joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4041a7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, eax
push esi
mov esi, dword [ebp + 8]
and ecx, 0xfffffffc
jbe 0x4041eb
rol eax, 5
xor eax, dword [edx + esi]
add edx, 4
imul eax, eax, 0x9e3779b9
rol eax, 5
xor eax, 4
imul eax, eax, 0x9e3779b9
cmp edx, ecx
jb 0x4041ba
jmp 0x4041eb
movsx ecx, byte [edx + esi]
rol eax, 5
xor eax, ecx
imul eax, eax, 0x9e3779b9
inc edx
cmp edx, dword [ebp + 0xc]
jb 0x4041db
pop esi
pop ebp
ret

Function at 0x40424b
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov ebx, dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonSize]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x404283
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x1c]
jb 0x4042ad
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x1c]
jb 0x4042ad
test edi, edi
je 0x40427a
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40427a
test edi, edi
je 0x4042b5
mov eax, edi
jmp 0x40427c
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40427c
int3

Function at 0x4042e4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 8]
mov dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonSize], eax
call fcn.0040424b
mov ecx, dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonSize]
mov dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonBase], eax
test ecx, ecx
je 0x40431a
shr ecx, 1
dec ecx
add eax, ecx
mov dword [sym.TestEnumTypeTraits.exe_gMozillaPoisonValue], eax
mov esp, ebp
pop ebp
ret
Function at 0x449400
Capabilities:
Allocate thread local storage

Disassembly:
push ebx
push edi
push esi
sub esp, 0x20
cmp dword [ecx + 4], 0
mov esi, ecx
je 0x449471
lea ebx, [esi + 0xc]
mov dword [esp + 4], 0
lea eax, [esp + 4]
push 0
push eax
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceBeginInitialize]
cmp eax, 1
mov dword [esp], eax
jne 0x4494a8
cmp dword [esp + 4], 0
je 0x44948f
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
je 0x4494bb
mov edi, eax
inc eax
mov dword [esi], eax
mov eax, dword [0x45fa9c]
nop dword [eax]
mov dword [esi + 8], eax
lock cmpxchg dword [0x45fa9c], esi
jne 0x449450
mov byte [0x45fa98], 1
push 0
push 0
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
jmp 0x44949f
call dword [sym.imp.kernel32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esp], eax
je 0x4494fc
mov ecx, eax
xor eax, eax
inc ecx
lock cmpxchg dword [esi], ecx
jne 0x449493
mov edi, dword [esp]
jmp 0x44949f
mov edi, dword [esi]
jmp 0x44949e
mov edi, eax
push dword [esp]
call dword [sym.imp.kernel32.dll_TlsFree]
dec edi
mov eax, edi
add esp, 0x20
pop esi
pop edi
pop ebx
ret
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0
call fcn.00449530
push 0
push 4
push ebx
call dword [sym.imp.kernel32.dll_InitOnceComplete]
lea ecx, [esp + 8]
mov edx, 0x455850
mov dword [esp + 8], 0x455818
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 0
mov dword [esp + 0x10], 0x456008
mov dword [esp + 0x14], 0
call fcn.00448780
mov ecx, esp
lea edx, [esp + 8]
mov dword [esp + 8], 0x455818
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x456008
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call fcn.00449560
int3

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
mov ecx, 0x6f3f253f
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x4cdf0c75
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x61cbc4
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop ax
xchg byte [esp], al
lea esp, [esp + 2]
jmp 0x61cc50
xchg dl, al
bt ax, di
mov eax, dword [esp]
push esi
pop word [esp]
call fcn.0061cc91
mov dword [reloc.MSVCRT.dll_strncpy], eax
xchg edx, eax
xchg edx, eax
dec edi
mov dx, 0xa063
add dx, 0xdd35
jmp 0x61cc30
mov eax, dword [esp]
push esi
pop word [esp]
jmp 0x61cc3a
jns 0x61cbf0
xchg dl, al
bt ax, di
jmp 0x61cc16
lea esp, [esp + 2]
jmp 0x61cc9e
xor edi, 0x54402ee0
bswap ebx
rdtsc
rdtsc
not dx
jmp 0x61cc06
neg edi
mov dx, 0x4f39
mov dl, byte [esp]
mov edx, 0x2bb9eb9
jmp 0x61ccf5
jmp 0x61cd42
mov ax, word [esp]
mov bx, bp
mov dl, 0x33
ror edi, 0
jae 0x61ccdf
mov bx, 0x8bb1
cmp al, dh
lea eax, reloc.MSVCRT.dll_strncpy
mov bx, 0xfd44
jmp 0x61cdb5
mov bx, 0xfd44
jmp 0x61cdb5
mov bx, 0x8bb1
cmp al, dh
lea eax, reloc.MSVCRT.dll_strncpy
jmp 0x61cd2c
add edi, dword [ebp]
setg dl
bsr dx, bx
je 0x61cd83
jne 0x61cd83
test al, 0x3d
lodsd eax, dword [esi]
mov ah, 0x47
cmc
mov word [edi], ds
xchg cx, ax
adc byte [ebx + 0x57e3ebf8], dl
jmp 0x61cd9e
clc
jmp 0x61cd50
call 0x61cd6d
xor edi, 0x6445fefb
cmc
js 0x61cd6a
clc
jmp 0x61cd50

