joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ba20
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x1c
mov esi, ecx
mov eax, dword [0x43000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push 0x3ef
push ecx
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x41bb63
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ef
push esi
call edi
xor ecx, ecx
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push ecx
push eax
call ebx
push 0x3ee
push esi
call edi
xor ecx, ecx
push ecx
push eax
call ebx
push 0x3f3
push esi
call edi
xor ecx, ecx
push ecx
push eax
call ebx
push 0x3f2
push esi
call edi
xor ecx, ecx
push ecx
push eax
call ebx
push 0x3ed
push esi
call edi
xor ecx, ecx
push ecx
push eax
call ebx
push 0x3f4
push esi
call edi
xor ecx, ecx
push ecx
push eax
call ebx
lea edi, [ebp - 0x28]
mov ecx, edi
mov edx, str.ReportDuringSubmit2
call fcn.004177d0
cmp dword [edi + 0x14], 7
jbe 0x41bac1
mov edi, dword [ebp - 0x28]
push edi
push 0x3f6
push esi
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [ebp - 0x14]
cmp ecx, 8
jb 0x41baf5
mov eax, dword [ebp - 0x28]
lea edx, [ecx + ecx]
add edx, 2
cmp edx, 0x1000
jae 0x41bbee
push edx
push eax
call fcn.0041dcce
add esp, 8
mov ecx, esi
call fcn.0041af60
mov edi, 0x3f7
push edi
push esi
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
call ebx
push 0xffff0000
push 0xffffffffffffffff
push 0x465
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
push edi
push esi
call ebx
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
mov dword [0x43068c], edi
mov dword [0x4305d0], esi
mov ecx, 0x4305d8
push 0x430638
call fcn.00407210
push edi
push edi
push 0x4305d0
push 0x4179c0
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x43068c], eax
jmp 0x41bbdc
push 0x3f2
push esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor ebx, ebx
test eax, eax
setne al
mov edi, 0x430650
cmp dword [0x430664], 7
mov ecx, 0x430650
jbe 0x41bb8f
mov ecx, dword [0x430650]
mov bl, al
mov edx, str.IncludeURL
push ebx
call fcn.0041bd50
add esp, 4
push 0x3ef
push esi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
xor ebx, ebx
test eax, eax
setne al
cmp dword [0x430664], 7
jbe 0x41bbc1
mov edi, dword [0x430650]
mov bl, al
mov ecx, edi
mov edx, str.SubmitCrashReport
push ebx
call fcn.0041bd50
add esp, 4
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e640
add esp, 0x1c
pop esi
pop edi
pop ebx
pop ebp
ret
mov edx, eax
add edx, 0xfffffffc
mov eax, dword [eax - 4]
sub edx, eax
cmp edx, 0x20
jae 0x41bc09
add ecx, ecx
add ecx, 0x25
mov edx, ecx
jmp 0x41baeb
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x41bc10
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
mov eax, 0x9c54
call fcn.0041ed80
mov dword [ebp - 0x9c60], edx
mov edi, ecx
mov eax, dword [0x43000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4e32]
push 0x2711
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea ebx, [ebp - 0x9c5c]
lea esi, [ebp - 0x9c58]
push ebx
push esi
push 0xb0
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebx]
mov ecx, dword [esi]
mov edi, 0xfffffffe
sub eax, ecx
je 0x41bcd0
lea ecx, [ecx*2 - 0x4e32]
add ecx, ebp
lea esi, [ebp - 0x9c54]
push eax
push ecx
push 0x2711
push esi
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
add esp, 0x10
mov eax, dword [ebp - 0x9c5c]
sub eax, dword [ebp - 0x9c58]
mov word [ebp + eax*2 - 0x9c54], 0
sub esp, 0x20
xor eax, eax
mov dword [esp + 0x1c], eax
movaps xmm0, xmmword [0x42a0f0]
movups xmmword [esp + 0xc], xmm0
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
not edi
sub esp, 0x20
xor esi, esi
mov dword [esp + 0x1c], esi
movaps xmm0, xmmword [0x42a0f0]
movups xmmword [esp + 0xc], xmm0
lea eax, [ebp - 0x4e32]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov eax, 0xfde9
mov dword [esp], eax
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call ebx
mov ecx, ebx
mov ebx, eax
sub esp, 0x20
mov dword [esp + 0x1c], esi
movaps xmm0, xmmword [0x42a0f0]
movups xmmword [esp + 0xc], xmm0
mov eax, dword [ebp - 0x9c60]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
mov eax, 0xfde9
mov dword [esp], eax
call ecx
add ebx, edi
add ebx, eax
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e640
mov eax, ebx
add esp, 0x9c54
pop esi
pop edi
pop ebx
pop ebp
ret

Function at 0x41bd50
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0xc
mov esi, edx
mov edi, ecx
mov eax, dword [0x43000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
lea ebx, [ebp - 0x14]
push ebx
push 2
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41bd96
push 0x42c900
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push 2
push 0
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41bdc2
push 0x42c900
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push edi
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x41bdf9
movzx eax, byte [ebp + 8]
lea ecx, [ebp - 0x18]
mov dword [ecx], eax
mov eax, 4
push eax
push ecx
push eax
push 0
push esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e640
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x4204b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [0x43000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov bl, 1
cmp dword [ecx + 0x38], 0
je 0x420553
mov esi, ecx
cmp byte [ecx + 0x3d], 0
je 0x420553
mov eax, dword [esi]
mov edi, dword [eax + 0xc]
mov ecx, edi
call dword [section..00cfg]
mov ecx, esi
push 0xffffffffffffffff
call edi
cmp eax, 0xffffffff
je 0x420551
mov edi, dword [esi + 0x38]
lea eax, [esi + 0x40]
mov dword [ebp - 0x38], eax
mov eax, dword [edi]
mov ebx, dword [eax + 0x20]
mov ecx, ebx
call dword [section..00cfg]
lea eax, [ebp - 0x34]
lea edx, [ebp - 0x30]
mov ecx, edi
push eax
lea eax, [ebp - 0x10]
push eax
push edx
push dword [ebp - 0x38]
call ebx
cmp eax, 3
je 0x420567
cmp eax, 1
je 0x42052a
test eax, eax
jne 0x420551
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
sub edi, eax
je 0x420548
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x420551
cmp byte [esi + 0x3d], 0
sete bl
jmp 0x420553
xor ebx, ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e640
mov eax, ebx
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
mov bl, 1
jmp 0x420553

Function at 0x428070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov ebx, edx
mov eax, dword [0x43000c]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov eax, dword [ecx]
mov edx, dword [eax + 4]
cmp byte [edx + 0xd], 0
mov edi, dword [ebp + 8]
je 0x4280f7
mov dword [ebp - 0x14], eax
mov esi, eax
cmp esi, dword [eax]
je 0x428128
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ebx
lea ebx, [ebp - 0x14]
mov ecx, ebx
call fcn.00426f60
mov al, 1
mov dword [ebp - 0x20], eax
mov ebx, dword [ebx]
lea ecx, [ebx + 0x10]
mov edx, edi
call fcn.00402450
test al, al
je 0x428143
movzx eax, byte [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov edx, ebx
push dword [ebp + 0xc]
push esi
push eax
call fcn.004021c0
add esp, 0xc
mov al, 1
mov byte [ebx + 4], al
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041e640
mov eax, ebx
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
mov dword [ebp - 0x1c], ecx
mov esi, edx
add edx, 0x10
mov ecx, edi
call fcn.00402450
mov ecx, eax
xor cl, 1
movzx ecx, cl
mov edx, dword [esi + ecx*8]
cmp byte [edx + 0xd], 0
je 0x4280fa
mov dword [ebp - 0x14], esi
test al, al
je 0x428132
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ecx]
jmp 0x428098
mov edx, ebx
push dword [ebp + 0xc]
push esi
push 1
jmp 0x4280d6
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x20], 0
mov ebx, esi
jmp 0x4280b7
mov ecx, dword [ebp + 0xc]
call fcn.00428160
mov eax, dword [ebp - 0x18]
mov dword [eax], ebx
mov ebx, eax
xor eax, eax
jmp 0x4280e0
Function at 0x4017b0
Capabilities:
Check os version
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428341
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x436008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x274], edx
mov esi, ecx
mov dword [ebp - 0x26c], esi
mov eax, dword [ebp + 8]
push 0x118
mov dword [ebp - 0x270], eax
lea eax, [ebp - 0x148]
push 0
push eax
call fcn.00418060
add esp, 0xc
mov dword [ebp - 0x14c], 0x11c
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40191c
cmp dword [ebp - 0x148], 6
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
ja 0x401851
jne 0x4018d2
cmp dword [ebp - 0x144], 2
jb 0x4018d2
push str.kernel32.dll
call edi
mov esi, eax
test esi, esi
je 0x4018d2
push 0x10
push 1
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4018d2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4018d2
movups xmm0, xmmword [0x431054]
push eax
movups xmmword [ebp - 0x30], xmm0
movups xmm0, xmmword [0x431064]
movups xmmword [ebp - 0x20], xmm0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4018d2
lea eax, [ebp - 0x30]
push eax
lea ecx, [esi + 6]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4018d2
cmp word [esi + 2], ax
jbe 0x4018d2
movzx edx, word [esi + 0x32]
movzx ecx, word [esi + 0x30]
movzx eax, word [esi + 0x36]
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x144], ecx
mov dword [ebp - 0x140], eax
push str.ntdll.dll
call edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.RtlGetVersion
push eax
call edi
mov esi, eax
test esi, esi
je 0x401916
push 0x118
lea eax, [ebp - 0x264]
push 0
push eax
call fcn.00418060
add esp, 0xc
mov dword [ebp - 0x268], 0x11c
lea eax, [ebp - 0x268]
push eax
call esi
mov esi, dword [ebp - 0x26c]
cmp dword [ebp - 0x148], 6
ja 0x40195a
jne 0x401930
cmp dword [ebp - 0x144], 1
jae 0x40195a
push 1
push 0x430b00
push 0x430b18
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 1
jne 0x401953
mov ecx, 0x430b98
call fcn.004023c0
xor eax, eax
jmp 0x4019f3
push 0x18
mov dword [ebp - 0x288], 0
mov dword [ebp - 0x284], 0
mov dword [ebp - 0x280], 0
call fcn.00416b00
add esp, 4
mov dword [ebp - 0x27c], eax
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [ebp - 4], 0
mov dword [ebp - 0x278], 0
mov dword [ebp - 4], 2
push ecx
push esi
lea ecx, [ebp - 0x288]
call fcn.00409470
test eax, eax
je 0x4019dd
push str.PdfReaderMain
push eax
call edi
test eax, eax
je 0x4019dd
push dword [ebp + 0xc]
push dword [ebp - 0x270]
push dword [ebp - 0x274]
push esi
call eax
add esp, 0x10
mov esi, eax
jmp 0x4019df
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288]
call fcn.004089a0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004168a4
mov esp, ebp
pop ebp
ret 8
Function at 0x401ca0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x12c
mov eax, dword [0x436008]
xor eax, esp
mov dword [esp + 0x128], eax
push esi
push 0x110
lea eax, [esp + 0x18]
mov esi, ecx
push 0
push eax
call fcn.00418060
add esp, 0xc
mov dword [esp + 0x10], 0x114
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x401d1e
cmp dword [esp + 0x14], 6
jb 0x401d1e
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x207
push eax
push esi
push 0x430c50
mov edx, str.SoftwareMicrosoftWindowsShellAssociationsUrlAssociationshttpUserChoice
mov ecx, 0x80000001
call fcn.00401ab0
add esp, 0xc
test al, al
je 0x401d1e
cmp word [esi], 0
jne 0x401d76
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.http_shellopencommand
mov ecx, 0x80000000
call fcn.00401ab0
add esp, 0xc
test al, al
je 0x401d4a
cmp word [esi], 0
jne 0x401d76
lea eax, [esp + 8]
mov dword [esp + 8], 0x207
push eax
push esi
push 0
mov edx, str.SoftwareClasses.html
mov ecx, 0x80000001
call fcn.00401ab0
add esp, 0xc
test al, al
je 0x401d8b
cmp word [esi], 0
je 0x401d8b
mov al, 1
pop esi
mov ecx, dword [esp + 0x128]
xor ecx, esp
call fcn.004168a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x12c]
xor al, al
pop esi
xor ecx, esp
call fcn.004168a4
mov esp, ebp
pop ebp
ret
Function at 0x407be0
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428b88
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x436008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
and edi, 0xffffb1af
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x407c1f
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push edi
push eax
call ebx
test eax, eax
je 0x407c34
mov al, 1
jmp 0x407cd3
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00408300
test al, al
je 0x407c7e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push edi
cmovae eax, dword [ebp - 0x28]
push eax
call ebx
test eax, eax
je 0x407c7e
mov bl, 1
jmp 0x407c80
xor bl, bl
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x407cbd
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407cb3
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407cef
push edx
push ecx
call fcn.00416b30
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
mov al, bl
mov dword [ebp - 0x14], 7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004168a4
mov esp, ebp
pop ebp
ret
call fcn.0041a4ff
int3

Function at 0x407d00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428c38
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x436008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x407d36
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x407de0
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], eax
lea edx, [ebp - 0x28]
mov ecx, esi
call fcn.00408300
test al, al
je 0x407d8f
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x407dcc
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x407dc2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x407dfd
push edx
push ecx
call fcn.00416b30
add esp, 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004168a4
mov esp, ebp
pop ebp
ret
call fcn.0041a4ff
int3
Function at 0x4099e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x428f95
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x436008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x150], esi
mov dword [ebp - 0x14c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 1
lea edx, [ebp - 0x28]
