joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407dc0
Capabilities:
Create process on windows
Print debug messages

Disassembly:
sub esp, 0x40
push esi
mov esi, ecx
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x407e6a
cmp dword [esi + 0x10c], 1
jne 0x407ded
call fcn.00407d60
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.TopesDialer
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x407e2a
lea eax, [esi + 0x43cc]
push str.Dialer.exe
push eax
lea ecx, [esp + 0xc]
push str._s__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 4]
push 6
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ecx, dword [esi + 0x7c]
mov eax, 0x2710
cmp ecx, 1
jne 0x407e3c
mov eax, 0x3e80
push 0
push eax
mov eax, dword [esi + 0x20]
push 0x15
push eax
call dword [sym.imp.USER32.dll_SetTimer]
push str.__create_CDMA_Comm_Thread..
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov dword [esi + 0x1c4], 1
mov dword [esi + 0x10c], 0
pop esi
add esp, 0x40
ret

Function at 0x407e70
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x8c]
test eax, eax
je 0x407f25
mov eax, dword [esi + 0x68]
cmp byte [eax + 0xac], 1
jne 0x407ebc
mov byte [eax + 0xac], 2
mov eax, dword [esi + 0x68]
mov ecx, dword [eax + 0xa8]
push ecx
lea ecx, [esi + 0x60]
call fcn.004066c0
mov edx, dword [esi + 0x68]
mov dword [edx + 0xa8], eax
mov eax, dword [esi + 0x68]
mov dword [eax + 0xa8], 0xffffffff
mov ecx, dword [esi + 0x20]
push edi
mov edi, dword [sym.imp.USER32.dll_KillTimer]
push 0x15
push ecx
mov dword [esi + 0x1c4], 0
mov dword [esi + 0x1cc], 0
call edi
mov edx, dword [esi + 0x20]
push 0x18
push edx
call edi
push str.TopesDialer
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
mov esi, eax
push 0
push 2
push esi
call edi
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push 0
push 2
push esi
call edi
push str.__end_CDMA_Comm_Thread..
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
ret
Function at 0x407f30
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x40
push esi
mov esi, ecx
cmp dword [esi + 0x1d8], 1
je 0x40803b
mov eax, dword [esi + 0x7c]
push ebx
cmp eax, 2
push ebp
jne 0x407fec
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push str.StdSpeedClient
push 0
call edi
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov ebp, dword [sym.imp.KERNEL32.dll_WinExec]
test eax, eax
mov dword [esi + 0x180], eax
jne 0x407f9b
lea eax, [esi + 0x43cc]
push str.StdSpeedClient
push eax
lea ecx, [esp + 0x18]
push str._s__s.exe
push ecx
call ebx
add esp, 0x10
lea edx, [esp + 0x10]
push 1
push edx
call ebp
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.StdSpeedServer
push 0
call edi
test eax, eax
mov dword [esi + 0x184], eax
pop edi
jne 0x40802f
lea eax, [esi + 0x43cc]
push str.StdSpeedServer
push eax
lea ecx, [esp + 0x14]
push str._s__s.exe
push ecx
call ebx
add esp, 0x10
lea edx, [esp + 0xc]
push 1
push edx
call ebp
pop ebp
mov dword [esi + 0x1c4], 1
pop ebx
pop esi
add esp, 0x40
ret
push str.StdSignalClient
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
mov dword [esi + 0x188], eax
jne 0x40802f
lea eax, [esi + 0x43cc]
push str.StdSignalClient
push eax
lea ecx, [esp + 0x14]
push str._s__s.exe
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0xc]
push 1
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
pop ebp
mov dword [esi + 0x1c4], 1
pop ebx
pop esi
add esp, 0x40
ret

Function at 0x4080c0
Capabilities:
Print debug messages

Disassembly:
sub esp, 0xa0
push ebx
mov ebx, ecx
mov eax, dword [ebx + 0x8c]
test eax, eax
je 0x40812f
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
mov ecx, 8
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push str.AT_SMSMT1_
push eax
call esi
lea ecx, [esp + 0x14]
lea edx, [esp + 0x34]
push ecx
push 0xd
push str.MAKE_SMS_:_S:_d__D:_s
push edx
mov byte [esp + 0x2f], 0xd
mov byte [esp + 0x30], 0xa
call esi
add esp, 0x18
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea ecx, [esp + 0xc]
push 0xd
push ecx
mov ecx, ebx
call fcn.00408660
pop edi
pop esi
pop ebx
add esp, 0xa0
ret
Function at 0x408540
Capabilities:
Print debug messages

Disassembly:
sub esp, 0x294
xor eax, eax
push ebx
push esi
mov ebx, ecx
push edi
mov ecx, 0x80
lea edi, [esp + 0xa0]
mov edx, dword [ebx + 0x108]
sub esp, 0x14
rep stosd dword es:[edi], eax
lea esi, [ebx + 0x198]
mov ecx, 5
mov edi, esp
lea eax, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [esp + 0xb8]
push 0x200
push ecx
push edx
lea ecx, [ebx + 0xec]
call fcn.00406380
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x40864e
cmp eax, 0x200
jg 0x40864e
mov ecx, dword [ebx + 0x8c]
test ecx, ecx
je 0x40864e
push eax
lea eax, [esp + 0xa4]
push eax
lea ecx, [esp + 0x28]
push str.READ_:_s__d_
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
xor eax, eax
mov ecx, dword [esp + 0xa0]
mov dword [esp + 0x10], eax
mov dx, word [esp + 0xa4]
mov dword [esp + 0x14], eax
push str._008:0
mov dword [esp + 0x1c], eax
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], eax
lea eax, [esp + 0x14]
push eax
mov word [esp + 0x1c], dx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
jne 0x408631
mov ecx, ebx
call fcn.004080c0
pop edi
pop esi
pop ebx
add esp, 0x294
ret 4
mov eax, dword [esp + 0xc]
cmp eax, 0x1e
jle 0x40864e
lea ecx, [esp + 0xa2]
push eax
push ecx
mov ecx, dword [ebx + 0x104]
call fcn.004012f0
pop edi
pop esi
pop ebx
add esp, 0x294
ret 4

Function at 0x408660
Capabilities:
Print debug messages

Disassembly:
mov eax, ecx
sub esp, 0x84
mov edx, dword [eax + 0x108]
push ebx
push esi
push edi
test edx, edx
jne 0x408683
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x84
ret 8
mov ebx, dword [esp + 0x98]
test ebx, ebx
jne 0x40869c
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x84
ret 8
sub esp, 0x14
lea esi, [eax + 0x1ac]
mov ecx, 5
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0xa8]
lea ecx, [esp + 0x20]
push ecx
push ebx
push esi
push edx
lea ecx, [eax + 0xec]
call fcn.004063f0
push esi
push ebx
lea edx, [esp + 0x18]
push str.Write_SMS_READ_:_S:_d__D:_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x84
ret 8
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x409840
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov eax, dword [0x40e300]
cmp ebx, eax
jae 0x40986d
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x40e304]
test byte [edx + eax*8 + 4], 1
jne 0x40987f
mov dword [0x40d334], 9
or eax, 0xffffffff
jmp 0x40999c
push 1
push 0
push ebx
call fcn.00408af0
add esp, 0xc
mov esi, eax
cmp eax, 0xffffffff
je 0x4098a7
push 2
push 0
push ebx
call fcn.00408af0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x4098af
or eax, 0xffffffff
jmp 0x40999c
mov eax, dword [ebp + 0xc]
neg edi
add edi, eax
jle 0x409941
push 0x1000
push 1
call fcn.00409e10
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x40993b
push 0x8000
push ebx
call fcn.00409e70
add esp, 8
mov dword [ebp - 8], eax
mov eax, 0x1000
cmp edi, 0x1000
jge 0x4098f2
mov eax, edi
mov edx, eax
push edx
mov eax, dword [ebp - 4]
push eax
push ebx
call fcn.004074e0
add esp, 0xc
mov dword [ebp + 0xc], eax
cmp eax, 0xffffffff
jne 0x409910
or dword [ebp - 0xc], 0xffffffff
jmp 0x409922
mov eax, edi
sub eax, dword [ebp + 0xc]
mov edi, eax
mov dword [ebp - 0xc], 0
test eax, eax
jg 0x4098e3
mov eax, dword [ebp - 8]
push eax
push ebx
call fcn.00409e70
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.004040b0
pop ecx
jmp 0x40998d
or dword [ebp - 0xc], 0xffffffff
jmp 0x40998d
mov dword [ebp - 0xc], 0
test edi, edi
jge 0x40998d
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00408af0
add esp, 0xc
cmp eax, 0xffffffff
jne 0x409966
or dword [ebp - 0xc], 0xffffffff
jmp 0x40998d
push ebx
call fcn.00407980
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0xc], 0
test eax, eax
jne 0x40998d
mov dword [0x40d334], 0xd
or dword [ebp - 0xc], 0xffffffff
push 0
push esi
push ebx
call fcn.00408af0
add esp, 0xc
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6f1a0a3f
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x5adc7fe6
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402140
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0040bab0
push ebx
push esi
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0x1000
push ecx
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
mov esi, dword [esp + 0x1014]
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupSetDirectoryIdA]
lea edx, [esp + 0x10]
push edx
push 0x101d0
push esi
call ebx
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
push 0x1000
push ecx
push 1
push 0
push 0
call sub.WINSPOOL.DRV_GetPrintProcessorDirectoryA
lea edx, [esp + 0x10]
push edx
push 0x101d1
push esi
call ebx
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x10]
push 0x1000
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
push ecx
push 0x101d2
push esi
call ebx
pop edi
pop esi
mov al, 1
pop ebx
add esp, 0x1004
ret 4

