joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57bf00
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x4c]
push ebx
push esi
mov esi, eax
mov byte [ebp - 0x4c], dl
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x30], 0
mov eax, 1
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x10]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x57c030
mov bl, 1
mov byte [ebp - 4], 0
lea edx, [ebp - 4]
mov eax, str.CreateHostsBackups
call fcn.0057e7c0
test al, al
je 0x57bf68
cmp byte [ebp - 4], 0
seta bl
mov esi, esi
test bl, bl
je 0x57bfcc
push 0
lea eax, [ebp - 0x30]
call fcn.0040a950
mov eax, dword [esi + 8]
mov dword [ebp - 0x3c], eax
call fcn.0041a8b0
lea esp, [esp - 8]
fstp qword [esp]
lea ecx, [ebp - 0x44]
xor edx, edx
mov eax, str.yyyymmdd_hhnnss
call fcn.0041b780
mov eax, dword [ebp - 0x44]
lea edx, [ebp - 0x40]
call fcn.0040ab30
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x38], eax
mov eax, str..backup
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x3c]
mov ecx, 2
lea eax, [ebp - 0x30]
call fcn.0040ae00
push dword [ebp - 0x30]
push dword [esi + 8]
call sub.kernel32.dll_CopyFileA
nop
mov eax, dword [esi + 8]
lea edx, [ebp - 0x48]
call fcn.0040bb40
mov eax, dword [ebp - 0x48]
xor edx, edx
call fcn.00421730
mov eax, esi
call fcn.0057ac90
mov eax, dword [esi + 8]
lea ecx, [ebp - 0x44]
xor dx, dx
call fcn.0040aab0
mov edx, dword [ebp - 0x44]
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0xc]
mov ecx, dword [ecx]
call dword [ecx + 0xec]
mov eax, esi
call fcn.0057abf0
mov al, byte [ebp - 0x4c]
test al, al
je 0x57c030
mov eax, dword [esi + 8]
lea edx, [ebp - 0x48]
call fcn.0040bb40
mov eax, dword [ebp - 0x48]
mov edx, 1
call fcn.00421730
lea esi, [esi]
call fcn.0040ec50
lea eax, [ebp - 0x48]
call fcn.0040b910
lea eax, [ebp - 0x44]
call fcn.00403ec0
lea eax, [ebp - 0x40]
call fcn.0040a950
lea eax, [ebp - 0x30]
call fcn.0040a950
pop eax
test eax, eax
je 0x57c05f
call fcn.0040ed80
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x57c7c0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0xd8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
lea eax, [ebp - 0x18]
call fcn.0040ee90
mov dword [ebp - 0xac], 0
mov dword [ebp - 0xa8], 0
cmp dword [ebp - 4], 1
jne 0x57c800
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
call dword [edx + 0x34]
mov dword [ebp - 8], eax
mov esi, esi
cmp dword [ebp - 8], 0
je 0x57c9d6
mov esi, esi
mov eax, 1
lea edx, [ebp - 0x50]
lea ecx, [ebp - 0x38]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x57c97c
mov dword [ebp - 0x2c], 0xffffffff
mov eax, 1
lea edx, [ebp - 0x78]
lea ecx, [ebp - 0x60]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x57c92f
mov eax, 1
lea edx, [ebp - 0xa0]
lea ecx, [ebp - 0x88]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x57c8b3
lea edx, [ebp - 0xa8]
mov eax, str.HNetCfg.FwPolicy2
call fcn.00572040
mov eax, dword [ebp - 0xa8]
lea edx, [ebp - 0x18]
call fcn.0040ef30
lea eax, [ebp - 0x18]
lea edx, [ebp - 0xac]
call fcn.0040ef20
mov edx, dword [ebp - 0xac]
mov eax, dword [ebp - 8]
add eax, 8
call fcn.0040db40
mov eax, dword [ebp - 8]
mov byte [eax + 4], 1
call fcn.0040ec50
pop eax
test eax, eax
je 0x57c92f
mov eax, 0x626984
call fcn.0040ede0
test eax, eax
je 0x57c92a
mov dword [ebp - 0xb0], eax
mov eax, 1
lea edx, [ebp - 0xd4]
lea ecx, [ebp - 0xbc]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x57c914
mov eax, dword [ebp - 0xb0]
mov eax, dword [eax + 4]
test eax, eax
jne 0x57c907
mov eax, 0x6c22f0
push eax
call sub.kernel32.dll_OutputDebugStringA
mov eax, dword [ebp - 8]
mov byte [eax + 4], 0
call fcn.0040ec50
pop eax
test eax, eax
je 0x57c923
call fcn.0040ee80
call fcn.0040ee70
jmp 0x57c92f
call fcn.0040ed80
call fcn.0040ec50
lea eax, [ebp - 0xac]
call fcn.0040daf0
lea eax, [ebp - 0xa8]
call fcn.0040daf0
lea eax, [ebp - 0x18]
call fcn.0040eea0
pop eax
test eax, eax
je 0x57c95c
call fcn.0040ed80
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 8], 0
je 0x57c97c
cmp dword [ebp - 4], 0
je 0x57c97c
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov edx, dword [edx]
call dword [edx + 0x44]
mov esi, esi
call fcn.0040ec50
pop eax
test eax, eax
je 0x57c9d6
