joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd260
Capabilities:
Check for time delay via gettickcount
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x84], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4bd42a
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0x4bd43c
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x540c44], eax
push 0x4bd450
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x540c48], eax
push 0x4bd468
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x540c4c], eax
push 0x4bd484
call sub.user32.dll_RegisterWindowMessageA
mov dword [0x540c50], eax
lea eax, [ebp - 0x2c]
xor ecx, ecx
mov edx, 0x28
call fcn.00402f04
mov dword [ebp - 0x28], 0x4bd234
mov eax, 0x4bd49c
mov dword [ebp - 8], eax
lea eax, [ebp - 0x2c]
push eax
call sub.user32.dll_RegisterClassA
test ax, ax
je 0x4bd409
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
mov edx, 0x4bd49c
xor ecx, ecx
mov eax, 0x20
call fcn.004076cc
mov dword [0x540c58], eax
cmp dword [0x540c58], 0
je 0x4bd409
push 0x4bd4b4
push 0
call sub.user32.dll_FindWindowA
test eax, eax
je 0x4bd379
push 0
push 0
mov eax, dword [0x540c48]
push eax
push 0xffff
call sub.user32.dll_SendMessageA
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
jmp 0x4bd35b
push 0x32
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x3e8
jae 0x4bd379
push 0x4bd4b4
push 0
call sub.user32.dll_FindWindowA
test eax, eax
jne 0x4bd354
lea eax, [ebp - 0x80]
xor ecx, ecx
mov edx, 0x44
call fcn.00402f04
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], 0
push dword [0x540c40]
push 0x4bd4cc
lea edx, [ebp - 0x84]
mov eax, dword [0x540c58]
call fcn.004bef20
push dword [ebp - 0x84]
lea eax, [ebp - 4]
mov edx, 3
call fcn.004048b0
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
push 0
push 0x80
push 0xffffffffffffffff
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004049f0
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4bd409
mov bl, 1
mov eax, dword [ebp - 0x3c]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x38]
push eax
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bd431
lea eax, [ebp - 0x84]
call fcn.00404530
lea eax, [ebp - 4]
call fcn.00404530
ret

Function at 0x4bef50
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
call fcn.004aa58c
cmp eax, 5
jl 0x4bef5d
mov al, 1
ret
call fcn.004aa4dc
test al, al
je 0x4bef92
push 0x4bef98
push 0
push 0x20000
call sub.kernel32.dll_OpenMutexA
test eax, eax
je 0x4bef85
push eax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x4bef94
call sub.kernel32.dll_GetLastError
cmp eax, 2
sete al
jmp 0x4bef94
xor eax, eax
ret
Function at 0x4bef6b
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
call fcn.004aa58c
cmp eax, 5
jl 0x4bef5d
mov al, 1
ret
call fcn.004aa4dc
test al, al
je 0x4bef92
push 0x4bef98
push 0
push 0x20000
call sub.kernel32.dll_OpenMutexA
test eax, eax
je 0x4bef85
push eax
call sub.kernel32.dll_CloseHandle
mov al, 1
jmp 0x4bef94
call sub.kernel32.dll_GetLastError
cmp eax, 2
sete al
jmp 0x4bef94
xor eax, eax
ret
Function at 0x4befb8
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004049e0
xor eax, eax
push ebp
push 0x4bf190
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.004bef50
test al, al
je 0x4bf0ec
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 8]
mov edx, 0x4bf1a8
call fcn.0040483c
mov eax, dword [ebp - 0x20]
call fcn.004049f0
push eax
push 0
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4bf057
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 8]
mov edx, 0x4bf1a8
call fcn.0040483c
mov eax, dword [ebp - 0x24]
call fcn.004049f0
push eax
push 0
push 0x120001
call sub.kernel32.dll_OpenMutexA
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4bf089
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov edx, 0x4bf1b8
call fcn.0040483c
mov eax, dword [ebp - 0x28]
call fcn.004049f0
push eax
push 0
push 0x1f0001
call sub.kernel32.dll_OpenMutexA
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4bf0bb
lea eax, [ebp - 0x2c]
mov ecx, dword [ebp - 8]
mov edx, 0x4bf1b8
call fcn.0040483c
mov eax, dword [ebp - 0x2c]
call fcn.004049f0
push eax
push 0
push 0x120001
call sub.kernel32.dll_OpenMutexA
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x4bf103
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 8]
mov edx, 0x4bf1a8
call fcn.0040483c
mov eax, dword [ebp - 0x30]
call fcn.004049f0
push eax
push 0
push 0
call fcn.00406b28
mov edx, dword [ebp - 4]
mov dword [edx], eax
jmp 0x4bf103
mov eax, dword [ebp - 8]
call fcn.004049f0
push eax
push 0
push 0
call fcn.00406b28
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x4bf164
call sub.kernel32.dll_GetLastError
cmp eax, 0xb7
je 0x4bf164
xor eax, eax
push ebp
push 0x4bf15a
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
lea eax, [ebp - 0x1c]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
lea eax, [ebp - 0x1c]
push eax
push 4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push eax
call sub.advapi32.dll_SetKernelObjectSecurity
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4bf164
mov eax, dword [ebp - 4]
cmp dword [eax], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf197
lea eax, [ebp - 0x30]
mov edx, 5
call fcn.00404554
lea eax, [ebp - 8]
call fcn.00404530
ret
Function at 0x4bf2e0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 7
add esp, 0xfffff004
push eax
dec eax
jne 0x4bf2e9
mov eax, dword [ebp - 4]
add esp, 0xfffffad0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004049e0
xor eax, eax
push ebp
push 0x4bf362
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x752f
lea eax, [ebp - 0x7534]
push eax
mov eax, dword [ebp - 4]
call fcn.004049f0
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
test eax, eax
jbe 0x4bf345
mov edx, ebx
lea eax, [ebp - 0x7534]
call fcn.00409808
jmp 0x4bf34c
mov eax, ebx
call fcn.00404530
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4bf369
lea eax, [ebp - 4]
call fcn.00404530
ret

Function at 0x4c0cf4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push 0
mov eax, dword [0x5698dc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
push 0xffffffffffffffec
mov eax, dword [0x5698dc]
mov eax, dword [eax]
mov ebx, dword [eax + 0x30]
push ebx
call sub.user32.dll_GetWindowLongA
and eax, 0xfffbffff
or eax, 0x80
push eax
push 0xffffffffffffffec
mov eax, dword [0x5698dc]
push ebx
call sub.user32.dll_SetWindowLongA
push 5
mov eax, dword [0x5698dc]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_ShowWindow
pop ebx
ret
Function at 0x4c3e0c
Capabilities:
Check for time delay via gettickcount
Read file on windows
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd0
mov dword [esp + 4], ecx
mov byte [esp], dl
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
call sub.kernel32.dll_GetTickCount_1
cmp esi, eax
je 0x4c3e23
call sub.kernel32.dll_GetTickCount_1
mov esi, eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov eax, 0x2710
mov edi, eax
test edi, edi
jle 0x4c3f9f
mov dword [esp + 0x18], 1
call fcn.004aa4dc
test al, al
je 0x4c3eaf
mov eax, dword [ebx + 0x418]
call fcn.00402f24
cdq
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov eax, dword [0x56951c]
cdq
push edx
push eax
mov eax, dword [esp + 0x28]
mov edx, dword [esp + 0x2c]
call fcn.00405400
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], edx
mov ecx, dword [esp + 0x20]
and ecx, 0xffffffff
mov eax, dword [esp + 0x24]
xor edx, edx
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x18]
push eax
push ecx
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_SetFilePointer
jmp 0x4c3ed1
mov eax, dword [0x56951c]
test eax, eax
jns 0x4c3ebd
add eax, 0x1ff
sar eax, 9
imul dword [ebx + 0x418]
call fcn.00402f24
mov dword [ebx + 0x3f4], eax
cmp byte [ebx + 0x441], 0
je 0x4c3ee1
mov ebp, 0x200
jmp 0x4c3ee6
mov ebp, 0x800
call fcn.004aa4dc
test al, al
je 0x4c3f2b
cmp byte [esp], 0
je 0x4c3f10
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [ebx + 0x568]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4c3f58
push 0
lea eax, [esp + 0x14]
push eax
push ebp
lea eax, [ebx + 0x568]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_ReadFile
jmp 0x4c3f58
mov eax, dword [ebx + 0x3f4]
push eax
test ebp, ebp
jns 0x4c3f3c
add ebp, 0x1ff
sar ebp, 9
push ebp
lea eax, [ebx + 0x568]
push eax
mov cl, byte [ebx + 0x430]
mov dl, byte [esp + 0xc]
mov eax, ebx
call fcn.004c36ac
inc dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
and eax, 0x80000003
jns 0x4c3f6c
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
jne 0x4c3f7d
mov eax, dword [0x5698dc]
mov eax, dword [eax]
call fcn.00475568
cmp byte [ebx + 0x440], 0
jne 0x4c3f9f
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
cmp eax, 0x7d0
ja 0x4c3f9f
inc dword [esp + 0x18]
dec edi
jne 0x4c3e50
call sub.kernel32.dll_GetTickCount_1
sub eax, esi
mov dword [esp + 0x28], eax
xor eax, eax
mov dword [esp + 0x2c], eax
fild qword [esp + 0x28]
fild dword [esp + 0x1c]
fdivp st(1)
fstp qword [esp + 8]
wait
fld qword [esp + 8]
add esp, 0x30
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c3fcc
Capabilities:
Check for time delay via gettickcount
Read file on windows
Write file on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffc8
mov dword [esp + 4], ecx
mov byte [esp], dl
mov ebx, eax
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
call sub.kernel32.dll_GetTickCount_1
cmp edi, eax
je 0x4c3fe3
call sub.kernel32.dll_GetTickCount_1
mov edi, eax
xor eax, eax
mov dword [esp + 0x1c], eax
mov eax, 0x2710
mov ebp, eax
test ebp, ebp
jle 0x4c4180
mov esi, 1
mov eax, esi
and eax, 0x80000001
jns 0x4c401b
dec eax
or eax, 0xfffffffe
inc eax
dec eax
jne 0x4c4026
xor eax, eax
mov dword [esp + 0x20], eax
jmp 0x4c4033
mov eax, dword [ebx + 0x418]
sub eax, 4
mov dword [esp + 0x20], eax
call fcn.004aa4dc
test al, al
je 0x4c408b
mov eax, dword [esp + 0x20]
cdq
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov eax, dword [0x56951c]
cdq
push edx
push eax
mov eax, dword [esp + 0x30]
mov edx, dword [esp + 0x34]
call fcn.00405400
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edx
mov ecx, dword [esp + 0x28]
and ecx, 0xffffffff
mov eax, dword [esp + 0x2c]
xor edx, edx
mov dword [esp + 0x14], eax
push 0
lea eax, [esp + 0x18]
push eax
push ecx
mov eax, dword [esp + 0x10]
push eax
call sub.kernel32.dll_SetFilePointer
jmp 0x4c40a6
mov eax, dword [0x56951c]
test eax, eax
jns 0x4c4099
add eax, 0x1ff
sar eax, 9
imul dword [esp + 0x20]
mov dword [ebx + 0x3f4], eax
cmp byte [ebx + 0x441], 0
je 0x4c40b9
mov dword [esp + 0x18], 0x200
jmp 0x4c40c1
mov dword [esp + 0x18], 0x800
call fcn.004aa4dc
test al, al
je 0x4c410e
cmp byte [esp], 0
je 0x4c40ef
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
lea eax, [ebx + 0x568]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x4c413e
push 0
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x20]
push eax
lea eax, [ebx + 0x568]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_ReadFile
jmp 0x4c413e
mov eax, dword [ebx + 0x3f4]
push eax
mov eax, dword [esp + 0x1c]
test eax, eax
jns 0x4c4122
add eax, 0x1ff
sar eax, 9
push eax
lea eax, [ebx + 0x568]
push eax
mov cl, byte [ebx + 0x430]
mov dl, byte [esp + 0xc]
mov eax, ebx
call fcn.004c36ac
inc dword [esp + 0x1c]
mov eax, esi
and eax, 0x80000003
jns 0x4c4150
dec eax
or eax, 0xfffffffc
inc eax
cmp eax, 3
jne 0x4c4161
mov eax, dword [0x5698dc]
mov eax, dword [eax]
call fcn.00475568
cmp byte [ebx + 0x440], 0
jne 0x4c4180
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
cmp eax, 0x7d0
ja 0x4c4180
inc esi
dec ebp
jne 0x4c400d
call sub.kernel32.dll_GetTickCount_1
sub eax, edi
mov dword [esp + 0x30], eax
xor eax, eax
mov dword [esp + 0x34], eax
fild qword [esp + 0x30]
fild dword [esp + 0x1c]
fdivp st(1)
fstp qword [esp + 8]
wait
fld qword [esp + 8]
add esp, 0x38
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4c434c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
mov eax, dword [0x5698dc]
mov eax, dword [eax]
call fcn.00475568
push 0
push ebx
push 4
push 0
mov eax, dword [ebp + 8]
mov ecx, dword [eax - 8]
mov ecx, dword [ecx]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
xor edx, edx
call fcn.004c3738
fstp st(0)
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
mov eax, dword [0x5698dc]
mov eax, dword [eax]
call fcn.00475568
push 0x50
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x341
jbe 0x4c4383
pop ebx
pop ebp
ret