Function at 0x628bc5
Capabilities:
Encode data using xor

Disassembly:
mov eax, ecx
jmp 0x60ef97
xor ecx, ecx
cmp dword [esp + 4], ecx
jbe 0x60efb1
push esi
movzx esi, byte [ecx + edx]
rol eax, 7
xor eax, esi
inc ecx
cmp ecx, dword [esp + 8]
jb 0x60efa0
pop esi
jmp 0x60efbc
ret 4
jmp 0x60ef8a

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401210
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor ecx, ecx
test esi, esi
jbe 0x40124c
mov edx, dword [esp + 8]
push ebx
push ebp
push edi
mov edi, dword [esp + 0x18]
mov eax, dword [edx]
movzx ebx, byte [ecx + edi]
mov ebp, eax
and ebp, 0xff
xor ebx, ebp
mov ebp, dword [ebx*4 + 0x4240f8]
shr eax, 8
xor eax, ebp
inc ecx
cmp ecx, esi
mov dword [edx], eax
jb 0x401226
pop edi
pop ebp
pop ebx
pop esi
ret

Function at 0x401560
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [eax + 8]
push ebx
push edi
mov edi, dword [eax + 4]
xor ebx, ebx
cmp edi, ecx
je 0x4015f6
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
mov edi, edi
mov eax, dword [edi]
cmp eax, 1
jne 0x401593
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x401593
add ebx, dword [edi + 8]
jmp 0x4015e6
cmp eax, 2
jne 0x4015a1
mov eax, dword [edi + 8]
lea ebx, [ebx + eax + 4]
jmp 0x4015e6
cmp eax, 3
jne 0x4015e6
mov eax, dword [edi + 4]
test eax, eax
je 0x4015e6
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call ebp
mov esi, eax
test esi, esi
je 0x4015e6
cmp esi, 0xffffffff
je 0x4015e6
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x4015df
add ebx, eax
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 8]
add edi, 0xc
cmp edi, eax
jne 0x401580
pop esi
pop ebp
pop edi
mov eax, ebx
pop ebx
ret 4
Function at 0x401600
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edx, dword [esp + 8]
sub esp, 8
test edx, edx
push edi
je 0x4017b9
mov edi, dword [esp + 0x18]
test edi, edi
je 0x4017b9
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 8]
push ebx
push ebp
mov ebp, dword [eax + 4]
xor ebx, ebx
cmp ebp, ecx
mov dword [esp + 0x10], ebp
je 0x4017ae
push esi
jmp 0x401640
mov edi, dword [esp + 0x24]
lea ecx, [ecx]
mov eax, dword [ebp]
cmp eax, 1
jne 0x401676
mov esi, dword [ebp + 4]
test esi, esi
je 0x401676
mov ecx, dword [ebp + 8]
lea eax, [ecx + ebx]
cmp eax, edi
ja 0x4017ad
mov eax, ecx
shr ecx, 2
lea edi, [ebx + edx]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
add ebx, dword [ebp + 8]
jmp 0x401784
cmp eax, 2
jne 0x4016b9
mov eax, dword [ebp + 8]
lea ecx, [eax + ebx + 4]
cmp ecx, edi
ja 0x4017ad
mov dword [ebx + edx], eax
mov esi, dword [ebp + 4]
test esi, esi
je 0x4016ad
mov ecx, dword [ebp + 8]
test ecx, ecx
je 0x4016ad
mov eax, ecx
shr ecx, 2
lea edi, [ebx + edx + 4]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [ebp + 8]
lea ebx, [ebx + ecx + 4]
jmp 0x401784
cmp eax, 3
jne 0x401784
mov eax, dword [ebp + 4]
test eax, eax
je 0x401784
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
test edi, edi
je 0x401780
cmp edi, 0xffffffff
je 0x401780
mov esi, dword [esp + 0x24]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
sub esi, ebx
call ebp
cmp esi, eax
jae 0x401712
mov ebp, esi
jmp 0x401719
push 0
push edi
call ebp
mov ebp, eax
cmp ebp, 0x3200000
jae 0x4017a6
mov eax, dword [esp + 0x24]
lea edx, [ebx + ebp]
cmp edx, eax
ja 0x4017a6
xor esi, esi
mov dword [esp + 0x10], esi
mov eax, ebp
sub eax, esi
cmp eax, 0x400
jbe 0x401746
mov eax, 0x400
mov edx, dword [esp + 0x20]
push 0
lea ecx, [esp + 0x14]
push ecx
push eax
lea eax, [ebx + edx]
add eax, esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x401773
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x401773
cmp esi, ebp
ja 0x401773
add esi, eax
jmp 0x401736
push edi
add ebx, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebp, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x1c]
mov ecx, dword [eax + 8]
add ebp, 0xc
cmp ebp, ecx
mov dword [esp + 0x14], ebp
jne 0x401639
pop esi
pop ebp
mov eax, ebx
pop ebx
pop edi
add esp, 8
ret 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebp
mov eax, ebx
pop ebx
pop edi
add esp, 8
ret 0xc
xor eax, eax
pop edi
add esp, 8
ret 0xc
Function at 0x402f30
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x124
mov eax, dword [0x42482c]
xor eax, ebp
push ebx
mov dword [esp + 0x124], eax
mov eax, dword [ebp + 8]
push esi
push edi
mov dword [esp + 0x1c], eax
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x20], bl
mov ecx, 0x40
lea edi, [esp + 0x21]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x41f438
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp eax, ebx
