joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c79a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff8
mov esi, edx
mov ebp, eax
push 0
push 0
push 0
push 0
push esi
push ebp
call sub.advapi32.dll_RegQueryValueExW
test eax, eax
sete bl
test bl, bl
je 0x5c7a1c
test esi, esi
je 0x5c79cd
cmp word [esi], 0
jne 0x5c7a1c
call fcn.00429d30
cmp eax, 2
je 0x5c7a1c
xor ebx, ebx
xor esi, esi
mov dword [esp + 4], 2
push 0
push 0
push 0
push 0
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push esi
push ebp
call sub.advapi32.dll_RegEnumValueW
mov edi, eax
test edi, edi
je 0x5c7a0a
cmp edi, 0xea
jne 0x5c7a1c
test edi, edi
jne 0x5c7a19
cmp word [esp], 0
jne 0x5c7a19
mov bl, 1
jmp 0x5c7a1c
inc esi
jmp 0x5c79db
mov eax, ebx
pop ecx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x5c7a88
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x5c7a9c
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
pop esi
pop ebx
ret
cmp dword [0x6d77e4], 0
jne 0x5c7abf
push 0x5c7ae4
push 0x5c7b04
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov dword [0x6d77e4], eax
cmp dword [0x6d77e4], 0
je 0x5c7ad9
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x6d77e4]
jmp 0x5c7ade
mov eax, 0x7f
pop esi
pop ebx
ret

Function at 0x5c7a89
Capabilities:
Delete registry key

Disassembly:
push ebx
push esi
mov esi, ecx
mov ebx, edx
cmp al, 2
je 0x5c7a9c
push esi
push ebx
call sub.advapi32.dll_RegDeleteKeyW
pop esi
pop ebx
ret
cmp dword [0x6d77e4], 0
jne 0x5c7abf
push 0x5c7ae4
push 0x5c7b04
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov dword [0x6d77e4], eax
cmp dword [0x6d77e4], 0
je 0x5c7ad9
push 0
push pe_nt_image_headers32
push esi
push ebx
call dword [0x6d77e4]
jmp 0x5c7ade
mov eax, 0x7f
pop esi
pop ebx
ret
Function at 0x5c7b20
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov byte [ebp - 5], al
xor eax, eax
push ebp
push 0x5c7c93
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 0x10], 0
je 0x5c7b54
mov eax, dword [ebp - 0x10]
cmp word [eax], 0
jne 0x5c7b5e
mov ebx, 0x57
jmp 0x5c7c7d
call fcn.00429d30
cmp eax, 2
jne 0x5c7c6c
push 0
push 8
lea eax, [ebp - 0x14]
push eax
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.005c7a60
test eax, eax
jne 0x5c7c6c
xor eax, eax
push ebp
push 0x5c7c65
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov ecx, pe_nt_image_headers32
xor edx, edx
call fcn.0040a350
xor eax, eax
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x5c7bb9
sub ebx, 4
mov ebx, dword [ebx]
mov dword [ebp - 0x1c], ebx
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 4]
call fcn.0040a774
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov esi, eax
cmp esi, 0xea
jne 0x5c7c24
mov edi, dword [ebp - 4]
test edi, edi
je 0x5c7bf4
sub edi, 4
mov edi, dword [edi]
cmp edi, 0x10000
jge 0x5c7c4e
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x5c7c13
mov eax, dword [ebp - 0x20]
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
add ecx, ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.0040a350
jmp 0x5c7bad
test esi, esi
jne 0x5c7c4e
mov eax, dword [ebp - 4]
call fcn.0040b278
mov ecx, eax
movzx eax, byte [ebp - 5]
mov edx, dword [ebp - 0x14]
call fcn.005c7b20
test eax, eax
je 0x5c7bad
inc dword [ebp - 0x18]
jmp 0x5c7bad
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7c6c
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
movzx eax, byte [ebp - 5]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.005c7a88
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5c7c9a
lea eax, [ebp - 4]
call fcn.0040a1c8
ret
Function at 0x6a0b40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x6a0bc4
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
je 0x6a0bac
mov ebx, esi
test ebx, ebx
je 0x6a0b72
sub ebx, 4
mov ebx, dword [ebx]
inc ebx
mov eax, ebx
add eax, eax
push eax
mov eax, esi
call fcn.0040b278
push eax
push 1
push 0
lea eax, [ebp - 8]
mov ecx, dword [ebp - 4]
mov edx, 0x6a0be0
call fcn.0040b4c8
mov eax, dword [ebp - 8]
call fcn.0040b278
push eax
push edi
call sub.advapi32.dll_RegSetValueExW
test eax, eax
sete al
mov ebx, eax
jmp 0x6a0bae
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a0bcb
lea eax, [ebp - 8]
call fcn.0040a1c8
ret

Function at 0x6a6fd8
Capabilities:
Check if file exists

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x6a6fe2
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x6a7098
push 0x6a70cc
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov ebx, eax
test ebx, ebx
je 0x6a7081
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6a7081
test al, 0x10
je 0x6a7032
mov ebp, 0x2000000
jmp 0x6a7034
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x6a7081
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x6a7081
cmp ebx, 0xff0
jge 0x6a7081
mov edx, edi
mov eax, esp
call fcn.006a6ef0
jmp 0x6a708a
mov eax, edi
mov edx, esi
call fcn.0040a5a8
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x6a6ffd
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push edi
push ebp
push eax
mov eax, 2
add esp, 0xfffff004
push eax
dec eax
jne 0x6a6fe2
mov eax, dword [esp + 0x2000]
add esp, 4
mov edi, edx
mov esi, eax
push 0x6a7098
push 0x6a70cc
call sub.kernel32.dll_GetModuleHandleW
push eax
call fcn.00414030
mov ebx, eax
test ebx, ebx
je 0x6a7081
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_GetFileAttributesW
cmp eax, 0xffffffff
je 0x6a7081
test al, 0x10
je 0x6a7032
mov ebp, 0x2000000
jmp 0x6a7034
xor ebp, ebp
push 0
push ebp
push 3
push 0
push 7
push 0
mov eax, esi
call fcn.0040b278
push eax
call sub.kernel32.dll_CreateFileW
mov ebp, eax
cmp ebp, 0xffffffff
je 0x6a7081
push 0
push 0x1000
lea eax, [esp + 8]
push eax
push ebp
call ebx
mov ebx, eax
push ebp
call sub.kernel32.dll_CloseHandle
test ebx, ebx
jle 0x6a7081
cmp ebx, 0xff0
jge 0x6a7081
mov edx, edi
mov eax, esp
call fcn.006a6ef0
jmp 0x6a708a
mov eax, edi
mov edx, esi
call fcn.0040a5a8
add esp, 0x2000
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x6a70e8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x20c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x6a7179
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x208]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryW
mov ebx, eax
test ebx, ebx
jle 0x6a714f
cmp ebx, 0x104
jge 0x6a714f
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call fcn.0040b318
mov eax, dword [ebp - 0x20c]
mov edx, esi
call fcn.006a6fd8
jmp 0x6a7160
mov eax, 0x6a7194
call fcn.0060d278
mov eax, esi
call fcn.0040a1c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a7180
lea eax, [ebp - 0x20c]
call fcn.0040a1c8
ret

Function at 0x6a71bc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x6a730b
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.006a6fd8
lea eax, [ebp - 8]
call fcn.006a70e8
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x3c
call fcn.00407760
mov dword [ebp - 0x48], 0x3c
mov dword [ebp - 0x44], 0x800540
mov eax, 0x6a7318
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
call fcn.0040b278
mov dword [ebp - 0x38], eax
mov eax, esi
call fcn.0040b278
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
call fcn.0040b278
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 0x48]
push eax
call sub.shell32.dll_ShellExecuteExW
test eax, eax
jne 0x6a7267
call sub.kernel32.dll_GetLastError
cmp eax, 0x4c7
jne 0x6a725d
call fcn.00428ff4
mov eax, 0x6a7330
call fcn.0060d1c0
cmp dword [ebp - 0x10], 0
jne 0x6a7277
mov eax, 0x6a735c
call fcn.0060d064
xor edx, edx
push ebp
push 0x6a72e9
push dword fs:[edx]
mov dword fs:[edx], esp
call fcn.006a6ce4
push 0x4ff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x10]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x6a7285
cmp eax, 0xffffffff
jne 0x6a72b2
mov eax, 0x6a73b0
call fcn.0060d1c0
call fcn.006a6ce4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_GetExitCodeProcess
test eax, eax
jne 0x6a72d2
mov eax, 0x6a73f0
call fcn.0060d1c0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6a72f0
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
Function at 0x41c500
Capabilities:
Query environment variable

