joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d430
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push edi
push esi
sub esp, 0x24
mov dword [esp + 0x1c], 0xc
mov dword [esp + 0x18], 0x10
mov dword [esp + 0x20], 0x10
mov eax, dword fs:[0x30]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
xor ecx, 0xffffffff
sub ecx, 0xffffffff
mov edx, eax
xor edx, 0xffffffff
and edx, ecx
xor ecx, 0xffffffff
and eax, ecx
sub eax, edx
mov eax, dword [eax]
mov dword [esp + 0x10], eax
mov esi, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov eax, esi
and eax, edx
shl eax, 1
mov ecx, esi
xor ecx, 0xffffffff
and ecx, 0xc9dfb41e
and esi, 0x36204be1
mov edi, edx
xor edi, 0xffffffff
and edi, 0xc9dfb41e
and edx, 0x36204be1
or ecx, esi
or edi, edx
xor ecx, edi
xor eax, 0xffffffff
sub eax, 0xffffffff
sub ecx, eax
mov eax, dword [ecx]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
mov eax, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0
je 0x44d4fe
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x30]
lea ecx, str.kernel32.dll
mov dword [esp], eax
mov dword [esp + 4], ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
sub esp, 8
cmp eax, 0
jne 0x44d4fe
jmp 0x44d51b
jmp 0x44d500
jmp 0x44d502
jmp 0x44d504
jmp 0x44d506
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
cmp eax, ecx
setne al
test al, 1
jne 0x44d4c6
jmp 0x44d519
jmp 0x44d51b
mov eax, dword [esp + 8]
mov eax, dword [eax + 0x18]
add esp, 0x24
pop esi
pop edi
ret

Function at 0x44dd3f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x44dd7e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x44dd7e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x44dd7e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x44dd7e
cmp dword [ecx + 0x74], 0xe
jbe 0x44dd7e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x459bb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x459bdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x459bdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x45f788
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045f793
Function at 0xaccfc8
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.00acd118
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xaccfee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xaccfda
add dl, dl
jne 0xaccff9
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xacd04c
xor eax, eax
add dl, dl
jne 0xacd006
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xacd0ed
add dl, dl
jne 0xacd015
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xacd020
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xacd02b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xacd036
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xacd042
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xaccfe5
mov eax, 1
add dl, dl
jne 0xacd05a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xacd065
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xacd051
sub eax, ebx
mov ebx, 1
jne 0xacd098
mov ecx, 1
add dl, dl
jne 0xacd07e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xacd089
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xacd075
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaccfe5
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xacd0af
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xacd0ba
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xacd0a6
cmp eax, 0x7d00
jae 0xacd0dd
cmp eax, 0x500
jb 0xacd0d8
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaccfe5
cmp eax, 0x7f
ja 0xacd0e0
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xaccfe5
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xacd10e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xaccfe5
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x4fa94024
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x2c846c58
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x4013f2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push dword [esp + 0xc]
mov esi, eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401409
pop esi
ret
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x40141b
xor eax, eax
jmp 0x40144c
push dword [esp + 0x10]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
add eax, edi
and esi, 0xf
jbe 0x40143e
cmp edi, eax
jae 0x401417
dec esi
movzx ecx, word [edi]
lea edi, [edi + ecx*2 + 2]
jne 0x401430
cmp edi, eax
jae 0x401417
mov ax, word [edi]
neg ax
sbb eax, eax
and eax, edi
pop edi
pop esi
ret

Function at 0x401dd2
Capabilities:
Get graphical window text

Disassembly:
push ebx
push dword [esp + 8]
push dword [eax]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
test ebx, ebx
je 0x401e16
push esi
push edi
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov esi, dword [esp + 0x14]
lea edi, [eax + 1]
mov edx, edi
call fcn.00401792
push edi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 0x14]
mov esi, eax
call fcn.00401e25
pop edi
mov eax, esi
pop esi
jmp 0x401e21
mov eax, dword [esp + 0xc]
call fcn.00401927
xor eax, eax
pop ebx
ret 8
Function at 0x402355
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push 0x3c
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x3c]
push ebx
push eax
call fcn.0042e270
add esp, 0xc
push 0x64
pop eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
lea ecx, [ebp + 8]
mov dword [ebp - 0x3c], esi
mov eax, dword [eax - 0xc]
push ecx
call fcn.00401000
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push eax
push ebx
push ebx
push esi
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x4023b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x402485
push edi
push dword [ebp - 0x2c]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x28]
call fcn.00401000
mov edi, dword [ebp + 0x14]
call fcn.00401bc0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040147d
push dword [ebp - 0x10]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00401000
mov edi, dword [ebp + 0x18]
call fcn.00401bc0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040147d
cmp dword [ebp - 0x20], ebx
je 0x402424
push dword [ebp - 0x20]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.00401000
mov edi, dword [ebp + 0x1c]
call fcn.00401bc0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040147d
cmp dword [ebp - 0x18], ebx
je 0x40244b
push dword [ebp - 0x18]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00401000
mov edi, dword [ebp + 0x20]
call fcn.00401bc0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040147d
cmp dword [ebp - 8], ebx
je 0x402472
push dword [ebp - 8]
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
call fcn.00401000
mov edi, dword [ebp + 0x24]
call fcn.00401bc0
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.0040147d
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov ax, word [ebp - 0x24]
mov ecx, dword [ebp + 0x10]
mov word [ecx], ax
pop edi
lea eax, [esi - 0x10]
call fcn.0040147d
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x4027cf
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi + 0x1c]
test eax, eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], 0x4307b0
je 0x402821
push 0xea60
push eax
mov byte [esi + 0xd], 1
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x40281c
cmp dword [ebp - 4], 0x103
jne 0x40281c
push 0
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 0x1c]
call edi
mov eax, dword [esi + 0x78]
sub eax, 0x10
call fcn.0040147d
mov eax, dword [esi + 0x70]
test eax, eax
je 0x40283a
push eax
call edi
and dword [esi + 0x70], 0
mov eax, dword [esi + 0x68]
test eax, eax
je 0x402848
push eax
call edi
and dword [esi + 0x68], 0
mov eax, dword [esi + 0x48]
push 0x10
pop edi
sub eax, edi
call fcn.0040147d
mov eax, dword [esi + 0x30]
sub eax, edi
call fcn.0040147d
mov eax, dword [esi + 0x2c]
sub eax, edi
call fcn.0040147d
mov eax, dword [esi + 0x28]
sub eax, edi
call fcn.0040147d
pop edi
leave
ret

Function at 0x402876
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x30]
call fcn.00401bc0
mov eax, dword [ebp + 0xc]
lea edi, [esi + 0x2c]
call fcn.00401bc0
mov eax, dword [ebp + 0x18]
mov dword [esi + 0x50], eax
mov al, byte [ebp + 0x1c]
mov byte [esi + 0x64], al
mov eax, dword [ebp + 0x10]
xor edi, edi
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x1c]
cmp eax, edi
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], edi
je 0x4028bb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp + 0x14]
push edi
mov dword [esi + 0x1c], edi
mov byte [esi + 0x4c], al
mov dword [esi + 0x84], edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea eax, [ebp + 8]
push eax
push edi
push esi
push 0x402c0b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, edi
mov dword [esi + 0x1c], eax
jne 0x4028f3
push esi
call fcn.00404450
jmp 0x4028f5
xor eax, eax
pop edi
pop esi
pop ebp
ret 0x18

Function at 0x402a7d
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push edi
xor eax, eax
push eax
push eax
push 1
push eax
call ebx
mov esi, dword [ebp + 8]
add esi, 0x68
mov edi, eax
call fcn.004045c6
xor eax, eax
push eax
push eax
push 1
push eax
call ebx
mov ebx, dword [ebp + 8]
lea esi, [ebx + 0x70]
mov edi, eax
call fcn.004045c6
lea edi, [ebp + 8]
lea eax, [ebp - 4]
mov ecx, ebx
call fcn.00403fe2
push 0x10000000
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push str.AdvancedInstaller
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
jne 0x402aef
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x402afd
push 0x402b01
push eax
call dword [sym.imp.WININET.dll_InternetSetStatusCallback]
xor eax, eax
leave
ret 8
Function at 0x4031d9
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, eax
mov esi, dword [edi + 4]
mov ebx, ecx
call fcn.00403da7
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
and dword [ebp - 4], 0
push 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp byte [ebx + 0x4c], 0
mov esi, eax
je 0x40320f
mov dword [ebp - 4], esi
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov eax, ebx
mov byte [ebx + 0xc], 1
call fcn.00403151
test esi, esi
mov byte [ebx + 0xc], 0
jbe 0x403236
cmp dword [ebp - 4], esi
je 0x403236
mov eax, 0x2ee2
test eax, eax
jne 0x403246
mov ebx, dword [ebx + 0x14]
mov eax, edi
call fcn.004044fe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x40324d
Capabilities:
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, eax
push dword [edi + 0x68]
lea ebx, [edi + 0x44]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push dword [ebp + 0x14]
mov byte [edi + 0x4d], 0
push dword [ebp + 0x10]
mov dword [edi + 0x40], 3
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x4032e3
push edi
call fcn.00404450
cmp eax, 0x3e5
jne 0x4032e5
jmp 0x4032c0
push edi
call fcn.00404450
cmp eax, 0x3e5
jne 0x4032c5
lea esi, [edi + 4]
push ebx
call fcn.004046c4
mov eax, esi
call fcn.004046ad
test al, al
jne 0x4032d0
push 0xa
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x403294
cmp dword [edi + 0x3c], 0
jne 0x4032d7
mov eax, dword [edi + 0x38]
jmp 0x4032e5
mov eax, 0xe0000008
jmp 0x4032e5
mov edi, dword [edi + 0x38]
test edi, edi
jle 0x4032e3
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x4032ec
Capabilities:
Query remote server for available data

Disassembly:
push ebx
push esi
push edi
mov edi, eax
push dword [edi + 0x68]
lea ebx, [edi + 0x44]
mov byte [ebx], 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push dword [esp + 0x1c]
mov byte [edi + 0x4d], 0
push dword [esp + 0x1c]
mov dword [edi + 0x40], 8
call dword [sym.imp.WININET.dll_InternetQueryDataAvailable]
test eax, eax
jne 0x403380
push edi
call fcn.00404450
cmp eax, 0x3e5
jne 0x403382
jmp 0x40335c
push edi
call fcn.00404450
cmp eax, 0x3e5
jne 0x403361
lea esi, [edi + 4]
push ebx
call fcn.004046c4
mov eax, esi
call fcn.004046ad
test al, al
jne 0x40336c
push 0xa
push dword [edi + 0x68]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp byte [ebx], 0
je 0x403330
cmp dword [edi + 0x3c], 0
jne 0x403373
mov eax, dword [edi + 0x38]
jmp 0x403382
mov eax, 0xe0000008
jmp 0x403382
mov edi, dword [edi + 0x38]
test edi, edi
jle 0x403380
mov eax, dword [esp + 0x14]
mov dword [eax], edi
xor eax, eax
pop edi
pop esi
pop ebx
ret 8
Function at 0x404006
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push 0x3c
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0042e270
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add esp, 0xc
lea ecx, [ebp - 0x3c]
push ecx
push 0
push 0
push eax
mov dword [ebp - 0x3c], 0x3c
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
test eax, eax
jne 0x404045
push dword [ebp + 8]
call fcn.00404450
jmp 0x404068
mov eax, dword [ebp - 0x30]
cmp eax, 3
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
je 0x404066
cmp eax, 4
je 0x404066
cmp eax, 1
je 0x404066
cmp eax, 2
je 0x404066
push 2
pop eax
jmp 0x404068
xor eax, eax
leave
ret 0xc

Function at 0x405b5c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov eax, esi
neg eax
push edi
lea ecx, [esi + 4]
sbb eax, eax
and eax, ecx
push 0x80
push dword [eax]
call fcn.0042d1bd
pop ecx
pop ecx
lea edi, [esi + 4]
push edi
xor eax, eax
call fcn.00401e41
mov eax, dword [esi + 0x28]
push dword [eax]
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [edi]
call ebx
mov eax, dword [0x438af8]
mov ecx, 0x438af8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
push 0xdc
lea eax, [ebp - 4]
push eax
call fcn.0040162d
push 0x40a
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [ebp - 4]
push edi
push eax
call ebx
lea eax, [ebp - 8]
push eax
xor eax, eax
push eax
lea ecx, [esi + 0x30]
push ecx
push 0x405bf4
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x38], eax
lea eax, [edi - 0x10]
call fcn.0040147d
pop edi
xor eax, eax
pop ebx
leave
ret

Function at 0x406547
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x40655d
xor al, al
jmp 0x4065d2
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [eax - 0xc]
lea eax, [esi + 1]
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [edi], eax
jne 0x406582
xor al, al
jmp 0x4065d1
push ebx
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
jne 0x4065a2
lea esi, [ebp - 8]
call fcn.00405363
xor al, al
jmp 0x4065d0
mov eax, dword [ebp + 8]
push esi
push dword [eax]
push ebx
call fcn.0042e2d0
mov byte [ebx + esi], 0
add esp, 0xc
lea esi, [ebp - 8]
call fcn.00405363
push dword [edi]
push dword [edi + 8]
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, 1
pop ebx
pop esi
leave
ret 4
Function at 0x4077f5
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
xor eax, eax
push esi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
je 0x407875
push esi
lea eax, [ebp - 4]
push eax
call fcn.00404513
test al, al
jne 0x40782c
push 8
pop esi
jmp 0x407881
push dword [ebp - 4]
push esi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x407875
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4317ac
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40787e
cmp dword [ebp - 0x14], 0
je 0x40787e
test edi, edi
mov eax, dword [ebp - 0xc]
je 0x40786a
mov ecx, dword [eax + 8]
mov dword [edi], ecx
test ebx, ebx
je 0x40787e
mov eax, dword [eax + 0xc]
mov dword [ebx], eax
jmp 0x40787e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
push dword [ebp - 4]
call fcn.0042ddfa
pop ecx
mov eax, esi
pop esi
leave
ret

Function at 0x40789b
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [edi]
push ebx
xor ebx, ebx
push esi
sub eax, 0x10
mov dword [ebp - 4], ebx
call fcn.00401c33
add eax, 0x10
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
lea esi, [ebp - 0xc]
call fcn.004044e7
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x4079b2
push esi
lea eax, [ebp - 4]
push eax
call fcn.00404513
test al, al
je 0x40799b
push dword [ebp - 4]
push esi
push dword [ebp - 0x10]
lea esi, [ebp - 0xc]
call fcn.004044e7
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40799b
mov eax, dword [0x438af8]
mov ecx, 0x438af8
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x407945
cmp dword [ebp - 0x14], ebx
je 0x407945
mov eax, dword [ebp - 0x18]
movzx ecx, word [eax + 2]
push dword [ebp + 8]
movzx eax, word [eax]
push ecx
push eax
jmp 0x407952
push dword [ebp + 8]
push 0x4e2
push 0x409
lea eax, [ebp - 8]
push str.StringFileInfo_04x_04x_s
push eax
call fcn.004044d4
add esp, 0x14
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
lea esi, [ebp - 8]
call fcn.004044e7
push eax
push dword [ebp - 4]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x407990
cmp dword [ebp - 0x1c], ebx
je 0x407990
push dword [ebp - 0x20]
push edi
call fcn.004018a3
mov bl, 1
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.0040147d
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.0040147d
push dword [ebp - 4]
call fcn.0042ddfa
mov al, bl
jmp 0x4079c5
mov eax, dword [ebp - 0xc]
add eax, 0xfffffff0
call fcn.0040147d
push ebx
call fcn.0042ddfa
xor al, al
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x407b0d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
mov edi, eax
mov dword [ebp - 4], 0xc8
push dword [ebp - 4]
call fcn.0042ddf5
pop ecx
mov ebx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
lea ecx, [ebp - 4]
push ecx
push ebx
lea ecx, [ebp - 8]
push ecx
push 0
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x407b4e
inc dword [ebp - 4]
jmp 0x407b1d
test eax, eax
jne 0x407b9c
cmp dword [ebp - 8], 1
je 0x407b74
cmp dword [ebp - 8], 4
jne 0x407b1d
push dword [ebx]
push 0x430a94
push edi
call fcn.004044d4
add esp, 0xc
mov byte [ebp + 0xf], 1
jmp 0x407ba0
mov eax, dword [ebp - 4]
push esi
push ebx
lea esi, [ebp + 0xc]
mov byte [eax + ebx], 0
call fcn.004015d9
call fcn.00401bc0
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff0
call fcn.0040147d
mov byte [ebp + 0xf], 1
pop esi
jmp 0x407ba0
mov byte [ebp + 0xf], 0
push ebx
call fcn.0042ddfa
mov al, byte [ebp + 0xf]
pop ecx
pop edi
pop ebx
leave
ret

Function at 0x407d9b
Capabilities:
Get file size

Disassembly:
mov eax, dword [eax]
push esi
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407dc9
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test esi, esi
mov ebx, eax
je 0x407de0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, ebx
pop ebx
pop esi
ret

Function at 0x407f41
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
xor eax, eax
push 0x10
xor ebx, ebx
cmp byte [ebp + 0x18], bl
pop ecx
lea edi, [ebp - 0x58]
mov dword [ebp - 0x5c], 0x44
rep stosd dword es:[edi], eax
mov dword [ebp - 0x18], ebx
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 8], ebx
mov byte [ebp - 4], bl
je 0x407f79
lea esi, [ebp - 8]
call fcn.0042d5bb
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx - 0xc]
neg eax
sbb eax, eax
and eax, ecx
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [edx - 0xc]
neg ecx
sbb ecx, ecx
and ecx, edx
lea edx, [ebp - 0x18]
push edx
lea edx, [ebp - 0x5c]
push edx
push ebx
push ebx
push dword [ebp + 0x14]
push ebx
push ebx
push ebx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp byte [ebp + 0x18], bl
mov edi, eax
je 0x407fbc
lea esi, [ebp - 8]
call fcn.0042d5d1
cmp edi, ebx
je 0x407fe7
cmp dword [ebp + 0x10], ebx
je 0x407fdc
push 0xffffffffffffffff
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 0x10]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
lea esi, [ebp - 8]
call fcn.0042d5d1
pop edi
pop esi
mov al, bl
pop ebx
leave
ret