Function at 0x402230
Capabilities:
Copy file

Disassembly:
mov eax, 0x1000
call fcn.0040bab0
push ebx
push ebp
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
push str.kernel32.dll
xor bl, bl
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
je 0x4022f3
push esi
push str.MoveFileExA
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4022dd
mov edi, dword [esp + 0x1018]
lea eax, [esp + 0x10]
push eax
push edi
call fcn.00402bb0
add esp, 8
test al, al
je 0x4022dd
lea ecx, [esp + 0x10]
push 1
push ecx
push edi
call esi
test eax, eax
je 0x4022dd
mov edx, dword [esp + 0x1014]
push 0
push edi
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x4022d3
push 4
lea eax, [esp + 0x14]
push 0
push eax
mov bl, 1
call esi
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
mov al, bl
pop ebp
pop ebx
add esp, 0x1000
ret 8
push 1
lea ecx, [esp + 0x14]
push edi
push ecx
call esi
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop esi
pop edi
mov al, bl
pop ebp
pop ebx
add esp, 0x1000
ret 8
pop edi
mov al, bl
pop ebp
pop ebx
add esp, 0x1000
ret 8
Function at 0x402310
Capabilities:
Copy file

Disassembly:
mov eax, 0x3008
call fcn.0040bab0
push ebx
push ebp
push esi
mov ebp, ecx
push edi
mov esi, dword [esp + 0x301c]
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x1018]
rep stosd dword es:[edi], eax
mov ecx, 0x400
lea edi, [esp + 0x2018]
rep stosd dword es:[edi], eax
mov ecx, 0x400
lea edi, [esp + 0x18]
test esi, esi
rep stosd dword es:[edi], eax
je 0x40239d
mov ebx, dword [esp + 0x3020]
test ebx, ebx
je 0x40239d
lea eax, [esp + 0x10]
push eax
call fcn.00402c60
mov eax, dword [esp + 0x18]
add esp, 4
cmp eax, 0xa
jne 0x40239d
lea ecx, [esp + 0x18]
push ecx
push esi
call fcn.00402bb0
add esp, 8
test al, al
jne 0x4023ac
push str.Get_Temp_File_Name_fail__
add ebp, 0x3218
push 0
push ebp
call fcn.00404400
add esp, 0xc
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x3008
ret 8
lea edx, [esp + 0x18]
push 1
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
je 0x40239d
lea eax, [esp + 0x1018]
push 0x1000
lea ecx, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x40241c
lea edx, [esp + 0x18]
push edx
push str.Get_Short_Path_Name_fail_____s_
push eax
lea eax, [ebp + 0x3218]
push eax
call fcn.00404400
lea edi, [esp + 0x28]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1018]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x2018]
push 0x1000
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
jne 0x402470
push ebx
push str.Get_Short_Path_Name_fail_____s_
add ebp, 0x3218
push eax
push ebp
call fcn.00404400
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x2018]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1018]
push str.wininit.ini
lea edx, [esp + 0x201c]
push ecx
push edx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x3008
ret 8
Function at 0x4024a0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x100c
call fcn.0040bab0
push ebx
push esi
mov esi, dword [ecx + 0x3564]
push edi
test esi, esi
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
je 0x402566
mov eax, dword [esp + 0x1020]
sub eax, 0
je 0x402572
sub eax, 2
jne 0x402566
mov esi, dword [ecx + 0x3568]
mov ebx, str.ConditionFileCnt
mov edi, str.C_File__d
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push 0
push ebx
push esi
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x18]
push eax
push edi
push ecx
call fcn.0040badf
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x1028]
add esp, 0xc
inc ecx
mov dword [esp + 0xc], ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
dec ecx
push ecx
push edx
push 1
lea edx, [esp + 0x24]
push eax
push edx
push esi
call edi
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ebx
push esi
call edi
pop edi
pop esi
pop ebx
add esp, 0x100c
ret 8
mov ebx, str.NormalFileCnt
mov edi, str.File__d
jmp 0x4024f4
Function at 0x402630
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x832c
call fcn.0040bab0
push esi
lea eax, [esp + 0x1c]
push edi
push eax
call fcn.00402c60
mov eax, dword [esp + 0x28]
add esp, 4
cmp eax, 0xa
jne 0x4027e4
mov esi, dword [esp + 0x8338]
lea ecx, [esp + 0x12c]
push 0x104
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x402682
lea edx, [esp + 0x12c]
mov dword [esp + 0xc], edx
jmp 0x402686
mov dword [esp + 0xc], esi
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x230]
push eax
push str.NUL_s
push ecx
call fcn.0040badf
add esp, 0xc
lea edx, [esp + 0x334]
mov ecx, 0x2000
xor eax, eax
push str.wininit.ini
lea edi, [esp + 0x338]
push 0x8000
push edx
rep stosd dword es:[edi], eax
push str.rename
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
xor esi, esi
mov dword [esp + 0x18], eax
cmp eax, esi
je 0x4027e4
mov al, byte [esp + 0x334]
mov dword [esp + 0x14], esi
test al, al
mov dword [esp + 0x10], esi
je 0x4027e4
lea edx, [esp + 0x334]
push ebx
push ebp
mov dword [esp + 0x10], edx
jmp 0x402705
mov edx, dword [esp + 0x10]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x238]
mov ebx, ecx
push eax
push edx
inc ebx
call fcn.0040ff20
add esp, 8
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x24], eax
je 0x4027a2
lea ecx, [ebx + esi]
mov al, byte [esp + ecx + 0x33c]
lea ebp, [esp + ecx + 0x33c]
test al, al
je 0x402780
mov edx, dword [esp + 0x14]
push 0x418ea8
push edx
lea eax, [esp + 0x38]
push 0x41448c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edi, [esp + 0x30]
mov esi, ebp
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
mov esi, dword [esp + 0x18]
je 0x4027a2
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
sub eax, ebx
sub eax, esi
inc eax
push eax
push ebp
push ecx
call fcn.0040bc90
add esp, 0xc
mov dword [esp + 0x1c], 1
xor ebx, ebx
add esi, ebx
mov dword [esp + 0x18], esi
mov cl, byte [esp + esi + 0x33c]
lea eax, [esp + esi + 0x33c]
test cl, cl
mov dword [esp + 0x10], eax
jne 0x402701
mov eax, dword [esp + 0x1c]
pop ebp
test eax, eax
pop ebx
je 0x4027e4
lea edx, [esp + 0x334]
push str.wininit.ini
push edx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionA]
pop edi
pop esi
add esp, 0x832c
ret 4
Function at 0x402960
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x411df0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x10], esp
push ebx
push edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
jbe 0x4029e7
push esi
call fcn.0040bfc5
add esp, 4
mov ebx, eax
push ebx
push esi
push 0
push edi
call sub.VERSION.dll_GetFileVersionInfoA
cmp eax, 1
jne 0x4029de
lea eax, [ebp - 0x18]
lea ecx, [ebp + 8]
push eax
push ecx
push 0x41449c
push ebx
call sub.VERSION.dll_VerQueryValueA
cmp eax, 1
jne 0x4029de
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, 0xd
mov dword [ebp - 0x14], eax
rep movsd dword es:[edi], dword [esi]
push ebx
call fcn.0040ba96
add esp, 4
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402bb0
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1004
call fcn.0040bab0
push ebx
push esi
mov esi, dword [esp + 0x1010]
push edi
mov ecx, 0x400
xor eax, eax
lea edi, [esp + 0x10]
mov dword [esp + 0xc], eax
test esi, esi
rep stosd dword es:[edi], eax
je 0x402c54
mov ebx, dword [esp + 0x1018]
test ebx, ebx
je 0x402c54
lea eax, [esp + 0x10]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x402c54
push 0x5c
push esi
call fcn.0040c0e0
mov edx, eax
add esp, 8
test edx, edx
je 0x402c20
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ecx, [ecx + esi - 1]
cmp edx, ecx
je 0x402c20
inc edx
jmp 0x402c22
mov edx, esi
push 3
push edx
lea edx, [esp + 0x14]
push edx
call fcn.0040bfe0
add esp, 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push ebx
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
pop edi
pop esi
setne al
pop ebx
add esp, 0x1004
ret
pop edi
pop esi
xor al, al
pop ebx
add esp, 0x1004
ret