joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4409f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
cmp byte [0x471aec], 0
push esi
push edi
jne 0x440a4c
push 0xa
push 3
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [0x470f2c], eax
mov esi, dword [eax]
add eax, 4
mov dword [0x470f2c], eax
mov ecx, dword [eax]
lea edi, [eax + 4]
push ecx
push edi
mov dword [0x470f2c], edi
call fcn.0043e5a0
add esp, 8
cmp eax, esi
jne 0x440bb1
mov byte [0x471aec], 1
jmp 0x440a52
mov edi, dword [0x470f2c]
push ebx
mov ebx, dword [esp + 0x18]
mov ecx, 0x45c8f0
mov eax, ebx
nop
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x440a80
test dl, dl
je 0x440a7c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x440a80
add eax, 2
add ecx, 2
test dl, dl
jne 0x440a60
xor eax, eax
jmp 0x440a85
sbb eax, eax
or eax, 1
test eax, eax
je 0x440b03
cmp byte [0x471acc], 1
je 0x440b03
mov esi, dword [sym.imp.python38.dll_PyDict_New]
call esi
mov dword [0x471630], eax
call esi
mov dword [0x471634], eax
call esi
mov dword [0x471638], eax
call esi
mov dword [0x47163c], eax
call esi
mov dword [0x471640], eax
call esi
mov dword [0x471644], eax
call esi
mov dword [0x471648], eax
call esi
mov edi, dword [sym.imp.python38.dll_PyLong_FromLong]
mov esi, 0xfffffffb
mov dword [0x47164c], eax
nop dword [eax + eax]
push esi
call edi
mov dword [esi*4 + 0x470ff4], eax
add esp, 4
inc esi
cmp esi, 0x101
jl 0x440ae0
mov edi, dword [0x470f2c]
mov byte [0x471acc], 1
mov ecx, edi
mov eax, ebx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x440b27
test dl, dl
je 0x440b23
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x440b27
add eax, 2
add ecx, 2
test dl, dl
jne 0x440b07
xor edx, edx
jmp 0x440b2c
sbb edx, edx
or edx, 1
mov ecx, edi
lea esi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x440b31
sub ecx, esi
mov eax, dword [edi + ecx + 1]
lea esi, [edi + ecx]
add esi, 5
test edx, edx
je 0x440b95
add esi, eax
mov ecx, ebx
mov eax, esi
nop
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x440b70
test dl, dl
je 0x440b6c
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x440b70
add ecx, 2
add eax, 2
test dl, dl
jne 0x440b50
xor edx, edx
jmp 0x440b75
sbb edx, edx
or edx, 1
mov ecx, esi
lea edi, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x440b80
sub ecx, edi
add esi, ecx
mov eax, dword [esi + 1]
add esi, 5
test edx, edx
jne 0x440b48
movzx eax, word [esi]
push eax
lea eax, [esi + 2]
push eax
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call fcn.0043d740
add esp, 0x10
pop ebx
pop edi
pop esi
ret
push str.Error__corrupted_constants_object
call fcn.0044d84a
add esp, 4
call fcn.00444b30
int3
Function at 0x4251e5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041e15f
and dword [ebp - 4], 0
cmp dword [0x44f6a8], 0
mov ebx, eax
jne 0x425296
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x425347
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x425347
push eax
call fcn.0041e0ed
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x44f6a8], eax
call esi
push eax
call fcn.0041e0ed
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x44f6ac], eax
call esi
push eax
call fcn.0041e0ed
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x44f6b0], eax
call esi
push eax
call fcn.0041e0ed
pop ecx
mov dword [0x44f6b8], eax
test eax, eax
je 0x425296
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0041e0ed
pop ecx
mov dword [0x44f6b4], eax
mov eax, dword [0x44f6b4]
cmp eax, ebx
je 0x4252ee
cmp dword [0x44f6b8], ebx
je 0x4252ee
push eax
call fcn.0041e168
push dword [0x44f6b8]
mov esi, eax
call fcn.0041e168
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4252ee
test edi, edi
je 0x4252ee
call esi
test eax, eax
je 0x4252e5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4252e5
test byte [ebp - 0xc], 1
jne 0x4252ee
or dword [ebp + 0x10], 0x200000
jmp 0x425327
mov eax, dword [0x44f6ac]
cmp eax, ebx
je 0x425327
push eax
call fcn.0041e168
pop ecx
test eax, eax
je 0x425327
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x425327
mov eax, dword [0x44f6b0]
cmp eax, ebx
je 0x425327
push eax
call fcn.0041e168
pop ecx
test eax, eax
je 0x425327
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x44f6a8]
call fcn.0041e168
pop ecx
test eax, eax
je 0x425347
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x425349
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x710c71
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x7109ec
add eax, ecx
mov ecx, 0x3c596b41
and eax, eax
call fcn.00710caf
or ecx, ecx
add ecx, ecx
xor dword [edx], ebx
add eax, ecx
mov eax, 0x3f426747
or eax, eax
inc edx
add ecx, 1
sub eax, 0x708d4143
inc ecx
cmp edx, edi
jne fcn.00710c71
dec eax
