x404100
push ebx
lea eax, [ebp - 0x218]
push eax
call fcn.00416ac6
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x4276e0], 0xffffffff
je 0x416e9f
xor eax, eax
cmp dword [0x4298e0], eax
ja 0x416e26
cmp dword [0x4298e4], eax
jbe 0x416e9f
cmp edi, 0x10002
je 0x416e62
cmp edi, 0x20002
je 0x416e5f
cmp edi, 0x40002
je 0x416e5b
cmp edi, 0x80002
je 0x416e56
xor eax, eax
cmp edi, 0x100002
setne al
add eax, 4
jmp 0x416e62
push 3
pop eax
jmp 0x416e62
push 2
jmp 0x416e58
xor eax, eax
inc eax
push dword [ebp + 0xc]
push dword [eax*4 + 0x4276e4]
lea eax, [ebp - 0x218]
push 0x4040f8
push ebx
push eax
call fcn.00416a9f
add esp, 0x14
test eax, eax
jl 0x416e9f
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
or edi, 4
push edi
push dword [0x4276e0]
call sub.rtutils.dll_TraceVprintfExA
pop edi
pop esi
pop ebx
leave
ret
Function at 0x423755
Capabilities:
Create thread

Disassembly:
mov eax, 0x425361
call fcn.00416848
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x4298ec], edi
mov esi, ecx
mov ebx, 0x80002
je 0x423782
push 0x40f2a8
push ebx
call fcn.00416ce0
pop ecx
pop ecx
push esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi + 0x30], edi
mov dword [ebp - 4], edi
jne 0x423802
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, edi
mov dword [esi + 0x3c], eax
jne 0x4237c5
cmp dword [0x4298ec], edi
je 0x4237be
push 0x40f288
push 0x10002
call fcn.00416ce0
pop ecx
pop ecx
mov edi, 0x80004005
jmp 0x42381a
lea eax, [ebp - 0x14]
push eax
push edi
push esi
push 0x423749
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x40], eax
jne 0x423802
cmp dword [0x4298ec], edi
je 0x4237be
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x40f26c
push 0x10002
call fcn.00416ce0
add esp, 0xc
jmp 0x4237be
inc dword [esi + 0x30]
cmp dword [0x4298ec], edi
je 0x42381a
push 0x40f24c
push ebx
call fcn.00416ce0
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x402130
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str.RealPlayer_CommandLine_Mutex
mov ebx, ecx
push 1
push eax
inc ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x40223e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x402180
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [0x439068]
mov ecx, 0x1f
mov byte [ebp - 0x8c], al
xor eax, eax
lea edi, [ebp - 0x8b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x8c]
push str.RealPlayer_CommandLine_Shmem__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x8c]
push edx
push ebx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
mov dword [ebp - 4], edi
je 0x402230
push ebx
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x402229
mov esi, dword [ebp + 0xc]
mov ecx, ebx
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 8]
push eax
push 0x590
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402740
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [str.SoftwareRealNetworksRealJukebox1.0Preferences]
lea ecx, [ebp - 0xc]
push eax
push ecx
push 1
push str.ClearLibCorruptionOnShutdown
mov dword [ebp - 0xc], 1
call fcn.0040b700
mov eax, dword [ebp - 0xc]
add esp, 0x10
test eax, eax
je 0x4027ca
lea edx, [ebp - 0x110]
push 0x104
push edx
call fcn.004027d0
mov al, byte [ebp - 0x110]
add esp, 8
test al, al
je 0x4027ca
lea ecx, [ebp - 8]
call fcn.004069e0
lea eax, [ebp - 0x110]
lea ecx, [ebp - 8]
push eax
push str._scpt
push ecx
call fcn.00407360
mov al, byte [ebp - 1]
add esp, 0xc
cmp al, 0xff
lea eax, [ebp - 8]
jne 0x4027bb
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 8]
call fcn.00406b10
mov esp, ebp
pop ebp
ret
Function at 0x4028b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov edi, 0x410714
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40294b
lea eax, [ebp - 0x104]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.PNCRT.dll_strrchr]
lea ecx, [ebp - 0x104]
push 0x5c
push ecx
call esi
add esp, 8
test eax, eax
jne 0x402912
lea edx, [ebp - 0x104]
