joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404069
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x20]
push 0x1c
push eax
push dword [0x421b50]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40414a
cmp dword [ebp - 4], 0x1c
jne 0x40414a
lea eax, [ebp - 0x20]
push eax
call fcn.0040402f
test eax, eax
je 0x40414a
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, 0x40b3bc
mov esi, eax
push ebx
call section..text
test eax, eax
jl 0x40414a
cmp dword [0x4173f8], edi
je 0x4040e4
push ebx
call fcn.00401474
push ebx
call section..text
test eax, eax
jl 0x40414a
xor ebx, ebx
lea eax, [ebp - 0x124]
inc ebx
push eax
push 0x104
mov dword [0x4173f8], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x228]
push eax
push edi
lea eax, [ebp - 0x124]
push 0x4094e4
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
push 0x4000100
push 2
push edi
push edi
lea eax, [ebp - 0x228]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x4094a4], eax
jne 0x404152
push edi
push str.Error_writing_temp_file
call fcn.00406caa
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
push ebx
push edi
push edi
push dword [0x421b50]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [ebp - 0x20]
push dword [ebp - 0xc]
and ecx, ebx
mov dword [0x4173f0], eax
shl ecx, 2
sub eax, ecx
mov ecx, dword [ebp - 8]
push esi
push 0xffffffffffffffff
lea eax, [eax + ecx - 0x1c]
mov dword [0x4173ec], eax
call fcn.0040453d
cmp eax, dword [ebp - 0xc]
je 0x4041a0
push edi
push str.Error_reading_installer_info_block
call fcn.00406caa
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x40414a
mov eax, dword [0x4173e8]
mov dword [0x4212fc], esi
test byte [ebp - 0x20], 2
mov dword [0x4173f4], eax
je 0x4041c1
inc dword [0x421308]
lea eax, [esi + 0x4c]
jmp 0x4041d8
lea eax, [esi + 0x98]
mov dword [0x42131c], eax
mov ecx, dword [esi + 0x84]
lea ecx, [ecx + ecx*2]
lea eax, [eax + ecx*8]
mov dword [0x4212f8], eax
mov esi, dword [esi + 0xc]
lea ecx, [esi + esi*2]
lea eax, [eax + ecx*8]
mov dword [0x40b3b8], eax
xor eax, eax
jmp 0x40414d
Function at 0x404220
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
jl 0x40424d
mov ecx, dword [0x4173f4]
push ebx
add eax, ecx
push ebx
push eax
mov dword [0x4173e8], eax
push dword [0x4094a4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00404343
cmp eax, ebx
jl 0x40433c
lea eax, [ebp - 4]
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
push eax
lea eax, [ebp + 8]
push esi
push eax
push dword [0x4094a4]
call edi
test eax, eax
je 0x404339
cmp dword [ebp - 4], esi
jne 0x404339
push dword [ebp + 8]
add dword [0x4173e8], esi
call fcn.00404343
cmp eax, ebx
mov dword [ebp - 8], eax
jl 0x40433c
cmp dword [ebp + 0x10], ebx
jne 0x404308
cmp dword [ebp + 8], ebx
jle 0x404334
mov esi, 0x4133e8
mov eax, 0x4000
cmp dword [ebp + 8], eax
jge 0x4042c0
mov eax, dword [ebp + 8]
lea ecx, [ebp - 4]
push ebx
push ecx
push eax
push esi
push dword [0x4094a4]
call edi
test eax, eax
je 0x404339
lea eax, [ebp + 0x14]
push ebx
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404304
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x14]
jne 0x404304
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4173e8], eax
cmp dword [ebp + 8], ebx
jg 0x4042b3
jmp 0x404334
push 0xfffffffffffffffe
jmp 0x40433b
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x404313
mov eax, dword [ebp + 0x14]
lea ecx, [ebp - 4]
push ebx
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x4094a4]
call edi
test eax, eax
je 0x404339
mov eax, dword [ebp - 4]
add dword [0x4173e8], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x40433c
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x404343
Capabilities:
Check for time delay via gettickcount
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov dword [esp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, dword [0x4173e8]
add eax, 0x1f4
sub esi, dword [0x40b3b4]
mov dword [esp + 0x18], eax
add esi, dword [esp + 0x24]
cmp esi, ebx
jle 0x404531
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push dword [0x4173f0]
push dword [0x421b50]
call edi
push ebx
push ebx
push dword [0x40b3b4]
push dword [0x4094a4]
call edi
mov ebp, dword [sym.imp.USER32.dll_PeekMessageA]
mov dword [0x421b4c], esi
mov dword [0x421b40], ebx
mov edi, 0x40b398
mov eax, dword [0x4173ec]
mov ecx, 0x4000
sub eax, dword [0x4173f0]
cmp eax, ecx
jle 0x4043ca
mov eax, ecx
lea ecx, [esp + 0x14]
push ebx
push ecx
mov esi, 0x4133e8
push eax
push esi
push dword [0x421b50]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404513
mov eax, dword [esp + 0x14]
mov dword [0x40b3bc], esi
add dword [0x4173f0], eax
mov dword [0x40b3c0], eax
mov eax, dword [0x4212fc]
cmp eax, ebx
je 0x404474
cmp byte [eax + 0x42], bl
jne 0x404474
cmp dword [esp + 0x10], ebx
je 0x404445
mov eax, dword [0x421b4c]
sub eax, dword [0x4173e8]
sub eax, dword [esp + 0x24]
add eax, dword [0x40b3b4]
mov dword [0x421b40], eax
jmp 0x404437
push edi
call dword [sym.imp.USER32.dll_DispatchMessageA]
push 1
push ebx
push ebx
push ebx
push edi
call ebp
test eax, eax
jne 0x404430
jmp 0x404474
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [esp + 0x18]
jbe 0x404474
push str.unpacking_data:__d__
push 0x404553
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x6f
push dword [0x41a6b8]
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [esp + 0x10], eax
push 0x40b3bc
mov dword [0x40b3cc], 0x40b3e8
mov dword [0x40b3d0], 0x8000
call fcn.00401058
test eax, eax
jl 0x40451c
mov esi, dword [0x40b3cc]
mov eax, 0x40b3e8
sub esi, eax
je 0x4044db
lea ecx, [esp + 0x1c]
push ebx
push ecx
push esi
push eax
push dword [0x4094a4]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x404518
cmp esi, dword [esp + 0x1c]
jne 0x404518
add dword [0x40b3b4], esi
cmp dword [0x40b3c0], ebx
jne 0x404400
jmp 0x4044e9
cmp dword [0x40b3c0], ebx
jne 0x40451c
cmp dword [esp + 0x14], ebx
je 0x40451c
mov eax, dword [0x4173e8]
mov ecx, eax
sub ecx, dword [0x40b3b4]
add ecx, dword [esp + 0x24]
test ecx, ecx
jg 0x4043b4
push ebx
push ebx
push eax
push dword [0x4094a4]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x404521
or eax, 0xffffffff
jmp 0x404533
push 0xfffffffffffffffe
jmp 0x40451e
push 0xfffffffffffffffd
pop eax
jmp 0x404533
cmp dword [esp + 0x10], ebx
je 0x404531
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 4
Function at 0x406c4f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
xor esi, esi
xor eax, eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x10], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
xor eax, eax
pop ecx
lea edi, [ebp - 0x50]
mov dword [ebp - 0x54], 0x44
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp + 0xc]
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x406ca4
cmp dword [ebp - 0xc], esi
je 0x406ca1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
leave
ret 8

Function at 0x406cc6
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x406d99
push esi
call fcn.00406e6a
test eax, eax
je 0x406d99
push ebx
push edi
push esi
call sub.KERNEL32.dll_lstrlenA
push str..
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406d93
cmp byte [ebp - 0x114], 0x2e
jne 0x406d31
cmp byte [ebp - 0x113], 0x2e
je 0x406d7a
cmp byte [ebp - 0x113], 0
je 0x406d7a
lea eax, [ebp - 0x114]
push eax
lea eax, [edi + esi + 1]
push eax
call sub.KERNEL32.dll_lstrcpyA
test byte [ebp - 0x140], 0x10
je 0x406d56
push dword [ebp + 0xc]
push esi
call fcn.00406cc6
jmp 0x406d7a
push esi
push 0x16
call fcn.00406750
mov eax, dword [ebp - 0x140]
test al, 1
je 0x406d73
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x406d16
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
and byte [edi + esi], 0
pop edi
pop ebx
push esi
push 0xe
call fcn.00406750
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
leave
ret 8
Function at 0x406f4b
Capabilities:
Get common file path
Get file size

Disassembly:
sub esp, 0xc
and dword [esp], 0
push ebx
push ebp
push esi
push edi
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
mov edi, dword [esp + 0x24]
test esi, esi
je 0x406f9b
push str.MoveFileExA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x406f89
push 5
push edi
push dword [esp + 0x28]
call eax
mov dword [esp + 0x10], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp dword [esp + 0x10], 0
jne 0x407134
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov esi, 0x400
test edi, edi
mov ebp, 0x41a2b8
je 0x406fb6
push esi
push ebp
push edi
call ebx
jmp 0x406fc0
mov dword [0x41a2b8], 0x4c554e
push esi
mov esi, 0x419eb8
push esi
push dword [esp + 0x28]
call ebx
push esi
push ebp
push str._s_s_r_n
push 0x419ab8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edi, eax
mov dword [esp + 0x24], edi
push 0x3f0
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.wininit.ini
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor ebx, ebx
push ebx
push 0x8000080
push 4
push ebx
push ebx
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x14], esi
je 0x407134
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebp, eax
push ebx
lea eax, [edi + ebp + 0xa]
push eax
push ebx
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
cmp eax, ebx
mov dword [esp + 0x18], eax
je 0x40711c
push ebx
push ebx
push ebx
push 2
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
test ebx, ebx
je 0x407110
push 0xffffffffffffffff
push str._Rename__r_n
push ebx
call fcn.00407142
test eax, eax
jne 0x40708a
lea eax, [ebx + ebp]
push str._Rename__r_n
push eax
call sub.KERNEL32.dll_lstrcpyA
add ebp, 0xa
mov eax, ebp
jmp 0x4070eb
push 0xffffffffffffffff
push 0x409780
push eax
call fcn.00407142
mov esi, eax
mov edi, ebx
inc esi
sub edi, esi
add edi, ebp
push edi
push 0x419ab8
push esi
call fcn.00407142
test eax, eax
jne 0x4070fd
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
push esi
push eax
mov dword [esp + 0x2c], eax
call fcn.00406f0b
push edi
mov eax, dword [esp + 0x28]
push dword [esp + 0x24]
add eax, esi
push eax
call fcn.00406f0b
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
sub esi, ebx
mov edi, dword [esp + 0x24]
mov eax, esi
mov esi, dword [esp + 0x14]
push edi
add eax, ebx
push 0x419ab8
push eax
call fcn.00406f0b
add ebp, edi
jmp 0x407101
mov esi, dword [esp + 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov dword [esp + 0x10], 1
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
push ebx
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret 8
Function at 0x40719d
Capabilities:
Create directory

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [sym.imp.USER32.dll_CharNextA]
jmp 0x4071b2
push esi
call edi
mov esi, eax
cmp byte [esi], 0x20
je 0x4071ad
cmp byte [esi], 0
je 0x407239
push esi
call edi
cmp byte [eax], 0x3a
mov bl, 0x5c
jne 0x4071d0
cmp byte [eax + 1], bl
jne 0x4071d0
lea esi, [eax + 2]
jmp 0x4071f9
cmp byte [esi], bl
jne 0x407239
cmp byte [esi + 1], bl
jne 0x407239
push 2
pop ebp
jmp 0x4071e7
test al, al
je 0x4071f6
push esi
call edi
mov esi, eax
mov al, byte [esi]
cmp al, bl
jne 0x4071de
test al, al
je 0x4071f6
push esi
call edi
mov esi, eax
dec ebp
jne 0x4071e7
mov al, byte [esi]
test al, al
je 0x407239
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
jmp 0x407212
test al, al
je 0x40721b
push esi
call edi
mov esi, eax
mov al, byte [esi]
cmp al, bl
jne 0x407207
cmp byte [esi], 0
jne 0x407225
push 0
push dword [esp + 0x18]
call ebp
jmp 0x407233
and byte [esi], 0
push 0
push dword [esp + 0x18]
call ebp
mov byte [esi], bl
inc esi
mov al, byte [esi]
test al, al
jne 0x407212
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x407240
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x14]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40729e
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 8]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40728d
cmp dword [ebp + 8], 1
je 0x40728f
mov byte [esi], bl
push dword [ebp + 0x14]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x4073f4
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x10]
push edi
mov al, byte [ebp]
mov dword [esp + 0x14], esi
test al, al
je 0x407549
mov edi, 0x400
mov ecx, esi
sub ecx, dword [esp + 0x14]
cmp ecx, edi
jge 0x407549
movzx ebx, al
inc ebp
cmp ebx, 0xdb
jge 0x407436
mov byte [esi], bl
inc esi
jmp 0x40753e
cmp ebx, 0xff
jne 0x40744a
mov al, byte [ebp]
mov byte [esi], al
inc esi
inc ebp
jmp 0x40753e
lea eax, [ebx - 0xdb]
cmp eax, 0x23
ja case.default.0x407460
movzx eax, byte [eax + 0x407577]
jmp dword [eax*4 + 0x407553]
push dword [0x421b48]
push esi
call fcn.0040730b
jmp case.default.0x407460
lea eax, [ebx - 0xdc]
shl eax, 0xa
add eax, 0x41a6c0
push eax
jmp 0x407503
push esi
push str.ProgramFilesDir
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
call fcn.00407240
cmp byte [esi], 0
jne 0x40750b
push str.C:Program_Files
jmp 0x407503
push esi
push dword [ebx*4 + 0x409368]
call fcn.0040759b
jmp case.default.0x407460
push esi
push str.AppData
call fcn.0040759b
push str.MicrosoftInternet_ExplorerQuick_Launch
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je case.0x407460.251
test al, 0x10
jne case.default.0x407460
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp case.default.0x407460
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp case.default.0x407460
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp case.default.0x407460
push 0x40af98
push esi
call sub.KERNEL32.dll_lstrcpyA
jmp case.default.0x407460
push esi
call dword [sym.imp.USER32.dll_CharNextA]
cmp byte [eax], 0
je 0x40751d
inc esi
cmp byte [esi], 0
jne 0x40750b
cmp ebx, 0xf0
jle 0x407535
cmp ebx, 0xf4
je 0x407535
cmp byte [esi], 0x5c
jne 0x407535
and byte [esi], 0
push esi
call dword [sym.imp.USER32.dll_CharNextA]
mov esi, eax
mov al, byte [ebp]
test al, al
jne 0x407414
and byte [esi], 0
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40759b
Capabilities:
Get common file path
Persist via run registry key

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [esp + 0x14]
push 0x409733
call sub.KERNEL32.dll_lstrcpyA
mov bl, byte [0x420ac0]
mov edi, 0x80000001
mov al, bl
mov esi, dword [esp + 0x18]
neg al
sbb eax, eax
push esi
and al, 0xf9
mov ebp, str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
add eax, 7
add eax, str.Common
push eax
xor eax, eax
test bl, bl
setne al
add eax, edi
push ebp
push eax
jmp 0x4075ee
test bl, bl
push esi
je 0x4075fa
push 0x409733
push ebp
xor bl, bl
push edi
call fcn.00407240
cmp byte [esi], 0
je 0x4075e0
jmp 0x407605
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x40760c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
xor ebx, ebx
xor esi, esi
inc ebx
push esi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ole32.dll_OleInitialize]
cmp eax, ebx
je 0x407635
cmp eax, esi
je 0x407635
mov eax, ebx
jmp 0x40771f
lea eax, [ebp - 4]
push eax
push 0x408274
push ebx
push esi
push 0x408284
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x407716
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x408294
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x40770d
mov eax, dword [ebp - 4]
push edi
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
push dword [ebp + 0x20]
mov edi, eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
cmp dword [ebp + 0x24], esi
je 0x407698
mov eax, dword [ebp - 4]
push dword [ebp + 0x24]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
cmp dword [ebp + 0x28], esi
je 0x4076a9
mov eax, dword [ebp - 4]
push dword [ebp + 0x28]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
cmp dword [ebp + 0x10], esi
je 0x4076bd
push dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x1c], esi
je 0x4076ce
mov eax, dword [ebp - 4]
push dword [ebp + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp edi, esi
pop edi
jl 0x407704
lea eax, [ebp - 0x80c]
push 0x400
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x80c]
push ebx
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x407704
mov dword [ebp - 0xc], esi
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_OleUninitialize]
mov eax, dword [ebp - 0xc]
pop esi
pop ebx
leave
ret 0x24
Function at 0xd7a058
Capabilities:
Decompress data using aplib

Disassembly:
call 0xd7a1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xd7a07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7a06a
add dl, dl
jne 0xd7a089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7a0dc
xor eax, eax
add dl, dl
jne 0xd7a096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xd7a17d
add dl, dl
jne 0xd7a0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd7a0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd7a0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd7a0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xd7a0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xd7a075
mov eax, 1
add dl, dl
jne 0xd7a0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xd7a0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd7a0e1
sub eax, ebx
mov ebx, 1
jne 0xd7a128
mov ecx, 1
add dl, dl
jne 0xd7a10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd7a119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd7a105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd7a075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xd7a13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xd7a14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xd7a136
cmp eax, 0x7d00
jae 0xd7a16d
cmp eax, 0x500
jb 0xd7a168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd7a075
cmp eax, 0x7f
ja 0xd7a170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xd7a075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xd7a19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xd7a075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x405540
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5a3f20
push eax
mov dword fs:[0], esp
sub esp, 0xc
xor eax, eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov edx, dword [esi + 0x164]
test edx, edx
jle 0x40558f
mov ecx, dword [esi + 0x104]
mov edi, dword [ecx]
cmp edi, eax
jne 0x405585
test edi, edi
jl 0x4055a6
cmp edi, 3
jle 0x405585
cmp edi, 0x11
jne 0x4055a6
inc ebx
add ecx, 4
cmp ebx, edx
mov eax, edi
jl 0x405571
mov eax, 1
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x18
ret
push ecx
mov dword [esi + 4], 1
mov ecx, esp
mov dword [esp + 0x14], esp
push 0x62cce0
call fcn.0058f74d
push ecx
mov dword [esp + 0x28], 0
mov ecx, esp
mov dword [esp + 0x1c], esp
push 0x62cce0
call fcn.0058f74d
lea eax, [esp + 0x14]
push edi
push eax
mov ecx, esi
mov dword [esp + 0x30], 0xffffffff
call fcn.00405750
mov ecx, dword [eax]
lea edx, [esi + 0x14]
push ecx
push str.Operators_must_be_separated_by_values._n_nThere_cant_be_two__s_operators_in_a_row.
push edx
mov dword [esp + 0x2c], 1
call fcn.0058c6ce
add esp, 0xc
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0xffffffff
call fcn.0058f6df
mov eax, dword [esi + 0x118]
mov edx, dword [esi + 0x12c]
pop edi
mov ecx, dword [eax + ebx*4 - 4]
lea eax, [eax + ebx*4]
mov dword [esi + 0xc], ecx
mov ecx, dword [edx + ebx*4]
mov edx, dword [eax]
lea eax, [ecx + edx - 1]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x10], eax
pop esi
xor eax, eax
mov dword fs:[0], ecx
pop ebx
add esp, 0x18
ret