joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001901e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003a058]
jne 0x10019028
repz ret
jmp fcn.1001d438

Function at 0x100191ca
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x100191f7
call fcn.1001b70f
mov dword [eax], esi
call fcn.1001b6fc
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.1001b684
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x100191d3
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10019226
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1001b722
pop ecx
call fcn.1001b6fc
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x1001924d
test al, 1
je 0x1001924d
test byte [esp + 0xc], 2
je 0x1001924d
call fcn.1001b70f
mov dword [eax], 5
call fcn.1001b6fc
mov dword [eax], 0xd
jmp 0x1001921d
xor eax, eax
pop esi
ret
Function at 0x1001efb5
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x1003a2f8]
je 0x1001efd0
inc edi
cmp edi, 0x17
jb 0x1001efc1
cmp edi, 0x17
jae 0x1001f150
push ebp
push 3
call fcn.1002751b
cmp eax, 1
pop ecx
je 0x1001f11c
push 3
call fcn.1002751b
test eax, eax
pop ecx
jne 0x1001f004
cmp dword [0x1003e3d0], 1
je 0x1001f11c
cmp ebx, 0xfc
je 0x1001f14f
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x1003e8a0
push ebp
call fcn.10019f27
add esp, 0xc
test eax, eax
je 0x1001f03a
push esi
push esi
push esi
push esi
push esi
call fcn.1001b550
add esp, 0x14
push 0x104
mov esi, 0x1003e8b9
push esi
push 0
mov byte [0x1003e9bd], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x1001f07e
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10019f27
add esp, 0xc
test eax, eax
je 0x1001f07e
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.1001b550
add esp, 0x14
push esi
call fcn.10019f90
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001f0c3
push esi
call fcn.10019f90
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1003ebb4
push 0x100361f4
sub ecx, eax
push ecx
push eax
call fcn.10027468
add esp, 0x14
test eax, eax
je 0x1001f0c3
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.1001b550
add esp, 0x14
jmp 0x1001f0c5
xor esi, esi
push 0x100361f0
push ebx
push ebp
call fcn.1001a41f
add esp, 0xc
test eax, eax
je 0x1001f0e5
push esi
push esi
push esi
push esi
push esi
call fcn.1001b550
add esp, 0x14
push dword [edi*8 + 0x1003a2fc]
push ebx
push ebp
call fcn.1001a41f
add esp, 0xc
test eax, eax
je 0x1001f107
push esi
push esi
push esi
push esi
push esi
call fcn.1001b550
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.100272ab
add esp, 0xc
jmp 0x1001f14f
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x1001f14f
cmp ebp, 0xffffffff
je 0x1001f14f
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x1003a2fc]
push dword [esi]
call fcn.10019f90
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x100272ab
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.10020cbb
xor ebx, ebx
cmp dword [0x1003ed50], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10027381
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10027461
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x10027461
push eax
call fcn.10020c4d
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003ed50], eax
call esi
push eax
call fcn.10020c4d
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003ed54], eax
call esi
push eax
call fcn.10020c4d
mov dword [0x1003ed58], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1001ec20
test eax, eax
pop ecx
pop ecx
je 0x1002734f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1001b550
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10027381
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10020c4d
cmp eax, ebx
pop ecx
mov dword [0x1003ed60], eax
je 0x10027381
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10020c4d
pop ecx
mov dword [0x1003ed5c], eax
mov eax, dword [0x1003ed5c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10027406
cmp dword [0x1003ed60], ecx
je 0x10027406
push eax
call fcn.10020cc4
push dword [0x1003ed60]
mov esi, eax
call fcn.10020cc4
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10027406
