joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdb2e64
Capabilities:
Encode data using xor

Disassembly:
jmp 0xdb2e6e
pushal
call 0xdb2e74
pop ebp
sub ebp, 0x10
sub ebp, 0x9b2e64
jmp 0xdb2e8a
mov eax, 0x9b2e64
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c3
mov edx, 0x5c3dac05
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb2ea1
jmp 0xdb2eb4
mov ecx, ebp
mov ecx, dword [ecx + 0x3c]
add ecx, 0xf8
add ecx, ebp
mov eax, 4
mov edx, 0x28
mul edx
add ecx, eax
mov eax, dword [ecx + 0xc]
add eax, ebp
push eax
push eax
push 0x208be8
push 0x7aa27c
add dword [esp], ebp
push 0xb123fcf0
call fcn.00db2ef8
jmp 0xdb2f22
mov ecx, dword [esp + 4]
push 0x208be8
push 0x7aa27c
add dword [esp], ebp
lea esp, [esp - 4]
mov dword [esp], ecx
call fcn.00db2f47
jmp 0xdb319e
pop edi
mov esi, dword [esp]
lea esp, [esp + 4]
jmp 0xdb31af
mov eax, 0x9b2e64
add eax, ebp
add eax, 0x371
mov ecx, 0x29e
mov edx, 0xc1ca9f32
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb31c6
jmp 0xdb31d9
xchg esi, edi
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0xa0]
add edi, esi
mov ebx, esi
xchg esi, eax
mov esi, dword [eax + 0x3c]
xchg esi, eax
mov eax, dword [eax + esi + 0x34]
sub ebx, eax
xchg edx, edi
mov edi, dword [edx]
xchg edx, edi
xchg ecx, edi
mov edi, dword [ecx + 4]
xchg ecx, edi
cmp edx, 0
je 0xdb3257
add edx, esi
add edi, 8
sub ecx, 8
cmp ecx, 0
je 0xdb31f7
mov ax, word [edi]
shr eax, 0xc
and eax, 0xf
cmp eax, 3
jne 0xdb324d
mov ax, word [edi]
and eax, 0xfff
add eax, edx
add dword [eax], ebx
dec ecx
dec ecx
add edi, 2
jmp 0xdb321f
jmp 0xdb3260
mov eax, 0x9b2e64
add eax, ebp
add eax, 0x422
mov ecx, 0x1ed
mov edx, 0xf351afa3
xor byte [eax], dl
inc eax
dec ecx
jne 0xdb3277
jmp 0xdb328a
mov edi, dword [esi + 0x3c]
mov edi, dword [edi + esi + 0x80]
add edi, esi
cmp dword [edi + 0xc], 0
je 0xdb3353
mov eax, dword [edi + 0xc]
add eax, esi
push eax
call dword [ebp + 0x7a9e94]
cmp eax, 0
jne 0xdb32c6
xchg edi, eax
mov edi, dword [eax + 0xc]
xchg edi, eax
add eax, esi
push eax
call dword [ebp + 0x7a9ea0]
cmp dword [edi + 0xc], 0
je 0xdb3353
cmp dword [edi], 0
jne 0xdb32e4
cmp dword [edi + 0x10], 0
je 0xdb3341
lea esp, [esp - 4]
mov dword [esp], ebp
mov edx, ebp
mov ebp, dword [edi + 0x10]
add ebp, esi
cmp dword [ebp], 0
je 0xdb3341
mov ecx, dword [ebp]
lea esp, [esp - 4]
mov dword [esp], eax
push edx
or ecx, ecx
jns 0xdb3315
push ecx
jmp 0xdb331e
add ecx, esi
add ecx, 2
push ecx
lea esp, [esp - 4]
mov dword [esp], eax
call dword [edx + 0x7a9e98]
pop edx
mov dword [ebp], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add ebp, 4
jmp 0xdb32f2
mov ebp, dword [esp]
lea esp, [esp + 4]
add edi, 0x14
jmp 0xdb3296
push esp
push dword fs:[0]
push 0x9b3474
lea esp, [esp - 4]
mov dword [esp], ebp
push esi
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x28]
add eax, esi
jmp eax

Function at 0xdb2ef8
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
shr ecx, 2
xor dword [edx], eax
add edx, 4
dec ecx
jne 0xdb2f12
pop ebp
ret 0xc
Function at 0xdb2fdf
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebp
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
cld
mov dl, 0x80
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0xdb3010
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdb2fee
add dl, dl
jne 0xdb3023
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdb3093
xor eax, eax
add dl, dl
jne 0xdb3038
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xdb3168
add dl, dl
jne 0xdb304b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdb305a
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdb3069
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdb3078
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xdb3086
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xdb3003
mov eax, 1
add dl, dl
jne 0xdb30a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xdb30b4
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdb3098
sub eax, ebx
mov ebx, 1
jne 0xdb30fb
mov ecx, 1
add dl, dl
jne 0xdb30d9
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdb30e8
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdb30cc
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdb3003
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xdb3116
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xdb3125
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xdb3109
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xdb3003
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xdb3190
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xdb3003
pop ebp
sub edi, dword [ebp + 8]
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403d6f
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.KERNEL32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret
Function at 0x402170
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0xc]
push ebx
xor ebx, ebx
push eax
push 0x20019
push ebx
push str.SoftwarePythonPythonCore
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4021a2
xor eax, eax
jmp 0x4022cf
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x64]
mov dword [ebp - 8], 0x50
push eax
push ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x4022c3
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp + 0x10]
inc dword [ebp - 4]
cmp eax, ebx
mov dword [ebp - 8], 0x50
je 0x4021f8
cmp byte [eax], bl
je 0x4021f8
lea ecx, [ebp - 0x64]
push ecx
push eax
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x4022a1
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x104]
push str.Python_Version__s__found_in_registry_
push eax
call esi
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0xb4]
push str.SoftwarePythonPythonCore_sInstallPath
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
push 0x20019
lea eax, [ebp - 0xb4]
push ebx
push eax
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4022a1
push 0x10c
call dword [sym.imp.MSVCR71.dll_malloc]
mov esi, eax
pop ecx
cmp esi, ebx
mov dword [ebp - 0x14], 0x105
je 0x402298
lea eax, [ebp - 0x14]
push eax
push esi
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402298
lea eax, [ebp - 0x104]
push eax
push ebx
push 0x180
push dword [ebp + 8]
call edi
mov ecx, dword [ebp + 0xc]
push esi
push eax
push 0x19a
push dword [ebp + 8]
mov dword [esi + 0x108], ecx
call edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push ebx
push eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 4]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x4021cf
pop edi
pop esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
pop ebx
leave
ret
Function at 0x4025f7
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.PySys_GetObject
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_OptimizeFlag
push edi
mov dword [ebp - 0xc], eax
call esi
xor esi, esi
cmp dword [0x40d44c], esi
jne 0x402655
xor eax, eax
jmp 0x40269f
cmp ebx, esi
je 0x40269c
cmp dword [ebp + 8], esi
je 0x40269c
cmp dword [ebp - 8], esi
je 0x40269c
cmp dword [ebp - 4], esi
je 0x40269c
cmp dword [ebp - 0xc], esi
je 0x40269c
cmp eax, esi
je 0x40269c
xor ecx, ecx
cmp dword [ebp + 0xc], esi
push 0x40d480
setne cl
mov dword [eax], ecx
call dword [ebp + 8]
call ebx
push dword [ebp + 0xc]
push dword [ebp - 4]
call fcn.004026a4
add esp, 0xc
mov esi, eax
call dword [ebp - 8]
mov eax, esi
jmp 0x40269f
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4027a9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
push 0x40e940
lea eax, [ebp - 0x268]
push str.PYTHONHOME_s
push eax
mov dword [ebp - 4], 0x104
call esi
lea eax, [ebp - 0x268]
push eax
call dword [sym.imp.MSVCR71.dll__putenv]
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x10
push dword [ebp + 8]
call edi
test eax, eax
jne 0x40287b
push dword [0x40e8b0]
lea eax, [ebp - 0x54]
push dword [0x40ea44]
push str.SOFTWAREPythonPythonCore_d._dInstallPath
push eax
call esi
add esp, 0x10
lea eax, [ebp - 4]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000001
call esi
test eax, eax
je 0x40284f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x54]
push eax
push 0x80000002
call esi
test eax, eax
je 0x40284f
xor eax, eax
jmp 0x40287b
lea eax, [ebp - 0x158]
push 0x40c5c8
push eax
call sub.MSVCR71.dll_strcat
push dword [ebp + 8]
lea eax, [ebp - 0x158]
push eax
call sub.MSVCR71.dll_strcat
add esp, 0x10
lea eax, [ebp - 0x158]
push eax
call edi
pop edi
pop esi
leave
ret
Function at 0x40287f
Capabilities:
Delete file
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push ebx
call dword [sym.imp.MSVCR71.dll__tempnam]
mov ecx, dword [sym.imp.MSVCR71.dll__iob]
mov esi, dword [sym.imp.MSVCR71.dll_freopen]
add ecx, 0x40
mov edi, 0x40c9d4
push ecx
push edi
push eax
mov dword [ebp - 4], eax
call esi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
push edi
push dword [ebp - 4]
call esi
push 0x40e740
call fcn.004027a9
mov esi, eax
add esp, 0x24
cmp esi, ebx
jne 0x402903
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x8c]
push str.Cant_load_Python_for_pre_install_script___d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x8c]
push eax
call fcn.004025ce
add esp, 0x10
or eax, 0xffffffff
jmp 0x402a05
push dword [ebp + 8]
push esi
call fcn.00402a0a
pop ecx
mov dword [ebp - 0xc], eax
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [sym.imp.MSVCR71.dll__iob]
mov edi, dword [sym.imp.MSVCR71.dll_fflush]
add eax, 0x40
push eax
call edi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
mov esi, dword [sym.imp.MSVCR71.dll_fclose]
add eax, 0x40
push eax
call esi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
call edi
mov eax, dword [sym.imp.MSVCR71.dll__iob]
add eax, 0x20
push eax
call esi
add esp, 0x10
cmp dword [ebp - 0xc], ebx
je 0x4029f8
push str.Running_the_pre_installation_script_failed_r_n
call sub.MSVCR71.dll_strlen
mov dword [esp], 0x40c970
push dword [ebp - 4]
mov edi, eax
call dword [sym.imp.MSVCR71.dll_fopen]
push 2
push ebx
mov ebx, dword [sym.imp.MSVCR71.dll_fseek]
push eax
mov dword [ebp + 8], eax
call ebx
push dword [ebp + 8]
call dword [sym.imp.MSVCR71.dll_ftell]
push 0
push 0
push dword [ebp + 8]
mov dword [ebp - 8], eax
call ebx
mov eax, dword [ebp - 8]
lea eax, [eax + edi + 1]
push eax
call dword [sym.imp.MSVCR71.dll_malloc]
mov ebx, eax
add esp, 0x28
test ebx, ebx
je 0x4029ed
push str.Running_the_pre_installation_script_failed_r_n
push ebx
call sub.MSVCR71.dll_strcpy
push dword [ebp + 8]
lea eax, [ebx + edi]
push dword [ebp - 8]
push 1
push eax
call dword [sym.imp.MSVCR71.dll_fread]
push dword [ebp + 8]
add eax, ebx
and byte [eax + edi], 0
call esi
push ebx
call fcn.004025ce
push ebx
call dword [sym.imp.MSVCR71.dll_free]
add esp, 0x24
jmp 0x4029f8
push str.Out_of_memory_
call fcn.004025ce
pop ecx
push dword [ebp - 4]
call dword [sym.imp.MSVCR71.dll_remove]
mov eax, dword [ebp - 0xc]
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402a0a
