joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x224
mov eax, dword [0x536400]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
lea ecx, [esp + 0xbc]
push edi
push ecx
mov dword [esp + 0x20], eax
call fcn.00453f60
mov eax, dword [ebp + 0xc]
lea edx, [esp + 0xc4]
push edx
push eax
push esi
call fcn.00453f80
mov edx, dword [ebp + 0x14]
mov ecx, 0x28
lea esi, [esp + 0xd0]
lea edi, [esp + 0x170]
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x170]
push ecx
push edx
push ebx
call fcn.00454000
mov eax, dword [ebp + 0x20]
lea ecx, [eax - 1]
mov eax, 0xcccccccd
mul ecx
shr edx, 4
add esp, 0x1c
add edx, 1
mov dword [esp + 0x18], edx
je 0x455021
lea edx, [esp + 0x204]
mov dword [esp + 0x10], 0
mov ebx, 1
mov dword [esp + 0xc], edx
xor eax, eax
mov ecx, 0x28
lea esi, [esp + 0x160]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
mov dword [esp + 0x204], eax
mov dword [esp + 0x208], eax
mov dword [esp + 0x20c], eax
mov dword [esp + 0x210], eax
mov dword [esp + 0x214], eax
mov ecx, ebx
shr ecx, 0x10
mov eax, ebx
shr eax, 0x18
mov byte [esp + 0x219], cl
mov ecx, dword [ebp + 0x18]
mov edx, ebx
shr edx, 8
test ecx, ecx
mov byte [esp + 0x218], al
mov byte [esp + 0x21a], dl
mov byte [esp + 0x21b], bl
mov eax, 4
jbe 0x454fe0
mov dword [esp + 0x14], ecx
mov edi, edi
lea ecx, [esp + 0x20]
push ecx
push eax
lea edx, [esp + 0x220]
push edx
call fcn.00454000
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x228]
push 0x14
push ecx
call fcn.004540a0
add esp, 0x18
xor eax, eax
lea esp, [esp]
movzx edx, byte [esp + eax + 0x218]
xor byte [esp + eax + 0x204], dl
movzx ecx, byte [esp + eax + 0x219]
movzx edx, byte [esp + eax + 0x21a]
xor byte [esp + eax + 0x205], cl
xor byte [esp + eax + 0x206], dl
movzx ecx, byte [esp + eax + 0x21b]
movzx edx, byte [esp + eax + 0x21c]
xor byte [esp + eax + 0x207], cl
xor byte [esp + eax + 0x208], dl
add eax, 5
cmp eax, 0x14
jb 0x454f70
sub dword [esp + 0x14], 1
mov ecx, 0x28
lea esi, [esp + 0xc0]
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
jne 0x454f40
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp eax, dword [ebp + 0x20]
jae 0x455004
mov edx, dword [esp + 0xc]
mov dl, byte [edx + eax]
mov esi, dword [esp + 0x1c]
mov byte [eax + esi], dl
add ecx, 1
add eax, 1
cmp ecx, 0x14
jb 0x454fe6
mov eax, 0x14
add dword [esp + 0x10], eax
sub dword [esp + 0xc], eax
add ebx, 1
lea eax, [ebx - 1]
cmp eax, dword [esp + 0x18]
jb 0x454ec8
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0046255c
mov esp, ebp
pop ebp
ret
Function at 0x455190
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x47c878
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x536400]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
lea ecx, [esp + 8]
call fcn.0040a5a0
mov edx, dword [esp + 0x38]
mov eax, edx
mov dword [esp + 0x30], 0
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4551d0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x10]
call fcn.0040b1f0
mov eax, dword [esp + 0x3c]
push eax
lea ecx, [esp + 0xc]
push ecx
call fcn.00455040
add esp, 8
lea ecx, [esp + 8]
mov dword [esp + 0x30], 0xffffffff
call fcn.0040ac60
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x458a80
Capabilities:
Compute adler32 checksum

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0xc]
movzx ecx, di
shr edi, 0x10
test esi, esi
jne 0x458a9e
pop edi
mov eax, 1
pop esi
ret 0xc
push ebx
mov ebx, dword [esp + 0x18]
test ebx, ebx
jbe 0x458bac
push ebp
lea esp, [esp]
cmp ebx, 0x15b0
mov eax, ebx
jb 0x458abf
mov eax, 0x15b0
sub ebx, eax
cmp eax, 0x10
jl 0x458b6b
mov edx, eax
shr edx, 4
mov ebp, edx
neg ebp
shl ebp, 4
add eax, ebp
jmp 0x458ae0
movzx ebp, byte [esi]
add ecx, ebp
movzx ebp, byte [esi + 1]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 2]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 3]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 4]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 5]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 6]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 7]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 8]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 9]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xa]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xb]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xc]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xd]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xe]
add edi, ecx
add ecx, ebp
movzx ebp, byte [esi + 0xf]
add edi, ecx
add ecx, ebp
add edi, ecx
add esi, 0x10
sub edx, 1
jne 0x458ae0
test eax, eax
je 0x458b7f
nop
movzx edx, byte [esi]
add ecx, edx
add esi, 1
add edi, ecx
sub eax, 1
jne 0x458b70
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul edx, edx, 0xffff000f
add ecx, edx
mov eax, 0x80078071
mul edi
shr edx, 0xf
imul edx, edx, 0xffff000f
add edi, edx
test ebx, ebx
ja 0x458ab0
pop ebp
mov eax, edi
pop ebx
shl eax, 0x10
pop edi
or eax, ecx
pop esi
ret 0xc
Function at 0x45e230
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax + 0x18], 0xc3d2e1f0
ret
Function at 0x46255c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x536400]
jne 0x462566
repz ret
jmp fcn.00469236
Function at 0x4659a6
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
je 0x4659e3
cmp dword [ebp + 0x14], edi
je 0x4659e3
cmp ecx, edi
jne 0x4659ea
call fcn.00466b43
push edi
push edi
push edi
push edi
mov dword [eax], 0x16
push edi
call fcn.00462784
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov esi, dword [ebp + 0x18]
cmp esi, edi
je 0x4659fe
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
jbe 0x465a1f
cmp ebx, 0xffffffff
je 0x465a0e
push ebx
push edi
push ecx
call fcn.00463870
add esp, 0xc
cmp esi, edi
je 0x4659cb
or eax, 0xffffffff
xor edx, edx
div dword [ebp + 0x10]
cmp dword [ebp + 0x14], eax
ja 0x4659cb
mov edi, dword [ebp + 0x10]
imul edi, dword [ebp + 0x14]
test word [esi + 0xc], 0x10c
mov dword [ebp - 0x10], edi
mov ebx, edi
je 0x465a3b
mov eax, dword [esi + 0x18]
mov dword [ebp - 0xc], eax
jmp 0x465a42
mov dword [ebp - 0xc], 0x1000
test edi, edi
je 0x465b33
test word [esi + 0xc], 0x10c
je 0x465a96
mov eax, dword [esi + 4]
test eax, eax
je 0x465a96
jl 0x465b94
cmp ebx, eax
mov edi, ebx
jb 0x465a67
mov edi, eax
cmp edi, dword [ebp - 4]
ja 0x465b3b
push edi
push dword [esi]
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.00462904
sub dword [esi + 4], edi
add dword [esi], edi
add dword [ebp - 8], edi
sub ebx, edi
add esp, 0x10
sub dword [ebp - 4], edi
mov edi, dword [ebp - 0x10]
jmp 0x465b2b
cmp ebx, dword [ebp - 0xc]
jb 0x465b03
cmp dword [ebp - 0xc], 0
je 0x465ac0
mov ecx, 0x7fffffff
xor edx, edx
cmp ebx, ecx
jbe 0x465ab5
mov eax, ecx
div dword [ebp - 0xc]
mov eax, ecx
jmp 0x465abc
mov eax, ebx
div dword [ebp - 0xc]
mov eax, ebx
sub eax, edx
jmp 0x465acb
mov eax, 0x7fffffff
cmp ebx, eax
ja 0x465acb
mov eax, ebx
cmp eax, dword [ebp - 4]
ja 0x465b67
push eax
push dword [ebp - 8]
push esi
call fcn.0046f1af
pop ecx
push eax
call fcn.0046febb
add esp, 0xc
test eax, eax
je 0x465ba6
cmp eax, 0xffffffff
je 0x465b94
add dword [ebp - 8], eax
sub ebx, eax
sub dword [ebp - 4], eax
jmp 0x465b2b
push esi
call fcn.0046f7da
cmp eax, 0xffffffff
pop ecx
je 0x465b98
cmp dword [ebp - 4], 0
je 0x465b67
mov ecx, dword [ebp - 8]
inc dword [ebp - 8]
mov byte [ecx], al
mov eax, dword [esi + 0x18]
dec ebx
dec dword [ebp - 4]
mov dword [ebp - 0xc], eax
test ebx, ebx
jne 0x465a4a
mov eax, dword [ebp + 0x14]
jmp 0x4659e5
xor esi, esi
cmp dword [ebp + 0xc], 0xffffffff
je 0x465b52
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.00463870
add esp, 0xc
call fcn.00466b43
push esi
push esi
push esi
push esi
mov dword [eax], 0x22
push esi
jmp 0x4659db
cmp dword [ebp + 0xc], 0xffffffff
je 0x465b7d
push dword [ebp + 0xc]
push 0
push dword [ebp + 8]
call fcn.00463870
add esp, 0xc
call fcn.00466b43
mov dword [eax], 0x22
xor eax, eax
push eax
push eax
push eax
push eax
push eax
jmp 0x4659db
or dword [esi + 0xc], 0x20
mov eax, edi
sub eax, ebx
xor edx, edx
div dword [ebp + 0x10]
jmp 0x4659e5
or dword [esi + 0xc], 0x10
jmp 0x465b98
Function at 0x469aa5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x469ad2
call fcn.00466b56
mov dword [eax], esi
call fcn.00466b43
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00462784
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x469aae
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x469b01
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00466b69
pop ecx
call fcn.00466b43
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x469b28
test al, 1
je 0x469b28
test byte [esp + 0xc], 2
je 0x469b28
call fcn.00466b56
mov dword [eax], 5
call fcn.00466b43
mov dword [eax], 0xd
jmp 0x469af8
xor eax, eax
pop esi
ret

Function at 0x46a01f
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x5368c8]
je 0x46a03a
inc edi
cmp edi, 0x17
jb 0x46a02b
cmp edi, 0x17
jae 0x46a1ba
push ebp
push 3
call fcn.00472765
cmp eax, 1
pop ecx
je 0x46a186
push 3
call fcn.00472765
test eax, eax
pop ecx
jne 0x46a06e
cmp dword [0x5363fc], 1
je 0x46a186
cmp ebx, 0xfc
je 0x46a1b9
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x53adc0
push ebp
call fcn.0046614f
add esp, 0xc
test eax, eax
je 0x46a0a4
push esi
push esi
push esi
push esi
push esi
call fcn.00462688
add esp, 0x14
push 0x104
mov esi, 0x53add9
push esi
push 0
mov byte [0x53aedd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x46a0e8
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0046614f
add esp, 0xc
test eax, eax
je 0x46a0e8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00462688
add esp, 0x14
push esi
call fcn.00469450
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x46a12d
push esi
call fcn.00469450
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x53b0d4
push 0x4b8010
sub ecx, eax
push ecx
push eax
call fcn.0046639f
add esp, 0x14
test eax, eax
je 0x46a12d
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00462688
add esp, 0x14
jmp 0x46a12f
xor esi, esi
push 0x4b800c
push ebx
push ebp
call fcn.004666a6
add esp, 0xc
test eax, eax
je 0x46a14f
push esi
push esi
push esi
push esi
push esi
call fcn.00462688
add esp, 0x14
push dword [edi*8 + 0x5368cc]
push ebx
push ebp
call fcn.004666a6
add esp, 0xc
test eax, eax
je 0x46a171
push esi
push esi
push esi
push esi
push esi
call fcn.00462688
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.004725a8
add esp, 0xc
jmp 0x46a1b9
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x46a1b9
cmp ebp, 0xffffffff
je 0x46a1b9
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x5368cc]
push dword [esi]
call fcn.00469450
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x4725a8
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004695bd
xor ebx, ebx
cmp dword [0x53b5b8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x47267e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x47275e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x47275e
push eax
call fcn.0046954f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x53b5b8], eax
call esi
push eax
call fcn.0046954f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x53b5bc], eax
call esi
push eax
call fcn.0046954f
mov dword [0x53b5c0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00469dac
test eax, eax
pop ecx
pop ecx
je 0x47264c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00462688
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x47267e
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0046954f
cmp eax, ebx
pop ecx
mov dword [0x53b5c8], eax
je 0x47267e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0046954f
pop ecx
mov dword [0x53b5c4], eax
mov eax, dword [0x53b5c4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x472703
cmp dword [0x53b5c8], ecx
je 0x472703
push eax
call fcn.004695c6
push dword [0x53b5c8]
mov esi, eax
call fcn.004695c6
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x472703
cmp edi, ebx
je 0x472703
call esi
cmp eax, ebx
je 0x4726d0
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4726d0
test byte [ebp - 0x18], 1
jne 0x472703
lea eax, [ebp - 0x10]
push eax
call fcn.00469de3
test eax, eax
pop ecx
je 0x4726eb
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00462688
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4726fa
or dword [ebp + 0x10], 0x200000
jmp 0x47273e
or dword [ebp + 0x10], 0x40000
jmp 0x47273e
mov eax, dword [0x53b5bc]
cmp eax, dword [ebp - 8]
je 0x47273e
push eax
call fcn.004695c6
cmp eax, ebx
pop ecx
je 0x47273e
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x47273e
mov eax, dword [0x53b5c0]
cmp eax, dword [ebp - 8]
je 0x47273e
push eax
call fcn.004695c6
cmp eax, ebx
pop ecx
je 0x47273e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x53b5b8]
call fcn.004695c6
cmp eax, ebx
pop ecx
je 0x47275e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x472760
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x440ef0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3e000]
push edi
or ebp, 0xffffffff
jmp 0x440f12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x440f19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x440f08
mov eax, 1
add ebx, ebx
jne 0x440f2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x440f20
jne 0x440f3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440f20
xor ecx, ecx
sub eax, 3
jb 0x440f50
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x440fc2
mov ebp, eax
add ebx, ebx
jne 0x440f5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x440f68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x440f8c
inc ecx
add ebx, ebx
jne 0x440f78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x440f6d
jne 0x440f89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x440f6d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x440fac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x440f9d
jmp 0x440f0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x440fac
add edi, ecx
jmp 0x440f0e
pop esi
lea edi, [esi + 0x3e000]
mov eax, dword [edi]
or eax, eax
je 0x441014
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x41000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4108c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x440fc9
mov ecx, edi
jns 0x440ff8
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x41090]
or eax, eax
je 0x44100e
mov dword [ebx], eax
add ebx, 4
jmp 0x440fe6
call dword [esi + 0x41098]
mov ebp, dword [esi + 0x41094]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x20f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x441048
sub esp, 0xffffff80
jmp 0x43dc7c
Function at 0x4011e0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x220
mov eax, dword [0x427070]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x228]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push esi
push 0x20a
mov esi, edx
lea edx, [esp + 0x20]
push 0
push edx
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
xor bl, bl
call fcn.00401f70
push 0x104
push esi
lea eax, [esp + 0x30]
push 0x104
push eax
call fcn.004022f7
add esp, 0x1c
push 0
lea ecx, [esp + 0x20]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [esp + 0xc], eax
test eax, eax
je 0x4012e5
xor ecx, ecx
inc eax
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00401ac8
mov esi, eax
add esp, 4
test esi, esi
je 0x4012e5
mov eax, dword [esp + 0xc]
push esi
push eax
push 0
lea ecx, [esp + 0x28]
push ecx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4012dc
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
push 0x424aa0
push esi
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0x34
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4012dc
mov eax, dword [esp + 0x10]
movzx ecx, word [eax + 0xa]
mov word [edi], cx
mov dx, word [eax + 8]
mov word [ebp], dx
movzx ecx, word [eax + 0xe]
mov edx, dword [esp + 0x14]
mov word [edx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [esp + 0x18]
mov word [ecx], ax
mov bl, 1
push esi
call fcn.004020c6
add esp, 4
mov ecx, dword [esp + 0x228]
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.00401ade
add esp, 0x220
ret
Function at 0x401300
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x62c
mov eax, dword [0x427070]
xor eax, esp
mov dword [esp + 0x628], eax
push ebx
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x22e]
push ecx
mov word [esp + 0x230], ax
call fcn.00401f70
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x32]
push eax
mov word [esp + 0x34], dx
call fcn.00401f70
mov eax, 0x428da0
add esp, 0x18
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401356
sub eax, edx
sar eax, 1
jne 0x401398
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0x104
push 0x428da0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x5c
push 0x428da0
call fcn.004027c8
add esp, 8
test eax, eax
je 0x401398
xor ecx, ecx
mov word [eax], cx
mov eax, 0x428da0
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4013a0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jae 0x4013d0
push 0x428da0
lea edx, [esp + 0x228]
push 0x104
push edx
call fcn.00402288
add esp, 0xc
push 0x104
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
jne 0x40142a
call fcn.00401130
test eax, eax
je 0x40142a
mov ecx, eax
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x401400
sub ecx, esi
sar ecx, 1
cmp ecx, 0x104
jae 0x40142a
push eax
lea edx, [esp + 0x20]
push 0x104
push edx
call fcn.00402288
add esp, 0xc
lea ebx, [esp + 0x1c]
mov esi, ebx
call fcn.00401750
mov byte [esp + 0xc], 0
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0x10]
push eax
sub esp, 0xc
mov eax, esp
lea ecx, [esp + 0x238]
mov dword [eax], ecx
mov edx, 0x104
xor esi, esi
mov dword [eax + 4], esi
lea ecx, [esp + 0x238]
mov dword [eax + 8], edx
push ecx
lea edx, [esp + 0x28]
push edx
call fcn.004018b0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x452]
push ecx
mov word [esp + 0x454], ax
call fcn.00401f70
lea edx, [esp + 0x24c]
push edx
push 0x424aa4
push 1
mov edi, 0x104
lea esi, [esp + 0x460]
call fcn.004010e0
add esp, 0x34
mov eax, esi
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x428d84], eax
test eax, eax
je 0x4014f1
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x4014f1
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x628]
xor ecx, esp
call fcn.00401ade
add esp, 0x62c
ret
mov ecx, dword [esp + 0x634]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00401ade
add esp, 0x62c
ret

Function at 0x401ade
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x427070]
jne 0x401ae8
repz ret
jmp fcn.00402d79
Function at 0x41ba6d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040462c
and dword [ebp - 4], 0
cmp dword [0x428a6c], 0
mov ebx, eax
jne 0x41bb1e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41bbcf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x41bbcf
push eax
call fcn.004045ba
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428a6c], eax
call esi
push eax
call fcn.004045ba
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428a70], eax
call esi
push eax
call fcn.004045ba
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x428a74], eax
call esi
push eax
call fcn.004045ba
pop ecx
mov dword [0x428a7c], eax
test eax, eax
je 0x41bb1e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004045ba
pop ecx
mov dword [0x428a78], eax
mov eax, dword [0x428a78]
cmp eax, ebx
je 0x41bb76
cmp dword [0x428a7c], ebx
je 0x41bb76
push eax
call fcn.00404635
push dword [0x428a7c]
mov esi, eax
call fcn.00404635
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41bb76
test edi, edi
je 0x41bb76
call esi
test eax, eax
je 0x41bb6d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41bb6d
test byte [ebp - 0xc], 1
jne 0x41bb76
or dword [ebp + 0x10], 0x200000
jmp 0x41bbaf
mov eax, dword [0x428a70]
cmp eax, ebx
je 0x41bbaf
push eax
call fcn.00404635
pop ecx
test eax, eax
je 0x41bbaf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41bbaf
mov eax, dword [0x428a74]
cmp eax, ebx
je 0x41bbaf
push eax
call fcn.00404635
pop ecx
test eax, eax
je 0x41bbaf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428a6c]
call fcn.00404635
pop ecx
test eax, eax
je 0x41bbcf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41bbd1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret