joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403fc3
Capabilities:
Check if file exists
Get common file path

Disassembly:
push 0x218
mov eax, 0x42003c
call fcn.0041eefb
mov esi, ecx
mov eax, dword [esi]
xor edi, edi
cmp dword [eax + 0x5e4], edi
jne 0x403fe8
xor eax, eax
call fcn.0041ef7e
ret
mov eax, dword [0x432b20]
mov ecx, 0x432b20
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x21c], eax
push ecx
mov dword [ebp - 4], edi
mov eax, dword [esi]
mov ecx, esp
mov dword [ebp - 0x224], esp
push ecx
mov ecx, dword [eax + 0x5e4]
call fcn.004047a6
lea ecx, [ebp - 0x21c]
call fcn.00411814
lea eax, [ebp - 0x21c]
mov dword [esp], str..tlg
push eax
call fcn.0040485b
push 0x206
lea eax, [ebp - 0x216]
push edi
push eax
mov word [ebp - 0x218], di
call fcn.0041e5f8
add esp, 0xc
push 1
push 0x1a
lea eax, [ebp - 0x218]
push eax
call dword [0x4224fc]
push eax
call dword [0x42245c]
lea eax, [ebp - 0x218]
push eax
call dword [0x422144]
cmp word [ebp + eax*2 - 0x21a], 0x5c
mov esi, dword [0x4220d8]
je 0x404096
push 0x427324
lea eax, [ebp - 0x218]
push eax
call esi
push 0x427328
lea eax, [ebp - 0x218]
push eax
call esi
mov ebx, dword [ebp - 0x21c]
cmp dword [ebx - 4], 1
jle 0x4040c5
push dword [ebx - 0xc]
lea eax, [ebp - 0x21c]
push eax
call fcn.004015a1
mov ebx, dword [ebp - 0x21c]
push ebx
lea eax, [ebp - 0x218]
push eax
call esi
cmp ebx, edi
jne 0x4040d7
xor eax, eax
jmp 0x4040df
push ebx
call dword [0x4222b4]
pop ecx
lea edx, [ebp - 0x21c]
call fcn.004014a1
lea eax, [ebp - 0x218]
push eax
call dword [0x422468]
test eax, eax
jne 0x404108
lea eax, [ebx - 0x10]
call main
jmp 0x403fe0
lea eax, [ebp - 0x218]
push eax
mov edi, 0x43302c
push edi
call fcn.00401445
lea eax, [ebp - 0x220]
push eax
call fcn.004102be
pop ecx
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x220]
xor esi, esi
cmp dword [eax - 0xc], esi
jne 0x404155
mov eax, dword [ebp - 0x220]
add eax, 0xfffffff0
call main
lea eax, [ebx - 0x10]
call main
mov eax, esi
jmp 0x403fe2
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x220]
call fcn.00404938
pop ecx
pop ecx
mov byte [ebp - 4], 2
call fcn.00404802
mov eax, dword [ebp - 0x224]
add eax, 0xfffffff0
call main
push dword [0x43302c]
call dword [0x4220dc]
push esi
push dword [0x43302c]
lea eax, [ebp - 0x218]
push eax
call dword [0x4220e0]
mov esi, eax
jmp 0x404138

Function at 0x4061db
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x41ffa3
call fcn.0041ee92
and dword [ebp - 0x10], 0
mov eax, dword [0x432b20]
mov ecx, 0x432b20
call dword [eax + 0xc]
lea esi, [eax + 0x10]
mov dword [ebp - 0x10], esi
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
push dword [eax + 4]
call dword [0x42250c]
mov edi, eax
test edi, edi
je 0x40624c
push edi
call dword [0x4224b8]
inc eax
push eax
push eax
lea esi, [ebp - 0x10]
call fcn.00401479
push eax
push edi
call dword [0x4224ac]
mov esi, dword [ebp - 0x10]
test esi, esi
jne 0x40623c
xor eax, eax
jmp 0x406244
push esi
call dword [0x4222b4]
pop ecx
lea edx, [ebp - 0x10]
call fcn.004014a1
add esi, 0xfffffff0
mov eax, esi
call fcn.004052e9
add eax, 0x10
mov dword [ebx], eax
mov eax, esi
call main
mov eax, ebx
call fcn.0041ef6a
ret 8
Function at 0x40731d
Capabilities:
Check if file exists
Get file system object information

Disassembly:
push 0x2f4
mov eax, 0x42046b
call fcn.0041eefb
mov ebx, ecx
push 0x3f2
push dword [ebx + 4]
call dword [0x42250c]
test eax, eax
mov dword [ebp - 0x2d0], eax
je 0x407552
push 0x4066e8
push 0xfffffffffffffffc
push eax
call dword [0x4224e0]
push 1
push 1
push 0x21
push 0x20
