joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dd1b
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x444
mov eax, dword [0x4205cc]
xor eax, esp
mov dword [esp + 0x440], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x30
mov dword [esp + 0x18], eax
lea eax, [esp + 0x1c]
mov edi, ecx
push 0
push eax
mov dword [esp + 0x1c], edi
call fcn.0042460f
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.0041e6f1
test eax, eax
je 0x41dd6b
push 8
pop eax
jmp 0x41de63
mov eax, dword [edi + 8]
and dword [esp + 0xc], 0
test eax, eax
je 0x41de46
mov esi, 0x200
cmp dword [esp + 0xc], eax
jge 0x41ddeb
cmp dword [esp + 0x1c], 0
jne 0x41ddeb
sub eax, dword [esp + 0xc]
mov ecx, dword [0x422c88]
mov edi, eax
cmp edi, esi
mov ebx, ecx
jle 0x41dda1
mov edi, esi
mov eax, dword [esp + 0x10]
mov eax, dword [eax + 4]
add eax, dword [esp + 0xc]
push 0
push eax
push dword [ecx]
call fcn.00425002
add esp, 0xc
test eax, eax
jne 0x41de4b
push dword [ebx]
lea eax, [esp + 0x4c]
push edi
push 1
push eax
call fcn.00424f60
add esp, 0x10
test eax, eax
jle 0x41de4b
add dword [esp + 0xc], eax
mov edi, dword [esp + 0x10]
lea ecx, [esp + 0x48]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x248]
mov dword [esp + 0x28], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x2c], esi
call fcn.0041f179
mov ebx, eax
test ebx, ebx
je 0x41de0e
cmp ebx, 4
jne 0x41de46
cmp dword [esp + 0x2c], esi
jae 0x41de36
push dword [esp + 0x14]
mov eax, esi
sub eax, dword [esp + 0x30]
push 1
push eax
lea eax, [esp + 0x254]
push eax
call fcn.004247e8
add esp, 0x10
cmp eax, 1
jne 0x41de52
cmp ebx, 4
je 0x41de56
mov eax, dword [edi + 8]
test eax, eax
jne 0x41dd80
push 8
pop edi
jmp 0x41de58
push 6
jmp 0x41dd65
push 7
jmp 0x41de48
xor edi, edi
lea esi, [esp + 0x18]
call fcn.0041f2c5
mov eax, edi
mov ecx, dword [esp + 0x44c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00421440
mov esp, ebp
pop ebp
ret 4
Function at 0x41e4e4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push dword [edi]
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x14]
push 4
push eax
call fcn.00424f60
add esp, 0x10
cmp eax, ebx
je 0x41e50b
or eax, 0xffffffff
jmp 0x41e5d9
push 4
lea eax, [ebp - 0x14]
push 0x41e1fc
push eax
call fcn.00422f87
add esp, 0xc
test eax, eax
jne 0x41e503
push dword [edi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00424f60
add esp, 0x10
cmp eax, ebx
jne 0x41e503
push esi
push dword [ebp - 0xc]
mov esi, dword [0x41c234]
call esi
push 0
push eax
push dword [edi]
mov dword [ebp - 0xc], eax
call fcn.00425002
add esp, 0xc
test eax, eax
jne 0x41e59d
push dword [edi]
lea eax, [ebp - 4]
push ebx
push 4
push eax
call fcn.00424f60
add esp, 0x10
cmp eax, ebx
jne 0x41e59d
push dword [ebp - 4]
call esi
push eax
mov dword [ebp - 4], eax
call fcn.004228a6
mov ebx, eax
test ebx, ebx
pop ecx
je 0x41e59d
push dword [edi]
push 1
push dword [ebp - 4]
push ebx
call fcn.00424f60
add esp, 0x10
cmp eax, 1
je 0x41e5a2
push ebx
call fcn.00422467
pop ecx
or eax, 0xffffffff
jmp 0x41e5d8
mov eax, dword [ebp - 4]
add eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 8], eax
jae 0x41e5c5
push eax
push edi
lea esi, [ebp - 8]
call fcn.0041e443
test eax, eax
pop ecx
pop ecx
je 0x41e5ad
push ebx
call fcn.00422467
pop ecx
mov ecx, dword [ebp - 0x10]
xor eax, eax
cmp dword [ebp - 8], ecx
sete al
dec eax
pop esi
pop ebx
leave
ret

Function at 0x41e6a7
Capabilities:
Terminate process

Disassembly:
push 0x41e4a4
push dword [esp + 8]
push 0x41e298
call fcn.00422a2a
add eax, 0x40
push eax
call fcn.0042228d
add esp, 0x10
push 3
call fcn.00425697
int3
Function at 0x23c5112c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
push dword [ebp + 0xc]
mov edi, 0x23c6468c
push edi
call fcn.23c513e5
push 0x40
push 0x23c5f210
push edi
push edi
call fcn.23c51341
add esp, 0x1c
cmp byte [ebp + 0x14], 0
jne 0x23c511b0
mov ebx, dword [ebp + 0x10]
mov dword [ebp + 0x14], 0x10
mov esi, 0x23c645ec
push 0x20
push dword [0x23c61054]
push esi
call fcn.23c57370
push ebx
push dword [0x23c61054]
call fcn.23c512a9
push 0x20
push dword [0x23c61050]
push dword [0x23c61054]
call fcn.23c51389
push 0x20
push esi
push dword [0x23c61050]
call fcn.23c57370
add esp, 0x2c
add ebx, 0x30
dec dword [ebp + 0x14]
jne 0x23c51168
jmp 0x23c5120b
mov eax, dword [ebp + 0x10]
mov dword [ebp + 0x14], 0x10
mov esi, 0x23c645ec
lea ebx, [eax + 0x2d0]
push 0x20
push dword [0x23c61050]
push esi
call fcn.23c57370
push ebx
push dword [0x23c61050]
call fcn.23c512a9
push 0x20
push dword [0x23c61054]
push dword [0x23c61050]
call fcn.23c51389
push 0x20
push esi
push dword [0x23c61054]
call fcn.23c57370
add esp, 0x2c
sub ebx, 0x30
dec dword [ebp + 0x14]
jne 0x23c511c5
push 0x40
push 0x23c5f250
push edi
push edi
call fcn.23c51341
push 0x40
push edi
push dword [ebp + 8]
call fcn.23c51414
add esp, 0x1c
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x23c5122c
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x40
push dword [ebp + 0xc]
mov esi, 0x23c6464c
push esi
call fcn.23c513e5
push 0x38
push str.91__
push esi
push esi
call fcn.23c51341
mov eax, dword [ebp + 8]
add esp, 0x1c
xor ebx, ebx
mov dword [ebp + 0xc], eax
movsx eax, byte [ebx + 0x23c5f348]
lea edi, [ebx + 0x23c5f348]
push eax
push 0x1c
push dword [0x23c61058]
call fcn.23c513a7
movsx eax, byte [edi]
push eax
push 0x1c
push dword [0x23c6105c]
call fcn.23c513a7
push 0x30
push 0x23c5f318
push esi
push dword [ebp + 0xc]
call fcn.23c51341
add dword [ebp + 0xc], 0x30
add esp, 0x28
inc ebx
cmp ebx, 0x10
jl 0x23c5125b
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x23c512a9
Capabilities:
Encrypt data using des

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
push 0x30
push 0x23c5f290
mov esi, 0x23c6460c
push edi
push esi
call fcn.23c51341
push 0x30
push dword [esp + 0x24]
push esi
call fcn.23c51389
push esi
push edi
call fcn.23c512e9
push 0x20
push 0x23c5f2c0
push edi
push edi
call fcn.23c51341
add esp, 0x34
pop edi
pop esi
ret

Function at 0x23c51389
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jle 0x23c513a5
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
xor byte [eax], dl
inc eax
dec esi
jne 0x23c5139c
pop esi
ret
Function at 0x23c51bb2
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push str.WebThunder
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x23c51bd5
xor eax, eax
jmp 0x23c51c36
push edi
push ebx
push 0x84200100
push ebx
push ebx
push dword [ebp + 8]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov edi, dword [sym.imp.WININET.dll_InternetCloseHandle]
cmp eax, ebx
mov dword [ebp - 8], eax
je 0x23c51c2e
lea ecx, [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 8], ebx
dec ecx
mov dword [ebp - 4], ebx
push ecx
push esi
push eax
call dword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x23c51c25
mov eax, dword [ebp - 4]
cmp eax, ebx
jbe 0x23c51c25
mov byte [eax + esi], bl
mov dword [ebp + 8], 1
push dword [ebp - 8]
call edi
mov ebx, dword [ebp + 8]
pop esi
push dword [ebp - 0xc]
call edi
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc

Function at 0x23c51d93
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.23c51dd5
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0x23c51e13
push 0
push 0
mov dword [esi + 0x190], 1
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor ecx, ecx
mov dword [esi + 0x18c], eax
test eax, eax
setne cl
mov eax, ecx
pop esi
leave
ret

Function at 0x23c51dd5
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x18c]
test eax, eax
je 0x23c51e11
and dword [esi + 0x190], 0
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x23c51e0a
push 0
push dword [esi + 0x18c]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
and dword [esi + 0x18c], 0
pop esi
ret

Function at 0x23c51e21
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
mov esi, ecx
cmp dword [esi + 0x190], 0
je 0x23c51e92
push str.ATOM_LICENSEOK
call dword [sym.imp.KERNEL32.dll_FindAtomA]
test ax, ax
jne 0x23c51e4e
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x23c51e2b
push eax
call dword [sym.imp.KERNEL32.dll_DeleteAtom]
lea eax, [ebp - 0x2c]
lea edi, [esi + 0x88]
push 0x29
push eax
push edi
lea ecx, [esi + 0x18]
call fcn.23c51f21
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.23c51a5a
test eax, eax
je 0x23c51e92
push str.XDRM:_License_acquired.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push dword [esi + 0x14]
push 0
push edi
push 4
call dword [esi + 0x10]
add esp, 0x10
pop edi
pop esi
leave
ret
Function at 0x23c51f21
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0xf014
call fcn.23c57a70
push ebx
xor ebx, ebx
push esi
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
mov dword [ebp - 0x14], ecx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp + 8], esi
jne 0x23c51f5b
xor eax, eax
jmp 0x23c52024
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, 0xf000
mov dword [ebp - 0xc], eax
cmp eax, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ebx
jae 0x23c51f94
lea ecx, [ebp - 4]
push ebx
push ecx
mov dword [ebp - 8], eax
push eax
lea eax, [ebp - 0xf014]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
jmp 0x23c51fff
push edi
lea eax, [ebp - 4]
push ebx
push eax
mov edi, 0x5000
lea eax, [ebp - 0xf014]
push edi
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
call esi
mov eax, dword [ebp - 0xc]
push ebx
push ebx
push 3
xor edx, edx
pop ecx
div ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0xa014]
push edi
push eax
push dword [ebp + 8]
call esi
mov eax, dword [ebp - 0xc]
push ebx
add eax, 0xffffb000
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x5014]
push edi
push eax
push dword [ebp + 8]
call esi
pop edi
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0xf014]
push dword [ebp + 0xc]
push dword [ebp - 8]
push eax
call fcn.23c5202a
push dword [ebp + 8]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x23c52095
Capabilities:
Hash data using sha1

Disassembly:
xor eax, eax
mov dword [ecx], 0x67452301
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], eax
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
mov dword [ecx + 0x10], 0xc3d2e1f0
push 0x40
add ecx, 0x1c
push eax
push ecx
call fcn.23c576b0
add esp, 0xc
ret
Function at 0x23c54226
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
mov esi, 0x23c64dd0
push esi
call fcn.23c57800
pop ecx
mov ecx, dword [ebp + 8]
push eax
push esi
call fcn.23c5460a
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x70]
push 0x64
push eax
push 0x23c6123c
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x23c54267
xor al, al
jmp 0x23c5428f
lea eax, [ebp - 4]
push 4
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.23c57370
mov ecx, dword [ebp + 8]
add esp, 0xc
lea eax, [ebp - 0xc]
mov byte [ebp - 8], bl
push 6
push eax
mov byte [ebp - 7], bl
call fcn.23c54295
mov al, 1
pop esi
pop ebx
leave
ret 4

Function at 0x23c54b17
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ebx
jne 0x23c54b31
xor esi, esi
jmp 0x23c54b5f
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.23c57a70
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp + 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov edi, eax
cmp edi, ebx
mov dword [ebp - 4], edi
jne 0x23c54b9c
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jg 0x23c54b87
call esi
mov esi, eax
jmp 0x23c54c31
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x23c54c31
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x23c54bcd
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
test eax, eax
jle 0x23c54be0
call esi
mov esi, eax
and esi, 0xffff
or esi, 0x80070000
jmp 0x23c54c28
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
cmp edi, ebx
mov dword [ebp + 8], edi
jne 0x23c54be4
jmp 0x23c54baf
call esi
jmp 0x23c54c26
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [esi + eax], bl
je 0x23c54c1a
lea eax, [esi + 1]
add eax, 3
and al, 0xfc
call fcn.23c57a70
lea eax, [esi + 1]
mov edi, esp
push eax
push dword [ebp + 8]
push edi
call fcn.23c57370
add esp, 0xc
mov byte [edi + esi], bl
push dword [ebp + 0x14]
lea ecx, [ebp - 0xc]
push edi
call fcn.23c54c98
mov esi, eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea esp, [ebp - 0x18]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x23c5564e
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
push 0x2001f
push dword [ebp + 8]
mov ebx, ecx
xor esi, esi
lea ecx, [ebp - 4]
push dword [ebx]
mov dword [ebp - 4], esi
call fcn.23c55610
mov edi, eax
cmp edi, esi
je 0x23c5568e
cmp dword [ebp - 4], esi
je 0x23c55687
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
jmp 0x23c5572b
lea eax, [ebp - 0x14]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 8], 0x100
push eax
push esi
push dword [ebp - 4]
call edi
test eax, eax
jne 0x23c556ff
lea eax, [ebp - 0x114]
lea ecx, [ebp - 4]
push eax
call fcn.23c5564e
cmp eax, esi
mov dword [ebp - 0xc], eax
jne 0x23c556ec
lea eax, [ebp - 0x14]
mov dword [ebp - 8], 0x100
push eax
push esi
push esi
lea eax, [ebp - 8]
push esi
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 4]
jmp 0x23c556b1
cmp dword [ebp - 4], esi
je 0x23c556fa
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xc]
jmp 0x23c5572b
cmp dword [ebp - 4], esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x23c55712
push dword [ebp - 4]
call edi
mov dword [ebp - 4], esi
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 4], esi
mov ebx, eax
je 0x23c55729
push dword [ebp - 4]
call edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x23c55732
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.23c57a70
push ebx
push esi
lea eax, [ebp - 0x2014]
push edi
mov esi, ecx
push eax
mov dword [ebp - 0x14], esi
call fcn.23c54df1
xor edi, edi
cmp eax, edi
jl 0x23c558ea
lea eax, [ebp - 0xa]
push eax
lea eax, [ebp - 0x2014]
push eax
call fcn.23c558f7
pop ecx
test eax, eax
pop ecx
jne 0x23c5577d
mov eax, 0x80020009
jmp 0x23c558ea
mov ecx, esi
call fcn.23c54dc9
lea eax, [ebp - 0x1014]
mov ecx, esi
push eax
call fcn.23c54df1
cmp eax, edi
jl 0x23c558ea
movzx eax, word [ebp - 0xa]
sub eax, 8
je 0x23c558b2
sub eax, 9
je 0x23c55817
dec eax
dec eax
jne 0x23c558d9
lea eax, [ebp - 0x1014]
test eax, eax
jne 0x23c557c2
xor ebx, ebx
jmp 0x23c557f7
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.23c57a70
mov ebx, esp
push esi
push ebx
lea eax, [ebp - 0x1014]
push 0xffffffffffffffff
push eax
push edi
push edi
mov word [ebx], di
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x10]
push eax
push edi
push edi
push ebx
call dword [sym.imp.OLEAUT32.dll_VarUI4FromDisp]
mov eax, dword [ebp - 0x10]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
jmp 0x23c558ca
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test al, 1
mov dword [ebp - 8], eax
jne 0x23c55853
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
mov eax, ebx
add eax, 3
and al, 0xfc
call fcn.23c57a70
mov dword [ebp - 4], esp
push ebx
push edi
push dword [ebp - 4]
call fcn.23c576b0
add esp, 0xc
cmp dword [ebp - 4], edi
jne 0x23c5585d
mov eax, 0x80004005
jmp 0x23c558ea
cmp dword [ebp - 8], 0
jle 0x23c55897
mov ecx, dword [ebp - 4]
mov eax, edi
cdq
sub eax, edx
sar eax, 1
lea esi, [eax + ecx]
mov al, byte [ebp + edi - 0x1014]
push eax
call fcn.23c5597e
pop ecx
mov ecx, edi
push 4
and ecx, 1
shl ecx, 2
mov edx, ecx
pop ecx
sub ecx, edx
shl al, cl
or byte [esi], al
inc edi
cmp edi, dword [ebp - 8]
jl 0x23c55863
mov eax, dword [ebp + 8]
push ebx
push dword [ebp - 4]
mov eax, dword [eax]
push 3
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor edi, edi
jmp 0x23c558d9
lea eax, [ebp - 0x1014]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x1014]
push eax
push 1
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.23c54df1
cmp eax, edi
jl 0x23c558ea
xor eax, eax
lea esp, [ebp - 0x2020]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x23c563c9
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
lea eax, [ebp - 0x400]
push str.SuperRegisterServer:
push eax
call fcn.23c57710
lea eax, [ebp - 0x400]
push eax
call fcn.23c57800
lea ecx, [ebp + 0xc]
lea eax, [ebp + eax - 0x400]
push ecx
push dword [ebp + 8]
push eax
call fcn.23c58951
add esp, 0x18
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
leave
ret