call fcn.0040ce40
test al, al
jne 0x409abb
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x14c], 1
mov byte [ebp - 4], 0
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x409aaf
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x409aa5
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x409bf5
push edx
push ecx
call fcn.00416b30
add esp, 8
mov dword [ebp - 0x18], 0
jmp 0x409bca
lea eax, [ebp - 0x28]
push eax
call fcn.00409860
test al, al
je 0x409b87
push 1
call fcn.00416b00
mov dword [ebp - 0x148], eax
push 0x118
push 0
mov byte [eax], 0
lea eax, [ebp - 0x140]
push eax
call fcn.00418060
add esp, 0x10
mov dword [ebp - 0x144], 0x11c
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x409b1f
cmp dword [ebp - 0x140], 6
mov eax, dword [ebp - 0x148]
setae cl
mov byte [eax], cl
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x148]
call fcn.004046b0
lea edx, [ebp - 0x28]
call fcn.0040ce40
test al, al
jne 0x409b6b
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 0x14c], 1
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x148]
call fcn.00403f00
jmp 0x409a71
lea eax, [ebp - 0x28]
push eax
call fcn.00409860
test al, al
jne 0x409b3a
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x148]
call fcn.00403f00
movups xmm0, xmmword [ebp - 0x28]
mov dword [esi + 0x10], 0
xor eax, eax
mov dword [esi + 0x14], 0
movups xmmword [esi], xmm0
mov word [ebp - 0x28], ax
movq xmm0, qword [ebp - 0x18]
movq qword [esi + 0x10], xmm0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x14c], 1
mov byte [ebp - 4], al
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004168a4
mov esp, ebp
pop ebp
ret 4
call fcn.0041a4ff
int3
Function at 0x40cc60
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x437a8c], 0
mov word [0x437a90], 0
cmp dword [eax + 0x10], 0
je 0x40cc87
cmp dword [eax + 0x14], 8
jb 0x40cc89
mov eax, dword [eax]
jmp 0x40cc89
xor eax, eax
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x437a8c], eax
test eax, eax
je 0x40ccbd
call dword [sym.imp.KERNEL32.dll_GetLastError]
movzx ecx, byte [0x437a91]
cmp eax, 0xb7
mov edx, 1
cmove ecx, edx
mov byte [0x437a91], cl
mov eax, 0x437a8c
ret 4

Function at 0x40cd20
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429508
mov eax, dword fs:[0]
push eax
sub esp, 8
mov eax, dword [0x436008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
mov ebx, dword [ebp + 8]
test eax, eax
je 0x40cd63
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi], 0
lea ecx, [ebp - 0x14]
mov word [edi + 4], 0
mov dword [ebp - 0x14], 0
call fcn.00412440
mov dword [ebp - 4], 0
mov esi, dword [ebp - 0x14]
cmp dword [esi], 0
je 0x40cd8c
lea eax, [esi + 8]
jmp 0x40cd8e
xor eax, eax
cmp dword [ebx + 0x10], 0
je 0x40cd9e
cmp dword [ebx + 0x14], 8
jb 0x40cda0
mov ebx, dword [ebx]
jmp 0x40cda0
xor ebx, ebx
push ebx
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [edi], eax
test eax, eax
je 0x40cdc1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40cdc1
mov byte [edi + 5], 1
cmp dword [edi], 0
setne bl
mov dword [ebp - 4], 0xffffffff
mov eax, dword [esi]
test eax, eax
je 0x40cdea
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esi], 0
mov eax, dword [esi + 4]
test eax, eax
je 0x40cdff
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [esi + 4], 0
push 0x2c
push esi
call fcn.00416b30
add esp, 8
mov dword [ebp - 0x14], 0
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004168a4
mov esp, ebp
pop ebp
ret 4
Function at 0x40ce40
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x414]
sub esp, 0x414
push 0xfffffffffffffffe
push 0x433da0
push 0x4179b0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x436008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x410], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40cea1
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
mov edx, esi
call fcn.0040cf70
mov bl, al
mov byte [ebp - 0x19], bl
mov dword [ebp - 4], 0xfffffffe
jmp 0x40ced3
test bl, bl
jne 0x40cf4a
mov dword [esi + 0x10], 0
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x40cee8
mov eax, dword [esi]
xor ecx, ecx
mov word [eax], cx
push 0x410
push ecx
lea eax, [ebp]
push eax
call fcn.00418060
add esp, 0xc
push 0x207
lea eax, [ebp]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea ecx, [ebp]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40cf20
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.004027a0
movzx ebx, bl
mov eax, 1
cmp dword [esi + 0x10], 0
cmovne ebx, eax
mov al, bl
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x410]
xor ecx, ebp
call fcn.004168a4
lea esp, [ebp + 0x414]
pop ebp
ret