joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c9b2
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x40fc90
call fcn.0040ced4
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x40c9f2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c9f2
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40ca0a
cmp eax, 0x20b
je 0x40c9f7
mov dword [ebp - 0x1c], ebx
jmp 0x40ca1e
cmp dword [ecx + 0x84], 0xe
jbe 0x40c9f2
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40ca18
cmp dword [ecx + 0x74], 0xe
jbe 0x40c9f2
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x45f46c], 0xffffffff
or dword [0x45f470], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x45f464]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x45f460]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x45f468], eax
call fcn.0040ce2e
call fcn.0040cece
cmp dword [0x4116d8], ebx
jne 0x40ca7e
push fcn.0040cece
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0040cebc
push 0x411028
push 0x411024
call sub.MSVCR71.dll__initterm
push 0x40ce72
call fcn.0040c9a0
mov eax, dword [0x45f45c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x45f458]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x40cad2
push 8
call sub.MSVCR71.dll__amsg_exit
pop ecx
push 0x411020
push section..data
call sub.MSVCR71.dll__initterm
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40cb50
cmp al, bl
je 0x40cafc
cmp dword [ebp - 0x20], ebx
jne 0x40cb50
mov al, byte [esi]
cmp al, bl
je 0x40cb0c
cmp al, 0x20
ja 0x40cb0c
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40cafc
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
je 0x40cb28
movzx eax, word [ebp - 0x54]
jmp 0x40cb2b
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00401cf0
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x40cb48
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x40cba5
cmp al, 0x22
jne 0x40cb5f
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x40cb72
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x40caea
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040cf0f
ret
Function at 0x403468
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x426014]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403500
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4034e0
xor eax, eax
push ebp
push 0x4034d9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40351c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4034e0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x426014]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x426014], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e64
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x429040], 0
je 0x403ec5
cmp word [0x429214], 0xd7b2
jne 0x403e8d
cmp dword [0x42921c], 0
jbe 0x403e8d
mov eax, 0x429210
call dword [0x42922c]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403eec
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x426020], 0
jne 0x403ee1
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405b60
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee4
xor ecx, ecx
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x405c80
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 4], 0
jne 0x405bb3
push 0x105
lea eax, [ebp - 0x115]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x115]
mov eax, dword [ebp - 8]
call fcn.004040d4
jmp 0x405c67
call sub.kernel32.dll_GetCommandLineA_1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
call fcn.00405ac0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
call fcn.00405b04
mov dword [ebp - 0xc], eax
cmp dword [ebp - 4], 0
je 0x405bee
dec dword [ebp - 4]
cmp dword [ebp - 4], 0
jl 0x405bee
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x405bbb
mov eax, dword [ebp - 8]
push eax
lea eax, [ebp - 0x11c]
mov edx, dword [ebp - 0x10]
call fcn.004041c0
mov eax, dword [ebp - 0x11c]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x10]
mov edx, 1
call fcn.0040445c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404224
cmp eax, 2
jl 0x405c67
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x405c67
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404224
mov edx, dword [ebp - 8]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x405c67
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00404224
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov edx, 2
call fcn.0040445c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405c87
lea eax, [ebp - 0x11c]
call fcn.00403fe4
ret

Function at 0x405d54
Capabilities:
Get file attributes

Disassembly:
call fcn.00405224
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x405d68
dec eax
and al, 0x10
sete al
ret

Function at 0x405f94
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.004041c0
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00405e58
ret

Function at 0x405fc4
Capabilities:
Get common file path

Disassembly:
push ecx
call fcn.00405224
call fcn.00405230
sub esp, 0x108
push esp
push 0
push edx
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [esp + 0x108]
mov edx, esp
call fcn.004041c0
add esp, 0x10c
ret

Function at 0x40600c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x428608]
mov byte [eax], 1
mov edx, dword [0x404f88]
xor eax, eax
call fcn.00408cf4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 1
mov eax, dword [ebp - 4]
add eax, 0x1e
push eax
push 4
mov eax, dword [ebp - 4]
push eax
push 0x405ff4
push 0
push 0
call sub.kernel32.dll_CreateThread
mov edx, dword [ebp - 4]
mov dword [edx + 0x1a], eax
mov eax, dword [ebp - 4]
pop ecx
pop ebp
ret
Function at 0x40616c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
jbe 0x406195
mov eax, dword [ebp - 4]
mov byte [eax + 0x18], 1
jmp 0x4061ab
mov eax, dword [ebp - 4]
cmp word [eax + 0x2c], 0
je 0x4061ab
mov ebx, dword [ebp - 4]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0x2e]
call dword [ebx + 0x2a]
pop ebx
pop ecx
pop ebp
ret

Function at 0x4061d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1a]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [ebp - 4]
mov byte [eax + 0x19], 1
pop ecx
pop ebp
ret

Function at 0x4066ac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40675d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax + 0x18], 0
jne 0x406707
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
call fcn.004043f4
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.004043f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d]
call fcn.004043f4
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 0x10], eax
jmp 0x406747
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
call fcn.004043f4
push eax
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.00409388
mov eax, dword [ebp - 0x14]
call fcn.004043f4
push eax
mov eax, dword [ebp - 8]
call fcn.004043f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d]
call fcn.004043f4
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406764
lea eax, [ebp - 0x14]
call fcn.00403fe4
ret
Function at 0x40676c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff4
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 0x18], 0
jne 0x4067f0
mov byte [ebp - 0x100c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
call fcn.004043f4
push eax
push 0x1000
lea eax, [ebp - 0x100c]
push eax
mov eax, dword [ebp - 0xc]
call fcn.004043f4
push eax
mov eax, dword [ebp - 8]
call fcn.004043f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d]
call fcn.004043f4
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x4067e6
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x100c]
mov ecx, 0x1000
call fcn.004041f0
jmp 0x40682a
mov eax, dword [ebp + 8]
call fcn.00403fe4
jmp 0x40682a
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00404038
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x19]
call fcn.004043f4
push eax
mov eax, dword [ebp - 0xc]
call fcn.004043f4
push eax
mov eax, dword [ebp - 8]
call fcn.004043f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1d]
call fcn.004043f4
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
mov esp, ebp
pop ebp
ret 4

Function at 0x406890
Capabilities:
Read .ini file

Disassembly:
or eax, 0
je 0x406882
lea eax, [esi + 4]
call fcn.00405aac
mov dword [esi], eax
lea edx, [esi + 4]
inc eax
add esi, eax
mov eax, edi
call fcn.0040a600
cmp byte [esi + 4], 0
jne 0x406865
pop eax
call fcn.00402c38
pop ecx
pop ebx
pop edi
pop esi
ret
push esi
push edi
push ebx
push ecx
mov ebx, eax
mov eax, 0x8003
mov edi, edx
call fcn.00402c1c
mov esi, eax
push eax
or byte [ebx + 0x18], 0
jne 0x4068c5
push dword [ebx + 0x19]
mov eax, 0x7fff
push eax
lea eax, [esi + 4]
push eax
push dword [ebx + 0x1d]
call sub.kernel32.dll_GetPrivateProfileSectionA
jmp 0x406860
push ebx
push esi
push edx
push ebp
mov edx, 0
mov ebp, dword [edi + 0x1c]
mov ebx, 0x7ffd
or ebp, ebp
je 0x406906
or ebx, ebx
je 0x406906
push edx
mov eax, edi
call fcn.00407c94
push eax
call fcn.00405aac
pop eax
xor ecx, 0xffffffff
mov edx, esi
sub ebx, ecx
ja 0x4068fa
add ecx, ebx
xor ebx, ebx
add esi, ecx
call fcn.00402d34
pop edx
inc edx
dec ebp
jmp 0x4068d8
mov word [esi], 0
pop ebp
pop edx
pop esi
pop ebx
mov eax, ebx
call fcn.00406680
push dword [ebx + 0x19]
push esi
push dword [ebx + 0x1d]
call sub.kernel32.dll_WritePrivateProfileSectionA
pop eax
call fcn.00402c38
pop ecx
pop ebx
pop edi
pop esi
ret

Function at 0x409dc4
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x409dd0
or byte [eax + 0x37], 0x10
mov byte [eax + 0x56], dl
mov ecx, dword [eax + 0x28]
jecxz 0x409dec
push eax
je 0x409ded
call dword [0x426800]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x178], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x426800]
ret
Function at 0x40aa00
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040a980
je 0x40aa32
mov eax, ebx
push edx
call fcn.0040848c
pop edx
cmp eax, edx
je 0x40aa32
test edx, edx
mov eax, ebx
jne 0x40aa24
pop ebx
inc edx
jmp fcn.00408460
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.00408460
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040aa50
ret
Function at 0x40b600
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov edx, 8
call fcn.00402f60
mov eax, dword [ebp - 0xc]
add eax, 4
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004043f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0xd]
mov eax, dword [ebp - 0x14]
call fcn.0040b334
mov edx, dword [ebp - 0xc]
mov byte [edx], al
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret

Function at 0x40b71c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40b7c0
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004043f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x40b797
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x20]
xor ecx, ecx
mov eax, 0x40b7dc
call fcn.00405d1c
mov eax, dword [ebp - 0x18]
call fcn.0040524c
jmp 0x40b79d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
call fcn.0040b334
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b7c7
lea eax, [ebp - 0x18]
call fcn.00403fe4
ret

Function at 0x40b828
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40b892
push dword fs:[eax]
mov dword fs:[eax], esp
push 7
lea eax, [ebp - 0xf]
push eax
push 0x1004
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x14]
lea edx, [ebp - 0xf]
mov ecx, 7
call fcn.004041f0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_GetACP_1
mov edx, eax
pop eax
call fcn.0040b7f8
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b899
lea eax, [ebp - 0x14]
call fcn.00403fe4
ret
Function at 0x40cc48
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40cdbd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
call fcn.00403fe4
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040407c
cmp dword [ebp - 0x10], 0
jne 0x40ccb4
lea eax, [ebp - 0x10]
mov edx, 0x105
call fcn.00404628
push 0x105
mov eax, dword [ebp - 0x10]
call fcn.004043f4
push eax
mov eax, dword [0x42b7ec]
push eax
call sub.kernel32.dll_GetModuleFileNameA
mov edx, eax
lea eax, [ebp - 0x10]
call fcn.00404628
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
call fcn.004043f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jbe 0x40cda7
mov eax, dword [ebp - 0x14]
call fcn.00402c1c
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x40cd60
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 0x10]
call fcn.004043f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x40cdcc
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
shr eax, 0x10
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x20]
mov ax, word [eax + 8]
mov word [ebp - 0x26], ax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
shr eax, 0x10
mov word [ebp - 0x24], ax
mov eax, dword [ebp - 0x20]
mov ax, word [eax + 0xc]
mov word [ebp - 0x22], ax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cd67
mov eax, dword [ebp - 0x1c]
call fcn.00402c38
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40cdc4
lea eax, [ebp - 0x10]
call fcn.00403fe4
ret
Function at 0x40d278
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x50]
xor ecx, ecx
mov edx, 0x3c
call fcn.00402f60
mov dword [ebp - 0x50], 0x3c
mov dword [ebp - 0x4c], 0x440
mov eax, dword [ebp - 4]
call fcn.004043f4
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 8]
call fcn.004043f4
mov dword [ebp - 0x3c], eax
cmp byte [ebp + 8], 0
je 0x40d2c7
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x40d2ce
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax], edx
lea eax, [ebp - 0x50]
push eax
call sub.shell32.dll_ShellExecuteExA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 0xd], al
cmp byte [ebp - 0xd], 0
je 0x40d331
cmp dword [ebp + 0xc], 0
jbe 0x40d328
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x102
jne 0x40d31b
mov byte [ebp - 0xd], 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_TerminateProcess
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_CloseHandle
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 8

Function at 0x40d364
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff68
mov dword [ebp - 0x98], 0x94
lea eax, [ebp - 0x98]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [ebp - 0x94], 6
setae byte [ebp - 1]
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x40d398
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde8
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
cmp byte [ebp - 5], 1
cmc
sbb eax, eax
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x216]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 0x216]
mov ecx, 0x105
call fcn.00404208
mov esp, ebp
pop ebp
ret
Function at 0x40d898
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40da5a
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x1c]
mov eax, 0x40da74
call fcn.0040d4c4
mov edx, dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
mov ecx, 0x40da88
call fcn.0040427c
mov eax, dword [ebp - 0xc]
call fcn.00405d54
test al, al
jne 0x40d90e
lea edx, [ebp - 0x20]
mov eax, 0x40da9c
call fcn.0040d4c4
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0xc]
mov ecx, 0x40da88
call fcn.0040427c
mov eax, dword [ebp - 0xc]
call fcn.00405d54
test al, al
je 0x40da37
xor eax, eax
push ebp
push 0x40d93b
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040d6ac
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40d945
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov edx, 0x40dab4
call fcn.0040427c
mov edx, dword [ebp - 0x24]
mov eax, 0x40dac8
call fcn.0040c96c
push 0
push 0
lea ecx, [ebp - 0x10]
mov edx, 0x40dadc
mov eax, dword [ebp - 0xc]
call fcn.0040d278
push 0x64
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
jmp 0x40d9ce
push 0x64
call sub.kernel32.dll_Sleep_1
push 0
push 0x40dae0
call sub.user32.dll_FindWindowA
mov dword [ebp - 0x14], eax
mov eax, dword [0x428618]
mov eax, dword [eax]
call fcn.0040a2a0
call sub.kernel32.dll_GetTickCount
sub eax, dword [ebp - 0x18]
cmp eax, 0x927c0
jbe 0x40d9ce
mov eax, 0x40dac8
mov edx, 0x40db00
call fcn.0040c96c
jmp 0x40da37
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x40d98c
lea eax, [ebp - 0x28]
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0x13f4
mov byte [ebp - 0x34], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x2c], 0
lea edx, [ebp - 0x40]
mov ecx, 2
mov eax, 0x40db30
call fcn.00405d1c
mov edx, dword [ebp - 0x28]
mov eax, 0x40dac8
call fcn.0040c96c
push 0
mov eax, dword [ebp - 4]
push eax
push 0x13f4
mov eax, dword [ebp - 0x14]
push eax
call sub.user32.dll_SendMessageA_1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40da61
lea eax, [ebp - 0x28]
mov edx, 4
call fcn.00404008
lea eax, [ebp - 0xc]
call fcn.00403fe4
ret