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
cmp dword [0x427850], 0
jne 0x41c581
cmp dword [0x427870], 0
jne 0x41c530
call sub.KERNEL32.DLL_GetEnvironmentStrings
mov dword [0x427870], eax
test eax, eax
jne 0x41c530
push str.GetEnvironmentStrings_failed
call fcn.0041bd1c
pop ecx
xor ebp, ebp
xor esi, esi
mov ebx, dword [0x427870]
jmp 0x41c544
lea eax, [edi + 1]
inc esi
add ebp, eax
add ebx, eax
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c53c
lea edi, [ebp + 1]
push edi
call fcn.004161a8
pop ecx
mov ebx, eax
mov dword [0x427854], ebx
test ebx, ebx
jne 0x41c56e
xor eax, eax
jmp 0x41c644
push edi
mov edx, dword [0x427870]
push edx
push ebx
call fcn.00416754
add esp, 0xc
jmp 0x41c5a1
xor esi, esi
mov ebx, dword [0x427850]
jmp 0x41c59b
push eax
call fcn.004168a4
pop ecx
test eax, eax
jne 0x41c597
dec esi
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c58b
lea ebx, [esi + 4]
push 4
mov dword [0x427858], ebx
inc ebx
push ebx
call fcn.00415c80
add esp, 8
test eax, eax
mov dword [esp], eax
jne 0x41c5c4
xor eax, eax
jmp 0x41c644
cmp dword [0x427850], 0
jne 0x41c5f5
xor esi, esi
mov ebx, dword [0x427854]
mov eax, dword [esp]
mov ebp, eax
jmp 0x41c5e6
mov dword [ebp], ebx
add ebp, 4
inc esi
inc edi
add ebx, edi
push ebx
call fcn.004168a4
pop ecx
mov edi, eax
test eax, eax
jne 0x41c5dc
jmp 0x41c626
xor esi, esi
mov ebx, dword [0x427850]
mov eax, dword [esp]
mov edi, eax
jmp 0x41c620
push eax
call fcn.004168a4
pop ecx
test eax, eax
je 0x41c615
mov eax, dword [ebx]
mov dword [edi], eax
jmp 0x41c619
dec esi
add edi, 0xfffffffc
add edi, 4
inc esi
add ebx, 4
mov eax, dword [ebx]
test eax, eax
jne 0x41c604
mov eax, dword [0x427850]
test eax, eax
je 0x41c636
push eax
call fcn.004161b8
pop ecx
mov edx, dword [esp]
mov eax, 1
mov dword [0x427850], edx
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x599f2eeb
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x4e50690e
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x62995675
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..rsrc
nop
nop
cmp eax, 0
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2ddb223b
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x40f6b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40f6d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40f6d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40f6c8
mov eax, 1
add ebx, ebx
jne 0x40f6eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40f6e0
jne 0x40f6fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f6e0
xor ecx, ecx
sub eax, 3
jb 0x40f710
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40f782
mov ebp, eax
add ebx, ebx
jne 0x40f71b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40f728
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40f74c
inc ecx
add ebx, ebx
jne 0x40f738
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40f72d
jne 0x40f749
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40f72d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40f76c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40f75d
jmp 0x40f6ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40f76c
add edi, ecx
jmp 0x40f6ce
pop esi
mov edi, esi
mov ecx, 0x1d
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40f78a
cmp byte [edi], 1
jne 0x40f78a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40f78f
lea edi, [esi + 0xd000]
mov eax, dword [edi]
or eax, eax
je 0x40f807
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x103b4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x103f0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40f7bc
mov ecx, edi
jns 0x40f7eb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x103f4]
or eax, eax
je 0x40f801
mov dword [ebx], eax
add ebx, 4
jmp 0x40f7d9
call dword [esi + 0x10404]
mov ebp, dword [esi + 0x103f8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40f83b
sub esp, 0xffffff80
jmp 0x40173c
Function at 0x4011a9
Capabilities:
Create thread