Function at 0x4019ba
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
mov eax, esi
xor edx, edx
push edi
div dword [ebx + 8]
mov eax, dword [ebp + 0xc]
mov edi, edx
add eax, edi
sub esi, edi
push eax
push esi
push 0
push 6
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov esi, eax
lea ecx, [ebx + 0x18]
lea eax, [ebp - 4]
add edi, esi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 4], edi
push eax
call fcn.00401ebd
mov ecx, dword [eax]
mov eax, edi
pop edi
mov dword [ecx + 0x14], esi
pop esi
pop ebx
leave
ret 8

Function at 0x402526
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40257c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x40257c
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x40256e
cmp esi, ecx
jae 0x40257c
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x40255c
cmp esi, ecx
jae 0x40257c
cmp word [esi], 0
je 0x40257c
mov eax, esi
jmp 0x40257e
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40266d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
je 0x402701
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push edi
push esi
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, eax
test edx, edx
jne 0x4026f8
test esi, esi
je 0x4026f8
mov ecx, dword [edi]
test ecx, ecx
je 0x4026f3
mov eax, dword [ebp - 4]
test eax, eax
je 0x4026e9
cmp eax, 2
jbe 0x4026db
cmp eax, 7
jne 0x4026e9
test cl, 1
jne 0x4026e9
shr ecx, 1
cmp ecx, 1
jb 0x4026e9
cmp word [esi + ecx*2 - 2], bx
jne 0x4026e9
cmp ecx, 1
jbe 0x4026f8
cmp word [esi + ecx*2 - 4], bx
jne 0x4026e9
jmp 0x4026f8
test cl, 1
jne 0x4026e9
shr ecx, 1
cmp word [esi + ecx*2 - 2], bx
je 0x4026f8
xor eax, eax
push 0xd
mov word [esi], ax
pop eax
jmp 0x4026fa
xor eax, eax
mov word [esi], ax
mov eax, edx
pop edi
pop esi
pop ebx
leave
ret 0xc
push 0x80004005
call fcn.004013de
int3
Function at 0x402d60
Capabilities:
Read .ini file

Disassembly:
push 0x814
mov eax, 0x412459
call fcn.00411e79
mov ebx, edx
mov eax, ecx
mov dword [ebp - 0x814], eax
mov dword [ebp - 0x81c], eax
mov edi, dword [ebp + 8]
xor ecx, ecx
mov esi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x820], eax
lea eax, [ebp - 0x810]
push 0x800
push ecx
push eax
mov dword [ebp - 0x818], ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x810]
push ebx
push 0x400
push eax
push 0x414c20
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov esi, dword [ebp - 0x814]
lea eax, [ebp - 0x810]
push eax
mov ecx, esi
call fcn.00403925
and dword [ebp - 4], 0
mov ecx, esi
push 0x414d84
push 0x414d88
mov dword [ebp - 0x818], 1
call fcn.004035e1
mov eax, esi
call fcn.00411e23
ret
Function at 0x4030c2
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
call fcn.00402870
mov esi, eax
test esi, esi
je 0x40328c
push str.PdhOpenQueryW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhAddCounterW
push esi
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhCollectQueryData
push esi
mov dword [esp + 0x28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhGetFormattedCounterValue
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhRemoveCounter
push esi
mov dword [esp + 0x1c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.PdhCloseQuery
push esi
mov dword [esp + 0x24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40328c
mov esi, dword [esp + 0x20]
test esi, esi
je 0x40328c
test edi, edi
je 0x40328c
cmp dword [esp + 0x14], 0
je 0x40328c
cmp dword [esp + 0x1c], 0
je 0x40328c
test ebx, ebx
je 0x40328c
movsd xmm0, qword [0x416b80]
lea ecx, [esp + 0xc]
xor edx, edx
movsd qword [esp + 0x28], xmm0
push ecx
push edx
push edx
mov ecx, eax
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
call dword [0x414370]
mov eax, dword [esp + 0x24]
call eax
test eax, eax
jne 0x403256
lea eax, [esp + 0x10]
mov ecx, esi
push eax
push 0
push str.Processor__Total___Processor_Time
push dword [esp + 0x18]
call dword [0x414370]
call esi
test eax, eax
jne 0x403256
push dword [esp + 0xc]
mov ecx, edi
call dword [0x414370]
call edi
test eax, eax
jne 0x403256
xorps xmm0, xmm0
xor esi, esi
movsd qword [esp + 0x20], xmm0
push dword [esp + 0xc]
mov ecx, edi
call dword [0x414370]
call edi
test eax, eax
jne 0x403256
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x30]
push eax
push 0
push 0x8200
push dword [esp + 0x1c]
call dword [0x414370]
call dword [esp + 0x24]
test eax, eax
jne 0x403256
movsd xmm0, qword [esp + 0x38]
addsd xmm0, qword [esp + 0x20]
push 0x1f4
movsd qword [esp + 0x24], xmm0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x4031eb
movsd xmm0, qword [esp + 0x20]
divsd xmm0, qword [0x416b78]
movsd qword [esp + 0x28], xmm0
cmp dword [esp + 0x10], 0
je 0x40326f
push dword [esp + 0x10]
mov esi, dword [esp + 0x20]
mov ecx, esi
call dword [0x414370]
call esi
cmp dword [esp + 0xc], 0
je 0x403284
push dword [esp + 0xc]
mov ecx, ebx
call dword [0x414370]
call ebx
movsd xmm0, qword [esp + 0x28]
jmp 0x40328f
xorps xmm0, xmm0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406db5
Capabilities:
Get file size

Disassembly:
push 0x1c
mov eax, 0x412cec
call fcn.00411e45
xorps xmm0, xmm0
movlpd qword [ebp - 0x20], xmm0
call fcn.004015d8
push eax
lea ecx, [ebp - 0x18]
call fcn.00401b64
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
mov esi, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
mov ecx, dword [eax + 0x78]
mov eax, dword [ecx]
mov dword [ebp - 0x14], eax
cmp eax, ecx
je 0x406e64
push 0
lea ecx, [eax + 0x18]
call fcn.00401abc
push eax
lea ecx, [ebp - 0x10]
call fcn.00403925
push 0
push 0
push 3
push 0
push 1
push 0x80000000
mov byte [ebp - 4], 1
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406e42
lea eax, [ebp - 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
push ebx
test eax, eax
je 0x406e3c
add edi, dword [ebp - 0x28]
adc esi, dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004015b2
lea ecx, [ebp - 0x14]
call fcn.00401b9d
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 0x14]
cmp eax, dword [ecx + 0x78]
jne 0x406df0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004015b2
mov eax, edi
mov edx, esi
call fcn.00411e0e
ret 4

Function at 0x408450
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov edx, dword [ebp + 0xc]
push ebx
mov ebx, ecx
test edx, edx
jne 0x408464
push 0xd
pop eax
jmp 0x4084a8
push esi
xor eax, eax
push edi
mov dword [ebp - 4], eax
mov esi, eax
mov edi, edx
mov ecx, edi
lea eax, [ecx + 2]
mov dword [ebp - 8], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 4]
jne 0x408477
sub ecx, dword [ebp - 8]
sar ecx, 1
inc ecx
lea edi, [edi + ecx*2]
lea esi, [esi + ecx*2]
cmp ecx, 1
jne 0x40846f
push esi
push edx
push 7
xor eax, eax
push eax
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4088af
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x413015
call fcn.00411ee7
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x428], ecx
mov dword [ebp - 0x42c], esi
mov dword [ebp - 0x418], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], edi
test edi, edi
jne 0x40892c
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x424], eax
test edi, edi
jne 0x40892c
call fcn.0040810c
mov esi, eax
jmp 0x408a32
push dword [ebp - 0x41c]
push dword [ebp - 0x420]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x40894f
call fcn.0040810c
jmp 0x408a25
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x408945
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x420], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x408982
mov esi, 0x8007000e
jmp 0x408a27
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x408a55
jb 0x40899d
cmp eax, 0xffffffff
ja 0x408a55
cmp eax, 0x400
jbe 0x4089b2
push eax
lea ecx, [ebp - 0x418]
call fcn.0040a59a
jmp 0x4089d4
lea eax, [ebp - 0x414]
mov dword [ebp - 0x418], eax
jmp 0x4089d4
mov dword [ebp - 4], 1
cmp dword [ebp - 0x418], 0
je 0x408978
push ebx
push dword [ebp - 0x418]
push ebx
push dword [ebp - 0x41c]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x408945
mov eax, dword [ebp - 0x418]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x42c]
push dword [ebp - 0x418]
call fcn.004094cc
mov esi, eax
test edi, edi
je 0x408a32
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x408a4b
lea ecx, [ebp - 0x418]
call fcn.0040a590
mov eax, esi
call fcn.00411e34
ret 0x10
push 0x80070216
call fcn.004013de
int3