joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4182a0
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
mov ebx, dword [esp + 0x10]
push edi
push ebp
push str.system.ini
push 0xa00
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push 0x459458
push str.display.drv
push str.boot
call esi
cmp eax, 1
jbe 0x418305
push str.shellscr.drv
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push ebx
call edi
test eax, eax
jne 0x41830b
push 0x8b
call fcn.0040e100
add esp, 4
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.0040d9f0
mov ebp, dword [esp + 0x28]
add esp, 8
inc dword [ebp]
jmp 0x41830f
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov ebp, dword [esp + 0x20]
push str.system.ini
push 0xa00
push ebx
push 0x459458
push str.system.drv
push str.boot
call esi
cmp eax, 1
jbe 0x418387
push str.atmsys.drv
push ebx
call edi
test eax, eax
jne 0x418387
push str.atm.ini
push 0xa00
push ebx
push 0x4595dc
push 0x4595d8
push str.Settings
call esi
cmp eax, 1
jbe 0x418387
push 0x4595c8
push ebx
call edi
test eax, eax
jne 0x418387
push 0x8c
call fcn.0040e100
add esp, 4
push eax
mov eax, dword [esp + 0x18]
push eax
call fcn.0040d9f0
add esp, 8
inc dword [ebp]
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x418470
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
push ebp
mov edi, dword [esp + 0x18]
push str.wifeman.ini
push 0x800
push edi
push 0x459458
push 0
push str.FontDrivers
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 2
ja 0x4184a1
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
mov ebp, dword [esp + 0x20]
cmp dword [ebp], 0
jle 0x4184c8
push 0x37
call fcn.0040e100
mov esi, dword [esp + 0x18]
add esp, 4
push eax
push esi
call fcn.0040d9f0
add esp, 8
inc dword [ebp]
jmp 0x4184cc
mov esi, dword [esp + 0x14]
push 0xb3
call fcn.0040e100
add esp, 4
push eax
push esi
call fcn.0040d9f0
mov ebx, dword [esp + 0x24]
add esp, 8
inc dword [ebp]
cmp byte [edi], 0
je 0x418533
push str.wifeman.ini
push 0x200
push ebx
push 0x459458
push edi
push str.FontDrivers
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jbe 0x418523
push ebx
push edi
push 0x92
push esi
call fcn.0040db90
add esp, 0x10
inc dword [ebp]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + edi + 1]
cmp byte [edi], 0
jne 0x4184ef
push str.wifeman.ini
push 0x800
push edi
push 0x459458
push 0
push str.FontPackages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 2
ja 0x41855c
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
push 0x37
call fcn.0040e100
add esp, 4
push eax
push esi
call fcn.0040d9f0
add esp, 8
inc dword [ebp]
push 0xb4
call fcn.0040e100
add esp, 4
push eax
push esi
call fcn.0040d9f0
add esp, 8
inc dword [ebp]
cmp byte [edi], 0
je 0x4185d6
push str.wifeman.ini
push 0x200
push ebx
push 0x459458
push edi
push str.FontPackages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jbe 0x4185c6
push ebx
push edi
push 0x92
push esi
call fcn.0040db90
add esp, 0x10
inc dword [ebp]
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + edi + 1]
cmp byte [edi], 0
jne 0x418592
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x418f10
Capabilities:
Get file size

Disassembly:
push esi
push edi
mov esi, 0xffffffff
push 0
mov eax, dword [esp + 0x10]
push 4
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x418f4a
cmp edi, esi
je 0x418f4a
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
ret

Function at 0x419190
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
push str.SYSTEM.INI
mov ecx, dword [esp + 0xc]
push eax
mov edx, dword [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret

Function at 0x419590
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x24
xor eax, eax
mov ecx, 8
push esi
push edi
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov dword [esp + 0xc], 0x20
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x30]
shr eax, 0xa
push eax
push 0x6f
push esi
call fcn.0040db10
mov edi, dword [esp + 0x24]
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x40000000
je 0x4195e1
xor eax, eax
jmp 0x4195f1
and eax, 0x80000000
cmp eax, 1
mov eax, 2
adc eax, 0xffffffff
test eax, eax
jne 0x419623
lea eax, [esp + 8]
push 4
mov dword [esp + 0xc], 0
push eax
push str.VMMcpgFree
push str.PerfStatsStatData
push 0x80000006
call fcn.00419b90
add esp, 0x14
test eax, eax
je 0x419623
mov edi, dword [esp + 8]
shr edi, 0xa
push edi
push 0x65
push esi
call fcn.0040db10
add esp, 0xc
cmp dword [0x457840], 0
jne 0x419640
call fcn.0040e5a0
cmp dword [0x457844], 0
je 0x419675
call fcn.0040e630
cmp eax, 0xffffffff
je 0x41965f
push eax
push 0x60
push esi
call fcn.0040da80
add esp, 0xc
call fcn.0040e6b0
cmp eax, 0xffffffff
je 0x419675
push eax
push 0x61
push esi
call fcn.0040da80
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push esi
call fcn.004191e0
add esp, 8
mov eax, 1
pop edi
pop esi
add esp, 0x24
ret

Function at 0x4196b0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov al, byte [0x44a9d0]
test al, 1
jne 0x4196f1
or al, 1
cmp dword [0x45743c], 0
mov byte [0x44a9d0], al
jne 0x4196e7
push 0
push str.IncludeNetworkDrives
call fcn.0040b7b0
mov dword [0x44a9d4], 0
add esp, 8
test eax, eax
je 0x4196f1
mov dword [0x44a9d4], 1
mov esi, dword [0x44a9d4]
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x419709
mov esi, 1
mov eax, esi
pop esi
ret
Function at 0x419710
Capabilities:
Get disk information
Get disk size

Disassembly:
sub esp, 0x2c
push ebx
push esi
push edi
push ebp
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
sub al, 0x11
cmp al, 1
sbb eax, eax
neg eax
cmp eax, 1
sbb edi, edi
and edi, 2
cmp edi, 0x1a
jge 0x419823
mov esi, dword [esp + 0x40]
xor ebx, ebx
lea eax, [edi + 0x41]
lea ecx, [esp + 0x30]
push eax
push 0x4508e0
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x3c]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
cmp al, 0x11
jne 0x419787
cmp edi, 2
jge 0x419787
cmp ebp, 2
je 0x419819
cmp ebp, 5
je 0x419819
cmp ebp, 4
jne 0x41979b
cmp dword [esp + 0x44], ebx
je 0x419819
lea eax, [esp + 0x24]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x18]
push eax
lea eax, [esp + 0x18]
push ecx
lea ecx, [esp + 0x38]
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x419819
lea eax, [edi + 0x41]
mov ecx, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov byte [esp + 0x12], al
mov eax, dword [esp + 0x14]
mov byte [esp + 0x13], bl
mov dword [esp + 0x28], ecx
mov dword [esp + 0x2c], ebx
fild qword [esp + 0x28]
mov dword [esp + 0x28], edx
mov dword [esp + 0x2c], ebx
fild qword [esp + 0x28]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ebx
fmulp st(1)
fild qword [esp + 0x28]
fmulp st(1)
fmul qword [0x450a28]
call fcn.004205f4
lea ecx, [esp + 0x12]
push eax
push ecx
push 0x63
push esi
call fcn.0040dd70
add esp, 0x10
inc edi
cmp edi, 0x1a
jl 0x41974b
mov eax, dword [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x419860
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0xb8
push ebx
push esi
push edi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersion]
call esi
mov ebx, eax
call esi
test eax, 0x40000000
je 0x419880
xor eax, eax
jmp 0x419890
and eax, 0x80000000
cmp eax, 1
mov eax, 2
adc eax, 0xffffffff
test eax, eax
jne 0x41989b
mov eax, 0x6c
jmp 0x4198a7
dec eax
cmp eax, 1
mov eax, 0x6e
adc eax, 0xffffffff
push eax
call fcn.0040e100
mov esi, dword [esp + 0xcc]
add esp, 4
push eax
push 0x6b
push esi
call fcn.0040db50
mov dword [esp + 0x3c], 0x94
lea eax, [esp + 0x3c]
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
xor eax, eax
mov al, bh
push eax
xor eax, eax
mov al, bl
push eax
push 0x56
push esi
call fcn.0040dac0
lea edi, [esp + 0x1c]
add esp, 0x10
xor eax, eax
mov ecx, 9
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [esp + 0x24], 0x182
jne 0x419914
mov eax, 0x5c
jmp 0x419937
cmp dword [esp + 0x24], 0x1e6
mov eax, 0x5d
je 0x419937
mov eax, dword [esp + 0x24]
sub eax, 0x24a
cmp eax, 1
sbb eax, eax
and eax, 0xc
add eax, 0x5e
push eax
call fcn.0040e100
add esp, 4
push eax
push 0x5a
push esi
call fcn.0040db50
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0xb8
ret
Function at 0x419ab0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 4
lea eax, [esp]
push esi
push edi
xor esi, esi
mov edi, dword [esp + 0x1c]
push eax
mov ecx, dword [esp + 0x18]
push 0x20019
mov edx, dword [esp + 0x18]
push esi
mov dword [esp + 0x14], esi
push ecx
push edx
mov dword [edi], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x419b05
lea eax, [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0xc]
push ecx
push edi
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x419b05
mov esi, 1
cmp dword [esp + 8], 0
je 0x419b1e
cmp dword [esp + 8], 0xffffffff
je 0x419b1e
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
add esp, 4
ret

Function at 0x419bc0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
xor esi, esi
push eax
lea ecx, [esp + 8]
mov dword [esp + 8], esi
mov edx, dword [esp + 0x18]
push ecx
mov eax, dword [esp + 0x18]
push esi
push 0xf003f
push esi
push 0x450a88
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x419c1e
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x419c1e
mov esi, 1
cmp dword [esp + 4], 0
je 0x419c37
cmp dword [esp + 4], 0xffffffff
je 0x419c37
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x419cd0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x108
push ebx
push esi
mov esi, dword [esp + 0x11c]
push edi
push ebp
mov ecx, esi
push 0xffffffffffffffff
push 0
call fcn.0042ee1d
lea eax, [esp + 0x10]
mov ecx, dword [esp + 0x120]
mov dword [esp + 0x10], 0
push eax
push 0xf003f
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x419d24
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
xor ebp, ebp
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edi, [esp + 0x15]
xor eax, eax
mov ecx, 0x40
push 0x103
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ebp
push ecx
call ebx
test eax, eax
jne 0x419d6a
lea eax, [esp + 0x14]
mov ecx, dword [esi + 8]
push eax
inc ebp
push ecx
mov ecx, esi
call fcn.0042ef67
jmp 0x419d2c
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x108
ret
Function at 0x41a1d0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41a466
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 4
sub esp, 0x1c4
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], 0
push 0x8001
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
push str.WSOCK32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x459720], eax
cmp dword [0x459720], 0
jne 0x41a24b
mov dword [ebp - 0x1bc], str.Unable_to_load_module_WSOCK32.DLL
push 0x4574f0
lea eax, [ebp - 0x1bc]
push eax
call fcn.00420569
push str.WSAStartup
mov eax, dword [0x459720]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x459724], eax
cmp dword [0x459724], 0
jne 0x41a289
mov dword [ebp - 0x1c0], str.Cannot_load_function_WSAStartup
push 0x4574f0
lea eax, [ebp - 0x1c0]
push eax
call fcn.00420569
push str.WSACleanup
mov eax, dword [0x459720]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x459728], eax
cmp dword [0x459728], 0
jne 0x41a2c7
mov dword [ebp - 0x1c4], str.Cannot_load_function_WSACleanup
push 0x4574f0
lea eax, [ebp - 0x1c4]
push eax
call fcn.00420569
push str.socket
mov eax, dword [0x459720]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x45972c], eax
cmp dword [0x45972c], 0
jne 0x41a305
mov dword [ebp - 0x1c8], str.Cannot_load_function_socket
push 0x4574f0
lea eax, [ebp - 0x1c8]
push eax
call fcn.00420569
push str.closesocket
mov eax, dword [0x459720]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x459730], eax
cmp dword [0x459730], 0
jne 0x41a343
mov dword [ebp - 0x1cc], str.Cannot_load_function_closesocket
push 0x4574f0
lea eax, [ebp - 0x1cc]
push eax
call fcn.00420569
push str.WSAGetLastError
mov eax, dword [0x459720]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x459738], eax
cmp dword [0x459738], 0
jne 0x41a381
mov dword [ebp - 0x1d0], str.Cannot_load_function_WSAGetLastError
push 0x4574f0
lea eax, [ebp - 0x1d0]
push eax
call fcn.00420569
mov word [ebp - 0x1b0], 0x101
lea eax, [ebp - 0x1ac]
push eax
mov eax, dword [ebp - 0x1b0]
push eax
call dword [0x459724]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x41a3b0
jmp 0x41a442
xor eax, eax
mov al, byte [ebp - 0x1ac]
cmp eax, 1
jne 0x41a3d2
xor eax, eax
mov al, byte [ebp - 0x1ab]
cmp eax, 1
je 0x41a3ed
mov dword [ebp - 0x1d4], str.Incompatible_WinSockets_module
push 0x4574f0
lea eax, [ebp - 0x1d4]
push eax
call fcn.00420569
push 0
push 1
push 0x12
call dword [0x45972c]
mov dword [ebp - 0x1b4], eax
cmp dword [ebp - 0x1b4], 0xffffffff
je 0x41a420
mov eax, dword [ebp - 0x1b4]
push eax
call dword [0x459730]
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 0
jne 0x41a43c
push 0
push str.AllowVoiceView
call fcn.0040b7b0
add esp, 8
mov dword [ebp - 0x18], eax
call dword [0x459728]
jmp 0x41a44d
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov eax, dword [ebp - 0x18]
jmp 0x41a470
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41a480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp]
lea ecx, [esp + 4]
mov dword [esp], 0
push eax
push 0
push ecx
push 0
push str.global
push 0x80000004
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
sub eax, 0xea
cmp eax, 1
sbb eax, eax
add esp, 8
neg eax
ret

Function at 0x41a4c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, dword [esp + 0x20]
push edi
push ebp
cmp dword [esi], 0
jne 0x41a4ed
mov edi, dword [esp + 0x2c]
push 0x91
push str.MSINFO95PERFDATA.CXX
mov eax, dword [edi]
push eax
call fcn.0040c0a0
add esp, 0xc
mov dword [esi], eax
jmp 0x41a4f1
mov edi, dword [esp + 0x2c]
mov ebx, dword [esp + 0x20]
mov eax, dword [edi]
mov ecx, dword [esi]
lea edx, [esp + 0x14]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push ecx
mov eax, dword [esp + 0x2c]
push edx
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
mov ebp, eax
jne 0x41a540
mov eax, dword [edi]
push 0xa2
add eax, 0x400
push str.MSINFO95PERFDATA.CXX
push eax
mov dword [edi], eax
mov ecx, dword [esi]
push ecx
call fcn.0040c110
add esp, 0x10
mov dword [esi], eax
cmp dword [esi], 0
je 0x41a557
cmp ebp, 0xea
je 0x41a4f5
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov eax, dword [esi]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x18]
push eax
call fcn.0040c170
add esp, 4
mov eax, 8
mov dword [esi], 0
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x41b780
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 8
push esi
push edi
xor esi, esi
push 1
mov edi, dword [esp + 0x18]
push 0x10
push edi
call fcn.00437a26
test eax, eax
je 0x41b7e9
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41b7e9
push edi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x41b7e2
lea ecx, [esp + 0xc]
lea edx, [esp + 8]
push ecx
push edx
push str.VarFileInfoTranslation
push eax
call sub.VERSION.dll_VerQueryValueA
cmp dword [esp + 0xc], 4
jne 0x41b7db
mov eax, dword [esp + 8]
mov esi, dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
add esp, 8
ret

Function at 0x41b800
Capabilities:
Get file version info

Disassembly:
sub esp, 0x10
push ebx
push esi
mov esi, dword [esp + 0x28]
push edi
mov edi, dword [esp + 0x24]
push ebp
lea eax, [esp + 0x18]
mov ebx, dword [esp + 0x24]
push eax
mov byte [edi], 0
push ebx
mov byte [esi], 0
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebp, eax
test ebp, ebp
je 0x41b8ed
push 0x7c
push str.MSINFO95VER32.CXX
push ebp
call fcn.0040c0a0
mov dword [esp + 0x20], eax
add esp, 0xc
test eax, eax
je 0x41b8ed
mov ecx, dword [esp + 0x18]
push eax
push ebp
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x41b8e0
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x10]
mov edx, dword [esp + 0x14]
push eax
mov dword [esp + 0x14], 0
push ecx
push 0x450d30
push edx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x41b8e0
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 8]
movzx ebx, cx
shr ecx, 0x10
push ebx
movzx eax, cx
movzx ebx, dx
shr edx, 0x10
push eax
movzx eax, dx
push ebx
push eax
push str._d._d._d._d
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
call edi
mov edx, dword [esp + 0x28]
add esp, 0x18
mov ecx, dword [edx + 0x14]
mov edx, dword [edx + 0x10]
movzx ebx, cx
shr ecx, 0x10
push ebx
movzx eax, cx
movzx ebx, dx
shr edx, 0x10
push eax
movzx eax, dx
push ebx
push eax
push str._d._d._d._d
push esi
call edi
add esp, 0x18
lea eax, [esp + 0x14]
push eax
call fcn.0040c170
add esp, 4
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x41cdb0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x3e4
push ebx
push esi
mov dword [ecx + 0x38], eax
push edi
push ebp
mov esi, ecx
lea edi, [eax + 0x4c]
push 0x14
push edi
call dword [sym.imp.KERNEL32.dll_IsBadStringPtrA]
test eax, eax
jne 0x41cddf
push edi
lea eax, [esi + 4]
push 0x459f5c
push eax
jmp 0x41cdf0
mov eax, dword [esp + 0x3f8]
lea ecx, [esi + 4]
push eax
push str._lu
push ecx
call fcn.0042ddf7
lea edi, [esp + 0x68]
add esp, 0xc
xor eax, eax
mov ecx, 0xe6
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x3f8]
push eax
mov dword [esp + 0x60], 0x398
lea eax, [esp + 0x60]
push eax
push ecx
call sub.MSACM32.dll_acmDriverDetailsA
test eax, eax
jne 0x41ce34
lea eax, [esp + 0x84]
lea ecx, [esi + 0x10]
push eax
call fcn.0043118b
xor ebx, ebx
mov eax, dword [esp + 0x3f8]
lea ecx, [esp + 0x10]
push ebx
mov dword [esp + 0x14], ebx
push eax
push ecx
call sub.MSACM32.dll_acmDriverOpen
cmp dword [esp + 0x78], ebx
jbe 0x41cefd
lea edi, [esp + 0x14]
xor eax, eax
mov ecx, 0x12
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x1c], ebx
push eax
mov dword [esp + 0x1c], 0x48
push ecx
call sub.MSACM32.dll_acmFormatTagDetailsA
test eax, eax
jne 0x41cefd
cmp dword [esp + 0x14], 0x48
jb 0x41cef2
cmp dword [esp + 0x1c], 1
je 0x41cef2
mov ebp, dword [esp + 0x1c]
mov edi, dword [esi + 0x24]
cmp dword [esi + 0x2c], 0
jne 0x41ceca
push 0xc
mov eax, dword [esi + 0x34]
push eax
lea ecx, [esi + 0x30]
push ecx
call fcn.0042f2df
mov ecx, dword [esi + 0x34]
lea edx, [ecx + ecx*2]
dec ecx
lea eax, [eax + edx*4]
js 0x41ceca
mov edx, dword [esi + 0x2c]
dec ecx
mov dword [eax], edx
mov dword [esi + 0x2c], eax
sub eax, 0xc
test ecx, ecx
jge 0x41ceba
mov ecx, dword [esi + 0x2c]
mov eax, dword [ecx]
mov dword [esi + 0x2c], eax
mov dword [ecx + 4], edi
mov dword [ecx], 0
inc dword [esi + 0x28]
mov dword [ecx + 8], ebp
mov eax, dword [esi + 0x24]
test eax, eax
je 0x41ceec
mov dword [eax], ecx
jmp 0x41ceef
mov dword [esi + 0x20], ecx
mov dword [esi + 0x24], ecx
inc ebx
cmp ebx, dword [esp + 0x78]
jb 0x41ce57
cmp dword [esp + 0x10], 0
je 0x41cf10
mov eax, dword [esp + 0x10]
push 0
push eax
call sub.MSACM32.dll_acmDriverClose
lea eax, [esi + 0x40]
mov ecx, dword [esp + 0x3f8]
push eax
push 0x65
push ecx
mov dword [eax], 0xffffffff
call sub.MSACM32.dll_acmMetrics
mov eax, dword [esp + 0x3fc]
pop ebp
and eax, 0x80000000
pop edi
shr eax, 0x1f
mov dword [esi + 0x3c], eax
mov eax, 1
pop esi
pop ebx
add esp, 0x3e4
ret 8
Function at 0x41ec10
Capabilities:
Create thread
Resume thread

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451188
push 0x423360
push eax
mov dword fs:[0], esp
sub esp, 0x104
push ebx
push esi
push edi
xor esi, esi
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [ebp - 0x24], esi
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x28]
push ecx
push 4
push esi
push str.ExitThread
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
mov eax, dword [ebp + 0xc]
add eax, 4
push eax
push esi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x1c], eax
cmp eax, esi
je 0x41ecd4
mov dword [ebp - 0x114], 0x10001
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x41ecd4
push 0x1c
lea eax, [ebp - 0x48]
push eax
mov eax, dword [ebp - 0x50]
sub eax, 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
cmp eax, 0x1c
jne 0x41ecd4
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
push 4
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x41ecd4
add dword [ebp - 0x20], 4
mov dword [ebp - 4], 0xffffffff
push 0x41ecfe
cmp dword [ebp - 0x24], 0
jne 0x41ecfd
cmp dword [ebp - 0x1c], 0
je 0x41ecf6
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov dword [ebp - 0x20], 0
ret

Function at 0x41ed20
Capabilities:
Resume thread

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push esi
lea ecx, [esp + 4]
push eax
mov eax, dword [esp + 0x18]
push 4
push ecx
sub eax, 4
mov ecx, dword [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov esi, eax
test esi, esi
je 0x41ed66
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp eax, 0xffffffff
jne 0x41ed5b
xor esi, esi
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
add esp, 8
ret