cmp edi, ebx
je 0x10027406
call esi
cmp eax, ebx
je 0x100273d3
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100273d3
test byte [ebp - 0x18], 1
jne 0x10027406
lea eax, [ebp - 0x10]
push eax
call fcn.1001eccf
test eax, eax
pop ecx
je 0x100273ee
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.1001b550
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x100273fd
or dword [ebp + 0x10], 0x200000
jmp 0x10027441
or dword [ebp + 0x10], 0x40000
jmp 0x10027441
mov eax, dword [0x1003ed54]
cmp eax, dword [ebp - 8]
je 0x10027441
push eax
call fcn.10020cc4
cmp eax, ebx
pop ecx
je 0x10027441
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10027441
mov eax, dword [0x1003ed58]
cmp eax, dword [ebp - 8]
je 0x10027441
push eax
call fcn.10020cc4
cmp eax, ebx
pop ecx
je 0x10027441
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003ed50]
call fcn.10020cc4
cmp eax, ebx
pop ecx
je 0x10027461
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10027463
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403c20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48af1c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x910
push edi
cmp dword [ebp + 8], 0
je 0x403ede
mov al, byte [0x4af244]
mov byte [ebp - 0x51c], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x51b]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x51c]
push ecx
call fcn.00403ef0
add esp, 4
lea ecx, [ebp - 0x414]
call fcn.00403ac0
mov dword [ebp - 4], 0
lea edx, [ebp - 0x414]
push edx
mov ecx, dword [ebp + 8]
call fcn.0047e77d
push 0x4a4240
push 0x4a423c
lea ecx, [ebp - 0x414]
call fcn.0047a8f1
push 0x4a4238
push 0x4a4234
lea ecx, [ebp - 0x414]
call fcn.0047a8f1
mov al, byte [0x4af244]
mov byte [ebp - 0x40c], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x51c]
push ecx
push 0x400
lea edx, [ebp - 0x40c]
push edx
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x40c]
test eax, eax
je 0x403d8a
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
lea ecx, [ebp - 0x40c]
push ecx
call fcn.00465060
add esp, 8
test eax, eax
je 0x403d8a
lea edx, [ebp - 0x40c]
push edx
lea ecx, [ebp - 0x414]
call fcn.0048114d
push 0x4a423c
push 0x4a4240
lea ecx, [ebp - 0x414]
call fcn.0047a8f1
push 0x4a4234
push 0x4a4238
lea ecx, [ebp - 0x414]
call fcn.0047a8f1
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
mov ecx, dword [ebp + 8]
call fcn.00480629
push 5
mov ecx, dword [ebp + 8]
call fcn.00405190
mov dword [ebp - 0x410], eax
cmp dword [ebp - 0x410], 0
je 0x403ecc
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp - 0x410]
call fcn.0047e77d
push 0x4a4240
push 0x4a423c
lea ecx, [ebp - 0x414]
call fcn.0047a8f1
push 0x4a4238
push 0x4a4234
lea ecx, [ebp - 0x414]
call fcn.0047a8f1
mov cl, byte [0x4af244]
mov byte [ebp - 0x91c], cl
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x91b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edx, [ebp - 0x51c]
push edx
push 0x400
lea eax, [ebp - 0x91c]
push eax
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx ecx, byte [ebp - 0x91c]
test ecx, ecx
je 0x403eb4
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
lea edx, [ebp - 0x91c]
push edx
call fcn.00465060
add esp, 8
test eax, eax
je 0x403eb4
lea eax, [ebp - 0x91c]
push eax
lea ecx, [ebp - 0x414]
call fcn.0048114d
push 0x4a423c
push 0x4a4240
lea ecx, [ebp - 0x414]
call fcn.0047a8f1
push 0x4a4234
push 0x4a4238
lea ecx, [ebp - 0x414]
call fcn.0047a8f1
lea ecx, [ebp - 0x414]
call fcn.0042e500
push eax
mov ecx, dword [ebp - 0x410]
call fcn.00480629
push 2
mov ecx, dword [ebp - 0x410]
call fcn.00405190
mov dword [ebp - 0x410], eax
jmp 0x403d9a
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x414]
call fcn.00480fc4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x403ef0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push 0x4af5f0
push 0x400
lea eax, [ebp - 0x400]
push eax
push 0x4a426c
push 0x4a4260
push 0x4a4258
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x400]
push ecx
push 0x4af4e8
push str._sLanguage_s.ini
mov edx, dword [ebp + 8]
push edx
call fcn.004650e4
