joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40466a
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xa6c
mov dword [ebp - 0xa54], 0
lea eax, [ebp - 0xa3c]
mov dword [esp + 8], eax
mov dword [esp + 4], str.SOFTWAREHoltek_Inc.
mov dword [esp], 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyA
sub esp, 0xc
test eax, eax
jne 0x4048c9
mov dword [ebp - 0xa50], 0
mov byte [ebp - 0xa38], 0
jmp 0x404839
lea eax, [ebp - 0xa40]
mov dword [esp + 8], eax
lea eax, [ebp - 0x128]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa3c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyA
sub esp, 0xc
mov esi, 0
jmp 0x4047f8
lea eax, [ebp - 0xa44]
mov dword [esp + 8], eax
lea eax, [ebp - 0x238]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xa40]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegOpenKeyA
sub esp, 0xc
mov dword [ebp - 0xa48], 0x7e0
lea eax, [ebp - 0xa48]
mov dword [esp + 0x14], eax
lea ebx, [ebp - 0xa38]
mov dword [esp + 0x10], ebx
lea eax, [ebp - 0xa4c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0
mov dword [esp + 4], 0x460953
mov eax, dword [ebp - 0xa44]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4047e7
cmp dword [ebp - 0xa4c], 1
jne 0x4047e7
mov edi, ebx
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [ebx + ecx], 0x6e69625c
mov dword [ebx + ecx + 4], 0x2d74685c
mov dword [ebx + ecx + 8], 0x33656469
mov dword [ebx + ecx + 0xc], 0x2e303030
mov dword [ebx + ecx + 0x10], 0x696e69
cmp dword [ebp - 0xa54], 0
jne 0x4047bc
mov dword [esp], str.__InstDir__binhtkc.exe_
call fcn.00403af3
mov dword [ebp - 0xa54], eax
lea eax, [ebp - 0xa38]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 0xa54]
mov dword [esp + 8], eax
mov dword [esp + 4], str.COMPILER
mov dword [esp], str.Hi_Tech
call sub.KERNEL32.dll_WritePrivateProfileStringA
sub esp, 0x10
mov eax, dword [ebp - 0xa44]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [esp + 0xc], 0x105
lea eax, [ebp - 0x238]
mov dword [esp + 8], eax
mov dword [esp + 4], esi
inc esi
mov eax, dword [ebp - 0xa40]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyA
sub esp, 0x10
test eax, eax
je 0x4046ee
mov eax, dword [ebp - 0xa40]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov dword [esp + 0xc], 0x105
lea eax, [ebp - 0x128]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0xa50]
mov dword [esp + 4], eax
inc eax
mov dword [ebp - 0xa50], eax
mov eax, dword [ebp - 0xa3c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegEnumKeyA
sub esp, 0x10
test eax, eax
je 0x4046bf
mov eax, dword [ebp - 0xa3c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
cmp byte [ebp - 0xa38], 0
je 0x4048c9
lea ebx, [ebp - 0xa38]
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call sub.msvcrt.dll_strrchr
mov dword [ebp - 0xa54], eax
test eax, eax
je 0x4048c9
mov dword [eax], 0x6578652e
mov byte [eax + 4], 0
mov dword [esp + 4], ebx
mov dword [esp], 0x460981
call fcn.00403954
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x405ab8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov dword [esp], str._SerialPrefix__SerialNo_
call fcn.00403af3
mov edi, eax
mov dword [esp], str._InstDir__SerialPrefix__SerialNo__activation_request.txt
call fcn.00403af3
mov esi, eax
mov dword [esp], eax
call fcn.00412842
test eax, eax
je 0x405afa
mov dword [esp], esi
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
call fcn.00403a9e
mov edx, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00410e6d
mov ebx, eax
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov dword [esp], edi
call sub.msvcrt.dll_free
mov eax, ebx
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x4069a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x824
lea eax, [ebp - 0x808]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x800
mov dword [esp + 4], 0xd
mov eax, dword [0x471310]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
cmp byte [ebp - 0x808], 0
je 0x4069ef
cmp byte [ebp - 0x807], 0x3a
jne 0x4069ef
mov word [ebp - 0x806], 0x5c
lea ebx, [ebp - 0x808]
mov dword [esp], ebx
call fcn.004086a0
mov dword [esp + 0xc], eax
mov dword [esp + 8], str.Space_available:__lu_MB
mov dword [esp + 4], 0x800
mov dword [esp], ebx
call fcn.0044e850
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov eax, dword [0x471330]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
call fcn.00408f2e
mov edx, 0
push edx
push eax
fild qword [esp]
lea esp, [esp + 8]
fmul dword [0x46174c]
fstp qword [esp + 0xc]
mov dword [esp + 8], str.Space_required:__.1f_MB
mov dword [esp + 4], 0x800
mov dword [esp], ebx
call fcn.0044e850
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc
mov eax, dword [0x471340]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x4086a0
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x44
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0xc]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x14]
mov dword [esp + 8], eax
lea eax, [ebp - 0x18]
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.KERNEL32.dll_GetDiskFreeSpaceA
sub esp, 0x14
test al, al
je 0x4086e3
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x14]
mov dword [0x471430], eax
jmp 0x4086ed
mov dword [0x471430], 0x1000
mov dword [esp], str.kernel32.dll
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
mov dword [esp + 4], str.GetDiskFreeSpaceExA
mov dword [esp], eax
call sub.KERNEL32.dll_GetProcAddress
sub esp, 8
mov edx, eax
test eax, eax
je 0x40874e
lea eax, [ebp - 0x20]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x28]
mov dword [esp + 8], eax
lea eax, [ebp - 0x30]
mov dword [esp + 4], eax
mov dword [esp], ebx
call edx
sub esp, 0x10
test al, al
je 0x40874e
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x2c]
test edx, edx
jns 0x408748
add eax, 0xfffff
adc edx, 0
shrd eax, edx, 0x14
jmp 0x408753
mov eax, 0
mov ebx, dword [ebp - 4]
leave
ret
Function at 0x40910c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x202c
call fcn.0044e410
mov esi, dword [ebp + 0x10]
mov dword [esp + 4], 0x4628e5
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov dword [ebp - 0x201c], eax
test eax, eax
jne 0x409162
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Cant_open_file:__s_n_s
call fcn.00401520
mov dword [esp + 4], 0x4628ff
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
jne 0x4091a1
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp], eax
call sub.msvcrt.dll_strerror
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Cant_create_file:__s_n_s
call fcn.00401520
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov dword [esp + 4], eax
mov eax, dword [0x4714a0]
mov dword [esp], eax
call fcn.00412bb1
cmp dword [0x471410], 0
je 0x4091f7
mov eax, dword [0x471420]
add eax, 0x2000
mov dword [0x471420], eax
mov dword [esp + 4], 0
add eax, dword [0x471410]
dec eax
mov edx, 0
div dword [0x471410]
mov dword [esp], eax
call fcn.0040d1e1
test esi, esi
je 0x4092be
mov ebx, 0x2000
cmp esi, 0x2000
ja 0x40920e
mov ebx, esi
mov eax, dword [ebp - 0x201c]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, ebx
je 0x409249
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.short_read_on__s
call fcn.00401520
mov dword [esp + 0xc], edi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, ebx
je 0x40927e
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], str.Write_error_on__s
call fcn.00401520
cmp dword [0x471410], 0
je 0x4092b6
mov eax, ebx
add eax, dword [0x471420]
mov dword [0x471420], eax
mov dword [esp + 4], 0
add eax, dword [0x471410]
dec eax
mov edx, 0
div dword [0x471410]
mov dword [esp], eax
call fcn.0040d1e1
sub esi, ebx
jne 0x4091ff
mov eax, dword [ebp - 0x201c]
mov dword [esp], eax
call sub.msvcrt.dll_fclose
mov dword [esp], edi
call sub.msvcrt.dll_fclose
add esp, 0x202c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4092df
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x202c
call fcn.0044e410
mov ebx, dword [ebp + 0xc]
mov edi, 0
cmp dword [ebp + 8], 0
je 0x4093b9
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll__strdup
mov dword [esp + 4], eax
mov eax, dword [0x4714a0]
mov dword [esp], eax
call fcn.00412bb1
jmp 0x409366
call sub.msvcrt.dll__errno
cmp dword [eax], 0xd
jne 0x409348
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.The_file__s_cannot_be_written_to___nclose_any_other_applications_that_may_be_using_it
mov dword [esp], str.Cant_create_file
call fcn.004012d2
test al, al
jne 0x409366
call sub.msvcrt.dll__errno
mov eax, dword [eax]
mov dword [esp + 8], eax
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Cant_create_file:__s_nError__d
call fcn.00401520
mov dword [esp + 4], 0x4628ff
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov edi, eax
test eax, eax
je 0x40931f
cmp dword [0x471410], 0
je 0x4093b9
mov eax, dword [0x471420]
add eax, 0x2000
mov dword [0x471420], eax
mov dword [esp + 4], 0
add eax, dword [0x471410]
dec eax
mov edx, 0
div dword [0x471410]
mov dword [esp], eax
call fcn.0040d1e1
call fcn.0040876c
mov esi, eax
cmp eax, ebx
je 0x4093e8
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], ebx
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov eax, dword [0x471440]
mov dword [esp + 4], eax
mov dword [esp], str.File_size_does_not_match___file__d:_s__ld__ld
call fcn.00401520
test esi, esi
je 0x40949f
mov ebx, 0x2000
cmp esi, 0x2000
ja 0x4093ff
mov ebx, esi
mov dword [esp + 8], ebx
lea eax, [ebp - 0x2018]
mov dword [esp + 4], eax
mov eax, dword [0x4743a0]
mov dword [esp], eax
call fcn.00415d0d
mov ebx, eax
test eax, eax
jg 0x409425
call fcn.00408758
test edi, edi
je 0x409497
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
lea eax, [ebp - 0x2018]
mov dword [esp], eax
call sub.msvcrt.dll_fwrite
cmp eax, 1
je 0x40945f
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
mov dword [esp], str.Write_error_on__s
call fcn.00401520
cmp dword [0x471410], 0
je 0x409497
mov eax, ebx
add eax, dword [0x471420]
mov dword [0x471420], eax
mov dword [esp + 4], 0
add eax, dword [0x471410]
dec eax
mov edx, 0
div dword [0x471410]
mov dword [esp], eax
call fcn.0040d1e1
sub esi, ebx
jne 0x4093f0
test edi, edi
je 0x4094ab
mov dword [esp], edi
call sub.msvcrt.dll_fclose
inc dword [0x471440]
add esp, 0x202c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4094bc
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1018
call fcn.0044e410
mov dword [ebp - 8], ebx
mov dword [ebp - 4], esi
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesA
sub esp, 4
cmp eax, 0xffffffff
jne 0x409576
mov dword [esp + 8], 0x1000
mov dword [esp + 4], ebx
lea esi, [ebp - 0x1008]
mov dword [esp], esi
call sub.msvcrt.dll_strncpy
mov byte [ebp - 9], 0
mov dword [esp + 4], 0x5c
mov dword [esp], esi
call sub.msvcrt.dll_strrchr
mov edx, eax
test eax, eax
je 0x40952f
lea eax, [ebp - 0x1006]
cmp eax, edx
jae 0x40952f
mov byte [edx], 0
mov dword [esp], esi
call fcn.004094bc
mov dword [esp + 4], 0
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
test al, al
jne 0x409556
mov dword [esp + 4], ebx
mov dword [esp], str.Failed_to_create_folder__s
call fcn.00401520
mov dword [esp], ebx
call sub.msvcrt.dll__strdup
mov dword [esp + 4], eax
mov eax, dword [0x4714b0]
mov dword [esp], eax
call fcn.00412bb1
mov eax, 1
jmp 0x40958f
test al, 0x10
jne 0x40958a
mov dword [esp + 4], ebx
mov dword [esp], str.Folder__s_exists_but_is_not_a_folder_
call fcn.00401520
mov eax, 0
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x409599
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
lea edi, [ebp - 0x58]
cld
mov ecx, 0xf
mov eax, 0
rep stosd dword es:[edi], eax
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x40
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x4c], 0x462a3a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 5
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.SHELL32.DLL_ShellExecuteExA
sub esp, 4
mov edx, 0
test al, al
je 0x409789
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x7c], eax
mov dword [esp], 0
call sub.msvcrt.dll_time
mov esi, eax
mov ebx, 1
mov dword [esp], 0
call sub.msvcrt.dll_time
sub eax, esi
cmp eax, 1
jle 0x409658
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0040d1e1
mov dword [esp], 0
call sub.msvcrt.dll_time
mov esi, eax
inc ebx
cmp ebx, 0x61
jle 0x4096d1
mov ebx, 0x62
jmp 0x4096d1
lea edi, [ebp - 0x78]
mov dword [esp + 4], edi
mov eax, dword [0x474310]
mov dword [esp], eax
call sub.USER32.dll_IsDialogMessageA
sub esp, 8
test al, al
jne 0x409695
mov dword [esp], edi
call sub.USER32.dll_TranslateMessage
sub esp, 4
mov dword [esp], edi
call sub.USER32.dll_DispatchMessageA
sub esp, 4
mov dword [esp], 0
call sub.msvcrt.dll_time
sub eax, esi
cmp eax, 1
jle 0x4096c7
mov dword [esp + 4], 0
mov dword [esp], ebx
call fcn.0040d1e1
mov dword [esp], 0
call sub.msvcrt.dll_time
mov esi, eax
inc ebx
cmp ebx, 0x61
jle 0x4096d1
mov ebx, 0x62
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea eax, [ebp - 0x78]
mov dword [esp], eax
call sub.USER32.dll_PeekMessageA
sub esp, 0x14
test al, al
jne 0x409664
mov dword [esp + 0x10], 0xff
mov dword [esp + 0xc], 0x7d0
mov dword [esp + 8], 0
lea eax, [ebp - 0x7c]
mov dword [esp + 4], eax
mov dword [esp], 1
call sub.USER32.dll_MsgWaitForMultipleObjects
sub esp, 0x14
cmp eax, 1
sete dl
cmp eax, 0x102
sete al
or eax, edx
test al, 1
jne 0x409626
mov dword [esp + 4], 0
mov dword [esp], 0x64
call fcn.0040d1e1
lea eax, [ebp - 0x80]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x20]
mov dword [esp], eax
call sub.KERNEL32.dll_GetExitCodeProcess
sub esp, 8
mov edx, 0
test al, al
je 0x409789
cmp dword [ebp - 0x80], 0
sete al
movzx edx, al
mov eax, edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a702
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
mov dword [esp + 4], 0x462e17
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
mov edi, eax
mov eax, 0
test edi, edi
je 0x40a76c
mov dword [esp], ebx
call fcn.004090e4
mov ebx, eax
lea eax, [eax + 1]
mov dword [esp], eax
call fcn.004131ff
mov esi, eax
mov dword [esp + 0xc], edi
mov dword [esp + 8], 1
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.msvcrt.dll_fread
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov byte [esi + ebx], 0
mov eax, esi
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x40bc5d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov eax, 0x408c
call fcn.0044e410
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x4088]
mov dword [esp], eax
call fcn.0041e2e0
mov dword [esp + 8], 0
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll__lseek
test esi, esi
je 0x40bcf8
mov ebx, 0x4000
cmp esi, 0x4000
ja 0x40bcab
mov ebx, esi
mov dword [esp + 8], ebx
lea edi, [ebp - 0x4018]
mov dword [esp + 4], edi
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, ebx
jne 0x40bce4
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
lea eax, [ebp - 0x4088]
mov dword [esp], eax
call fcn.0041deb0
sub esi, ebx
jne 0x40bc9c
jmp 0x40bcf8
test esi, esi
je 0x40bcf8
mov dword [esp + 4], esi
mov dword [esp], str.Cant_read_entire_filecheck:__ld
call fcn.00401520
lea eax, [ebp - 0x4088]
mov dword [esp + 4], eax
lea eax, [ebp - 0x4028]
mov dword [esp], eax
call fcn.0041e200
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x4018]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.msvcrt.dll__read
cmp eax, 0x10
je 0x40bd42
mov dword [esp + 4], eax
mov dword [esp], str.Cant_read_filecheck:__d
call fcn.00401520
mov ebx, 0
movzx eax, byte [ebp + ebx - 0x4028]
cmp al, byte [ebp + ebx - 0x4018]
je 0x40bd5d
call fcn.00408758
inc ebx
cmp ebx, 0x10
jne 0x40bd47
add esp, 0x408c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40bd6e
Capabilities:
Create directory
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x85c
mov dword [esp], 0x46338e
call sub.msvcrt.dll_getenv
mov esi, eax
test eax, eax
jne 0x40bdc9
mov dword [esp], 0x463393
call sub.msvcrt.dll_getenv
mov esi, eax
test eax, eax
jne 0x40bdc9
mov dword [esp], str.windir
call sub.msvcrt.dll_getenv
test eax, eax
je 0x40bdc4
mov dword [esp + 4], str._temp
mov dword [esp], eax
call fcn.004130c0
mov esi, eax
test eax, eax
jne 0x40bdc9
mov esi, 0x4633a4
mov ebx, 0
lea edi, [ebp - 0x848]
call sub.msvcrt.dll_rand
and eax, 0xfff
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], esi
mov dword [esp + 8], str._sht_d
mov dword [esp + 4], 0x800
mov dword [esp], edi
call fcn.0044e850
lea eax, [ebp - 0x48]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.msvcrt.dll__stat
test eax, eax
jne 0x40be17
inc ebx
cmp ebx, 0xa
jne 0x40bdd4
mov dword [esp + 4], 0
lea ebx, [ebp - 0x848]
mov dword [esp], ebx
call sub.KERNEL32.dll_CreateDirectoryA
sub esp, 8
test al, al
jne 0x40be44
mov dword [esp + 4], ebx
mov dword [esp], str.Failed_to_create_folder__s
call fcn.00401520
lea eax, [ebp - 0x848]
mov dword [esp + 4], eax
mov dword [esp], str.TmpDir
call fcn.00403954
mov dword [esp + 4], eax
mov eax, dword [0x471490]
mov dword [esp], eax
call fcn.00412bb1
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40c40d
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
cmp dword [0x471490], 0
je 0x40c470
mov eax, dword [0x471490]
mov dword [esp], eax
call fcn.00412f7b
mov esi, eax
dec esi
cmp esi, 0xffffffff
je 0x40c470
mov dword [esp + 4], esi
mov eax, dword [0x471490]
mov dword [esp], eax
call fcn.00412f38
mov ebx, eax
mov dword [esp], eax
call fcn.00412864
test eax, eax
je 0x40c45f
mov dword [esp], ebx
call sub.KERNEL32.dll_RemoveDirectoryA
sub esp, 4
jmp 0x40c46a
mov dword [esp], ebx
call sub.KERNEL32.dll_DeleteFileA
sub esp, 4
dec esi
cmp esi, 0xffffffff
jne 0x40c433
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
Function at 0x40d1e1
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x84c
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [esp], 0x4636b3
call fcn.00403c85
test al, al
jne 0x40d436
cmp esi, 0xffffffff
jne 0x40d22d
mov dword [esp + 4], 0
mov eax, dword [0x4715a0]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov byte [0x471570], 1
jmp 0x40d279
cmp byte [0x471570], 0
je 0x40d255
mov dword [esp + 4], 5
mov eax, dword [0x4715a0]
mov dword [esp], eax
call sub.USER32.dll_ShowWindow
sub esp, 8
mov byte [0x471570], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x402
mov eax, dword [0x4715a0]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
test ebx, ebx
je 0x40d3d3
mov eax, dword [0x471590]
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextLengthA
sub esp, 4
mov esi, eax
cmp eax, 0x2710
jle 0x40d2fa
mov dword [esp + 0xc], eax
lea eax, [eax - 0x1388]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xb1
mov eax, dword [0x471590]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0x463783
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc2
mov eax, dword [0x471590]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov eax, dword [0x471590]
mov dword [esp], eax
call sub.USER32.dll_GetWindowTextLengthA
sub esp, 4
mov esi, eax
mov edi, esi
cmp byte [ebx], 0xd
jne 0x40d308
sub edi, dword [0x471580]
inc ebx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], str._s_r_n
mov dword [esp + 4], 0x800
lea ebx, [ebp - 0x818]
mov dword [esp], ebx
call fcn.0044e850
mov dword [esp + 0xc], esi
mov dword [esp + 8], edi
mov dword [esp + 4], 0xb1
mov eax, dword [0x471590]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0xc2
mov eax, dword [0x471590]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0xb7
mov eax, dword [0x471590]
mov dword [esp], eax
call sub.USER32.dll_SendMessageA
sub esp, 0x10
mov dword [esp + 0xc], 0x100
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov eax, dword [0x471590]
mov dword [esp], eax
call sub.USER32.dll_RedrawWindow
sub esp, 0x10
mov edi, ebx
cld
mov ecx, 0xffffffff
mov al, 0
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [0x471580], ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea ebx, [ebp - 0x838]
mov dword [esp], ebx
call sub.USER32.dll_PeekMessageA
sub esp, 0x14
test al, al
je 0x40d436
mov dword [esp + 4], ebx
mov eax, dword [0x474310]
mov dword [esp], eax
call sub.USER32.dll_IsDialogMessageA
sub esp, 8
test al, al
jne 0x40d436
mov dword [esp], ebx
call sub.USER32.dll_TranslateMessage
sub esp, 4
mov dword [esp], ebx
call sub.USER32.dll_DispatchMessageA
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40f571
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov esi, 0
test edi, edi
je 0x40f59e
mov ecx, ebx
inc ebx
mov edx, esi
and edx, 0xf
movzx eax, byte [ecx]
xor al, byte [edx + 0x45652a]
mov byte [ecx], al
inc esi
cmp edi, esi
jne 0x40f586
pop ebx
pop esi
pop edi
pop ebp
ret