push 0x2f
push edx
call esi
add esp, 8
test eax, eax
jne 0x402912
lea eax, [ebp - 0x104]
jmp 0x402913
inc eax
push 0x104
push 0x410714
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x40294b
mov edi, 0x410828
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x410714
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x410714
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4039a0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
test ebx, ebx
mov esi, ecx
mov dword [ebp - 4], eax
je 0x403ac2
push edi
push str.PATH
call dword [sym.imp.PNCRT.dll_getenv]
add esp, 4
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.004069e0
test edi, edi
je 0x4039e0
push edi
lea ecx, [ebp - 0x14]
call fcn.00406c30
mov al, byte [esi + 0x2b]
add esi, 0x24
cmp al, 0xff
pop edi
je 0x403a48
xor ecx, ecx
cmp al, 7
sete cl
mov eax, ecx
test eax, eax
je 0x403a1d
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
push edx
push 0x410a88
push eax
call fcn.00406ce0
add esp, 0xc
mov ecx, esi
push eax
call fcn.00406bc0
lea ecx, [ebp - 0x1c]
call fcn.00406b10
push 0x410a88
lea ecx, [ebp - 0xc]
call fcn.00406b20
push ebx
lea ecx, [ebp - 0xc]
call fcn.00407040
mov ax, word [ebp - 0xe]
cmp ah, 0xff
je 0x403a5f
xor ecx, ecx
cmp ah, 7
sete cl
mov eax, ecx
jmp 0x403a70
mov al, byte [esi + 4]
test al, al
jne 0x403a1d
mov al, byte [esi + 5]
test al, al
jne 0x403a1d
mov al, byte [esi + 6]
test al, al
je 0x4039f8
jmp 0x403a1d
mov ecx, dword [ebp - 0x10]
test cl, cl
jne 0x403a74
test ch, ch
jne 0x403a74
test al, al
je 0x403a8d
jmp 0x403a74
test eax, eax
jne 0x403a8d
push 0x410a84
lea ecx, [ebp - 0xc]
call fcn.00407040
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0xc]
push edx
call fcn.004070a0
mov al, byte [ebp - 5]
cmp al, 0xff
lea eax, [ebp - 0xc]
jne 0x403a9a
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.PNCRT.dll__putenv]
add esp, 4
mov esi, 0x80004005
test eax, eax
jne 0x403ab0
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00406b10
lea ecx, [ebp - 0x14]
call fcn.00406b10
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405900
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
or ebx, 0xffffffff
push eax
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], 0
mov dword [ebp - 0xcc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dx, word [ebp - 0xc0]
mov esi, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
mov word [ebp - 0x10], dx
xor edx, edx
cmp esi, 2
mov di, ax
sete dl
mov esi, edx
mov word [ebp - 0x14], di
test esi, esi
mov word [ebp - 0x12], cx
je 0x40597f
mov ebx, 8
jmp 0x4059a0
cmp ax, 4
jae 0x40598c
mov ebx, 2
jmp 0x4059a0
jne 0x4059a3
cmp cx, 0xa
sbb ebx, ebx
and ebx, 0xfffffc04
add ebx, 0x400
mov dword [ebp - 0xe], ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x405a8e
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
and eax, 0xffff
cmp eax, 3
ja case.default.0x4059c9
jmp dword [eax*4 + 0x405a98]
test esi, esi
je 0x405a25
cmp di, 3
ja 0x4059e3
jne 0x405a25
cmp word [ebp - 0x12], 0x32
jb 0x405a25
mov eax, dword [ebp - 0x18]
and eax, 0xffff
sub eax, 4
jns 0x4059f9
mov dword [ebp - 0xa], 0xfffffffe
jmp 0x405a64
test eax, eax
jne 0x405a06
mov dword [ebp - 0xa], 1
jmp 0x405a64
cmp eax, 1
jne 0x405a14
mov dword [ebp - 0xa], 2
jmp 0x405a64
sub eax, 2
neg eax
sbb eax, eax
and al, 0xfb
add eax, 4
mov dword [ebp - 0xa], eax
jmp 0x405a64
mov eax, dword [ebp - 0x20]
sub eax, 0x182
je 0x4059f0
sub eax, 0x64
je 0x4059fd
sub eax, 0x64
jne case.default.0x4059c9
mov dword [ebp - 0xa], 2
jmp 0x405a64
mov dword [ebp - 0xa], 0x40
jmp 0x405a64
mov dword [ebp - 0xa], 0x20
jmp 0x405a64
mov dword [ebp - 0xa], 8
jmp 0x405a64
mov dword [ebp - 0xa], 0xffffffff
call fcn.00405ab0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 6], eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov cx, word [ebp - 4]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405ab0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x7fffffff