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x403f80
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48af56
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1110
call fcn.00465440
push edi
mov dword [ebp - 0x111c], 0
mov al, byte [0x4af244]
mov byte [ebp - 0x1118], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x1117]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1118]
push ecx
call fcn.00403ef0
add esp, 4
lea ecx, [ebp - 0x1010]
call fcn.00403ac0
mov dword [ebp - 4], 1
mov edx, dword [ebp + 0xc]
push edx
lea ecx, [ebp - 0x1010]
call fcn.0048155c
push 0x4a4240
push 0x4a423c
lea ecx, [ebp - 0x1010]
call fcn.0047a8f1
push 0x4a4238
push 0x4a4234
lea ecx, [ebp - 0x1010]
call fcn.0047a8f1
lea eax, [ebp - 0x1118]
push eax
push 0x1000
lea ecx, [ebp - 0x100c]
push ecx
lea ecx, [ebp - 0x1010]
call fcn.0042e500
push eax
lea ecx, [ebp - 0x1010]
call fcn.0042e500
push eax
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx edx, byte [ebp - 0x100c]
test edx, edx
je 0x404074
lea eax, [ebp - 0x100c]
push eax
lea ecx, [ebp - 0x1010]
call fcn.0048114d
push 0x4a423c
push 0x4a4240
lea ecx, [ebp - 0x1010]
call fcn.0047a8f1
push 0x4a4234
push 0x4a4238
lea ecx, [ebp - 0x1010]
call fcn.0047a8f1
lea ecx, [ebp - 0x1010]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00480d39
mov edx, dword [ebp - 0x111c]
or edx, 1
mov dword [ebp - 0x111c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1010]
call fcn.00480fc4
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40ab20
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2110
call fcn.00465440
push edi
mov al, byte [0x4af244]
mov byte [ebp - 0x2110], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x210f]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x2110]
push ecx
call fcn.00403ef0
add esp, 4
mov dl, byte [0x4af244]
mov byte [ebp - 0x2008], dl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
push 0x1000
lea eax, [ebp - 0x2008]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040ae00
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
push 0x4a4240
push 0x4a423c
lea edx, [ebp - 0x2008]
push edx
call fcn.0040ac80
add esp, 0xc
push 0x4a4238
push 0x4a4234
lea eax, [ebp - 0x2008]
push eax
call fcn.0040ac80
add esp, 0xc
mov cl, byte [0x4af244]
mov byte [ebp - 0x1004], cl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1003]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x2110]
push edx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x2008]
push ecx
lea edx, [ebp - 0x2008]
push edx
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x1004]
test eax, eax
je 0x40ac28
lea ecx, [ebp - 0x1004]
push ecx
lea edx, [ebp - 0x2008]
push edx
call fcn.00465350
add esp, 8
push 0x4a423c
push 0x4a4240
lea eax, [ebp - 0x2008]
push eax
call fcn.0040ac80
add esp, 0xc
push 0x4a4234
push 0x4a4238
lea ecx, [ebp - 0x2008]
push ecx
call fcn.0040ac80
add esp, 0xc
lea edx, [ebp - 0x2008]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00465350
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40c270
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2110
call fcn.00465440
push edi
mov al, byte [0x4af244]
mov byte [ebp - 0x2110], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x210f]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x2110]
push ecx
call fcn.00403ef0
add esp, 4
mov dl, byte [0x4af244]
mov byte [ebp - 0x2008], dl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x2008]
push ecx
call fcn.00465350
add esp, 8
push 0x4a4240
push 0x4a423c
lea edx, [ebp - 0x2008]
push edx
call fcn.0040ac80
add esp, 0xc
push 0x4a4238
push 0x4a4234
lea eax, [ebp - 0x2008]
push eax
call fcn.0040ac80
add esp, 0xc
mov cl, byte [0x4af244]
mov byte [ebp - 0x1004], cl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1003]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x2110]
push edx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x2008]
push ecx
lea edx, [ebp - 0x2008]
push edx
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x1004]
test eax, eax
je 0x40c36f
lea ecx, [ebp - 0x1004]
push ecx
lea edx, [ebp - 0x2008]
push edx
call fcn.00465350
add esp, 8
push 0x4a423c
push 0x4a4240
lea eax, [ebp - 0x2008]
push eax
call fcn.0040ac80
add esp, 0xc
push 0x4a4234
push 0x4a4238
lea ecx, [ebp - 0x2008]
push ecx
call fcn.0040ac80
add esp, 0xc
lea edx, [ebp - 0x2008]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.00465350
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40c9a6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x10]
push ecx
push 1
push 0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ca66
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ca5c
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00481528
add esp, 4
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 0x14]
mov dword [ebp - 4], edx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ca4a
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0x14]
push eax
call fcn.004659b0
add esp, 0xc
mov ecx, dword [ebp + 0x14]
add ecx, dword [ebp - 0xc]
mov byte [ecx], 0
mov dword [ebp - 8], 1
mov edx, dword [ebp - 4]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.00481551
add esp, 4
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x410807
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov byte [ebp - 0x104], 0
push str.Global_
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.004117a0
mov ecx, dword [eax + 0x78]
push ecx
lea edx, [ebp - 0x104]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str._is_running
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [ebp - 0x104]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [0x4af6f8], eax
cmp dword [0x4af6f8], 0
je 0x410894
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x410894
mov edx, dword [0x4af6f8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x4af6f8], 0
xor eax, eax
cmp dword [0x4af6f8], 0
sete al
mov esp, ebp
pop ebp
ret
Function at 0x410b95
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1510
call fcn.00465440
push edi
mov dword [ebp - 0x1510], ecx
mov al, byte [0x4af700]
mov byte [ebp - 0x1108], al
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1107]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x1108]
push ecx
push 0x8048
call fcn.0040ab20
add esp, 8
push 0x4af5f0
lea edx, [ebp - 0x1108]
push edx
push 0x4a53d8
push 0x4a53dc
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x4af4e8
lea eax, [ebp - 0x104]
push eax
call fcn.00465350
add esp, 8
push 4
lea ecx, [ebp - 0x110c]
push ecx
push 3
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push 0x4a53e4
lea edx, [ebp - 0x150c]
push edx
call fcn.004650e4
add esp, 8
push 0x4a53ec
lea eax, [ebp - 0x110c]
push eax
call fcn.0046b9a0
add esp, 8
test eax, eax
jne 0x410c5d
push 0x4a53f0
lea ecx, [ebp - 0x150c]
push ecx
call fcn.004650e4
add esp, 8
push 0x4a53fc
lea edx, [ebp - 0x110c]
push edx
call fcn.0046b9a0
add esp, 8
test eax, eax
jne 0x410c89
push str.ChineseBig5
lea eax, [ebp - 0x150c]
push eax
call fcn.004650e4
add esp, 8
push 0x4af5f0
lea ecx, [ebp - 0x150c]
push ecx
push 0x4a540c
push 0x4a5418
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x411930
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2114
call fcn.00465440
push edi
mov dword [ebp - 0x2114], 0
mov al, byte [0x4af244]
mov byte [ebp - 0x2110], al
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x210f]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x2110]
push ecx
call fcn.00403ef0
add esp, 4
mov dl, byte [0x4af244]
mov byte [ebp - 0x2008], dl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x2007]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x2008]
push ecx
call fcn.00465350
add esp, 8
push 0x4a4240
push 0x4a423c
lea edx, [ebp - 0x2008]
push edx
call fcn.0040ac80
add esp, 0xc
push 0x4a4238
push 0x4a4234
lea eax, [ebp - 0x2008]
push eax
call fcn.0040ac80
add esp, 0xc
mov cl, byte [0x4af244]
mov byte [ebp - 0x1004], cl
mov ecx, 0x400
xor eax, eax
lea edi, [ebp - 0x1003]
rep stosd dword es:[edi], eax
lea edx, [ebp - 0x2110]
push edx
push 0x1000
lea eax, [ebp - 0x1004]
push eax
lea ecx, [ebp - 0x2008]
push ecx
lea edx, [ebp - 0x2008]
push edx
push str.String
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
movsx eax, byte [ebp - 0x1004]
test eax, eax
je 0x411a39
lea ecx, [ebp - 0x1004]
push ecx
lea edx, [ebp - 0x2008]
push edx
call fcn.00465350
add esp, 8
push 0x4a423c
push 0x4a4240
lea eax, [ebp - 0x2008]
push eax
call fcn.0040ac80
add esp, 0xc
push 0x4a4234
push 0x4a4238
lea ecx, [ebp - 0x2008]
push ecx
call fcn.0040ac80
add esp, 0xc
lea edx, [ebp - 0x2008]
push edx
mov ecx, dword [ebp + 8]
call fcn.00481032
mov eax, dword [ebp - 0x2114]
or al, 1
mov dword [ebp - 0x2114], eax
mov eax, dword [ebp + 8]
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x414349
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb4
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x84], 2
jne 0x4143f0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 0xb0], eax
lea ecx, [ebp - 0xb4]
push ecx
push 0x20
mov edx, dword [ebp - 0xb0]
push edx
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0xa4], 1
lea eax, [ebp - 0xac]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [ebp - 0xac]
mov dword [ebp - 0xa0], ecx
mov edx, dword [ebp - 0xa8]
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], 2
push 0
push 0
push 0
lea eax, [ebp - 0xa4]
push eax
push 0
mov ecx, dword [ebp - 0xb4]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 0xc
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esp, ebp
pop ebp
ret
Function at 0x414696
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
lea eax, [ebp - 0x208]
push eax
push 0x4a5648
push accept
call fcn.004147a1
add esp, 0xc
test eax, eax
jne 0x41479d
push 0x4a5650
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x208]
push edx
lea eax, [ebp - 0x208]
push eax
push accept
call fcn.004147a1
add esp, 0xc
test eax, eax
jne 0x41479d
push 0x4a5664
lea ecx, [ebp - 0x208]
push ecx
call fcn.00415b80
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x414762
push 0x4a566c
lea edx, [ebp - 0x208]
push edx
call fcn.004652d0
add esp, 8
mov dword [ebp - 0x20c], eax
cmp dword [ebp - 0x20c], 0
jne 0x414757
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [ebp + eax - 0x209]
mov dword [ebp - 0x20c], ecx
jmp 0x414760
mov edx, dword [ebp - 0x20c]
mov byte [edx], 0
jmp 0x41476b
mov eax, dword [ebp - 0x20c]
mov byte [eax], 0
push 0x4a5670
mov ecx, dword [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret

Function at 0x4147a1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
lea eax, [ebp - 8]
push eax
push 1
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x414808
mov dword [ebp - 0x110], 0x104
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x10c]
push ecx
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
lea eax, [ebp - 0x10c]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x4150fe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48c0ed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x41c
push edi
mov dword [ebp - 0x418], ecx
cmp dword [0x4a54e8], 0
je 0x415217
mov al, byte [0x4af78c]
mov byte [ebp - 0x40c], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x40b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x400
lea ecx, [ebp - 0x40c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
lea edx, [ebp - 0x40c]
push edx
call fcn.00466be0
add esp, 8
mov byte [eax], 0
push str.Update.exe
lea eax, [ebp - 0x40c]
push eax
call fcn.00465360
add esp, 8
push 5
push str.__LocalVersion6.5
lea ecx, [ebp - 0x40c]
push ecx
lea ecx, [ebp - 0x410]
call fcn.00481032
mov dword [ebp - 0x41c], eax
mov edx, dword [ebp - 0x41c]
mov dword [ebp - 0x420], edx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x420]
push eax
lea ecx, [ebp - 0x414]
push ecx
call fcn.00481259
mov dword [ebp - 0x424], eax
mov edx, dword [ebp - 0x424]
mov dword [ebp - 0x428], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x428]
call fcn.0042e500
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x414]
call fcn.00480fc4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x410]
call fcn.00480fc4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret