joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404fac
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x424ab9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x34
push str.SOFTWAREMicrosoftWindowsCurrentVersionInstallerFolders
lea ecx, [ebp - 0x1c]
call fcn.00417999
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x20], 0x2001f
call fcn.00404f1e
test eax, eax
je 0x404ffb
mov eax, dword [ebp - 0x20]
or ah, 1
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
lea ecx, [ebp - 0x1c]
call fcn.00405250
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x405040
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041792b
mov eax, dword [ebp - 0x24]
jmp 0x40512f
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
call fcn.00417999
mov byte [ebp - 4], 1
push 1
push 0x5c
lea ecx, [ebp - 0x2c]
call fcn.0041538e
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x2c]
push ecx
push 1
lea edx, [ebp - 0x30]
push edx
lea ecx, [ebp - 0x14]
call fcn.00415951
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x40]
push ecx
call fcn.004052c0
mov byte [ebp - 0x28], al
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x30]
call fcn.0041792b
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0041792b
mov edx, dword [ebp - 0x28]
and edx, 0xff
test edx, edx
je 0x4050bd
push 0x42eda0
lea ecx, [ebp - 0x14]
call fcn.00417d07
lea ecx, [ebp - 0x14]
call fcn.00405250
push eax
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
je 0x40510a
mov dword [ebp - 0x34], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0041792b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041792b
mov eax, dword [ebp - 0x34]
jmp 0x40512f
mov dword [ebp - 0x38], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0041792b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0041792b
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x40b87c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40b89c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00408608
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x40b8bf
test byte [esp + 8], 2
je 0x40b8bf
call fcn.0040867b
mov dword [eax], 0xd
call fcn.00408684
mov dword [eax], 5
jmp 0x40b898
xor eax, eax
ret
Function at 0x40cba1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x42fc00
cmp edx, dword [eax]
je 0x40cbc3
add eax, 8
inc ecx
cmp eax, 0x42fc90
jl 0x40cbb4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x42fc00]
jne 0x40ccf1
mov eax, dword [0x432c00]
cmp eax, 1
je 0x40cccb
test eax, eax
jne 0x40cbf4
cmp dword [0x42f484], 1
je 0x40cccb
cmp edx, 0xfc
je 0x40ccf1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40cc2b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00406a10
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00406840
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40cc6e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00406840
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x427f94
push edi
call fcn.004106b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00406a10
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00406a20
lea eax, [ebp - 0xa0]
push 0x427f74
push eax
call fcn.00406a20
push dword [esi + 0x42fc04]
lea eax, [ebp - 0xa0]
push eax
call fcn.00406a20
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00410e81
add esp, 0x2c
pop edi
jmp 0x40ccf1
lea eax, [ebp + 8]
lea esi, [esi + 0x42fc04]
push 0
push eax
push dword [esi]
call fcn.00406840
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x41ba65
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x41ba9d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00417dd2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00417daa
jmp 0x41baa9
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x401110
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
xor ecx, ecx
push edi
mov edi, 0xddc
mov esi, 0x5dce
test ebx, ebx
je 0x4011c3
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4011c3
cmp ebx, eax
jae 0x4011c3
mov ebx, 0x197f
mov eax, 0x2e8ba2e9
imul ebx
sar edx, 5
mov ebx, edx
shr ebx, 0x1f
add ebx, edx
jne 0x401145
mov ebx, dword [ebp + 8]
sub dword [ebp + 0xc], ebx
mov edx, ecx
je 0x401180
mov esi, dword [ebp + 0xc]