push 0x20
mov dword [0x432f40], eax
call dword [sym.imp.COMCTL32.dll_ImageList_Create]
mov edi, dword [0x422454]
push 0x110
push 0x2b4
mov dword [ebx + 0x24], eax
lea eax, [ebp - 0x2cc]
push eax
push 0x80
push str.file.txt
call edi
push dword [ebp - 0x2cc]
mov esi, dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
push 0xffffffffffffffff
push dword [ebx + 0x24]
call esi
push 0x110
push 0x2b4
lea eax, [ebp - 0x2cc]
push eax
push 0x80
push str.file.dmp
call edi
push dword [ebp - 0x2cc]
push 0xffffffffffffffff
push dword [ebx + 0x24]
call esi
push 0x110
push 0x2b4
lea eax, [ebp - 0x2cc]
push eax
push 0x80
push str.file.tlg
call edi
push dword [ebp - 0x2cc]
push 0xffffffffffffffff
push dword [ebx + 0x24]
call esi
mov esi, dword [0x422524]
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x2fc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x300]
push eax
push 0
push 0x1061
push dword [ebp - 0x2d0]
mov dword [ebp - 0x300], 4
mov dword [ebp - 0x2f4], str.name
call esi
push dword [ebx + 0x24]
push 0
push 0x1003
push dword [ebp - 0x2d0]
call esi
xor edi, edi
inc edi
lea eax, [ebp - 0x2dc]
push edi
push eax
call fcn.004010c5
mov ebx, eax
call fcn.00403ace
and dword [ebp - 4], 0
push 0
push dword [ebp - 0x2d0]
mov ecx, eax
call fcn.004085c7
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x2dc]
add eax, 0xfffffff0
call main
lea eax, [ebp - 0x2d8]
push 2
push eax
call fcn.004010c5
mov ebx, eax
call fcn.00403ace
mov dword [ebp - 4], edi
push dword [ebp - 0x2d8]
mov esi, dword [0x422468]
call esi
test eax, eax
je 0x4074c2
push 0
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d8]
call fcn.004085c7
lea eax, [ebp - 0x2d4]
push 0x60
push eax
call fcn.004010c5
call fcn.00403aa9
mov byte [ebp - 4], 2
push dword [ebp - 0x2d4]
call esi
test eax, eax
je 0x4074f7
push edi
push dword [ebp - 0x2d0]
lea ecx, [ebp - 0x2d4]
call fcn.004085c7
cmp dword [0x432f88], 0
je 0x407536
lea eax, [ebp - 0x2e0]
push 0x167
push eax
call fcn.004010c5
call fcn.00403aa9
push edi
push dword [ebp - 0x2d0]
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.004085c7
mov eax, dword [ebp - 0x2e0]
add eax, 0xfffffff0
call main
mov eax, dword [ebp - 0x2d4]
add eax, 0xfffffff0
call main
mov eax, dword [ebp - 0x2d8]
add eax, 0xfffffff0
call main
call fcn.0041ef7e
ret
Function at 0x40b03e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
or dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x34], eax
mov eax, dword [ebp + 0x10]
push ebx
mov dword [esi + 0x38], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
cmp byte [esi + 0x2c], bl
mov dword [esi + 0x3c], eax
jne 0x40b075
push str.GIF_not_initialized
push 0x42649c
call fcn.00414b27
pop ecx
pop ecx
jmp 0x40b0bd
cmp dword [esi + 0x24], 1
jbe 0x40b0bd
cmp dword [esi + 0x14], ebx
jne 0x40b0bd
lea eax, [ebp + 8]
push eax
push 4
push esi
push 0x40b2c5
push ebx
push ebx
mov dword [ebp + 8], ebx
call dword [0x4223f0]
add esp, 0x18
cmp eax, ebx
mov dword [esi + 0x14], eax
jne 0x40b0b6
push str.Couldnt_start_a_GIF_animation_thread_n
push 0x42649c
call fcn.00414b27
pop ecx
pop ecx
mov al, 1
jmp 0x40b0bf
push eax
call dword [0x422178]
xor al, al
pop ebx
pop ebp
ret 0xc
Function at 0x40b447
Capabilities:
Get file version info

Disassembly:
push 0x238
mov eax, 0x42063c
call fcn.0041eefb
mov eax, dword [ebp + 0xc]
xor esi, esi
cmp eax, esi
mov dword [ebp - 0x244], eax
jne 0x40b46c
xor eax, eax
jmp 0x40b65a
push dword [ebp + 8]
push esi
push 0x1f0fff
call dword [0x42213c]
mov edi, eax
cmp edi, esi
je 0x40b465
push 0x208
lea eax, [ebp - 0x21e]
push esi
push eax
mov word [ebp - 0x220], si
call fcn.0041e5f8
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
push esi
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
push edi
jne 0x40b4bd
call dword [0x4220c8]
jmp 0x40b465
call dword [0x4220c8]
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x220]
push eax
mov dword [ebp - 0x23c], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov edi, eax
cmp edi, esi
je 0x40b465
push edi
call fcn.0041e4c4
pop ecx
push eax
push edi
push dword [ebp - 0x23c]
mov dword [ebp - 0x228], eax
lea eax, [ebp - 0x220]
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40b465
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x230]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x228]
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x22c], esi
call sub.VERSION.dll_VerQueryValueW
xor edi, edi
test dword [ebp - 0x22c], 0xfffffffc
mov dword [ebp - 0x234], esi
jbe 0x40b648
mov eax, dword [0x432b20]
mov ecx, 0x432b20
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x238], eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x230]
lea eax, [eax + edi*4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push ecx
push eax
lea eax, [ebp - 0x238]
push str.StringFileInfo_04x_04xCompanyName
push eax
call fcn.004058e5
mov ebx, dword [ebp - 0x238]
add esp, 0x10
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x224]
push eax
push ebx
push dword [ebp - 0x228]
mov dword [ebp - 0x224], esi
mov dword [ebp - 0x240], esi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x40b5de
lea eax, [ebp - 0x240]
push eax
lea eax, [ebp - 0x224]
push eax
push str.StringFileInfo040904e4CompanyName
push dword [ebp - 0x228]
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40b5fe
cmp dword [ebp - 0x224], esi
je 0x40b5fe
push dword [ebp - 0x244]
push dword [ebp - 0x224]
call dword [0x4223f4]
test eax, eax
pop ecx
pop ecx
jne 0x40b61e
or dword [ebp - 4], 0xffffffff
lea eax, [ebx - 0x10]
call main
mov eax, dword [ebp - 0x22c]
inc edi
shr eax, 2
cmp edi, eax
jb 0x40b54d
jmp 0x40b648
push dword [ebp - 0x224]
push str.company_name__s
push 0x426488
call fcn.00414b27
add esp, 0xc
lea eax, [ebx - 0x10]
mov dword [ebp - 0x234], 1
call main
push dword [ebp - 0x228]
call fcn.0041e5f2
mov eax, dword [ebp - 0x234]
pop ecx
call fcn.0041ef7e
ret
Function at 0x40e34f
Capabilities:
Read data from internet
Receive data

Disassembly:
push 0x418
mov eax, 0x420417
call fcn.0041eefb
lea eax, [ebp - 0x418]
mov ebx, ecx
push eax
mov ecx, str.http:__qqhelper.qq.com:8080_site_media_QQTroubleShoot.exe
mov edi, edx
call fcn.0040a29f
lea eax, [ebp - 0x424]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0041171e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x414]
mov dword [esp], str.QQTroubleShoot.exe
push ecx
mov ecx, eax
call fcn.00404989
pop ecx
pop ecx
mov byte [ebp - 4], 2
call fcn.00404802
mov eax, dword [ebp - 0x414]
add eax, 0xfffffff0
call main
mov eax, dword [ebp - 0x424]
add eax, 0xfffffff0
call main
mov edi, dword [edi]
push esi
push 0x80
push 2
push esi
push 1
push 0x40000000
push edi
call dword [0x422194]
mov edi, eax
cmp edi, 0xffffffff
je 0x40e4a0
push esi
push 0x80000000
push esi
push esi
push dword [ebp - 0x418]
push dword [ebx]
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
cmp eax, esi
mov dword [ebp - 0x414], eax
je 0x40e4a0
mov ebx, dword [sym.imp.WININET.dll_InternetReadFile]
lea ecx, [ebp - 0x41c]
push ecx
push 0x3ff
lea ecx, [ebp - 0x410]
push ecx
push eax
jmp 0x40e47b
cmp dword [ebp - 0x41c], esi
je 0x40e4b6
push esi
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x41c]
lea eax, [ebp - 0x410]
push eax
push edi
call dword [0x422198]
test eax, eax
je 0x40e48d
mov eax, dword [ebp - 0x41c]
cmp eax, dword [ebp - 0x420]
jne 0x40e48d
lea eax, [ebp - 0x41c]
push eax
push 0x3ff
lea eax, [ebp - 0x410]
push eax
push dword [ebp - 0x414]
mov dword [ebp - 0x41c], esi
mov dword [ebp - 0x420], esi
call ebx
test eax, eax
jne 0x40e428
push dword [ebp - 0x414]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push edi
call dword [0x4220c8]
mov eax, dword [ebp - 0x418]
add eax, 0xfffffff0
call main
xor eax, eax
call fcn.0041ef7e
ret
push edi
call dword [0x4220c8]
push dword [ebp - 0x414]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov eax, dword [ebp - 0x418]
add eax, 0xfffffff0
call main
xor eax, eax
inc eax
jmp 0x40e4b0
Function at 0x40f2d7
Capabilities:
Check if file exists

Disassembly:
push 0x54
mov eax, 0x4204cf
call fcn.0041ee92
mov eax, dword [0x432134]
test eax, eax
je 0x40f30a
push eax
push 0x429ae4
push 0x426430
call fcn.00414b27
mov eax, dword [0x432134]
add esp, 0xc
call fcn.0041ef6a
ret
mov eax, dword [0x432b20]
mov ecx, 0x432b20
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea ebx, [ebp - 0x10]
call fcn.0040f214
test al, al
jne 0x40f355
push str.GetLCID:_Get_Base_Dir_fail_
push 0x426430
call fcn.00414b27
pop ecx
pop ecx
call dword [0x4221a4]
mov esi, eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call main
mov eax, esi
jmp 0x40f304
push 0x5c
lea edi, [ebp - 0x10]
call fcn.00411eb8
push 0x2f
call fcn.00411eb8
push str.I18nconfig.xml
mov eax, edi
push eax
call fcn.0040485b
push dword [ebp - 0x10]
call dword [0x422468]
test eax, eax
jne 0x40f397
push dword [ebp - 0x10]
push str.GetLCID:_config_not_exist___s
push 0x426430
call fcn.00414b27
add esp, 0xc
jmp 0x40f33e
lea ecx, [ebp - 0x60]
call dword [sym.imp.tinyxml.dll_public:_void___thiscall_TiXmlDocument::constructor_void_]
xor ebx, ebx
push ebx
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x60]
call dword [sym.imp.tinyxml.dll_public:_bool___thiscall_TiXmlDocument::LoadFile_wchar_t_const___enum_TiXmlEncoding_]
test al, al
jne 0x40f3e1
push str.GetLCID:_Load_File_fail_
push 0x426430
call fcn.00414b27
pop ecx
pop ecx
call dword [0x4221a4]
lea ecx, [ebp - 0x60]
mov esi, eax
mov byte [ebp - 4], bl
call dword [sym.imp.tinyxml.dll_public_virtual:_void___thiscall_TiXmlDocument::destructor_void_]
jmp 0x40f346
lea ecx, [ebp - 0x60]
call dword [sym.imp.tinyxml.dll_public:_class_TiXmlElement____thiscall_TiXmlDocument::RootElement_void_]
mov esi, eax
cmp esi, ebx
jne 0x40f3f7
push str.GetLCID:_Get_Root_Element_fail_
jmp 0x40f3bc
call dword [0x4221a4]
mov ecx, esi
mov edi, eax
call dword [sym.imp.tinyxml.dll_public:_class_TiXmlElement____thiscall_TiXmlNode::FirstChildElement_void_]
jmp 0x40f43f
mov ecx, esi
call dword [sym.imp.tinyxml.dll_public:_char_const____thiscall_TiXmlNode::Value_void_const]
cmp eax, ebx
je 0x40f437
push str.locale
push eax
call fcn.0041e61c
test eax, eax
pop ecx
pop ecx
jne 0x40f437
push 0x429c28
mov ecx, esi
call dword [sym.imp.tinyxml.dll_public:_char_const____thiscall_TiXmlElement::Attribute_char_const__const]
cmp eax, ebx
jne 0x40f46b
mov ecx, esi
call dword [sym.imp.tinyxml.dll_public:_class_TiXmlElement____thiscall_TiXmlNode::NextSiblingElement_void_]
mov esi, eax
cmp esi, ebx
jne 0x40f409
push edi
push str.GetLCID:_from_default__lu
push 0x426430
call fcn.00414b27
add esp, 0xc
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call dword [sym.imp.tinyxml.dll_public_virtual:_void___thiscall_TiXmlDocument::destructor_void_]
mov esi, edi
jmp 0x40f346
push 0xa
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x14], ebx
call dword [0x422318]
mov edi, eax
push edi
push str.GetLCID:_from_config__lu
push 0x426430
call fcn.00414b27
add esp, 0x18
jmp 0x40f458
Function at 0x40fc34
Capabilities:
Get file version info

Disassembly:
push 0x184
mov eax, 0x41fcf5
call fcn.0041eefb
xor edi, edi
mov ebx, edx
cmp ebx, edi
mov esi, ecx
mov dword [ebp - 0x64], esi
mov dword [ebp - 0x54], edi
je 0x40fdff
cmp word [ebx], di
je 0x40fdff
push edi
push edi
push 3
push edi
push 3
push 0x80000000
push ebx
call dword [0x422194]
cmp eax, 0xffffffff
mov dword [ebp - 0x54], eax
je 0x40fdff
mov eax, dword [0x432b20]
mov esi, 0x432b20
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x58], eax
mov dword [ebp - 4], edi
mov eax, dword [0x432b20]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x60], eax
push edi
push ebx
mov byte [ebp - 4], 1
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
cmp esi, edi
je 0x40fd1f
push esi
call fcn.0041e4c4
pop ecx
push eax
push esi
push edi
push ebx
mov dword [ebp - 0x68], eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x40fd16
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0x427324
push dword [ebp - 0x68]
mov dword [ebp - 0x6c], edi
mov dword [ebp - 0x70], edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x40fd16
mov eax, dword [ebp - 0x6c]
movzx ecx, word [eax + 0xc]
push ecx
movzx ecx, word [eax + 0xe]
push ecx
movzx ecx, word [eax + 8]
movzx eax, word [eax + 0xa]
push ecx
push eax
lea eax, [ebp - 0x58]
push str._d._d._d._d
push eax
call fcn.004058e5
add esp, 0x18
push dword [ebp - 0x68]
call fcn.0041e5f2
pop ecx
mov ebx, dword [ebp - 0x54]
mov esi, dword [0x4221bc]
push edi
lea eax, [ebp - 0x5c]
push eax
push 0x40
lea eax, [ebp - 0x50]
push eax
push ebx
call esi
test eax, eax
je 0x40fdcc
cmp dword [ebp - 0x5c], 0x40
jne 0x40fdcc
push edi
push edi
push dword [ebp - 0x14]
push ebx
call dword [0x4221c0]
push edi
lea eax, [ebp - 0x5c]
push eax
mov edi, 0xf8
push edi
lea eax, [ebp - 0x190]
push eax
push ebx
call esi
test eax, eax
je 0x40fdcc
cmp dword [ebp - 0x5c], edi
jne 0x40fdcc
mov eax, dword [ebp - 0x188]
mov dword [ebp - 0x54], eax
lea eax, [ebp - 0x54]
push eax
call dword [0x422388]
push 9
pop ecx
mov esi, eax
lea edi, [ebp - 0x94]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x94]
mov eax, dword [ebp - 0x84]
push dword [ebp - 0x90]
inc eax
push dword [ebp - 0x8c]
push dword [ebp - 0x88]
push eax
mov eax, dword [ebp - 0x80]
add eax, 0x76c
push eax
lea eax, [ebp - 0x60]
push str.__04d__02d__02d__02d:_02d:_02d_GMT
push eax
call fcn.004058e5
add esp, 0x24
push ebx
call dword [0x4220c8]
lea eax, [ebp - 0x60]
push eax
push dword [ebp - 0x64]
lea ecx, [ebp - 0x58]
call fcn.00404938
mov eax, dword [ebp - 0x60]
pop ecx
pop ecx
add eax, 0xfffffff0
call main
mov eax, dword [ebp - 0x58]
add eax, 0xfffffff0
call main
mov eax, dword [ebp - 0x64]
jmp 0x40fe0c
push esi
mov ecx, 0x427538
call fcn.004047a6
mov eax, esi
call fcn.0041ef7e
ret
Function at 0x40ff0f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [0x432024]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xc]
push edi
push eax
lea eax, [ebp - 0x6c]
push eax
call fcn.00411bbb
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [ebp - 0x70]
push ecx
push 0x20019
xor esi, esi
push esi
push eax
push 0x80000001
call dword [0x422004]
mov edi, eax
mov eax, dword [ebp - 0x6c]
add eax, 0xfffffff0
call main
cmp edi, esi
jne 0x410013
mov edi, dword [0x422008]
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x74]
push eax
push esi
push str.FullDump
push dword [ebp - 0x70]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x74], esi
mov dword [ebp - 0x78], 4
call edi
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x74], 4
jne 0x40fffc
cmp dword [ebp - 0x6c], ebx
jne 0x40fffc
push 0x62
lea eax, [ebp - 0x66]
push esi
push eax
mov word [ebp - 0x68], si
call fcn.0041e5f8
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push str.HASH
push dword [ebp - 0x70]
mov dword [ebp - 0x84], 0x64
mov dword [ebp - 0x80], ebx
call edi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x7c]
mov word [ebp - 6], si
call fcn.00404e2e
test eax, eax
jne 0x40fffc
push dword [ebp - 0x70]
call dword [0x422010]
mov eax, ebx
jmp 0x410018
push dword [ebp - 0x70]
call dword [0x422010]
cmp dword [ebp - 0x74], 4
jne 0x410013
cmp dword [ebp - 0x6c], 2
mov eax, ebx
je 0x410018
mov eax, dword [0x432f88]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e4d6
leave
ret

Function at 0x41022f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
call fcn.00411bbb
mov eax, dword [eax]
pop ecx
pop ecx
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push eax
push 0x80000001
call dword [0x422004]
mov ebx, eax
mov eax, dword [ebp - 0xc]
neg ebx
sbb bl, bl
add eax, 0xfffffff0
inc bl
call main
test bl, bl
pop ebx
je 0x4102bc
and dword [ebp - 0xc], 0
and dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push str.bUseInterMod
push dword [ebp - 4]
mov dword [ebp - 0x10], 4
call dword [0x422008]
push dword [ebp - 4]
call dword [0x422010]
cmp dword [ebp - 8], 4
jne 0x4102bc
xor eax, eax
inc eax
cmp dword [ebp - 0xc], eax
jne 0x4102bc
mov dword [0x432f88], eax
leave
ret
Function at 0x4103af
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1090
call fcn.0041f050
mov eax, dword [0x432024]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x1028], 0
push ebx
mov dword [ebp - 0x1020], eax
push esi
push edi
xor eax, eax
mov byte [ebp - 0x18], 0
lea edi, [ebp - 0x17]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, ecx
lea esi, [ebp - 0x108c]
mov dword [ebp - 0x1024], ebx
stosb byte es:[edi], al
call fcn.0041ca2b
push 0x42a1f4
push ebx
call dword [0x42231c]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x41044b
mov esi, dword [0x422390]
mov edi, 0x1000
jmp 0x41042d
lea ecx, [ebp - 0x101c]
lea edx, [ebp - 0x108c]
call fcn.0041d175
push ebx
push edi
lea eax, [ebp - 0x101c]
push 1
push eax
call esi
add esp, 0x10
test eax, eax
jne 0x41041c
push ebx
call dword [0x42232c]
pop ecx
jmp 0x41046a
call dword [0x422140]
push eax
push dword [ebp - 0x1024]
push str.GetModuleHashStr_open_file___s__fail_errno__lu_
push 0x426430
call fcn.00414b27
add esp, 0x10
lea eax, [ebp - 0x18]
push eax
lea esi, [ebp - 0x108c]
call fcn.0041d380
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x1020]
call fcn.004104a0
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x1020]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e4d6
leave
ret

Function at 0x410ee2
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 5
push 0xffffffffffffffff
push 0
call fcn.0041ee56
test eax, eax
je 0x410f48
push dword [ebp - 4]
call dword [0x422144]
cmp eax, 0x104
jge 0x410f22
push dword [ebp - 4]
push esi
call dword [0x422108]
jmp 0x410f3b
push 0x103
push dword [ebp - 4]
push esi
call fcn.0041e60a
add esp, 0xc
and word [esi + 0x206], 0
push dword [ebp - 4]
call fcn.0041ee5c
xor eax, eax
inc eax
leave
ret
xor eax, eax
leave
ret