joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401e00
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push str.RealPlayer_CommandLine_Mutex
mov ebx, ecx
push 1
push eax
inc ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov esi, eax
test esi, esi
mov dword [ebp - 4], esi
je 0x401f0e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x401e50
push 0x2710
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov al, byte [0x437278]
mov ecx, 0x1f
mov byte [ebp - 0x8c], al
xor eax, eax
lea edi, [ebp - 0x8b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea ecx, [ebp - 0x8c]
push str.RealPlayer_CommandLine_Shmem__d
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [ebp - 0x8c]
push edx
push ebx
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov edi, eax
test edi, edi
mov dword [ebp - 8], edi
je 0x401f00
push ebx
push 0
push 0
push 2
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
mov dword [ebp - 0xc], eax
je 0x401ef9
mov esi, dword [ebp + 0xc]
mov ecx, ebx
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp + 8]
push eax
push 0x590
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402410
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [str.SoftwareRealNetworksRealJukebox1.0Preferences]
lea ecx, [ebp - 0xc]
push eax
push ecx
push 1
push str.ClearLibCorruptionOnShutdown
mov dword [ebp - 0xc], 1
call fcn.0040b3a0
mov eax, dword [ebp - 0xc]
add esp, 0x10
test eax, eax
je 0x40249a
lea edx, [ebp - 0x110]
push 0x104
push edx
call fcn.004024a0
mov al, byte [ebp - 0x110]
add esp, 8
test al, al
je 0x40249a
lea ecx, [ebp - 8]
call fcn.004065f0
lea eax, [ebp - 0x110]
lea ecx, [ebp - 8]
push eax
push str._scpt
push ecx
call fcn.00406f70
mov al, byte [ebp - 1]
add esp, 0xc
cmp al, 0xff
lea eax, [ebp - 8]
jne 0x40248b
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 8]
call fcn.00406720
mov esp, ebp
pop ebp
ret
Function at 0x402570
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
push edi
mov edi, 0x40f574
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40260b
lea eax, [ebp - 0x104]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov esi, dword [sym.imp.PNCRT.dll_strrchr]
lea ecx, [ebp - 0x104]
push 0x5c
push ecx
call esi
add esp, 8
test eax, eax
jne 0x4025d2
lea edx, [ebp - 0x104]
push 0x2f
push edx
call esi
add esp, 8
test eax, eax
jne 0x4025d2
lea eax, [ebp - 0x104]
jmp 0x4025d3
inc eax
push 0x104
push 0x40f574
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x40260b
mov edi, 0x40f688
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x40f574
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
mov eax, 0x40f574
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x403b40
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
mov ebx, dword [ebp + 8]
xor eax, eax
push esi
test ebx, ebx
mov esi, ecx
mov dword [ebp - 4], eax
je 0x403c62
push edi
push str.PATH
call dword [sym.imp.PNCRT.dll_getenv]
add esp, 4
lea ecx, [ebp - 0x14]
mov edi, eax
call fcn.004065f0
test edi, edi
je 0x403b80
push edi
lea ecx, [ebp - 0x14]
call fcn.00406840
mov al, byte [esi + 0x2b]
add esi, 0x24
cmp al, 0xff
pop edi
je 0x403be8
xor ecx, ecx
cmp al, 7
sete cl
mov eax, ecx
test eax, eax
je 0x403bbd
lea edx, [ebp - 0x14]
lea eax, [ebp - 0x1c]
push edx
push 0x40f988
push eax
call fcn.004068f0
add esp, 0xc
mov ecx, esi
push eax
call fcn.004067d0
lea ecx, [ebp - 0x1c]
call fcn.00406720
push 0x40f988
lea ecx, [ebp - 0xc]
call fcn.00406730
push ebx
lea ecx, [ebp - 0xc]
call fcn.00406c50
mov ax, word [ebp - 0xe]
cmp ah, 0xff
je 0x403bff
xor ecx, ecx
cmp ah, 7
sete cl
mov eax, ecx
jmp 0x403c10
mov al, byte [esi + 4]
test al, al
jne 0x403bbd
mov al, byte [esi + 5]
test al, al
jne 0x403bbd
mov al, byte [esi + 6]
test al, al
je 0x403b98
jmp 0x403bbd
mov ecx, dword [ebp - 0x10]
test cl, cl
jne 0x403c14
test ch, ch
jne 0x403c14
test al, al
je 0x403c2d
jmp 0x403c14
test eax, eax
jne 0x403c2d
push 0x40f984
lea ecx, [ebp - 0xc]
call fcn.00406c50
lea edx, [ebp - 0x14]
lea ecx, [ebp - 0xc]
push edx
call fcn.00406cb0
mov al, byte [ebp - 5]
cmp al, 0xff
lea eax, [ebp - 0xc]
jne 0x403c3a
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.PNCRT.dll__putenv]
add esp, 4
mov esi, 0x80004005
test eax, eax
jne 0x403c50
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
call fcn.00406720
lea ecx, [ebp - 0x14]
call fcn.00406720
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x405510
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcc
push ebx
push esi
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [ebp - 0xcc]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
or ebx, 0xffffffff
push eax
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], 0
mov dword [ebp - 0xcc], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov dx, word [ebp - 0xc0]
mov esi, dword [ebp - 0xbc]
mov eax, dword [ebp - 0xc8]
mov ecx, dword [ebp - 0xc4]
mov word [ebp - 0x10], dx
xor edx, edx
cmp esi, 2
mov di, ax
sete dl
mov esi, edx
mov word [ebp - 0x14], di
test esi, esi
mov word [ebp - 0x12], cx
je 0x40558f
mov ebx, 8
jmp 0x4055b0
cmp ax, 4
jae 0x40559c
mov ebx, 2
jmp 0x4055b0
jne 0x4055b3
cmp cx, 0xa
sbb ebx, ebx
and ebx, 0xfffffc04
add ebx, 0x400
mov dword [ebp - 0xe], ebx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40569e
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x38]
and eax, 0xffff
cmp eax, 3
ja case.default.0x4055d9
jmp dword [eax*4 + 0x4056a8]
test esi, esi
je 0x405635
cmp di, 3
ja 0x4055f3
jne 0x405635
cmp word [ebp - 0x12], 0x32
jb 0x405635
mov eax, dword [ebp - 0x18]
and eax, 0xffff
sub eax, 4
jns 0x405609
mov dword [ebp - 0xa], 0xfffffffe
jmp 0x405674
test eax, eax
jne 0x405616
mov dword [ebp - 0xa], 1
jmp 0x405674
cmp eax, 1
jne 0x405624
mov dword [ebp - 0xa], 2
jmp 0x405674
sub eax, 2
neg eax
sbb eax, eax
and al, 0xfb
add eax, 4
mov dword [ebp - 0xa], eax
jmp 0x405674
mov eax, dword [ebp - 0x20]
sub eax, 0x182
je 0x405600
sub eax, 0x64
je 0x40560d
sub eax, 0x64
jne case.default.0x4055d9
mov dword [ebp - 0xa], 2
jmp 0x405674
mov dword [ebp - 0xa], 0x40
jmp 0x405674
mov dword [ebp - 0xa], 0x20
jmp 0x405674
mov dword [ebp - 0xa], 8
jmp 0x405674
mov dword [ebp - 0xa], 0xffffffff
call fcn.004056c0
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov dword [ebp - 6], eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edx
mov edx, dword [ebp - 8]
mov dword [eax + 8], ecx
mov cx, word [ebp - 4]
mov dword [eax + 0xc], edx
mov word [eax + 0x10], cx
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4056c0
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x7fffffff
jne 0x4056d9
xor eax, eax
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [ebp - 0x28], 0
jne 0x405719
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push str.HARDWAREDESCRIPTIONSystemFloatingPointProcessor
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40570f
xor eax, eax
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x405d00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x20]
test eax, eax
je 0x405e08
mov esi, dword [ebp + 8]
test esi, esi
je 0x405e08
cmp byte [esi], 0
je 0x405e08
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x405e08
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0
test eax, eax
jne 0x405d5c
mov ecx, dword [edi + 8]
push 0
lea eax, [ebp + 0x10]
push 0
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405e08
mov eax, dword [ebp + 0x10]
dec eax
je 0x405dc8
sub eax, 3
je 0x405d9c
sub eax, 3
jne 0x405df8
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x405df4
mov edx, dword [edi + 8]
mov ecx, eax
push edx
push esi
call fcn.004061f0
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x405df4
mov ecx, dword [edi + 8]
push ecx
push esi
mov ecx, eax
call fcn.004060e0
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
push 0x10
call sub.PNCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
test eax, eax
je 0x405df4
mov edx, dword [edi + 8]
mov ecx, eax
push edx
push esi
call fcn.00405f00
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
pop edi
test ecx, ecx
pop esi
pop ebx
setne al
pop ebp
ret 0xc
xor eax, eax
mov dword [ebx], eax
mov ecx, dword [ebx]
xor eax, eax
test ecx, ecx
pop edi
pop esi
setne al
pop ebx
pop ebp
ret 0xc
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
Function at 0x409750
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp dword [esi + 4], ebx
je 0x4097c0
mov al, byte [0x437278]
push edi
mov byte [ebp - 0x400], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
mov edx, dword [ebp + 0xc]
lea ecx, [ebp + 0x10]
stosw word es:[edi], ax
stosb byte es:[edi], al
push ecx
lea eax, [ebp - 0x400]
push edx
push eax
mov dword [ebp + 8], ebx
call dword [sym.imp.PNCRT.dll_vsprintf]
add esp, 0xc
cmp eax, ebx
pop edi
jle 0x4097c0
lea ecx, [ebp + 8]
push ebx
push ecx
push eax
mov eax, dword [esi + 4]
lea edx, [ebp - 0x400]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x409c10
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov ecx, 7
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x409c9e
mov esi, dword [ebp - 0x18]
test esi, esi
je 0x409c9e
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x409c9e
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
mov dword [ebp + 8], 0
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x409c9e
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x409c86
mov edx, esi
cmp edi, ebx
jb 0x409c90
add edx, ebx
cmp edi, edx
jbe 0x409ca9
mov edx, dword [ebp + 8]
add eax, 0x28
inc edx
cmp edx, ecx
mov dword [ebp + 8], edx
jb 0x409c78
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov edx, dword [ebp + 8]
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
inc edx
sub edi, ebx
mov dword [eax], edx
mov dword [ecx], edi
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40a260
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0x40a39f
mov eax, dword [esi + 0x10]
cmp eax, ebx
je 0x40a394
push str.EnumProcesses
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edx, eax
mov ecx, 0x100
xor eax, eax
lea edi, [ebp - 0x664]
test edx, edx
mov dword [ebp - 4], ebx
rep stosd dword es:[edi], eax
je 0x40a394
lea eax, [ebp - 4]
lea ecx, [ebp - 0x664]
push eax
push 0x400
push ecx
call edx
test eax, eax
mov dword [ebp - 8], eax
je 0x40a391
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], ebx
shr eax, 2
mov dword [ebp - 4], eax
je 0x40a391
lea ebx, [ebp - 0x664]
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x264]
rep stosd dword es:[edi], eax
mov eax, dword [ebx]
mov dword [ebp - 0x264], 0x128
push eax
push 0
push 0x410
mov dword [ebp - 0x25c], eax
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40a36e
mov edx, dword [esi + 0x10]
push str.EnumProcessModules
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
cmp eax, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x14], ecx
je 0x40a367
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0xc]
push ecx
push 4
push edx
push edi
call eax
test eax, eax
je 0x40a367
mov eax, dword [esi + 0x10]
push str.GetModuleBaseNameA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40a367
mov edx, dword [ebp - 0xc]
lea ecx, [ebp - 0x240]
push 0x103
push ecx
push edx
push edi
call eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x264]
push eax
push esi
call dword [ebp + 8]
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add esp, 8
inc eax
add ebx, 4
cmp eax, ecx
mov dword [ebp - 0x10], eax
jb 0x40a2e0
mov ebx, dword [ebp - 8]
pop edi
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 8]
cmp eax, ebx
je 0x40a444
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.Process32First
push eax
call edi
mov ecx, dword [esi + 8]
push str.Process32Next
push ecx
mov ebx, eax
call edi
test ebx, ebx
mov dword [ebp - 8], eax
je 0x40a444
test eax, eax
je 0x40a444
mov ecx, 0x4a
xor eax, eax
lea edi, [ebp - 0x13c]
lea edx, [ebp - 0x13c]
rep stosd dword es:[edi], eax
mov eax, dword [esi]
push edx
push eax
mov dword [ebp - 0x13c], 0x128
call ebx
mov ebx, dword [ebp + 8]
mov edi, eax
test edi, edi
je 0x40a40b
lea ecx, [ebp - 0x13c]
push ecx
push esi
call ebx
add esp, 8
test edi, edi
je 0x40a439
mov eax, dword [esi]
lea edx, [ebp - 0x13c]
push edx
push eax
mov dword [ebp - 0x13c], 0x128
call dword [ebp - 8]
test eax, eax
je 0x40a439
lea ecx, [ebp - 0x13c]
push ecx
push esi
call ebx
add esp, 8
jmp 0x40a40f
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40abc0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xcb0
push ebx
push esi
push edi
mov esi, ecx
call fcn.004095b0
push str._Process_Info__r_n
push esi
call fcn.00409750
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.ProcessId:__lu_r_n
push esi
call fcn.00409750
mov al, byte [0x437278]
mov ecx, 0xff
mov byte [ebp - 0x4b0], al
xor eax, eax
lea edi, [ebp - 0x4af]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [ebp - 0x4b0]
push 0x400
xor ebx, ebx
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [ebp - 0x4b0]
push edx
push str.Name:__s_r_n
push esi
call fcn.00409750
mov dl, byte [0x437278]
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xcaf]
mov byte [ebp - 0xcb0], dl
mov byte [ebp - 0xb0], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f
xor eax, eax
lea edi, [ebp - 0xaf]
add esp, 0xc
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xcb0]
lea ecx, [ebp - 0x4b0]
push eax
push 0x800
push ebx
push ecx
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40ace7
lea edx, [ebp - 8]
lea eax, [ebp - 4]
push edx
push eax
lea ecx, [ebp - 0xcb0]
push 0x40f56c
push ecx
mov dword [ebp - 8], ebx
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40ace7
mov eax, dword [ebp - 4]
xor edx, edx
mov dx, word [eax + 0xc]
mov ecx, dword [eax + 0xc]
push edx
xor edx, edx
mov dx, word [eax + 8]
mov eax, dword [eax + 8]
shr ecx, 0x10
push ecx
push edx
shr eax, 0x10
push eax
lea ecx, [ebp - 0xb0]
push str._lu._lu._lu._lu
push ecx
call dword [sym.imp.PNCRT.dll_sprintf]
add esp, 0x18
lea edx, [ebp - 0xb0]
push edx
push str.Version:__s_r_n
push esi
call fcn.00409750
mov eax, dword [esi + 0x10]
add esp, 0xc
cmp eax, ebx
je 0x40ad58
push str.GetProcessMemoryInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
test ebx, ebx
je 0x40ad58
mov ecx, 0xa
xor eax, eax
lea edi, [ebp - 0x30]
push 0x28
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call ebx
test eax, eax
je 0x40ad58
mov ecx, dword [ebp - 0x24]
push ecx
push str.WorkingSetSize:__lu_Bytes_r_n
push esi
call fcn.00409750
mov edx, dword [ebp - 0x10]
add esp, 0xc
push edx
push str.PagefileUsage:__lu_Bytes_r_n
push esi
call fcn.00409750
add esp, 0xc
push 0x410180
push esi
call fcn.00409750
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b0b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
test eax, eax
je 0x40b0c6
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
mov ebx, dword [ebp + 8]
push eax
push esi
push 0
push 0x2001f
push 0
push 0
push 0
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40b11c
push esi
push 0x2001f
push 0
push edi
push ebx
mov dword [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40b11c
xor edx, edx
mov dword [esi], 0
test eax, eax
sete dl
pop edi
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0x10
cmp dword [ebp - 4], 1
jne 0x40b143
mov edx, dword [ebp + 0x10]
test edx, edx
je 0x40b143
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
mov ecx, dword [esi]
push edx
push 1
push eax
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edx, edx
pop edi
test eax, eax
sete dl
pop esi
mov eax, edx
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40b1b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
mov dword [ebp - 4], 0
cmp dword [ebx], 0
jne 0x40b1ce
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
lea edi, [esi + 1]
push edi
call dword [sym.imp.PNCRT.dll_malloc]
mov dword [ebp - 8], edi
xor edi, edi
add esp, 4
cmp eax, edi
mov dword [ebp - 0xc], eax
je 0x40b2b1
lea ecx, [ebp - 8]
lea edx, [ebp - 0x10]
push ecx
mov ecx, dword [ebx]
push eax
mov eax, dword [ebp + 8]
push edx
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea edx, [ebp + 0x14]
mov ecx, ebx
push edx
mov dword [ebp + 8], eax
mov dword [ebp + 0x14], edi
call fcn.0040b360
cmp dword [ebp - 0x10], 1
jne 0x40b28f
cmp dword [ebp + 0x14], edi
jbe 0x40b28f
mov ebx, dword [ebp + 0x10]
mov ecx, esi
mov edx, ecx
xor eax, eax
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [ebp + 8]
test eax, eax
jne 0x40b251
mov eax, dword [ebp - 8]
cmp esi, eax
jb 0x40b24a
mov esi, eax
mov eax, dword [ebp - 0xc]
push esi
push eax
jmp 0x40b276
mov edx, dword [ebp + 0xc]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp esi, ecx
jae 0x40b268
mov ecx, esi
jmp 0x40b274
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push ebx
call dword [sym.imp.PNCRT.dll_strncpy]
mov eax, dword [ebp + 8]
add esp, 0xc
xor ecx, ecx
test eax, eax
sete cl
mov dword [ebp - 4], ecx
jmp 0x40b2a4
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
push esi
push edx
push eax
call dword [sym.imp.PNCRT.dll_strncpy]
add esp, 0xc
mov dword [ebp - 4], edi
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.PNCRT.dll_free]
add esp, 4
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40c750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40dcf0
push 0x40cac0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.PNCRT.dll___set_app_type]
add esp, 4
mov dword [0x45e48c], 0xffffffff
mov dword [0x45e490], 0xffffffff
call dword [sym.imp.PNCRT.dll___p__fmode]
mov ecx, dword [0x45e444]
mov dword [eax], ecx
call dword [sym.imp.PNCRT.dll___p__commode]
mov edx, dword [0x45e440]
mov dword [eax], edx
mov eax, dword [sym.imp.PNCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x45e488], ecx
call fcn.0040cab0
mov eax, dword [0x410608]
test eax, eax
jne 0x40c7e1
push 0x40caa0
call dword [sym.imp.PNCRT.dll___setusermatherr]
add esp, 4
call fcn.0040ca80
push 0x40f02c
push 0x40f028
call sub.PNCRT.dll__initterm
add esp, 8
mov edx, dword [0x45e43c]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x45e438]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.PNCRT.dll___getmainargs]
add esp, 0x14
push 0x40f024
push section..data
call sub.PNCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.PNCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40c8ef
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40c855
cmp al, 0x22
jne 0x40c847
cmp byte [esi], 0x22
jne 0x40c85e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40c86e
cmp al, 0x20
ja 0x40c86e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40c85e
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40c88f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40c894
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.PNCRT.dll_exit]
jmp 0x40c8d4
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40c85e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40c8ef