jne 0x405ac9
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 0
jne 0x405b09
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemFloatingPointProcessor
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x405aff
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4060f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
test eax, eax
je 0x4061f8
mov esi, dword [ebp + 8]
test esi, esi
je 0x4061f8
cmp byte [esi], 0
je 0x4061f8
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4061f8
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0
test eax, eax
jne 0x40614c
mov ecx, dword [edi + 8]
push 0
lea eax, [ebp + 0x10]
push 0
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4061f8
mov eax, dword [ebp + 0x10]
dec eax
je 0x4061b8
sub eax, 3
je 0x40618c
sub eax, 3
jne 0x4061e8
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x4061e4
mov edx, dword [edi + 8]
mov ecx, eax
push edx
push esi
call fcn.00406620
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x4061e4
mov ecx, dword [edi + 8]
push ecx
push esi
mov ecx, eax
call fcn.004064d0
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x4061e4
mov edx, dword [edi + 8]
mov ecx, eax
push edx
push esi
call fcn.004062f0
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
xor eax, eax
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc

Function at 0x4090b0
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
lea ecx, [ebp - 0xc]
push eax
push 0
push ecx
push 0x409080
push 0
push 0
mov dword [ebp - 4], edi
mov dword [ebp + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x409119
push 0xea60
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x409110
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x409128
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push edx
push eax
mov ecx, edi
call fcn.00409170
mov ecx, dword [edi + 0xc04]
xor eax, eax
test ecx, ecx
je 0x409141
mov edx, dword [edi + 0xc08]
push edx
push ebx
call ecx
add esp, 8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x409bc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x409c30
mov al, byte [0x439068]
push edi
mov byte [ebp - 0x400], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
lea eax, [ebp - 0x400]
push edx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.PNCRT.dll_vsprintf]
add esp, 0xc
cmp eax, ebx
pop edi
jle 0x409c30
lea ecx, [ebp + 8]
push ebx
push ecx
push eax
mov eax, dword [esi + 4]
lea edx, [ebp - 0x400]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40a080
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40a10e
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x40a10e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40a10e
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
mov dword [ebp + 8], 0
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x40a10e
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x40a0f6
mov edx, esi
cmp edi, ebx
jb 0x40a100
add edx, ebx
cmp edi, edx
jbe 0x40a119
mov edx, dword [ebp + 8]
add eax, 0x28
inc edx
cmp edx, ecx
mov dword [ebp + 8], edx
jb 0x40a0e8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
inc edx
sub edi, ebx
mov dword [eax], edx
mov dword [ecx], edi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40a6d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0x40a80f
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x40a804
push str.EnumProcesses
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x664]
test edx, edx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
je 0x40a804
lea eax, [ebp - 4]
lea ecx, [ebp - 0x664]
push eax
push 0x400
push ecx
call edx
test eax, eax
mov dword [ebp - 8], eax
je 0x40a801
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
shr eax, 2
mov dword [ebp - 4], eax
je 0x40a801
lea ebx, [ebp - 0x664]
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [ebx]
mov dword [ebp - 0x264], 0x128