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40b6e8
push eax
mov dword fs:[0], esp
sub esp, 8
push ebx
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
mov eax, dword [esi + 0xd0]
push 0x640000
push ebx
push 0x401
push eax
call edi
mov ecx, dword [esi + 0xd0]
push ebx
push ebx
push 0x402
push ecx
call edi
lea edx, [esp + 0x10]
mov dword [esi + 0x64], ebx
push edx
push ebx
push esi
push 0x401270
push ebx
push ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [esi + 0x60], eax
jne 0x40125b
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
push 0x6b
lea ecx, [esp + 0x10]
mov dword [esp + 0x20], ebx
call sub.MFC42.DLL_CString::LoadStringA
mov eax, dword [esp + 0xc]
push 0x40
push 0x410020
push eax
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
call sub.MFC42.DLL_AfxGetThread
cmp eax, ebx
je 0x40123a
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x40123c
xor eax, eax
mov eax, dword [eax + 0x20]
push ebx
push ebx
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
lea ecx, [esp + 0xc]
mov dword [esp + 0x1c], 0xffffffff
call fcn.0040b142
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x14
ret

Function at 0x402180
Capabilities:
Create thread

Disassembly:
push ecx
lea edx, [esp]
xor eax, eax
push edx
push eax
push ecx
push 0x4021b0
push eax
push eax
mov dword [ecx + 0x110], eax
mov dword [ecx + 0x108], eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x1c
ret
Function at 0x4031f0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x40b918
push eax
mov dword fs:[0], esp
sub esp, 0xc
push esi
mov esi, ecx
push 1
mov ecx, 0x4119e8
call fcn.00404060
mov eax, dword [0x411fcc]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x40325d
call sub.MFC42.DLL_AfxGetThread
test eax, eax
je 0x403239
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x7c]
jmp 0x40323b
xor eax, eax
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
pop esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret 4
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
mov dword [esp + 0x18], 0
push ecx
mov ecx, esi
call fcn.00404270
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x1c], 1
call sub.MFC42.DLL_CString::operator_1
lea ecx, [esp + 0xc]
mov byte [esp + 0x18], 0
call fcn.0040b142
lea ecx, [esp + 4]
call sub.MFC42.DLL_CString::CString
mov ecx, esi
mov byte [esp + 0x18], 2
call fcn.00402930
push eax
mov ecx, esi
call fcn.00402a10
push eax
mov ecx, esi
call fcn.00402850
push eax
mov ecx, esi
call fcn.00402820
push eax
lea edx, [esp + 0x14]
push str._hwnd:_x_uin:_u_nick:_s_sign:_s
push edx
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x20]
add esp, 0x18
push 5
push 0
push eax
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [esp + 4]
mov dword [esi + 0x5f4], 1
mov byte [esp + 0x18], 0
call fcn.0040b142
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0xffffffff
call fcn.0040b142
mov ecx, dword [esp + 0x10]
pop esi
mov dword fs:[0], ecx
add esp, 0x18
ret 4
Function at 0x403a20
Capabilities:
Get file version info

Disassembly:
push 0xffffffffffffffff
push 0x40b988
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x18]
push eax
call sub.MFC42.DLL_CString::CString_2
push 0
push 0
lea ecx, [esp + 0x20]
mov dword [esp + 0x18], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
push 0xffffffffffffffff
lea ecx, [esp + 0x1c]
mov dword [esp + 4], eax
call sub.MFC42.DLL_CString::ReleaseBuffer
mov eax, dword [esp]
test eax, eax
jne 0x403a9a
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], 0xffffffff
call fcn.0040b142
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14
push esi
push eax
call sub.MFC42.DLL_operatornew
mov ecx, dword [esp + 8]
add esp, 4
mov esi, eax
push esi
push ecx
push 0
push 0
lea ecx, [esp + 0x2c]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x403b15
lea edx, [esp + 4]
lea eax, [esp + 8]
push edx
push eax
push 0x410430
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x403b15
mov eax, dword [esp + 8]
mov edx, dword [esp + 0x20]
mov ecx, dword [eax + 8]
shr ecx, 0x10
mov dword [edx], ecx
mov ecx, dword [eax + 8]
mov edx, dword [esp + 0x24]
and ecx, 0xff
mov dword [edx], ecx
mov ecx, dword [eax + 0xc]
mov edx, dword [esp + 0x28]
shr ecx, 0x10
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [esp + 0x2c]
and eax, 0xff
mov dword [ecx], eax
push 0xffffffffffffffff
lea ecx, [esp + 0x20]
call sub.MFC42.DLL_CString::ReleaseBuffer
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
lea ecx, [esp + 0x1c]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040b142
mov ecx, dword [esp + 0xc]
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 0x14