mov al, byte [edx + ebx + 1]
sub al, 0x72
xor byte [edx + ebx], al
inc edx
cmp edx, esi
jb 0x401165
mov esi, 0x5dce
jmp 0x401180
mov eax, 0x2aaaaaab
imul edi
sar edx, 1
mov edi, edx
shr edi, 0x1f
add edi, edx
jne 0x401180
inc ecx
mov eax, ecx
and eax, 0x80000001
jns 0x4011a1
dec eax
or eax, 0xfffffffe
inc eax
jne 0x4011a6
add ecx, 2
cmp ecx, 0x46df
jl 0x401192
mov edi, edi
mov eax, 0x3949660b
imul esi
sar edx, 5
mov esi, edx
shr esi, 0x1f
add esi, edx
jne 0x4011b0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403230
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x40328d
mov eax, dword [ebp + 8]
push ebx
push esi
mov ecx, dword [ebp + 0xc]
inc edi
mov bh, byte [edi + ecx - 1]
inc byte [eax]
movzx esi, byte [eax]
movzx edx, byte [esi + eax + 2]
movzx ecx, byte [eax + 1]
add esi, eax
add ecx, edx
movzx edx, cl
mov byte [eax + 1], cl
movzx ecx, byte [edx + eax + 2]
mov bl, byte [esi + 2]
mov byte [esi + 2], cl
mov byte [edx + eax + 2], bl
movzx ecx, byte [esi + 2]
mov edx, dword [ebp + 0xc]
add cl, bl
movzx ecx, cl
movzx ecx, byte [ecx + eax + 2]
xor cl, bh
mov byte [edi + edx - 1], cl
cmp edi, dword [ebp + 0x10]
jb 0x403240
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x401290
Capabilities:
Shutdown system

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x4012b6
push 4
push 0x407070
push str.You_must_restart_system._Now_restart_system__
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4012b6
jmp 0x4012c0
ret
sub esp, 0x14
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea ecx, [esp]
push ecx
push 0x28
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4012e7
add esp, 0x14
ret
lea edx, [esp + 8]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov ecx, dword [esp]
push 0
push 0
lea eax, [esp + 0xc]
push 0
push eax
push 0
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401331
xor eax, eax
add esp, 0x14
ret
push 0
push 7
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov eax, 1
add esp, 0x14
ret
Function at 0x4013c0
Capabilities:
Link many functions at runtime

Disassembly:
sub esp, 0x208
push ebx
push esi
push edi
mov esi, ecx
call fcn.00401830
mov ebx, eax
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x110]
rep stosd dword es:[edi], eax
mov ecx, 0x41
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x110]
mov ecx, esi
push eax
call fcn.004018f0
lea eax, [ebx - 1]
cmp eax, 5
ja case.0x401408.1
jmp dword [eax*4 + 0x401544]
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
push ecx
push str._sNetMInsNT.dll
push edx
mov dword [esi + 0x1c], 0
call fcn.00401c7d
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x20], eax
je case.0x401408.1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.InstallNT
push eax
call edi
mov ecx, dword [esi + 0x20]
push str.UninstallNT
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x20]
push str.InstallHelperService
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x20]
push str.UninstallHelperService
push eax
call edi
mov ecx, dword [esi + 4]
mov dword [esi + 0x18], eax
test ecx, ecx
je case.0x401408.1
mov ecx, dword [esi + 8]
test ecx, ecx
je case.0x401408.1
mov ecx, dword [esi + 0x14]
test ecx, ecx
je case.0x401408.1
test eax, eax
je case.0x401408.1
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x208
ret
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
push ecx
push str._sNetMIns20.dll
push edx
mov dword [esi + 0x1c], 1
call fcn.00401c7d
add esp, 0xc
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 0x20], eax
je case.0x401408.1
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.install2000
push eax
call edi
mov ecx, dword [esi + 0x20]
push str.uninstall2000
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi + 0x20]
push str.InstallHelperService
push edx
mov dword [esi + 0x10], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x20]
push str.UninstallHelperService
push eax
call edi
mov ecx, dword [esi + 0xc]
mov dword [esi + 0x18], eax
test ecx, ecx
je case.0x401408.1
mov ecx, dword [esi + 0x10]
jmp 0x40148f
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x208
ret
Function at 0x401650
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x30c