ret
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x401140
mov ecx, dword [esp + 0xc]
test ecx, ecx
jbe 0x401140
mov eax, 0xaaaaaaab
mul ecx
mov eax, dword [esp + 0x10]
shr edx, 1
lea edx, [edx + edx*2]
push ebp
lea ebp, [edx + esi]
cmp esi, ebp
je 0x4010ba
mov ecx, dword [section..data]
push ebx
push edi
lea ecx, [ecx]
xor edi, edi
test ecx, ecx
jbe 0x4010b0
cmp esi, ebp
je 0x4010b4
movzx ecx, byte [esi]
movzx ebx, byte [esi + 1]
shl ecx, 8
or ecx, ebx
inc esi
movzx ebx, byte [esi + 1]
inc esi
shl ecx, 8
or ecx, ebx
mov ebx, ecx
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 3], bl
shr ecx, 6
mov ebx, ecx
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], bl
shr ecx, 6
mov ebx, ecx
and ebx, 0x3f
movzx ebx, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ecx, 6
mov byte [eax + 1], bl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov ecx, dword [section..data]
add edi, 4
inc esi
add eax, 4
cmp edi, ecx
jb 0x401046
cmp esi, ebp
jne 0x401040
mov ecx, dword [esp + 0x18]
pop edi
pop ebx
sub ecx, edx
sub ecx, 1
pop ebp
je 0x401110
sub ecx, 1
jne 0x40113a
movzx ecx, byte [esi]
movzx edx, byte [esi + 1]
shl ecx, 8
or ecx, edx
add ecx, ecx
add ecx, ecx
mov edx, ecx
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 2], dl
shr ecx, 6
mov edx, ecx
and edx, 0x3f
movzx edx, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax + 1], dl
shr ecx, 6
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov byte [eax + 3], 0x3d
add eax, 4
sub eax, dword [esp + 0x10]
pop esi
ret
movzx ecx, byte [esi]
shl ecx, 4
mov edx, ecx
and edx, 0x3f
mov dl, byte [edx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
shr ecx, 6
mov byte [eax + 1], dl
mov cl, byte [ecx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [eax], cl
mov cl, 0x3d
mov byte [eax + 2], cl
mov byte [eax + 3], cl
add eax, 4
sub eax, dword [esp + 0x10]
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x401170
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401189
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4011c4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4011c0
lea ebx, [ebx]
cmp esi, eax
jae 0x4011c4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4011b0
cmp esi, eax
jb 0x4011ca
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x405f80
Capabilities:
Get common file path

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x405fbd
mov ecx, dword [esp + 8]
mov edx, dword [esp]
push esi
push ecx
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, esi
pop esi
pop ecx
ret
xor eax, eax
pop ecx
ret

Function at 0x406280
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push ebx
push edi
call fcn.00426582
mov edi, dword [eax + 0xc]
mov eax, dword [esp + 0x14]
movzx ecx, word [esp + 0x10]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov ebx, eax
test ebx, ebx
jne 0x4062a7
pop edi
pop ebx
pop ecx
ret
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x4062c5
pop esi
pop edi
pop ebx
pop ecx
ret
push ebp
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
call fcn.00437ce0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea edx, [esp + 0x10]
push edx
push 0
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
mov ebp, dword [esp + 0x10]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
test esi, esi
je 0x406324
lea eax, [esi + 4]
push eax
push ebp
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [esi + 8], eax
jmp 0x406326
xor esi, esi
mov eax, dword [esp + 0x20]
mov dword [eax], esi
mov eax, dword [esp + 0x10]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop ebp
pop esi
pop edi
mov eax, 1
pop ebx
pop ecx
ret
Function at 0x409b00
Capabilities:
Enumerate processes

Disassembly:
push 0xffffffffffffffff
push 0x44f9eb
mov eax, dword fs:[0]
push eax
sub esp, 0x130
mov eax, dword [0x469b70]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x469b70]
xor eax, esp
push eax
lea eax, [esp + 0x144]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x154]
xor esi, esi
mov ebp, ecx
mov dword [esp + 0x14], esi
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp + 0x13e0], eax
call fcn.00417336
xor ecx, ecx
cmp eax, esi
setne cl
cmp ecx, esi
jne 0x409b6f
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x14], edi
push esi
push 2
mov dword [esp + 0x154], esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
jne 0x409bc5
push 0x453f18
mov ecx, ebx
call fcn.00401710
lea eax, [edi - 0x10]
mov dword [esp + 0x14c], esi
lea ecx, [eax + 0xc]
or edx, esi
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x409c4b
mov ecx, dword [eax]
push eax
jmp 0x409c44
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x20], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x409c0f
lea esp, [esp]
mov edx, dword [esp + 0x20]
cmp edx, dword [ebp + 0x13e0]
je 0x409bfd
lea eax, [esp + 0x18]
push eax
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x409be0
jmp 0x409c0f
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x18]
call fcn.004016d0
mov edi, dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [edi - 0x10]
push esi
call fcn.00401410
add eax, 0x10
mov dword [ebx], eax
add esp, 4
mov dword [esp + 0x14c], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x409c4b
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov eax, ebx
mov ecx, dword [esp + 0x144]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x12c]
xor ecx, esp
call fcn.00437657
add esp, 0x13c
ret 4
Function at 0x40bcb0
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x44fdb8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x469b70]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov esi, ecx
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov edi, dword [esp + 0x3c]
xor eax, eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x20], eax
mov al, byte [esp + 0x44]
add edx, ecx
push edi
mov byte [esp + 0x18], al
mov dword [esp + 0x20], edx
call fcn.00416ade
mov ebx, eax
mov eax, dword [esp + 0x44]
push edi
push eax
push ebx
call fcn.00437ce0
lea ebp, [esi + 0x358]
add esp, 0x10
mov ecx, ebp
call fcn.00405d70
mov ecx, dword [esp + 0x14]
sub esp, 0x10
mov eax, esp
mov dword [eax], ecx
mov dword [eax + 4], ebx
mov ebx, dword [esp + 0x2c]
mov dword [eax + 8], ebx
lea ecx, [esi + 0x378]
mov dword [eax + 0xc], edi
call fcn.0040b5d0
call fcn.00417336
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40bd62
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x38], eax
mov ecx, dword [esp + 0x44]
push edi
push ebx
push ecx
lea edx, [esi + 0x118]
push edx
lea eax, [esp + 0x48]
push str._s_Inx:_d_Offset:_d_Len:_d_r_n
push eax
mov dword [esp + 0x44], 0
call fcn.00401ab0
mov edi, dword [esp + 0x50]
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov edx, dword [ebp]
mov eax, dword [edx + 0x14]
mov ecx, ebp
call eax
mov ecx, dword [esi + 0x350]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea eax, [edi - 0x10]
mov dword [esp + 0x2c], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40bde0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret 0x14
Function at 0x40c190
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x44fe40
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x469b70]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
call fcn.00417336
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40c1d3
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea ebp, [eax + 0x10]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x24], 0
call fcn.00417336
xor ecx, ecx
test eax, eax
setne cl
test ecx, ecx
jne 0x40c205
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
add eax, 0x10
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x14]
push ecx
mov ecx, esi
mov byte [esp + 0x28], 1
call fcn.0040be00
mov edi, dword [esp + 0x14]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
push edi
call ebx
test eax, eax
je 0x40c23d
push edi
call fcn.004205af
xor edi, edi
cmp dword [esi + 0x10], edi
jle 0x40c268
push edi
lea edx, [esp + 0x1c]
push edx
mov ecx, esi
call fcn.0040be30
mov ebp, dword [esp + 0x18]
push ebp
call ebx
test eax, eax
je 0x40c262
push ebp
call fcn.004205af
inc edi
cmp edi, dword [esi + 0x10]
jl 0x40c244
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x24], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c28d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
lea eax, [ebp - 0x10]
mov dword [esp + 0x24], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c2b1
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x40d410
Capabilities:
Create thread

Disassembly:
push esi
push 0
push 0
push 1
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0
push 0
push esi
push 0x40cd40
push 0
push 0
mov dword [esi + 0x254], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x258], eax
mov eax, 1
pop esi
ret

Function at 0x40df30
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40df97
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x40df73
cmp eax, 2
jne 0x40df86
mov eax, dword [esp + 0x14]
test esi, esi
je 0x40df93
test eax, eax
je 0x40df90
cmp byte [eax + esi - 1], 0
je 0x40df93
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc
Function at 0x40f150
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc4
mov eax, dword [0x469b70]
xor eax, esp
mov dword [esp + 0xc0], eax
push edi
mov edi, dword [esp + 0xcc]
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x18
push str.unknown_OperatingSystem.
mov ecx, edi
mov dword [esp + 0x30], 0x9c
call fcn.00401590
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40f2cd
mov eax, dword [esp + 0x2c]
sub eax, 4
je 0x40f336
mov ecx, 1
sub eax, ecx
je 0x40f269
sub eax, ecx
jne 0x40f2cd
mov eax, dword [esp + 0x30]
sub eax, 0
je 0x40f21e
sub eax, ecx
jne 0x40f2cd
cmp byte [esp + 0xc2], cl
mov ecx, edi
jne 0x40f1fe
push str.Microsoft_Windows_7
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
push str.Microsoft_Windows_Server_2008_R2
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
cmp byte [esp + 0xc2], cl
mov ecx, edi
jne 0x40f249
push str.Microsoft_Windows_Vista
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
push str.Microsoft_Windows_Server_2008
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
mov eax, dword [esp + 0x30]
sub eax, 0
je 0x40f314
sub eax, ecx
je 0x40f2f2
sub eax, ecx
jne 0x40f2cd
cmp byte [esp + 0xc2], cl
jne 0x40f2b1
cmp word [esp + 4], 9
jne 0x40f2b1
push str.Microsoft_Windows_XP_Professional_x64_Edition
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x40f2e3
push str.Microsoft_Windows_Server_2003
mov ecx, edi
call fcn.004016d0
pop esi
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
push 0x59
call esi
test eax, eax
je 0x40f2cc
push str.Microsoft_Windows_Server_2003_R2
jmp 0x40f2c5
push str.Microsoft_Windows_XP
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
push str.Microsoft_Windows_2000
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
mov eax, dword [esp + 0x30]
test eax, eax
je 0x40f38c
cmp eax, 0xa
je 0x40f36a
cmp eax, 0x5a
jne 0x40f2cd
push str.Microsoft_Windows_Me
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
push str.Microsoft_Windows_98
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
mov eax, dword [esp + 0x38]
cmp eax, 2
jne 0x40f3b7
push str.Microsoft_Windows_NT_4.0
mov ecx, edi
call fcn.004016d0
pop edi
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
cmp eax, 1
jne 0x40f2cd
push str.Microsoft_Windows_95
mov ecx, edi
call fcn.004016d0
mov ecx, dword [esp + 0xc4]
pop edi
xor ecx, esp
call fcn.00437657
add esp, 0xc4
ret
Function at 0x40fd70
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x4502e6
mov eax, dword fs:[0]
push eax
sub esp, 0xec
mov eax, dword [0x469b70]
xor eax, esp
mov dword [esp + 0xe8], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x469b70]
xor eax, esp
push eax
lea eax, [esp + 0x100]
mov dword fs:[0], eax
mov eax, dword [esp + 0x110]
mov ebp, dword [esp + 0x114]
xor ebx, ebx
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
call fcn.00417336
xor ecx, ecx
cmp eax, ebx
setne cl
cmp ecx, ebx
jne 0x40fddd
push 0x80004005
call fcn.00401150
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xc]
call eax
lea edi, [eax + 0x10]
mov dword [esp + 0x28], edi
lea ecx, [esp + 0x30]
push ecx
push ebp
mov dword [esp + 0x110], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jne 0x40fe43
mov esi, dword [esp + 0x18]
push str.None_VerSion_Supprot
mov ecx, esi
call fcn.00401710
lea eax, [edi - 0x10]
mov dword [esp + 0x108], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40fe3c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
jmp 0x40ff6f
push esi
call fcn.00416ade
add esp, 4
mov edi, eax
push edi
push esi
push ebx
push ebp
call sub.VERSION.dll_GetFileVersionInfoA
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push edx
push str.VarFileInfoTranslation
push edi
mov dword [esp + 0x24], ebx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [esp + 0x14]
shr eax, 2
xor esi, esi
test eax, eax
jle 0x40ff2a
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
jmp 0x40fe90
mov eax, dword [esp + 0x1c]
movzx ecx, word [eax + esi*4 + 2]
movzx edx, word [eax + esi*4]
push ecx
push edx
lea eax, [esp + 0x3c]
push str.StringFileInfo_04x_04xProductName
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x2c]
push ecx
lea edx, [esp + 0x28]
push edx
lea eax, [esp + 0x3c]
push eax
push edi
mov dword [esp + 0x34], ebx
mov dword [esp + 0x3c], ebx
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [esp + 0x24]
push ecx
lea ecx, [esp + 0x24]
call fcn.00401710
mov eax, dword [esp + 0x20]
mov ecx, dword [eax - 0xc]
push ecx
push eax
lea ecx, [esp + 0x30]
mov byte [esp + 0x110], 1
call fcn.00402bc0
mov eax, dword [esp + 0x20]
add eax, 0xfffffff0
mov byte [esp + 0x108], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40ff1a
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x14]
inc esi
shr ecx, 2
cmp esi, ecx
jl 0x40fe90
push edi
call fcn.00416ad3
mov esi, dword [esp + 0x2c]
add esi, 0xfffffff0
push esi
call fcn.00401410
mov edi, dword [esp + 0x20]
add eax, 0x10
mov dword [edi], eax
add esp, 8
mov dword [esp + 0x108], 0xffffffff
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x40ff6d
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov eax, edi
mov ecx, dword [esp + 0x100]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0xe8]
xor ecx, esp
call fcn.00437657
add esp, 0xf8
ret