joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4051f0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x417b50
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
lea eax, [esp + 4]
xor ebx, ebx
push eax
push str.SOFTWAREIntelBasedriversDebug
push 0x80000002
mov dword [esp + 0x2c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x405314
mov cl, byte [esp + 0x28]
push ebp
push edi
mov byte [esp + 0x10], cl
mov edi, str.SetupBD:
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x14], ebx
push ecx
push str.SetupBD:
lea ecx, [esp + 0x18]
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.00402330
mov eax, dword [0x419218]
mov ecx, dword [esp + 0x38]
mov edi, eax
mov byte [esp + 0x28], 1
cmp ecx, edi
jae 0x405274
mov edi, ecx
sub eax, dword [esp + 0x18]
cmp eax, edi
ja 0x405281
call fcn.0040f879
cmp edi, ebx
jbe 0x4052cf
mov edx, dword [esp + 0x18]
push ebx
lea ecx, [esp + 0x14]
lea ebp, [edx + edi]
push ebp
call fcn.00402510
test al, al
je 0x4052cf
push esi
mov esi, dword [esp + 0x38]
cmp esi, ebx
jne 0x4052a9
mov esi, 0x41921c
mov eax, dword [esp + 0x1c]
mov edx, dword [esp + 0x18]
mov ecx, edi
push ebp
lea edi, [edx + eax]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.004024f0
pop esi
mov eax, dword [esp + 0x14]
pop edi
cmp eax, ebx
pop ebp
jne 0x4052de
mov eax, 0x41921c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
cmp ecx, ebx
je 0x405314
mov al, byte [ecx - 1]
cmp al, bl
je 0x40530a
cmp al, 0xff
je 0x40530a
dec al
mov byte [ecx - 1], al
jmp 0x405314
dec ecx
push ecx
call fcn.0040f86e
add esp, 4
mov ecx, dword [esp + 0x2c]
cmp ecx, ebx
je 0x405346
mov al, byte [ecx - 1]
cmp al, bl
je 0x40533c
cmp al, 0xff
je 0x40533c
dec al
pop ebx
mov byte [ecx - 1], al
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret
dec ecx
push ecx
call fcn.0040f86e
add esp, 4
mov ecx, dword [esp + 0x18]
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret
Function at 0x405b80
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x417bf6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov al, byte [esp + 3]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], ebx
mov byte [esp + 0x14], al
call fcn.00401d10
push str.SetupBD.ini
lea ecx, [esp + 0x24]
push 0x41fbc0
push ecx
mov dword [esp + 0x248], ebx
call fcn.0040f530
add esp, 0xc
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
mov byte [esp + 0x23c], 1
cmp eax, ebx
jne 0x405bfd
mov eax, 0x41921c
push ebp
push eax
lea edx, [esp + 0x3c]
push 0x200
push edx
push 0x41fa60
push str.InfName
push str.WinNT4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
call fcn.00402510
test al, al
je 0x405c61
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov eax, ecx
lea esi, [esp + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [ecx + ebp], bl
mov esi, dword [esp + 0x248]
mov dl, byte [esp + 0x14]
lea ecx, [esp + 0x14]
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x419218]
push eax
push ebx
push ecx
mov ecx, esi
call fcn.00401b10
mov ecx, dword [esp + 0x28]
pop ebp
cmp ecx, ebx
je 0x405caf
mov al, byte [ecx - 1]
cmp al, bl
je 0x405ca5
cmp al, 0xff
je 0x405ca5
dec al
mov byte [ecx - 1], al
jmp 0x405caf
dec ecx
push ecx
call fcn.0040f86e
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ebx
cmp ecx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
je 0x405cdf
mov al, byte [ecx - 1]
cmp al, bl
je 0x405cd5
cmp al, 0xff
je 0x405cd5
dec al
mov byte [ecx - 1], al
jmp 0x405cdf
dec ecx
push ecx
call fcn.0040f86e
add esp, 4
mov ecx, dword [esp + 0x234]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x234
ret
Function at 0x405d00
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x417c16
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x228
mov al, byte [esp + 3]
push ebx
push esi
xor ebx, ebx
push edi
push ebx
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], ebx
mov byte [esp + 0x14], al
call fcn.00401d10
push str.SetupBD.ini
lea ecx, [esp + 0x24]
push 0x41fbc0
push ecx
mov dword [esp + 0x248], ebx
call fcn.0040f530
add esp, 0xc
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
mov byte [esp + 0x23c], 1
cmp eax, ebx
jne 0x405d7d
mov eax, 0x41921c
push ebp
push eax
lea edx, [esp + 0x3c]
push 0x200
push edx
push 0x41fa60
push str.NMSDir
push str.WinNT4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebp, ecx
lea ecx, [esp + 0x18]
push ebp
call fcn.00402510
test al, al
je 0x405de1
mov edi, dword [esp + 0x18]
mov ecx, ebp
mov eax, ecx
lea esi, [esp + 0x38]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x1c], ebp
mov byte [ecx + ebp], bl
mov esi, dword [esp + 0x248]
mov dl, byte [esp + 0x14]
lea ecx, [esp + 0x14]
mov byte [esi], dl
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov eax, dword [0x419218]
push eax
push ebx
push ecx
mov ecx, esi
call fcn.00401b10
mov ecx, dword [esp + 0x28]
pop ebp
cmp ecx, ebx
je 0x405e2f
mov al, byte [ecx - 1]
cmp al, bl
je 0x405e25
cmp al, 0xff
je 0x405e25
dec al
mov byte [ecx - 1], al
jmp 0x405e2f
dec ecx
push ecx
call fcn.0040f86e
add esp, 4
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x24], ebx
cmp ecx, ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
je 0x405e5f
mov al, byte [ecx - 1]
cmp al, bl
je 0x405e55
cmp al, 0xff
je 0x405e55
dec al
mov byte [ecx - 1], al
jmp 0x405e5f
dec ecx
push ecx
call fcn.0040f86e
add esp, 4
mov ecx, dword [esp + 0x234]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x234
ret
Function at 0x406550
Capabilities:
Check mutex on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x29c
push ebx
push ebp
push esi
push edi
xor esi, esi
push eax
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x406587
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29c
ret
lea ecx, [esp + 0x218]
call fcn.00403b10
cmp eax, 5
jne 0x4066d5
call fcn.0040ebf0
test eax, eax
je 0x4066d5
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x19]
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
mov edx, dword [0x41fb88]
lea ecx, [esp + 0x18]
stosw word es:[edi], ax
push 0x200
push ecx
push 0xd
push edx
stosb byte es:[edi], al
call fcn.0040ea10
add esp, 0x10
lea eax, [esp + 0x18]
push 0x10
push str.SetupBD
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
mov cl, byte [esp + 0x13]
sub esp, 0x10
mov ebp, esp
lea edi, [esp + 0x28]
xor eax, eax
mov dword [esp + 0x24], esp
mov byte [ebp], cl
or ecx, 0xffffffff
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x40661f
call fcn.0040f879
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x40665a
mov al, byte [ecx - 1]
test al, al
je 0x40665a
cmp al, 0xff
je 0x40665a
cmp ebx, esi
jne 0x406694
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebp
call fcn.00401d10
call fcn.004051f0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29c
ret
cmp ebx, esi
jne 0x40667f
push 1
mov ecx, ebp
call fcn.00401d10
call fcn.004051f0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29c
ret
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x40668b
cmp eax, ebx
jae 0x40669c
push 1
mov ecx, ebp
call fcn.00401d10
push ebx
mov ecx, ebp
call fcn.00402bb0
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
lea esi, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
mov byte [eax + ebx], 0
call fcn.004051f0
add esp, 0x10
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29c
ret
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x29c
ret

Function at 0x4066f0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret
Function at 0x407300
Capabilities:
Get file version info

Disassembly:
sub esp, 0x14c
push ebx
mov ebx, dword [esp + 0x154]
push ebp
push esi
lea eax, [esp + 0x18]
push edi
xor ebp, ebp
push eax
push ebx
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x407339
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14c
ret
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x14]
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebp
ja 0x40735e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14c
ret
push esi
call fcn.00410375
mov edi, eax
add esp, 4
cmp edi, ebp
jne 0x40737a
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14c
ret
push edi
push esi
push ebp
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4073d1
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
push 0x41c1cc
push edi
mov dword [esp + 0x28], ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4073d1
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [eax + 8]
mov cx, word [eax + 8]
mov eax, dword [esp + 0x164]
push ecx
shr edx, 0x10
push edx
push str._d._d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebp, 1
push edi
call fcn.0040f86e
add esp, 4
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14c
ret
Function at 0x407be0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push ebx
push ebp
push esi
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x20]
lea edx, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], eax
push ecx
xor esi, esi
mov dword [esp + 0x18], eax
push edx
push esi
mov dword [esp + 0x24], eax
push esi
push esi
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x7c]
push esi
push esi
push esi
push eax
push esi
mov dword [esp + 0x48], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x407cef
sub esp, 0x10
mov edi, str.CreateProcess___error__path_too_long__
mov dword [esp + 0x78], esp
mov cl, byte [esp + 0x78]
mov ebp, esp
mov byte [ebp], cl
or ecx, 0xffffffff
mov dword [ebp + 4], esi
mov dword [ebp + 8], esi
mov dword [ebp + 0xc], esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov ebx, ecx
cmp ebx, 0xfffffffd
jbe 0x407c64
call fcn.0040f879
mov ecx, dword [ebp + 4]
cmp ecx, esi
je 0x407c89
mov al, byte [ecx - 1]
test al, al
je 0x407c89
cmp al, 0xff
je 0x407c89
cmp ebx, esi
jne 0x407cad
dec al
push esi
mov byte [ecx - 1], al
mov ecx, ebp
call fcn.00401d10
jmp 0x407cd7
cmp ebx, esi
jne 0x407c98
push 1
mov ecx, ebp
call fcn.00401d10
jmp 0x407cd7
mov eax, dword [ebp + 0xc]
cmp eax, 0x1f
ja 0x407ca4
cmp eax, ebx
jae 0x407cb5
push 1
mov ecx, ebp
call fcn.00401d10
push ebx
mov ecx, ebp
call fcn.00402bb0
mov edi, dword [ebp + 4]
mov ecx, ebx
mov edx, ecx
mov esi, str.CreateProcess___error__path_too_long__
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp + 4]
mov dword [ebp + 8], ebx
mov byte [eax + ebx], 0
call fcn.004051f0
add esp, 0x10
call fcn.00408b80
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x54
ret
mov ecx, dword [esp + 0x10]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0x14]
push eax
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x54
ret
Function at 0x409950
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
push 0
push 8
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov byte [ebp - 0x13], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4099ce
call esi
cmp eax, 0x3f0
jne 0x4099ba
lea ecx, [ebp - 4]
push ecx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4099ce
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edx, edx
cmp eax, 0x78
sete dl
mov eax, edx
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [ebp - 8]
push eax
push 0
push 0
push 2
push ecx
call ebx
test eax, eax
je 0x4099f4
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call esi
cmp eax, 0x7a
je 0x409a07
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 8]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.004106d0
mov esi, esp
test esi, esi
jne 0x409a28
xor eax, eax
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push edi
push esi
push 2
push eax
call ebx
test eax, eax
jne 0x409a44
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0xc]
xor edi, edi
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push 0x220
push 0x20
lea edx, [ebp - 0x18]
push 2
push edx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x409a71
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esi]
mov dword [ebp - 0x10], edi
cmp eax, edi
jbe 0x409aa1
lea ebx, [esi + 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebx]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x409a9a
mov eax, dword [esi]
inc edi
add ebx, 8
cmp edi, eax
jb 0x409a7d
jmp 0x409aa1
mov dword [ebp - 0x10], 1
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 0x10]
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c350
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x210
push edi
push str.SetupBD.ini
lea eax, [esp + 8]
push 0x41fbc0
push eax
call fcn.0040f530
mov ecx, 0x7f
xor eax, eax
lea edi, [esp + 0x21]
mov byte [esp + 0x20], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x14]
add esp, 0xc
test eax, eax
pop edi
jne 0x40c391
mov eax, 0x41921c
push esi
push eax
lea ecx, [esp + 0x18]
push 0x200
push ecx
push 0x41fa60
push str.LevelsToRoot
push str.Config
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x14]
push edx
call fcn.00410a91
mov ecx, dword [esp + 0xc]
add esp, 4
test ecx, ecx
mov esi, eax
je 0x40c3ed
mov al, byte [ecx - 1]
test al, al
je 0x40c3e3
cmp al, 0xff
je 0x40c3e3
dec al
mov byte [ecx - 1], al
mov eax, esi
pop esi
add esp, 0x210
ret
dec ecx
push ecx
call fcn.0040f86e
add esp, 4
mov eax, esi
pop esi
add esp, 0x210
ret
Function at 0x40eaa0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
push edi
mov esi, dword [esp + 0xc]
mov edi, eax
shr eax, 4
and edi, 0xf
inc eax
and eax, 0xffff
push ecx
push eax
push 6
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x40eaff
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40eaff
mov ecx, eax
xor edx, edx
mov ax, word [ecx]
test ax, ax
je 0x40eaf6
and eax, 0xffff
add ecx, 2
cmp edx, edi
mov esi, eax
je 0x40eb04
lea ecx, [ecx + esi*2]
jmp 0x40eaf9
add ecx, 2
inc edx
cmp edx, 0x10
jl 0x40eadb
pop edi
xor eax, eax
pop esi
ret
mov edx, dword [esp + 0x1c]
lea eax, [edx - 1]
cmp esi, eax
jle 0x40eb11
mov esi, eax
mov edi, dword [esp + 0x18]
push esi
push ecx
push edi
call fcn.00410b13
add esp, 0xc
mov word [edi + esi*2], 0
mov eax, edi
pop edi
pop esi
ret

Function at 0x40ebb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov ecx, dword [esp + 8]
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [esp + 8]
push edi
and ecx, 0xffff
push eax
push ecx
push 5
push esi
xor edi, edi
call dword [sym.imp.KERNEL32.dll_FindResourceExA]
test eax, eax
je 0x40ebeb
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40ebeb
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
ret
mov eax, edi
pop edi
pop esi
ret

Function at 0x40ebf0
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x10c
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
mov ecx, dword [0x41cf84]
mov edx, dword [0x41cf88]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [str.PROSetMutex]
mov dword [esp + 8], ecx
mov dword [esp + 4], eax
mov dword [esp + 0xc], edx
call fcn.0040eca0
test eax, eax
pop edi
jne 0x40ec3f
lea eax, [esp]
lea ecx, [esp + 0xc]
push eax
push 0x41cf7c
push ecx
jmp 0x40ec4e
lea edx, [esp]
lea eax, [esp + 0xc]
push edx
push str.Global_s
push eax
call fcn.004109b4
add esp, 0xc
lea ecx, [esp + 0xc]
push esi
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40ec82
mov eax, 1
pop esi
add esp, 0x10c
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x10c
ret
Function at 0x40eca0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xb0
lea ecx, [esp + 0x1c]
push ebx
push ebp
push esi
push edi
call fcn.00403b10
cmp eax, 5
jne 0x40edad
mov ecx, dword [0x41cfd0]
mov eax, dword [str.Terminal_Server]
mov edx, dword [0x41cfd4]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], eax
mov eax, dword [0x41cfd8]
push ecx
xor ebx, ebx
push str.SystemCurrentControlSetControlProductOptions
push 0x80000002
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40edad
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x14]
push edx
push ebx
push eax
push ebx
push str.ProductSuite
push ecx
call esi
test eax, eax
jne 0x40edad
mov eax, dword [esp + 0x18]
cmp eax, ebx
je 0x40edad
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
cmp edi, ebx
je 0x40edad
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x18]
push edi
push eax
push ebx
push str.ProductSuite
push ecx
call esi
test eax, eax
jne 0x40edad
cmp dword [esp + 0x14], 7
jne 0x40edad
mov al, byte [edi]
mov esi, edi
test al, al
je 0x40ed97
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
test eax, eax
je 0x40edba
push esi
call ebp
lea esi, [esi + eax + 1]
cmp byte [esi], 0
jne 0x40ed7d
xor ebx, ebx
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [esp + 0x10]
cmp eax, ebx
je 0x40edad
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xb0
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xb0
ret
Function at 0x413d55
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x41d478
cmp edx, dword [eax]
je 0x413d77
add eax, 8
inc ecx
cmp eax, 0x41d508
jl 0x413d68
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x41d478]
jne 0x413ea5
mov eax, dword [0x41fc40]
cmp eax, 1
je 0x413e7f
test eax, eax
jne 0x413da8
cmp dword [0x41d094], 1
je 0x413e7f
cmp edx, 0xfc
je 0x413ea5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x413ddf
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004150c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00410dc0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x413e22
lea eax, [ebp - 0x1a4]
push eax
call fcn.00410dc0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4196e0
push edi
call fcn.004155a0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004150c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004150d0
lea eax, [ebp - 0xa0]
push 0x4196c0
push eax
call fcn.004150d0
push dword [esi + 0x41d47c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004150d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00415df8
add esp, 0x2c
pop edi
jmp 0x413ea5
lea eax, [ebp + 8]
lea esi, [esi + 0x41d47c]
push 0
push eax
push dword [esi]
call fcn.00410dc0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4033e8
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.00405d20
test esi, esi
jne 0x403420
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00405e5c
jmp 0x40343e
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004032cc
mov edi, eax
test esi, esi
je 0x40343e
cmp dword [ebx], 0
je 0x40343e
dec esi
jmp 0x403427
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x403b14
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x4cd020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x403bac
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExW
test eax, eax
jne 0x403b8c
xor eax, eax
push ebp
push 0x403b85
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403be4
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403b8c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, word [0x4cd020]
and ax, 0xffc0
movzx edx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x4cd020], ax
mov esp, ebp
pop ebp
ret