mov eax, 1
lea edx, [ebp - 0x6c]
lea ecx, [ebp - 0xbc]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x57c9c2
cmp dword [ebp - 4], 0
je 0x57c9b8
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
call dword [ecx + 0x30]
nop
call fcn.0040ec50
call fcn.0040ed80
call fcn.0040ec50
pop eax
test eax, eax
je 0x57c9d1
call fcn.0040ee80
call fcn.0040ee70
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x57dcf0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x18]
push ebx
push esi
push edi
mov edi, eax
mov ebx, edx
mov esi, ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov edx, dword [eax]
test edx, edx
je 0x57dd2c
sub edx, 2
je 0x57dd50
sub edx, 1
je 0x57dd74
sub edx, 1
je 0x57ddbc
sub edx, 1
je 0x57dd98
jmp 0x57dde0
mov dword [ebp - 8], 0
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00573620
mov dword [ebp - 0x18], eax
jmp 0x57de7c
mov dword [ebp - 8], 1
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00573620
mov dword [ebp - 0x18], eax
jmp 0x57de7c
mov dword [ebp - 8], 2
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00573620
mov dword [ebp - 0x18], eax
jmp 0x57de7c
mov dword [ebp - 8], 4
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00573620
mov dword [ebp - 0x18], eax
jmp 0x57de7c
mov dword [ebp - 8], 3
push dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.00573620
mov dword [ebp - 0x18], eax
jmp 0x57de7c
mov dword [ebp - 4], 0
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 4]
push eax
push 0
mov eax, ebx
test ebx, ebx
jne 0x57ddfd
mov eax, 0x6c22f0
push eax
push dword [edi + 0x14]
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x57de3c
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], 0xb
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, 0x5da7a4
mov edx, 1
mov eax, 0x68dbb0
call fcn.00420570
mov edx, 0x57de0a
mov ecx, ebp
call fcn.0040eb60
mov esi, esi
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0xf
jne 0x57de57
mov eax, dword [ebp - 4]
call fcn.0057ee10
cmp eax, 5
je 0x57de79
mov eax, dword [ebp - 0x14]
cmp dword [eax], 6
jne 0x57de6c
mov eax, dword [ebp - 4]
call fcn.0057ee10
cmp eax, 5
je 0x57de79
mov eax, dword [ebp - 4]
call fcn.0057ee10
mov edx, dword [ebp - 0x14]
mov dword [edx], eax
lea esi, [esi]
mov eax, dword [ebp - 0x18]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x580550
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
push ebx
push esi
push edi
mov esi, eax
mov ebx, edx
mov dword [ebp - 8], ecx
mov byte [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [eax], 0
push 0x80000000
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov edi, eax
test edi, edi
jle 0x580615
push 2
mov eax, esi
test esi, esi
jne 0x580593
mov eax, 0x6c22f0
push eax
push edi
call sub.advapi32.dll_OpenServiceW
mov esi, eax
test esi, esi
jle 0x5805ed
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebx + 4]
push 0xffffffffffffffff
push esi
call sub.advapi32.dll_ChangeServiceConfigW
test eax, eax
je 0x5805c5
mov byte [ebp - 4], 1
jmp 0x5805e5
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 8]
mov dword [edx], eax
call fcn.005774c0
push 4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, str.snlServiceChangeConfig.QueryServiceStatus
call fcn.005779a0
push esi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x58060d
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 8]
mov dword [edx], eax
call fcn.005774c0
push 4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, str.snlServiceChangeConfig.OpenServiceW
call fcn.005779a0
push edi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x580635
call sub.kernel32.dll_GetLastError
mov edx, dword [ebp - 8]
mov dword [edx], eax
call fcn.005774c0
push 4
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov ecx, str.snlServiceChangeConfig.OpenSCManager
call fcn.005779a0
mov al, byte [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x580640
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x24]
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov byte [ebp - 0x24], 0
mov dword [edi], 0
push 0x80000000
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
jle 0x58074e
push 0x14
mov eax, ebx
test ebx, ebx
jne 0x58067d
mov eax, 0x6c22f0
push eax
push esi
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
jle 0x58072c
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x58070a
cmp dword [ebp - 0x18], 4
sete byte [ebp - 0x24]
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x18]
cmp eax, 1
jb 0x580724
sub eax, 1
je 0x5806d0
sub eax, 2
je 0x5806d0
sub eax, 3
jb 0x580724
sub eax, 1
ja 0x580724
nop
lea eax, [ebp - 0x20]
push eax
push 0
push ebx
call sub.advapi32.dll_StartServiceW
or eax, eax
setne al
mov byte [ebp - 0x24], al
test al, al
jne 0x580724
call sub.kernel32.dll_GetLastError
mov dword [edi], eax
call fcn.005774c0
push 4
mov edx, dword [edi]
mov ecx, str.snlServiceStart.StartServiceW
call fcn.005779a0
mov esi, esi
jmp 0x580724
call sub.kernel32.dll_GetLastError
mov dword [edi], eax
call fcn.005774c0
push 4
mov edx, dword [edi]
mov ecx, str.snlServiceStart.QueryServiceStatus
call fcn.005779a0
push ebx
call sub.advapi32.dll_CloseServiceHandle
jmp 0x580746
call sub.kernel32.dll_GetLastError
mov dword [edi], eax
call fcn.005774c0
push 4
mov edx, dword [edi]
mov ecx, str.snlServiceStart.OpenServiceW
call fcn.005779a0
push esi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x580768
call sub.kernel32.dll_GetLastError
mov dword [edi], eax
call fcn.005774c0
push 4
mov edx, dword [edi]
mov ecx, str.snlServiceStart.OpenSCManager
call fcn.005779a0
mov al, byte [ebp - 0x24]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x580780
Capabilities:
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x20]
push ebx
push esi
push edi
mov ebx, eax
mov edi, edx
mov byte [ebp - 0x20], 1
mov dword [edi], 0
push 0x80000000
push 0
push 0
call sub.advapi32.dll_OpenSCManagerA
mov esi, eax
test esi, esi
jle 0x580892
push 0x24
mov eax, ebx
test ebx, ebx
jne 0x5807bd
mov eax, 0x6c22f0
push eax
push esi
call sub.advapi32.dll_OpenServiceW
mov ebx, eax
test ebx, ebx
jle 0x580870
mov byte [ebp - 0x20], 0
lea eax, [ebp - 0x1c]
push eax
push ebx
call sub.advapi32.dll_QueryServiceStatus
test eax, eax
je 0x58084e
cmp dword [ebp - 0x18], 1
sete byte [ebp - 0x20]
mov eax, dword [ebp - 0x18]
cmp eax, 1
jb 0x580868
sub eax, 1
je 0x580848
sub eax, 1
je 0x580814
sub eax, 1
je 0x580848
sub eax, 1
jb 0x580868
sub eax, 3
ja 0x580868
lea esi, [esi]
lea eax, [ebp - 0x1c]
push eax
push 1
push ebx
call sub.advapi32.dll_ControlService
test eax, eax
je 0x58082a
mov byte [ebp - 0x20], 1
jmp 0x580868
call sub.kernel32.dll_GetLastError
mov dword [edi], eax
call fcn.005774c0
push 4
mov edx, dword [edi]
mov ecx, str.snlServiceStop.ControlService
call fcn.005779a0
jmp 0x580868
mov byte [ebp - 0x20], 1
jmp 0x580868
call sub.kernel32.dll_GetLastError
mov dword [edi], eax
call fcn.005774c0
push 4
mov edx, dword [edi]
mov ecx, str.snlServiceStop.QueryServiceStatus
call fcn.005779a0
push ebx
call sub.advapi32.dll_CloseServiceHandle
jmp 0x58088a
call sub.kernel32.dll_GetLastError
mov dword [edi], eax
call fcn.005774c0
push 4
mov edx, dword [edi]
mov ecx, str.snlServiceStop.OpenServiceW
call fcn.005779a0
push esi
call sub.advapi32.dll_CloseServiceHandle
jmp 0x5808ac
call sub.kernel32.dll_GetLastError
mov dword [edi], eax
call fcn.005774c0
push 4
mov edx, dword [edi]
mov ecx, str.snlServiceStop.OpenSCManager
call fcn.005779a0
mov al, byte [ebp - 0x20]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5bcbd0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [0x5dbff0]
mov edx, dword [0x5dbff0]
mov edx, dword [edx]
call dword [edx + 0x6c]
mov ebx, eax
push 0
push ebx
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
push ebx
call sub.user32.dll_GetWindowLongA
and eax, 0xfffbffff
or eax, 0x80
push eax
push 0xffffffffffffffec
push ebx
call sub.user32.dll_SetWindowLongA
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x5beb30
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 8]
mov dword [ebp - 8], eax
mov dword [ebp - 4], edx
push 0
push dword [ebp - 4]
mov eax, dword [ebp - 8]
push dword [eax + 4]
call sub.user32.dll_SetWindowRgn
push 4
mov eax, dword [ebp - 8]
push dword [eax + 4]
call sub.user32.dll_ShowWindow
mov esp, ebp
pop ebp
ret
Function at 0x5d50c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x5c]
push ebx
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
mov eax, dword [ebp - 4]
call fcn.00409160
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x5c], 0
mov eax, 1
lea edx, [ebp - 0x54]
lea ecx, [ebp - 0x3c]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x5d5290
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
add dword [ebp - 0x20], 1
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
mov byte [edx + eax], 0
cmp dword [ebp - 0x20], 0xf
jl 0x5d5110
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
nop
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
mov word [ebp + eax*2 - 0x18], 0
cmp dword [ebp - 0x20], 7
jl 0x5d5130
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x5c]
call fcn.005d4f70
mov edx, dword [ebp - 0x5c]
lea eax, [ebp - 4]
call fcn.00409190
cmp dword [ebp - 4], 0
jne 0x5d5214
jmp 0x5d5290
cmp dword [ebp - 0x1c], 7
jg 0x5d5290
mov esi, esi
lea ecx, [ebp - 0x2c]
lea eax, [ebp - 4]
mov edx, 0x6bdd7c
call fcn.005d41d0
mov eax, dword [ebp - 0x2c]
mov edx, 0x6bddcc
call fcn.00409d40
test eax, eax
je 0x5d521e
lea esi, [esi]
cmp dword [ebp - 0x2c], 0
jne 0x5d51c2
mov eax, dword [ebp - 0x1c]
mov word [ebp + eax*2 - 0x18], 0
jmp 0x5d5210
lea eax, [ebp - 0x5c]
call fcn.00403ec0
push 0
mov ecx, dword [ebp - 0x2c]
mov edx, 0x6bdd9c
lea eax, [ebp - 0x5c]
call fcn.00409290
mov eax, dword [ebp - 0x5c]
mov edx, 0xffffffff
call fcn.00416c30
mov dword [ebp - 0x30], eax
cmp eax, 0xffff
jg 0x5d5290
cmp dword [ebp - 0x30], 0
jl 0x5d5290
lea esi, [esi]
mov eax, dword [ebp - 0x1c]
mov dx, word [ebp - 0x30]
mov word [ebp + eax*2 - 0x18], dx
add dword [ebp - 0x1c], 1
cmp dword [ebp - 4], 0
jne 0x5d5180
mov dword [ebp - 0x20], 0xffffffff
lea esi, [esi]
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
movzx eax, word [ebp + eax*2 - 0x18]
mov edx, eax
sar edx, 0x1f
and edx, 0xff
add eax, edx
sar eax, 8
mov byte [ebp - 0x24], al
mov eax, dword [ebp - 0x20]
movzx eax, word [ebp + eax*2 - 0x18]
mov edx, eax
sar edx, 0x1f
mov ecx, eax
xor ecx, edx
sub ecx, edx
and ecx, 0xff
mov ebx, edx
xor ebx, ecx
sub ebx, edx
mov edx, ebx
mov byte [ebp - 0x28], dl
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
shl eax, 1
mov cl, byte [ebp - 0x24]
mov byte [edx + eax], cl
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0x20]
shl eax, 1
mov cl, byte [ebp - 0x28]
mov byte [edx + eax + 1], cl
cmp dword [ebp - 0x20], 7
jl 0x5d5228
call fcn.0040ec50
lea eax, [ebp - 0x5c]
call fcn.00403ec0
lea eax, [ebp - 4]
call fcn.00403ec0
lea eax, [ebp - 0x2c]
call fcn.00403ec0
pop eax
test eax, eax
je 0x5d52b7
call fcn.0040ed80
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x5d6c10
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x44]
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
test eax, eax
jne 0x5d6c31
mov eax, 0x6c22f0
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0xc], eax
test eax, eax
jbe 0x5d6cbc
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x18]
call fcn.00410a80
mov eax, 1
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.0040e9e0
call fcn.00404380
push eax
test eax, eax
jne 0x5d6ca1
push dword [ebp - 0x18]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
mov eax, dword [ebp - 4]
test eax, eax
jne 0x5d6c7c
mov eax, 0x6c22f0
push eax
call sub.version.dll_GetFileVersionInfoW
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
mov eax, str.VarFileInfoTranslation
push eax
push dword [ebp - 0x18]
call sub.version.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
shr eax, 2
mov dword [ebp - 8], eax
call fcn.0040ec50
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x18]
call fcn.00410a90
pop eax
test eax, eax
je 0x5d6cbb
call fcn.0040ed80
nop
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x411c20
Capabilities:
Get common file path

Disassembly:
sub esp, 0x47c
push ebx
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x85]
mov byte [esp + 0x84], bl
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x88]
mov dword [esp + 0x1c], 0
push eax
push ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x104
push str.C:Windows
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x84]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x417a74], eax
mov ecx, dword [eax + 0x3c]
add ecx, eax
mov dword [0x417a78], ecx
cmp dword [ecx], 0x4550
jne 0x411fd5
xor edx, edx
push ebp
mov dx, word [ecx + 0x14]
push esi
mov esi, edx
mov edx, dword [0x417a64]
mov edi, ecx
lea edx, [edx + edx*4]
add edi, esi
lea esi, [edi + edx*8 + 0x18]
mov edx, dword [0x417030]
mov edi, edx
inc edx
cmp edi, 1
mov dword [0x417a7c], esi
mov dword [0x417030], edx
jne 0x411d9d
mov edx, 0x411c00
sub edx, eax
mov dword [0x417a5c], edx
xor edx, edx
mov dx, word [ecx + 6]
mov dword [0x417a80], edx
mov edi, dword [ecx + 0x80]
mov ebp, dword [ecx + 0x28]
mov dword [esp + 0x14], edi
mov edi, dword [ecx + 0xa0]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], edi
xor edi, edi
test edx, edx
jmp 0x41c1ed
jmp 0xffc1c3e1
pop edi
xor eax, eax
pop ebx
add esp, 0x47c
ret

Function at 0x4123d6
Capabilities:
Terminate process

Disassembly:
cmp dword [0x417bb0], 2
je 0x4123e4
jmp 0x41b941
push dword [esp + 4]
call fcn.00413769
pop ecx
push 0xff
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x413769
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x417190
cmp edx, dword [eax]
je 0x41378b
add eax, 8
inc ecx
cmp eax, 0x417220
jl 0x41377c
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x417190]
jne 0x4138b9
mov eax, dword [0x417bb0]
cmp eax, 1
je 0x413893
test eax, eax
jne 0x4137bc
cmp dword [0x4170e4], 1
je 0x413893
cmp edx, 0xfc
je 0x4138b9
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4137f3
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00414670
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00414490
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x413836
lea eax, [ebp - 0x1a4]
push eax
call fcn.00414490
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x41645c
push edi
call fcn.00414f00
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00414670
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00414680
lea eax, [ebp - 0xa0]
push 0x41643c
push eax
call fcn.00414680
push dword [esi + 0x417194]
lea eax, [ebp - 0xa0]
push eax
jmp 0x41c714
lea eax, [ebp + 8]
lea esi, [esi + 0x417194]
push 0
push eax
push dword [esi]
call fcn.00414490
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x40ec26
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407a23
mov dword [ebp - 0x14], eax
cmp dword [0x439e9c], esi
jne 0x40ed19
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40eca6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40edf9
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40edf9
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40edf9
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x439e9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x439ea0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x439ea4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x439eac], eax
test eax, eax
je 0x40ed16
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x439ea8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ed3e
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ed31
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40ed53
push 4
pop eax
jmp 0x40edfb
cmp dword [ebp - 0x14], esi
je 0x40ed53
push dword [0x439e9c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ed38
mov eax, dword [0x439ea8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40edb1
cmp dword [0x439eac], edi
je 0x40edb1
push eax
call ebx
push dword [0x439eac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40edb1
test eax, eax
je 0x40edb1
call ecx
test eax, eax
je 0x40eda6
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40eda6
test byte [ebp - 8], 1
jne 0x40edb1
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40ede1
mov eax, dword [0x439ea0]
cmp eax, edi
je 0x40edde
push eax
call ebx
test eax, eax
je 0x40edde
call eax
mov esi, eax
test esi, esi
je 0x40edde
mov eax, dword [0x439ea4]
cmp eax, edi
je 0x40edde
push eax
call ebx
test eax, eax
je 0x40edde
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x439e9c]
call ebx
test eax, eax
je 0x40edf9
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40edfb
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402049
mov esp, ebp
pop ebp
ret