joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404350
Capabilities:
Enumerate processes

Disassembly:
sub esp, 0x52c
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x528], eax
mov eax, dword [esp + 0x530]
push ebx
mov ebx, dword [esp + 0x538]
push esi
push edi
push 0x200
push eax
lea eax, [esp + 0x13c]
push 0x200
push eax
call fcn.0040bce4
lea ecx, [esp + 0x144]
push 0x200
push ecx
call fcn.0040c204
add esp, 0x18
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x4043cd
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x528]
xor ecx, esp
call fcn.0040a52f
add esp, 0x52c
ret
push 0x128
lea edx, [esp + 0x10]
push 0
push edx
call fcn.0040a110
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x404490
lea esp, [esp]
push 0x200
lea ecx, [esp + 0x34]
push ecx
lea edx, [esp + 0x33c]
push 0x200
push edx
call fcn.0040bce4
lea eax, [esp + 0x344]
push 0x200
push eax
call fcn.0040c204
lea ecx, [esp + 0x14c]
push ecx
lea edx, [esp + 0x350]
push edx
call fcn.0040bfb0
add esp, 0x20
test eax, eax
je 0x404461
test ebx, ebx
je 0x40445e
cmp edi, dword [esp + 0x544]
jge 0x40445e
mov eax, dword [esp + 0x14]
mov dword [ebx + edi*4], eax
add edi, 1
push 0x128
lea ecx, [esp + 0x10]
push 0
push ecx
call fcn.0040a110
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push esi
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x404400
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x534]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040a52f
add esp, 0x52c
ret

Function at 0x4044c0
Capabilities:
Delete registry value
Persist via run registry key
Print debug messages

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x41f5f8
push 0x80000001
call esi
test eax, eax
je 0x40450e
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
push 0x41f5f8
push 0x80000002
call esi
test eax, eax
je 0x40450e
push str.AutoLaunch_open_key_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push 0x41f5d4
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x40452d
push str.AutoLaunch_del_key_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x404540
Capabilities:
Persist via run registry key
Print debug messages
Query or enumerate registry value

Disassembly:
push ecx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push 0x41f5f8
push 0x80000001
call esi
test eax, eax
je 0x404590
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
push 0x41f5f8
push 0x80000002
call esi
test eax, eax
je 0x404590
push str.AutoLaunch_open_key_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
pop esi
pop ecx
ret
mov edx, dword [esp + 4]
push 0
push 0
push 0
push 0
push 0x41f5d4
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
sete al
pop esi
pop ecx
ret

Function at 0x4045c0
Capabilities:
Delete registry key
Print debug messages
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x108], eax
mov eax, dword [esp + 0x114]
push ebp
mov ebp, dword [esp + 0x114]
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
push eax
push ebp
mov dword [esp + 0x1c], eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x404622
push 0x41f648
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
pop ebp
mov ecx, dword [esp + 0x108]
xor ecx, esp
call fcn.0040a52f
add esp, 0x10c
ret
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x100
lea edx, [esp + 0x1c]
push edx
push 0
push eax
xor bl, bl
call edi
mov esi, eax
test esi, esi
jne 0x404676
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
call fcn.004045c0
mov ecx, dword [esp + 0x18]
add esp, 8
test al, al
push 0x100
lea eax, [esp + 0x1c]
push eax
push 0
push ecx
sete bl
call edi
mov esi, eax
test esi, esi
je 0x404646
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x4046a1
cmp esi, 0x103
jne 0x4046a1
mov eax, dword [esp + 0x14]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x4046a1
mov al, 1
jmp 0x4046ae
push 0x41f628
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor al, al
mov ecx, dword [esp + 0x118]
pop edi
pop esi
pop ebx
pop ebp
xor ecx, esp
call fcn.0040a52f
add esp, 0x10c
ret
Function at 0x4046f0
Capabilities:
Persist via run registry key
Print debug messages
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x104], eax
push esi
call fcn.00406a30
push eax
lea eax, [esp + 0xc]
push str._s_vsee.exe__quiet_start
push eax
call fcn.00401830
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 0xf003f
push 0
push 0x41f5f8
push 0x80000001
call esi
test eax, eax
je 0x40477c
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push 0x41f5f8
push 0x80000002
call esi
test eax, eax
je 0x40477c
push str.AutoLaunch_open_key_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop esi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.0040a52f
add esp, 0x108
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 4]
push eax
lea ecx, [esp + 0xc]
push ecx
push 1
push 0
push 0x41f5d4
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x4047b0
push str.AutoLaunch_set_key_failed_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x108]
pop esi
xor ecx, esp
call fcn.0040a52f
add esp, 0x108
ret
Function at 0x404f90
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x220]
push 0xb0
push str.WriteLZMAResource
push str....._vseeCore_vseeResource.cpp
call fcn.004010e0
add esp, 0xc
test al, al
je 0x404fe4
call fcn.00401610
call fcn.00401580
push esi
push str.WriteCompressedResource:__s_n
call fcn.004014d0
add esp, 8
call fcn.00401630
cmp byte [esp + 0x228], 0
mov dword [esp + 4], 0
push esi
je 0x405016
call fcn.00406a30
push eax
push str._s_s
lea eax, [esp + 0x1c]
push 0x104
push eax
call fcn.0040a7fb
add esp, 0x14
jmp 0x405028
lea ecx, [esp + 0x14]
push 0x104
push ecx
call fcn.0040a0a1
add esp, 0xc
push 0x41d46c
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0xc]
push eax
call fcn.0040a46e
add esp, 0xc
test eax, eax
jne 0x4050e3
movzx ecx, word [esp + 0x21c]
push edi
push 0xa
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov eax, dword [esi]
mov dword [esp + 0xc], eax
mov edx, dword [esi + 4]
push eax
mov dword [esp + 0x14], edx
call fcn.0040bee9
add esp, 4
push 5
mov edi, eax
lea eax, [esi + 8]
push eax
lea ecx, [esp + 0x18]
push ecx
add esi, 0xd
push esi
lea edx, [esp + 0x1c]
push edx
push edi
call fcn.00408030
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push eax
push 1
push ecx
push edi
call fcn.0040b8bd
mov edx, dword [esp + 0x18]
push edx
call fcn.0040a316
add esp, 0x14
pop edi
mov al, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040a52f
add esp, 0x214
ret
push esi
lea eax, [esp + 0x118]
push str.unable_to_create_lzma_resource_file__s
push eax
call fcn.00401830
add esp, 0xc
cmp byte [esp + 0x224], 0
je 0x40512d
cmp byte [0x424224], 0
je 0x40512d
push 0x1000
push 0x41f72c
lea ecx, [esp + 0x11c]
push ecx
push 0
mov byte [0x424224], 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [esp + 0x214]
pop esi
xor ecx, esp
xor al, al
call fcn.0040a52f
add esp, 0x214
ret
Function at 0x406570
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4065ae
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4065a7
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x406940
Capabilities:
Create process on windows
Query environment variable
Self delete

Disassembly:
sub esp, 0x20c
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x208], eax
push 0x104
lea eax, [esp + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x406a12
push 0x104
lea ecx, [esp + 4]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x406a12
push esi
push 0x420114
lea eax, [esp + 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x10c]
push edx
call esi
push 0x42010c
lea eax, [esp + 0x10c]
push eax
call esi
push 0x104
lea ecx, [esp + 8]
push ecx
push 0x420104
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
pop esi
je 0x406a12
push 0
push 0
lea edx, [esp + 0x10c]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x406a12
mov al, 1
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040a52f
add esp, 0x20c
ret
mov ecx, dword [esp + 0x208]
xor ecx, esp
xor al, al