push eax
push 0
push 0x410
mov dword [ebp - 0x25c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a7de
mov edx, dword [esi + 0x10]
push str.EnumProcessModules
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], ecx
je 0x40a7d7
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xc]
push ecx
push 4
push edx
push edi
call eax
test eax, eax
je 0x40a7d7
mov eax, dword [esi + 0x10]
push str.GetModuleBaseNameA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a7d7
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0x240]
push 0x103
push ecx
push edx
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x264]
push eax
push esi
call dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add esp, 8
inc eax
add ebx, 4
cmp eax, ecx
mov dword [ebp - 0x10], eax
jb 0x40a750
mov ebx, dword [ebp - 8]
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x40a8b4
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Process32First
push eax
call edi
mov ecx, dword [esi + 8]
push str.Process32Next
push ecx
mov ebx, eax
call edi
test ebx, ebx
mov dword [ebp - 8], eax
je 0x40a8b4
test eax, eax
je 0x40a8b4
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x13c]
lea edx, [ebp - 0x13c]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push edx
push eax
mov dword [ebp - 0x13c], 0x128
call ebx
mov ebx, dword [ebp + 8]
mov edi, eax
test edi, edi
je 0x40a87b
lea ecx, [ebp - 0x13c]
push ecx
push esi
call ebx
add esp, 8
test edi, edi
je 0x40a8a9
mov eax, dword [esi]
lea edx, [ebp - 0x13c]
push edx
push eax
mov dword [ebp - 0x13c], 0x128
call dword [ebp - 8]
test eax, eax
je 0x40a8a9
lea ecx, [ebp - 0x13c]
push ecx
push esi
call ebx
add esp, 8
jmp 0x40a87f
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b030
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcb0
push ebx
push esi
push edi
mov esi, ecx
call fcn.00409a10
push str._Process_Info__r_n
push esi
call fcn.00409bc0
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.ProcessId:__lu_r_n
push esi
call fcn.00409bc0
mov al, byte [0x439068]
mov ecx, 0xff
mov byte [ebp - 0x4b0], al
xor eax, eax
lea edi, [ebp - 0x4af]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x4b0]
push 0x400
xor ebx, ebx
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x4b0]
push edx
push str.Name:__s_r_n
push esi
call fcn.00409bc0
mov dl, byte [0x439068]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xcaf]
mov byte [ebp - 0xcb0], dl
mov byte [ebp - 0xb0], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0xaf]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xcb0]
lea ecx, [ebp - 0x4b0]
push eax
push 0x800
push ebx
push ecx
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40b157
lea edx, [ebp - 8]
lea eax, [ebp - 4]
push edx
push eax
lea ecx, [ebp - 0xcb0]
push 0x41070c
push ecx
mov dword [ebp - 8], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40b157
mov eax, dword [ebp - 4]
xor edx, edx
mov dx, word [eax + 0xc]
mov ecx, dword [eax + 0xc]
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
shr ecx, 0x10
push ecx
push edx
shr eax, 0x10
push eax
lea ecx, [ebp - 0xb0]
push str._lu._lu._lu._lu
push ecx
call dword [sym.imp.PNCRT.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0xb0]
push edx
push str.Version:__s_r_n
push esi
call fcn.00409bc0
mov eax, dword [esi + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x40b1c8
push str.GetProcessMemoryInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40b1c8
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x30]
push 0x28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x40b1c8
mov ecx, dword [ebp - 0x24]
push ecx
push str.WorkingSetSize:__lu_Bytes_r_n
push esi
call fcn.00409bc0
mov edx, dword [ebp - 0x10]
add esp, 0xc
push edx
push str.PagefileUsage:__lu_Bytes_r_n
push esi
call fcn.00409bc0
add esp, 0xc
push 0x411350
push esi
call fcn.00409bc0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret