joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401050
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
test edx, edx
je 0x4011b2
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4011b2
mov eax, dword [ebp + 0x10]
cmp eax, 1
jb 0x4011b2
push esi
xor esi, esi
test eax, eax
je 0x4011a7
dec eax
push ebx
mov bl, byte [ebp + 0xa]
shr eax, 2
inc eax
push edi
lea edi, [ecx + 2]
mov dword [ebp + 0xc], eax
mov dl, byte [edi - 2]
cmp dl, 0x2b
jne 0x40109c
mov dl, 0x3e
jmp 0x4010ca
cmp dl, 0x2f
jne 0x4010a5
mov dl, 0x3f
jmp 0x4010ca
cmp dl, 0x39
jg 0x4010af
add dl, 4
jmp 0x4010ca
cmp dl, 0x3d
je 0x4010c8
cmp dl, 0x5a
jg 0x4010be
sub dl, 0x41
jmp 0x4010ca
cmp dl, 0x7a
jg 0x4010c8
sub dl, 0x47
jmp 0x4010ca
mov dl, 0x40
mov cl, byte [edi - 1]
cmp cl, 0x2b
jne 0x4010d6
mov cl, 0x3e
jmp 0x401104
cmp cl, 0x2f
jne 0x4010df
mov cl, 0x3f
jmp 0x401104
cmp cl, 0x39
jg 0x4010e9
add cl, 4
jmp 0x401104
cmp cl, 0x3d
je 0x401102
cmp cl, 0x5a
jg 0x4010f8
sub cl, 0x41
jmp 0x401104
cmp cl, 0x7a
jg 0x401102
sub cl, 0x47
jmp 0x401104
mov cl, 0x40
mov al, cl
shl dl, 2
shr al, 4
add al, dl
mov edx, dword [ebp + 8]
mov byte [esi + edx], al
inc esi
mov al, byte [edi]
cmp al, 0x3d
je 0x40115d
mov bl, al
cmp bl, 0x2b
jne 0x401126
mov bl, 0x3e
jmp 0x40114f
cmp bl, 0x2f
jne 0x40112f
mov bl, 0x3f
jmp 0x40114f
cmp bl, 0x39
jg 0x401139
add bl, 4
jmp 0x40114f
cmp bl, 0x5a
jg 0x401143
sub bl, 0x41
jmp 0x40114f
cmp bl, 0x7a
jg 0x40114d
sub bl, 0x47
jmp 0x40114f
mov bl, 0x40
mov al, bl
shl cl, 4
shr al, 2
add al, cl
mov byte [esi + edx], al
inc esi
mov al, byte [edi + 1]
cmp al, 0x3d
je 0x401199
cmp al, 0x2b
jne 0x40116c
mov al, 0x3e
jmp 0x40118e
cmp al, 0x2f
jne 0x401174
mov al, 0x3f
jmp 0x40118e
cmp al, 0x39
jg 0x40117c
add al, 4
jmp 0x40118e
cmp al, 0x5a
jg 0x401184
sub al, 0x41
jmp 0x40118e
cmp al, 0x7a
jg 0x40118c
sub al, 0x47
jmp 0x40118e
mov al, 0x40
mov cl, bl
shl cl, 6
add cl, al
mov byte [esi + edx], cl
inc esi
add edi, 4
dec dword [ebp + 0xc]
jne 0x401090
pop edi
pop ebx
mov byte [esi + edx], 0
mov eax, esi
pop esi
pop ebp
ret 0xc
xor eax, eax
pop ebp
ret 0xc
Function at 0x4011c0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4012d7
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x4012d7
mov ebx, dword [ebp + 0x10]
cmp ebx, 1
jb 0x4012d7
push esi
xor eax, eax
xor esi, esi
mov dword [ebp + 8], eax
test ebx, ebx
je 0x4012cc
mov dl, byte [esi + ecx]
inc esi
mov cl, dl
and dl, 3
shr cl, 2
movzx ecx, cl
shl dl, 4
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi], cl
cmp esi, ebx
jae 0x4012b5
mov ecx, dword [ebp + 0xc]
mov bl, byte [esi + ecx]
inc esi
mov cl, bl
and bl, 0xf
shr cl, 4
add dl, cl
movzx ecx, dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi + 1], cl
cmp esi, dword [ebp + 0x10]
jae 0x401292
mov ecx, dword [ebp + 0xc]
shl bl, 2
mov dl, byte [esi + ecx]
inc esi
mov cl, dl
and dl, 0x3f
shr cl, 6
add bl, cl
movzx ecx, bl
mov ebx, dword [ebp + 0x10]
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi + 2], cl
movzx ecx, dl
movzx ecx, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi + 3], cl
add eax, 4
mov ecx, dword [ebp + 8]
add ecx, 3
mov dword [ebp + 8], ecx
cmp ecx, ebx
mov ecx, dword [ebp + 0xc]
jb 0x4011f7
pop esi
mov byte [eax + edi], 0
pop edi
pop ebx
pop ebp
ret 0xc
shl bl, 2
movzx ecx, bl
pop esi
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi + 2], cl
mov byte [eax + edi + 3], 0x3d
add eax, 4
mov byte [eax + edi], 0
pop edi
pop ebx
pop ebp
ret 0xc
movzx ecx, dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + edi + 1], cl
mov word [eax + edi + 2], 0x3d3d
add eax, 4
pop esi
mov byte [eax + edi], 0
pop edi
pop ebx
pop ebp
ret 0xc
pop edi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x401d10
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x660
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x65c], eax
push esi
push edi
lea eax, [esp + 8]
mov dword [esp + 8], 0x114
push eax
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x401ec2
cmp dword [esp + 0x10], 1
jne 0x401ec2
xor eax, eax
push 0x206
push eax
mov word [esp + 0x258], ax
lea eax, [esp + 0x25a]
push eax
call fcn.004164b0
add esp, 0xc
xor eax, eax
mov word [esp + 0x124], ax
xorps xmm0, xmm0
mov dword [esp + 0x146], eax
mov word [esp + 0x14a], ax
push 0x3a
push eax
mov word [esp + 0x154], ax
lea eax, [esp + 0x156]
push eax
movdqu xmmword [esp + 0x132], xmm0
movdqu xmmword [esp + 0x142], xmm0
call fcn.004164b0
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x130]
add esp, 0xc
push str..amver
push eax
call esi
push 0x425940
lea eax, [esp + 0x150]
push eax
call esi
push str..amver
lea eax, [esp + 0x150]
push eax
call esi
call fcn.00402880
push eax
lea eax, [esp + 0x254]
push eax
call esi
lea eax, [esp + 0x14c]
push eax
lea eax, [esp + 0x254]
push eax
call esi
xor eax, eax
push 0x206
push eax
mov word [esp + 0x460], ax
lea eax, [esp + 0x462]
push eax
call fcn.004164b0
add esp, 0xc
call fcn.00402880
push eax
lea eax, [esp + 0x45c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push edi
call fcn.004029d0
push eax
lea eax, [esp + 0x45c]
push eax
call esi
lea eax, [esp + 0x458]
push eax
lea eax, [esp + 0x150]
push eax
lea eax, [esp + 0x12c]
push eax
call fcn.00404610
push 0
push 0
push 1
push 0
push 0
push 0x10000000
lea eax, [esp + 0x268]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
je 0x401ea0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
lea eax, [esp + 0x254]
push eax
call fcn.00404360
pop edi
pop esi
mov ecx, dword [esp + 0x65c]
xor ecx, esp
call fcn.0040b999
mov esp, ebp
pop ebp
ret
xor eax, eax
push 0xc6
push eax
mov word [esp + 0x190], ax
lea eax, [esp + 0x192]
push eax
call fcn.004164b0
add esp, 0xc
call fcn.00402880
push eax
lea eax, [esp + 0x18c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 0x188]
push 0x425940
push eax
call esi
push str..amver
lea eax, [esp + 0x18c]
push eax
call esi
push 0
push 0x80
push 2
push 0
push 2
push 0x40000004
lea eax, [esp + 0x1a0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push edi
call fcn.00403f30
mov ecx, dword [esp + 0x664]
pop edi
pop esi
xor ecx, esp
call fcn.0040b999
mov esp, ebp
pop ebp
ret
Function at 0x401f70
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x210
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
xor eax, eax
mov edi, ecx
push 0x206
push eax
mov word [esp + 0x10], ax
lea eax, [esp + 0x12]
push eax
call fcn.004164b0
add esp, 0xc
lea eax, [esp + 8]
push 0
push 0x23
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [esp + 8]
push str.4997GameBox_Data_
push eax
call esi
lea eax, [esp + 8]
push eax
push 0x104
push edi
call fcn.0040c1d8
add esp, 0xc
push str.softinfo.ini
push edi
call esi
mov eax, dword [0x42f8bc]
push edi
add eax, 0xb4
push 0x104
push eax
call fcn.0040c1d8
add esp, 0xc
push 0
push 0
call fcn.00402880
mov ecx, dword [0x42f8c8]
push eax
call fcn.00402b80
mov eax, dword [0x42f8bc]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x42579c
push dword [eax]
call esi
push 0
push 0
call fcn.00402720
mov ecx, dword [0x42f8c8]
push eax
call fcn.00402b80
mov eax, dword [0x42f8bc]
push 0x42579c
push dword [eax + 4]
call esi
call fcn.00404290
push 0
push ecx
call fcn.00402880
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
add esp, 4
push eax
call esi
push 0
push ecx
call fcn.00402720
add esp, 4
push eax
call esi
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.0040b999
mov esp, ebp
pop ebp
ret
Function at 0x402370
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
push 0
push ecx
push 0x4022f0
push 0
push 0
call fcn.0040bfab
mov esi, eax
add esp, 0x18
test esi, esi
je 0x4023c4
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x4023c4
cmp dword [ebp - 4], 0
jne 0x4023c4
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x402720
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov esi, dword [0x42f8bc]
push edi
push dword [esi + 4]
call ebx
test eax, eax
jg 0x402863
cmp word [esi + 0xb4], 0
lea eax, [esi + 0xb4]
je 0x40278a
push eax
push 0x104
push dword [esi + 4]
push 0x42579c
push str.StartMenuPath
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi + 4]
cmp word [eax], 0
jne 0x402866
push dword [esi + 4]
call ebx
test eax, eax
jne 0x402863
lea eax, [ebp - 0xe0]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0xd0], ax
lea eax, [ebp - 0xce]
push eax
call fcn.004164b0
movzx eax, word [ebp - 0xda]
push eax
movzx eax, word [ebp - 0xde]
push eax
lea eax, [ebp - 0xd0]
push str._d_02d
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push 0
push 2
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x425954
push dword [esi + 4]
call edi
push dword [esi + 0x14]
call ebx
test eax, eax
jne 0x40282b
cmp dword [esi + 0x38], eax
je 0x40281d
push str.haow
jmp 0x402822
push 0x425cc0
push dword [esi + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [esi + 0x14]
push dword [esi + 4]
call edi
cmp dword [esi + 0x38], 0
je 0x402859
push 0x425c54
push dword [esi + 4]
call edi
lea eax, [ebp - 0xd0]
push eax
push dword [esi + 4]
call edi
push 0x425c58
push dword [esi + 4]
call edi
push 0x425954
push dword [esi + 4]
call edi
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b999
mov esp, ebp
pop ebp
ret
Function at 0x402880
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x42f8bc]
push edi
mov edx, dword [esi]
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4028a3
sub eax, edi
sar eax, 1
je 0x4028c7
mov eax, edx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b999
mov esp, ebp
pop ebp
ret
cmp word [esi + 0xb4], 0
lea edi, [esi + 0xb4]
je 0x4028ff
push edi
push 0x104
push edx
push 0x42579c
push str.InstallPath
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi]
cmp word [eax], 0
jne 0x4029b4
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
xor eax, eax
push 0x62
push eax
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push eax
call fcn.004164b0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.0040bb10
add esp, 4
call fcn.0040baef
cdq
mov ebx, 0x1a
idiv ebx
add edx, 0x41
push edx
call fcn.0040baef
cdq
idiv ebx
add edx, 0x41
push edx
call fcn.0040baef
cdq
idiv ebx
add edx, 0x41
push edx
call fcn.0040baef
cdq
idiv ebx
add edx, 0x41
push edx
call fcn.0040baef
cdq
idiv ebx
lea eax, [ebp - 0x70]
add edx, 0x41
push edx
push 0x425c5c
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push 0
push 0x23
push dword [esi]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x70]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push dword [esi]
push str.InstallPath
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esi]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b999
mov esp, ebp
pop ebp
ret

Function at 0x4029d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x42f8bc]
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jg 0x402a82
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x402a1b
push edi
push 0x104
push dword [esi + 0xc]
push 0x42579c
push str.REName
push str.config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, dword [esi + 0xc]
cmp word [eax], 0
jne 0x402a81
cmp dword [esi + 0x48], 0
jne 0x402a34
push 0x425c88
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
jmp 0x402a69
push 0
call fcn.0040c4bf
push eax
call fcn.0040bb10
call fcn.0040baef
cdq
mov ecx, 0x22
idiv ecx
shl edx, 8
add edx, str.MRAInplaceViewer
push edx
push str._s.exe
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
test edi, edi
je 0x402a81
push edi
push dword [esi + 0xc]
push str.REName
push str.config
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
mov eax, dword [esi + 0xc]
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x402a90
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 4]
xor bl, bl
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x402af3
push dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 0x14]
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
movzx ebx, bl
mov ecx, 1
cmove ebx, ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402b00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
lea eax, [ebp - 0x10]
mov dword [ebp - 0x58], 0x44
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
push dword [ebp + 0xc]
mov dword [ebp - 0x50], 0x42579c
push 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x402b77
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret 0x10
xor al, al
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4032d0
Capabilities:
Check if file exists
Create directory
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x218], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.004164b0
add esp, 0xc
call fcn.00402720
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push eax
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test edi, edi
je 0x403367
push edi
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x425954
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x218]
lea eax, [ebp - 0x20c]
push eax
call esi
push 0x425d10
lea eax, [ebp - 0x20c]
push eax
call esi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0
push eax
push 0x4202f0
push 1
push 0
push 0x420300
mov dword [ebp - 0x214], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x403444
mov eax, dword [ebp - 0x210]
mov esi, dword [ebp - 0x21c]
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 0x210]
push 0x42579c
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, dword [ebp - 0x210]
push 0
push esi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x44]
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x214]
push edx
push 0x420310
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x403444
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40342f
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x20c]
push 2
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x214]
pop edi
pop esi
test ecx, ecx
je 0x403456
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov ecx, dword [ebp - 0x210]
test ecx, ecx
je 0x403466
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b999
mov esp, ebp
pop ebp
ret 0x14
Function at 0x403480
Capabilities:
Acquire debug privileges
Enumerate processes
Get file system object information
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x71c
mov eax, dword [section..data]
xor eax, esp
mov dword [esp + 0x718], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 1
push edi
push 0
push 2
mov dword [esp + 0x1c], esi
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
jne 0x4034d2
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x718]
xor ecx, esp
call fcn.0040b999
mov esp, ebp
pop ebp
ret 4
lea eax, [esp + 0x20]
mov dword [esp + 0x20], 0x22c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4034b9
lea eax, [esp + 0x10]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x403570
lea eax, [esp + 0x18]
push eax
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x40355d
mov eax, dword [esp + 0x18]
push 0
push 0
mov dword [esp + 0x25c], eax
mov eax, dword [esp + 0x24]
push 0
mov dword [esp + 0x264], eax
lea eax, [esp + 0x25c]
push eax
push 0
push dword [esp + 0x24]
mov dword [esp + 0x268], ebx
mov dword [esp + 0x274], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x403570
push 0x2b4
lea eax, [esp + 0x264]
push 0
push eax
call fcn.004164b0
add esp, 0xc
lea eax, [esp + 0x260]
push 0x101
push 0x2b4
push eax
push 0
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [esp + 0x51c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x4035f9
push dword [esp + 0x28]
push eax
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov esi, dword [esp + 0x14]
neg eax
sbb eax, eax
and ebx, eax
lea eax, [esp + 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x403570
mov ecx, dword [esp + 0x724]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040b999
mov esp, ebp
pop ebp
ret 4
Function at 0x403630
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x206
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [esi], 0x1b58
call fcn.004164b0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push str.mshtml.dll
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x218]
xor edi, edi
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x218], edi
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [ebp - 0x210], eax
test eax, eax
je 0x403732
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov ebx, eax
test ebx, ebx
je 0x403732
push ebx
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push dword [ebp - 0x218]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x403720
lea eax, [ebp - 0x214]
mov dword [ebp - 0x210], edi
push eax
lea eax, [ebp - 0x210]
mov dword [ebp - 0x214], edi
push eax
push 0x425954
push ebx
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x403720
cmp dword [ebp - 0x214], edi
je 0x403720
mov eax, dword [ebp - 0x210]
movzx edi, word [eax + 0xa]
push ebx
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp edi, 0xb
jne 0x40374b
mov dword [esi], 0x2af8
pop edi
mov dword [esi], 0x1b58
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b999
mov esp, ebp
pop ebp
ret 4
cmp edi, 0xa
jne 0x403769
pop edi
mov dword [esi], 0x2710
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b999
mov esp, ebp
pop ebp
ret 4
cmp edi, 9
jne 0x403787
pop edi
mov dword [esi], 0x2328
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b999
mov esp, ebp
pop ebp
ret 4
cmp edi, 8
jne 0x4037a5
pop edi
mov dword [esi], 0x1f40
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b999
mov esp, ebp
pop ebp
ret 4
cmp edi, 7
je 0x403732
cmp edi, 6
jne 0x403732
mov ecx, dword [ebp - 4]
pop edi
mov dword [esi], 0x1770
xor ecx, ebp
pop esi
pop ebx
call fcn.0040b999
mov esp, ebp
pop ebp
ret 4