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.Py_SetProgramName
push edi
mov ebx, eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 8], eax
call esi
push str.PyErr_Print
push edi
mov dword [ebp - 4], eax
call esi
mov esi, eax
xor eax, eax
cmp ebx, eax
je 0x402a91
cmp dword [ebp + 8], eax
je 0x402a91
cmp dword [ebp - 8], eax
je 0x402a91
cmp dword [ebp - 4], eax
je 0x402a91
cmp esi, eax
je 0x402a91
push 0x40d480
call dword [ebp + 8]
call ebx
push edi
call fcn.00402a99
push dword [ebp + 0xc]
call dword [ebp - 4]
mov edi, eax
add esp, 0xc
test edi, edi
je 0x402a8a
call esi
call dword [ebp - 8]
mov eax, edi
jmp 0x402a94
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402a99
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.PyImport_ImportModule
push edi
call esi
push str.PyObject_SetAttrString
push edi
mov ebx, eax
call esi
push str.PyObject_GetAttrString
push edi
mov dword [ebp - 8], eax
call esi
push str.PyCFunction_New
push edi
mov dword [ebp + 8], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 4], eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x10], eax
call esi
push str.PyLong_FromVoidPtr
push edi
mov dword [ebp - 0x14], eax
call esi
xor esi, esi
mov dword [ebp - 0x18], eax
cmp ebx, esi
je 0x402ba7
cmp dword [ebp + 8], esi
je 0x402ba7
cmp dword [ebp - 8], esi
je 0x402ba7
cmp dword [ebp - 4], esi
je 0x402ba7
cmp dword [ebp - 0xc], esi
je 0x402ba7
cmp dword [ebp - 0x10], esi
je 0x402ba7
cmp dword [ebp - 0x14], esi
je 0x402ba7
push str.__builtin__
call ebx
mov edi, eax
pop ecx
cmp edi, esi
je 0x402b83
push str.ValueError
push edi
call dword [ebp + 8]
push str.OSError
push edi
mov dword [0x40e8b4], eax
call dword [ebp + 8]
add esp, 0x10
mov dword [0x40ea4c], eax
mov esi, 0x40c0c8
push 0
push esi
call dword [ebp - 4]
push eax
push dword [esi]
push edi
call dword [ebp - 8]
add esi, 0x10
add esp, 0x14
cmp esi, 0x40c128
jb 0x402b68
mov eax, dword [ebp - 0xc]
mov dword [0x40e928], eax
mov eax, dword [ebp - 0x10]
mov dword [0x40e92c], eax
mov eax, dword [ebp - 0x14]
mov dword [0x40e724], eax
mov eax, dword [ebp - 0x18]
mov dword [0x40ea70], eax
xor eax, eax
jmp 0x402baa
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4031f4
Capabilities:
Link many functions at runtime
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push edi
mov edi, dword [ebp + 8]
push str.Py_Initialize
push edi
call esi
push str.PySys_SetArgv
push edi
mov dword [ebp + 8], eax
call esi
push str.PyRun_SimpleString
push edi
mov dword [ebp - 4], eax
call esi
push str.Py_Finalize
push edi
mov dword [ebp - 8], eax
call esi
push str.Py_BuildValue
push edi
mov dword [ebp - 0xc], eax
call esi
push str.PyCFunction_New
push edi
mov ebx, eax
call esi
push str.PyArg_ParseTuple
push edi
mov dword [ebp - 0x14], eax
call esi
push str.PyErr_Format
push edi
mov dword [ebp - 0x10], eax
call esi
xor ecx, ecx
cmp dword [ebp + 8], ecx
je 0x40336b
cmp dword [ebp - 4], ecx
je 0x40336b
cmp dword [ebp - 8], ecx
je 0x40336b
cmp dword [ebp - 0xc], ecx
je 0x40336b
cmp ebx, ecx
je 0x40336b
cmp dword [ebp - 0x10], ecx
je 0x40336b
cmp eax, ecx
je 0x40336b
cmp dword [ebp - 0x14], ecx
je 0x40336b
mov esi, dword [ebp + 0xc]
cmp esi, ecx
je 0x403367
cmp byte [esi], cl
je 0x403367
push ecx
push esi
call dword [sym.imp.MSVCR71.dll__open]
mov ebx, eax
pop ecx
cmp ebx, 0xffffffff
pop ecx
jne 0x4032e5
mov eax, dword [sym.imp.MSVCR71.dll__iob]
push esi
add eax, 0x40
push str.Could_not_open_postinstall_script__s_n
push eax
call dword [sym.imp.MSVCR71.dll_fprintf]
add esp, 0xc
push 3
jmp 0x40336d
push str.Running_Script...
push 0x3ec
push dword [0x40e930]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
call dword [ebp + 8]
push edi
call fcn.00402a99
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [ebp - 4]
push 3
lea eax, [ebp - 0x38]
pop esi
push eax
push ebx
mov dword [ebp + 8], esi
call dword [sym.imp.MSVCR71.dll__fstat]
add esp, 0x14
test eax, eax
jne 0x403357
mov edi, dword [ebp - 0x24]
lea eax, [edi + 5]
add eax, esi
and al, 0xfc
call fcn.00406cb0
mov esi, esp
push edi
push esi
push ebx
call dword [sym.imp.MSVCR71.dll__read]
add esp, 0xc
test eax, eax
jle 0x403357
add eax, esi
push esi
mov byte [eax], 0xa
and byte [eax + 1], 0
call dword [ebp - 8]
pop ecx
mov dword [ebp + 8], eax
call dword [ebp - 0xc]
push ebx
call dword [sym.imp.MSVCR71.dll__close]
mov eax, dword [ebp + 8]
pop ecx
jmp 0x40336e
push 2
jmp 0x40336d
push 1
pop eax
lea esp, [ebp - 0x44]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403590
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
push 1
push 0
push 0x40d454
push 0x40d480
push str.runas
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x4035df
push eax
lea eax, [ebp - 0x80]
push str.Failed_to_start_elevated_process__ShellExecute_returned__d_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x80]
push 0x10
push str.Setup
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
leave
ret
Function at 0x4035e1
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1000
call fcn.00406cb0
push ebx
push ebp
push esi
push edi
push dword [0x40ea48]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
lea eax, [esp + 0x14]
push ebp
mov ebx, 0x40d454
push eax
push ebx
mov esi, str.Setup
push str.title
push esi
call edi
lea eax, [esp + 0x10]
push 0x50
push eax
push 0x40d5a0
call fcn.004037d6
add esp, 0xc
lea eax, [esp + 0x10]
push dword [0x40ea48]
push ebp
push eax
push ebx
push str.info
push esi
call edi
lea eax, [esp + 0x10]
push ebp
push eax
push 0x40d720
call fcn.004037d6
add esp, 0xc
push dword [0x40ea48]
push 0x50
push 0x40e8c0
push ebx
push str.build_info
push esi
call edi
push dword [0x40ea48]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x40ea48]
mov dword [0x40d468], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x40ea48]
mov dword [0x40e8b8], eax
push 0xa
push 0x40e910
push ebx
push str.target_version
push esi
call edi
push dword [0x40ea48]
push 0x50
push 0x40e860
push ebx
push str.name
push str.metadata
call edi
push dword [0x40ea48]
push 0x104
push 0x40d600
push ebx
push str.install_script
push esi
call edi
push dword [0x40ea48]
push 0xa
mov ebp, 0x40ea60
push ebp
push ebx
push str.user_access_control
push esi
call edi
push str.force
push ebp
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403720
call fcn.00403552
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
jmp 0x40374c
push str.auto
push ebp
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403753
call fcn.00403552
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
call fcn.004034fc
test eax, eax
je 0x403786
call fcn.00403590
jmp 0x4037c9
cmp byte [0x40ea60], 0
je 0x403786
push str.none
push ebp
call sub.MSVCR71.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x403786
push 0
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40d5a0
call fcn.0040385b
push eax
mov dword [0x40e920], eax
call fcn.004033de
pop ecx
pop ecx
push dword [0x40d584]
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [0x40ea48]
test eax, eax
je 0x4037b9
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [0x40ea6c]
test eax, eax
je 0x4037c9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1000
ret
Function at 0x403938
Capabilities:
Create process on windows
Resume thread
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
lea eax, [ebp - 0x15c]
push 0x104
xor ebx, ebx
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push str._s.bat
push eax
call dword [sym.imp.MSVCR71.dll_sprintf]
lea eax, [ebp - 0x260]
push 0x40cfd4
push eax
call dword [sym.imp.MSVCR71.dll_fopen]
mov esi, dword [sym.imp.MSVCR71.dll_fprintf]
push str.:Repeat_n
push eax
mov dword [ebp - 4], eax
call esi
lea eax, [ebp - 0x15c]
mov edi, str.del___s__n
push eax
push edi
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x15c]
push eax
push str.if_exist___s__goto_Repeat_n
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x260]
push eax
push edi
push dword [ebp - 4]
call esi
add esp, 0x40
push dword [ebp - 4]
call dword [sym.imp.MSVCR71.dll_fclose]
push 0x44
lea eax, [ebp - 0x58]
pop esi
push esi
push ebx
push eax
call sub.MSVCR71.dll_memset
add esp, 0x10
lea eax, [ebp - 0x14]
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x2c], 1
push eax
lea eax, [ebp - 0x58]
push eax
push 0x40c5c8
push ebx
push esi
push ebx
push ebx
lea eax, [ebp - 0x260]
push ebx
push eax
push ebx
mov word [ebp - 0x28], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x403a57
mov esi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0xfffffffffffffff1
push dword [ebp - 0x10]
call esi
push 0xf
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push 0x80
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_SetPriorityClass]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push dword [ebp - 0x10]
call esi
pop edi
pop esi
pop ebx
leave
ret