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x1c]
test eax, eax
je 0x401809
push ebp
push esi
push edi
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x401699
lea ecx, [esp + 0x10]
push ecx
mov ecx, ebx
call fcn.004018f0
jmp 0x4017b3
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
mov dl, 0x5c
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [esp + ecx + 0xf], dl
je 0x4016d1
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x10]
mov byte [esp + ecx + 0x10], dl
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x11], al
lea edx, [esp + 0x114]
mov ecx, ebx
push edx
call fcn.004018f0
mov edi, 0x4071b8
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x21c]
push str._sMdInstall.exe
push ecx
call fcn.00401c7d
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0xc
lea edx, [esp + 0x218]
lea eax, [esp + 0x114]
push 0
push edx
push eax
call ebp
lea ecx, [esp + 0x114]
push ecx
mov ecx, ebx
call fcn.004018f0
mov edi, str.NetMIns20.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x21c]
push str._sNetMIns20.dll
push ecx
call fcn.00401c7d
add esp, 0xc
lea edx, [esp + 0x218]
lea eax, [esp + 0x114]
push 0
push edx
push eax
call ebp
mov edi, str.MdInstall.exe__silent__c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.MobileDeskTop_Helper
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [ebx + 0x18]
mov ecx, dword [esp + 0x324]
lea eax, [esp + 0x14]
push eax
push ecx
call dword [ebx + 0x10]
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30c
ret 4
push str.MobileDeskTop_Helper
call dword [ebx + 0x18]
add esp, 4
call dword [ebx + 8]
pop ebx
add esp, 0x30c
ret 4
Function at 0x401830
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
lea eax, [esp]
mov dword [esp], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x10]
sub eax, 0
je 0x4018d8
dec eax
je 0x40189b
dec eax
jne 0x4018d8
mov eax, dword [esp + 4]
cmp eax, 3
je 0x4018d8
cmp eax, 4
jne 0x401871
add esp, 0x94
ret
cmp eax, 5
jne 0x4018d8
mov eax, dword [esp + 8]
test eax, eax
jne 0x40188a
mov eax, 5
add esp, 0x94
ret
cmp eax, 1
jb 0x4018d8
mov eax, 6
add esp, 0x94
ret
cmp dword [esp + 4], 4
jne 0x4018d8
mov eax, dword [esp + 8]
test eax, eax
jne 0x4018b6
mov eax, 1
add esp, 0x94
ret
cmp eax, 0xa
jne 0x4018c7
mov eax, 2
add esp, 0x94
ret
cmp eax, 0x5a
jne 0x4018d8
mov eax, 3
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret

Function at 0x4019a0
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
push edi
push 0x4071d8
push 0x66
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.004018f0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push str._sdrclass.inf
push edx
call fcn.00401c7d
add esp, 0xc
lea eax, [esp + 0x118]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401a40
lea ecx, [esp + 0x10]
push 0
push ecx
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret

Function at 0x401a50
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
push edi
push 0x4071d8
push 0x65
mov edi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov ecx, edi
call fcn.004018f0
lea ecx, [esp + 0x14]
lea edx, [esp + 0x118]
push ecx
push str._smddrvnt3.inf
push edx
call fcn.00401c7d
add esp, 0xc
lea eax, [esp + 0x118]
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x401af0
lea ecx, [esp + 0x10]
push 0
push ecx
push ebp
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
Function at 0x401b00
Capabilities:
Delete file

Disassembly:
sub esp, 0x30c
lea eax, [esp]
push esi
push eax
call fcn.004018f0
lea ecx, [esp + 4]
lea edx, [esp + 0x108]
push ecx
push str._sdrclass.inf
push edx
call fcn.00401c7d
lea eax, [esp + 0x10]
lea ecx, [esp + 0x218]
push eax
push str._smddrvnt3.inf
push ecx
call fcn.00401c7d
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x18
lea edx, [esp + 0x108]
push edx
call esi
lea eax, [esp + 0x20c]
push eax
call esi
pop esi
add esp, 0x30c
ret

Function at 0x403261
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4072a8
cmp edx, dword [eax]
je 0x403283
add eax, 8
inc ecx
cmp eax, 0x407338
jl 0x403274
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4072a8]
jne 0x4033b1
mov eax, dword [0x407ac4]
cmp eax, 1
je 0x40338b
test eax, eax
jne 0x4032b4
cmp dword [0x4071f4], 1
je 0x40338b
cmp edx, 0xfc
je 0x4033b1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4032eb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00404570
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00403f70
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40332e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00403f70
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40644c
push edi
call fcn.00401cd0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00404570
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00404580
lea eax, [ebp - 0xa0]
push 0x40642c
push eax
call fcn.00404580
push dword [esi + 0x4072ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00404580
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00404a15
add esp, 0x2c
pop edi
jmp 0x4033b1
lea eax, [ebp + 8]
lea esi, [esi + 0x4072ac]
push 0
push eax
push dword [esi]
call fcn.00403f70
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x40287f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40288e
pop dword [ebp - 0x48]
mov eax, 0x40288e
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x4d8ed040
add dword [ebp - 0x58], 0xc3750b
mov dword [ebp - 0x54], 0xd908c998
sub dword [ebp - 0x54], 0xa6d57d53
mov dword [ebp - 0x50], 0x6e5ead31
add dword [ebp - 0x50], 0xdded96fd
mov dword [ebp - 0x4c], 0x9d541956
sub dword [ebp - 0x4c], 0x9d541956
lea eax, [ebp - 0x58]
push eax
mov eax, 0xbc009713
add eax, 0x443fd951
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xda37c468
sub dword [ebp - 0x58], 0x65c55b12
mov dword [ebp - 0x54], 0x2393ca57
add dword [ebp - 0x54], 0x1dd8971e
mov dword [ebp - 0x50], 0x1f52971c
sub dword [ebp - 0x50], 0xbbe32ab0
mov dword [ebp - 0x4c], 0xe3746063
sub dword [ebp - 0x4c], 0xe3746063
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3a642
push 0
call eax
mov ecx, 0x6dde6969
sub ecx, 0x6dde123b
xor esi, esi
add esi, eax
mov edi, 0x410000
add edi, dword [ebp - 0x48]
mov edx, 0xe4515805
add edx, 0x3659d2e2
xor dword [ebp - 0x1c], 0x64fb2a12
mov ebx, dword [edi]
sub dword [ebp - 0x20], esi
xor ebx, edx
add dword [ebp - 0x40], 0xaa8827ee
mov dword [esi], ebx
xor dword [ebp - 0x38], eax
add esi, 0xfcc15f1c
add esi, 0x33ea0e8
add edi, 4
loop 0x4029a2
add eax, 0x798f5dce
sub eax, 0x798e0e43
xor ebx, ebx
add ebx, eax
add eax, 0xa52a6da9
sub eax, 0xa52a6da4
mov ecx, 0x98749cec
sub ecx, 0x98349cec
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x4044d0
Capabilities:
Get file size
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x43ece8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4535c4]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x28]
mov dword [esp + 0x20], 0
mov eax, dword [esp + 0x2c]
push eax
push str.LoadImageFile_:__s_n
call fcn.00428db1
mov ecx, dword [esp + 0x34]
add esp, 8
push 0
push 0
push 3
push 0
push 0
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push str.FileSize___d_n
call fcn.00428db1
add esp, 8
push esi
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push 0
lea edx, [esp + 0x18]
push edx
push esi
push eax
push edi
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.CloseHandle_n
call fcn.00428db1
add esp, 4
lea eax, [esp + 0x28]
push eax
push 1
push ebx
mov dword [esp + 0x34], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0x447e40
call fcn.00428db1
lea edi, [ebp + 0x534]
add esp, 4
cmp dword [edi], 0
je 0x4045df
push 0x447e48
call fcn.00428db1
mov eax, dword [edi]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
add esp, 4
push eax
call edx
push 0x447e48
call fcn.00428db1
add esp, 4
mov eax, dword [esp + 0x28]
push edi
push 0x446c5c
push 0
push esi
push eax
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [esp + 0x28]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
push 0x447e40
call fcn.00428db1
mov eax, dword [ebp + 0x20]
add esp, 4
push 1
push 0
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [ebp + 0x20]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push str.LoadImageFile
call fcn.00428db1
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x30]
add eax, 0xfffffff0
add esp, 4
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404659
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8