mov dword [esp + 0x10], ebx
je 0x402ff1
push 0x104
lea ecx, [esp + 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jbe 0x402ff1
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x24]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
cmp edi, ebx
jbe 0x402ff1
push edi
call fcn.004144c9
mov ecx, dword [esp + 0x14]
add esp, 4
mov esi, eax
push esi
push edi
push ecx
lea edx, [esp + 0x2c]
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402fe8
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0x41f434
push esi
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x403008
push esi
call fcn.00413f9d
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x120]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
movzx edx, word [eax + 8]
movzx eax, word [eax + 0xa]
mov ecx, dword [esp + 0x1c]
push edx
push eax
push 0x41f428
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push esi
call fcn.00413f9d
mov ecx, dword [esp + 0x140]
add esp, 0x14
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004144ff
mov esp, ebp
pop ebp
ret
Function at 0x403050
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, dword [0x42482c]
xor eax, ebp
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [esp + 0xac], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea eax, [esp + 8]
push eax
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x4030be
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x94
call edi
test eax, eax
jne 0x4030be
mov byte [esi], al
pop edi
pop esi
mov ecx, dword [esp + 0xa4]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x18]
sub eax, 0
je 0x40313d
dec eax
je 0x4030e8
dec eax
jne 0x40314c
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
push edx
push eax
push 0x41f470
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x40314c
cmp dword [esp + 0xc], 4
jne 0x40314c
mov eax, dword [esp + 0x10]
test eax, eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
jne 0x403111
push 0x41f464
push esi
call edi
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 4
jne 0x40314c
cmp dword [esp + 0x10], 0xa
jne 0x40312c
push 0x41f458
push esi
call edi
mov eax, dword [esp + 0x14]
add esp, 8
cmp eax, 4
jne 0x40314c
cmp dword [esp + 0x10], 0x5a
jne 0x40314c
push 0x41f44c
push esi
call edi
jmp 0x403149
push 0x41f444
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
mov ecx, dword [esp + 0xac]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004144ff
mov esp, ebp
pop ebp
ret
Function at 0x403170
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x114
mov eax, dword [0x42482c]
xor eax, ebp
mov dword [esp + 0x110], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
push edi
mov esi, ecx
mov dword [esp + 0xc], eax
xor eax, eax
test esi, esi
mov byte [esp + 0x10], 0
mov ecx, 0x40
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ebx, 1
stosb byte es:[edi], al
je 0x4031d3
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
test eax, eax
jle 0x4031d3
push esi
call edi
cmp eax, 0x104
jbe 0x4031ea
push 0x6f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret
push 0x103
push esi
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov eax, dword [ebp + 8]
test eax, eax
je 0x40320d
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_PathSkipRootA]
mov esi, eax
push esi
call edi
test eax, eax
jne 0x40323b
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret
push 0x5c
push esi
call fcn.00414acc
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
add esp, 8
test esi, esi
je 0x40328c
mov ecx, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
mov byte [esi], 0
call edi
and ebx, eax
jne 0x403277
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x403277
mov ebx, 1
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call fcn.00414acc
mov esi, eax
add esp, 8
test esi, esi
jne 0x403252
mov eax, dword [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
call edi
and ebx, eax
jne 0x4032ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4032ae
mov ebx, 1
mov ecx, dword [esp + 0x11c]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.004144ff
mov esp, ebp
pop ebp
ret

Function at 0x403400
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403419
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x40342d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x40344e
cmp esi, eax
jae 0x403427
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x403440
cmp esi, eax
jae 0x403427
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x40670c
Capabilities:
Check for unmoving mouse cursor

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
cmp eax, 0x2711
push esi
mov esi, ecx
jne 0x40686b
mov eax, dword [esi + 0x118]
push ebp
xor ebp, ebp
cmp eax, ebp
jne 0x40686a
push edi
lea ecx, [esi + 0x48]
call fcn.0040d7f0
test eax, eax
je 0x4067a3
mov eax, dword [esi + 0x44]
push ebp
push eax
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, eax
mov eax, dword [esp + 0x20]
cmp eax, 0x205
je 0x406756
cmp eax, 0x202
jne 0x406869
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x14], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push ebp
push eax
push ebp
push ecx
push edx
push ebp
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov eax, dword [esi + 4]
push ebp
push ebp
push ebp
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 8
ret 0x10
mov ecx, dword [esi + 0x40]
push ebx
push ebp
push ecx
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edx, dword [0x4259a0]
mov ecx, 0x4259a0
mov edi, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x20], eax
cmp dword [esi + 0x114], ebp
lea ecx, [esp + 0x20]
je 0x4067d9
push 0x87
jmp 0x4067de
push 0x84
call fcn.004044e0
mov ebx, dword [esp + 0x20]
push ebx
push 0x8009
push ebp
push 0x8009
push edi
call dword [sym.imp.USER32.dll_ModifyMenuA]
mov eax, dword [esp + 0x24]
cmp eax, 0x205
je 0x40680c
cmp eax, 0x202
jne 0x40684e
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
call dword [sym.imp.USER32.dll_GetCursorPos]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [esi + 4]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push ebp
push edx
push ebp
push eax
push ecx
push ebp
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov edx, dword [esi + 4]
push ebp
push ebp
push ebp
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
lea eax, [ebx - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop ebx
jg 0x406869
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
pop ebp
xor eax, eax
pop esi
add esp, 8
ret 0x10
Function at 0x407bc0
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1bc
mov eax, dword [0x42482c]
xor eax, ebp
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x1bc], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov dword [esp + 0x14], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], 0x9c
call esi
test eax, eax
jne 0x407c24
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], 0x94
call esi
test eax, eax
je 0x407d4f
cmp dword [esp + 0x28], 2
jne 0x407d4f
cmp dword [esp + 0x1c], 4
jbe 0x407d4f
call fcn.0040fc10
test eax, eax
je 0x407c9d
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0
call fcn.0040fc80
add esp, 4
test eax, eax
jl 0x407d4f
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x407c9d
push 0x104
lea ecx, [esp + 0xbc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0
push eax
lea edx, [esp + 0xc0]
push edx
push 0
call fcn.0040fd10
add esp, 0x10
jmp 0x407d4f
push 0x41f720
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
je 0x407d41
cmp eax, 0xb7
je 0x407d41
cmp eax, 5
je 0x407d41
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcA]
push 4
call fcn.00407090
add esp, 4
push 0
push ebx
push 0
mov ecx, 0x42457c
call fcn.004072b0
mov eax, dword [ebp + 0x14]
mov ecx, dword [esp + 0x14]
push eax
push ecx
call fcn.00407a40
add esp, 8
mov ecx, 0x42457c
mov edi, eax
call fcn.004079e0
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1b8]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x1c4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004144ff
mov esp, ebp
pop ebp
ret 0x10
Function at 0x409920
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x42482c]
xor eax, esp
push ebp
push esi
lea edx, [esp + 0x10]
push edx
push 0x2001f
mov ebp, ecx
mov ecx, dword [esp + 0x130]
push 0
mov dword [esp + 0x12c], eax
mov eax, dword [ebp]
push ecx
push eax
mov dword [esp + 0x28], ecx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x409987
lea ecx, [esp + 8]
call fcn.00409810
mov esi, eax
test esi, esi
mov eax, dword [esp + 0x10]
mov dword [esp + 8], eax
je 0x409995
lea ecx, [esp + 8]
call fcn.00409810
jmp 0x409a2e
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
lea ecx, [esp + 0x38]
push ecx
push 0
push eax
mov dword [esp + 0x30], 0x100
call edi
test eax, eax
jne 0x4099fc
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x10]
call fcn.00409920
mov esi, eax
test esi, esi
jne 0x409a24
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x10]
push esi
push esi
push esi
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x38]
push edx
push esi
push eax
mov dword [esp + 0x30], 0x100
call edi
test eax, eax
je 0x4099c2
mov eax, dword [esp + 0xc]
test eax, eax
je 0x409a13
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0xc], 0
mov ecx, dword [esp + 0x18]
mov edx, dword [ebp]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
lea ecx, [esp + 0xc]
call fcn.00409810
pop edi
mov ecx, dword [esp + 0x120]
mov eax, esi
pop esi
pop ebp
xor ecx, esp
call fcn.004144ff
add esp, 0x11c
ret 4