call fcn.0040a52f
add esp, 0x20c
ret
Function at 0x406a30
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
cmp dword [0x4aaaf8], 0
push esi
push edi
jne 0x406bb9
push 0x100
mov dword [esp + 0x10], 0x100
call fcn.00409a70
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 4
lea ecx, [esp + 8]
push ecx
push 1
push 0
mov dword [0x4aaaf8], eax
mov eax, dword [esp + 0x18]
push 0x41d4b4
push 0x80000002
mov dword [0x4aaafc], eax
call esi
test eax, eax
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
jne 0x406b01
mov eax, dword [0x4aaaf8]
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push 0
push 0x420178
push ecx
call edi
test eax, eax
jne 0x406b01
mov edx, dword [0x4aaaf8]
push 0x41d5a6
push edx
call fcn.00406670
add esp, 8
test al, al
jne 0x406b01
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4aaaf8]
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
add ecx, 1
test dl, dl
jne 0x406ad6
sub ecx, esi
je 0x406bbe
cmp byte [eax + ecx - 1], 0x5c
jne 0x406bbe
pop edi
mov byte [eax + ecx - 1], dl
mov eax, dword [0x4aaaf8]
pop esi
add esp, 8
ret
lea ecx, [esp + 8]
push ecx
push 1
push 0
push 0x42014c
push 0x80000002
call esi
test eax, eax
jne 0x406b9e
mov eax, dword [0x4aaaf8]
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push 0
push 0x42013c
push ecx
call edi
test eax, eax
jne 0x406b6d
mov edx, dword [0x4aaafc]
mov eax, dword [0x4aaaf8]
push 0x420134
push edx
push eax
call fcn.004066a0
mov eax, dword [esp + 0x14]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4aaaf8]
pop edi
pop esi
add esp, 8
ret
mov ecx, dword [0x4aaafc]
mov edx, dword [0x4aaaf8]
push 0x42011c
push ecx
push edx
call fcn.0040a0a1
mov eax, dword [esp + 0x14]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4aaaf8]
pop edi
pop esi
add esp, 8
ret
mov ecx, dword [0x4aaafc]
mov edx, dword [0x4aaaf8]
push 0x42011c
push ecx
push edx
call fcn.0040a0a1
add esp, 0xc
mov eax, dword [0x4aaaf8]
pop edi
pop esi
add esp, 8
ret
Function at 0x406c30
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x20c], eax
mov eax, dword [esp + 0x214]
push esi
add eax, 0xffffffff
cmp eax, 3
push edi
mov edi, dword [esp + 0x220]
ja case.default.0x406c60
jmp dword [eax*4 + 0x406e64]
mov esi, 0xb
jmp 0x406c7e
mov esi, 2
jmp 0x406c7e
xor esi, esi
jmp 0x406c7e
mov esi, 0x17
test edi, edi
jne 0x406cd5
call fcn.00401610
call fcn.00401580
push str.linkName___0
push 0x83
push str.LinkExist
push 0x41ffe8
push 0x41d410
call fcn.004014d0
push 0x41d3fc
call fcn.004014d0
call fcn.00401630
push 0x83
push str.LinkExist
push 0x41ffe8
push str.linkName___0
call fcn.004019f0
add esp, 0x28
cmp byte [edi], 0
jne 0x406d2d
call fcn.00401610
call fcn.00401580
push str.linkName_0____0
push 0x84
push str.LinkExist
push 0x41ffe8
push 0x41d410
call fcn.004014d0
push 0x41d3fc
call fcn.004014d0
call fcn.00401630
push 0x84
push str.LinkExist
push 0x41ffe8
push str.linkName_0____0
call fcn.004019f0
add esp, 0x28
lea eax, [esp + 8]
push eax
push esi
push 0
mov dword [esp + 0x14], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 0x103
lea ecx, [esp + 0x11]
push 0
push ecx
mov byte [esp + 0x18], 0
call fcn.0040a110
mov eax, dword [esp + 0x14]
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x406e4b
push 0x103
lea ecx, [esp + 0x115]
push 0
push ecx
mov byte [esp + 0x11c], 0
call fcn.0040a110
add esp, 0xc
cmp esi, 2
je 0x406d9d
cmp esi, 0x17
jne 0x406db4
push 0x420134
lea edx, [esp + 0x10]
push 0x104
push edx
call fcn.004066a0
add esp, 0xc
push edi
lea eax, [esp + 0x10]
push eax
push str._s_s
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040a7fb
lea edx, [esp + 0x124]
push edx
call fcn.00406550
add esp, 0x18
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0040a52f
add esp, 0x210
ret
call fcn.00401610
call fcn.00401580
push str.0___LinkExist:_invalid_value_for_whichFolder_
push 0x80
push str.LinkExist
push 0x41ffe8
push 0x41d410
call fcn.004014d0
push 0x41d3fc
call fcn.004014d0
call fcn.00401630
push 0x80
push str.LinkExist
push 0x41ffe8
push str.0___LinkExist:_invalid_value_for_whichFolder_
call fcn.004019f0
add esp, 0x28
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
xor al, al
call fcn.0040a52f
add esp, 0x210
ret
Function at 0x4071f0
Capabilities:
Get common file path

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x14]
push edi
push str.personal
push esi
call fcn.00406670
mov edi, dword [esp + 0x18]
add esp, 8
test al, al
je 0x407233
mov eax, dword [esp + 0x14]
push eax
push edi
push str.UserSettingsPath
call fcn.004033f0
push 0x41d5a6
push edi
call fcn.00406670
add esp, 0x14
test al, al
je 0x407307
push str.personal
push esi
mov dword [esp + 0x10], 0
call fcn.00406670
add esp, 8
test al, al
je 0x40725e
lea ecx, [esp + 8]
push ecx
push 0x1a
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
jmp 0x407285
push 0x4202e8
push esi
call fcn.00406670
add esp, 8
test al, al
je 0x407281
lea edx, [esp + 8]
push edx
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
jmp 0x407285
mov eax, dword [esp + 8]
test eax, eax
je 0x4072ec
call fcn.00401610
call fcn.00401580
push str.r__S_OK
push 0x134
push str.GetAppDataPath
push 0x41ffe8
push 0x41d410
call fcn.004014d0
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SHGetSpecialFolderLocation_failed:__d___syserror__
call fcn.004014d0
call fcn.00401630
push 0x134
push str.GetAppDataPath
push 0x41ffe8
push str.r__S_OK
call fcn.004019f0
add esp, 0x18
pop edi
xor eax, eax
pop esi
pop ecx
ret
mov eax, dword [esp + 8]
push edi
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x4072e6
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x407310
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push eax
push edi
push esi
call fcn.004071f0
add esp, 0xc
test eax, eax
je 0x407361
push 0x420134
push edi
push esi
call fcn.004066a0
add esp, 0xc
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40737a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 3
jne 0x407366
push str.Invalid_path_name_to_VSee_application_directory_n
call fcn.004014d0
add esp, 4
pop edi
xor eax, eax
pop esi
ret
xor ecx, ecx
cmp eax, 0xb7
setne cl
pop edi
sub ecx, 1
and ecx, esi
mov eax, ecx
pop esi
ret
pop edi
mov eax, esi
pop esi
ret

Function at 0x407380
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x208], eax
push str.personal
lea eax, [esp + 0x108]
push 0x104
push eax
call fcn.00407310
add esp, 0xc
lea ecx, [esp]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea edx, [esp]
push edx
lea eax, [esp + 0x108]
push eax
call fcn.00406670
mov ecx, dword [esp + 0x210]
add esp, 8
xor ecx, esp
call fcn.0040a52f
add esp, 0x20c
ret
Function at 0x4074a0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x328
mov eax, dword [0x424310]
xor eax, esp
mov dword [esp + 0x324], eax
mov ecx, dword [esp + 0x33c]
mov eax, dword [esp + 0x338]
mov edx, dword [esp + 0x340]
push ebx
push ebp
mov ebp, dword [esp + 0x338]
push esi
push edi
mov edi, dword [esp + 0x33c]
push str.0.0.0.0
mov dword [esp + 0x30], ecx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x358]
lea ecx, [esp + 0x38]
push 0x100
push ecx
mov dword [esp + 0x30], ebp
mov dword [esp + 0x2c], edx
mov dword [esp + 0x34], eax
call fcn.0040a0a1
xor esi, esi
add esp, 0xc
cmp ebp, esi
je 0x407525
mov edx, dword [esp + 0x344]
push edx
push esi
push ebp
call fcn.0040a110
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
xor bl, bl
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x407607
push esi
call fcn.00409a70
add esp, 4
push eax
push esi
push 0
push edi
mov dword [esp + 0x28], eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4075fa
mov esi, dword [esp + 0x18]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x34]
push edx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4075fa
mov eax, dword [esp + 0x30]
movzx ecx, word [eax + 2]
movzx edx, word [eax]
push ecx
push edx
lea eax, [esp + 0x13c]
push str.StringFileInfo_04x_04xProductVersion
push eax
call fcn.00405150
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x13c]
push eax
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4075fa
mov ebp, dword [esp + 0x14]
xor edx, edx
lea edi, [esp + 0x34]
mov al, byte [edx + ebp]
cmp al, 0x20
je 0x4075dd
cmp al, 0x2c
jne 0x4075d8
mov byte [edi], 0x2e
jmp 0x4075da
mov byte [edi], al
add edi, 1
mov eax, ebp
add edx, 1
lea esi, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4075e5
sub eax, esi
cmp edx, eax
jbe 0x4075c8
mov ebp, dword [esp + 0x24]
mov bl, 1
mov ecx, dword [esp + 0x18]
push ecx
call fcn.00409a75
add esp, 4
test ebp, ebp
je 0x407621
mov eax, dword [esp + 0x344]
lea edx, [esp + 0x34]
push edx
push eax
push ebp
call fcn.0040a0a1
add esp, 0xc
lea ecx, [esp + 0x34]
push 0x2e
push ecx
call fcn.0040bc10
mov edi, dword [esp + 0x24]
add esp, 8
test edi, edi
mov esi, eax
mov byte [esi], 0
je 0x40764c
lea edx, [esp + 0x34]
push edx
call fcn.0040bcce
add esp, 4
mov dword [edi], eax
lea edi, [esi + 1]
push 0x2e
push edi
call fcn.0040bc10
mov ebp, dword [esp + 0x34]
add esp, 8
test ebp, ebp
mov esi, eax
mov byte [esi], 0
je 0x407673
push edi
call fcn.0040bcce
add esp, 4
mov dword [ebp], eax
add esi, 1
push 0x2e
push esi
call fcn.0040bc10
mov ebp, dword [esp + 0x28]
add esp, 8
test ebp, ebp
mov edi, eax
mov byte [edi], 0
je 0x40769a
push esi
call fcn.0040bcce
add esp, 4
mov dword [ebp], eax
mov esi, dword [esp + 0x28]
test esi, esi
je 0x4076b0
add edi, 1
push edi
call fcn.0040bcce
add esp, 4
mov dword [esi], eax
mov ecx, dword [esp + 0x334]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040a52f
add esp, 0x328
ret
Function at 0x40a52f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424310]
jne 0x40a539
repz ret
jmp fcn.0040fdd3
Function at 0x40b93f
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x40b97c
cmp dword [ebp + 0x14], edi
je 0x40b97c
cmp ecx, edi
jne 0x40b983
call fcn.0040db72
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.0040ad2b
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x40b997
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x40b9b8
cmp ebx, 0xffffffff
je 0x40b9a7
push ebx
push edi
push ecx
call fcn.0040a110
add esp, 0xc
cmp esi, edi
je 0x40b964
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x40b964
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x40b9d4
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x40b9db
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x40bacc
test word [esi + 0xc], 0x10c
je 0x40ba2f
mov eax, dword [esi + 4]
test eax, eax
je 0x40ba2f
jl 0x40bb2d
cmp ebx, eax
mov edi, ebx
jb 0x40ba00
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x40bad4
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00409ebd
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x40bac4
cmp ebx, dword [ebp - 0xc]
jb 0x40ba9c
cmp dword [ebp - 0xc], 0
je 0x40ba59
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x40ba4e
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x40ba55
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x40ba64
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x40ba64
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x40bb00
push eax
push dword [ebp - 8]
push esi
call fcn.0040f324
pop ecx
push eax
call fcn.004144ae
add esp, 0xc
test eax, eax
je 0x40bb3f
cmp eax, 0xffffffff
je 0x40bb2d
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x40bac4
push esi
call fcn.00413dcd
cmp eax, 0xffffffff
pop ecx
je 0x40bb31
cmp dword [ebp - 4], 0
je 0x40bb00
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x40b9e3
mov eax, dword [ebp + 0x14]
jmp 0x40b97e
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x40baeb
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.0040a110
add esp, 0xc
call fcn.0040db72
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x40b974
cmp dword [ebp + 0xc], 0xffffffff
je 0x40bb16
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.0040a110
add esp, 0xc
call fcn.0040db72
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x40b974
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x40b97e
or dword [esi + 0xc], 0x10
jmp 0x40bb31