Function at 0x23c56415
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x23c56427
xor eax, eax
ret
cmp dword [esp + 8], 0
je 0x23c56432
and eax, 0x10
ret
not eax
shr eax, 4
and eax, 1
ret

Function at 0x23c5643b
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call fcn.23c57710
lea eax, [ebp - 0x104]
push eax
call fcn.23c57800
add esp, 0xc
lea eax, [ebp + eax - 0x104]
cmp byte [eax], 0x5c
je 0x23c56471
dec eax
jmp 0x23c56469
and byte [eax + 1], 0
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push str._s_
push eax
call fcn.23c5888d
lea eax, [ebp - 0x208]
push eax
push str.Will_find_all_old_files_by:__s
call fcn.23c563c9
add esp, 0x14
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x23c56518
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x30c]
push str._s_s
push eax
call fcn.23c5888d
add esp, 0x10
lea eax, [ebp - 0x30c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push eax
lea eax, [ebp - 0x30c]
push eax
push str.Delete_old_file:__s__result_d
call fcn.23c563c9
add esp, 0xc
lea eax, [ebp - 0x44c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x23c564b9
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x23c56523
push str.Not_found_old_files.
call fcn.23c563c9
pop ecx
push 1
pop eax
pop esi
leave
ret
Function at 0x23c56529
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push ebx
push esi
mov esi, str.693571CB_54A3_4E90_9D52_EEAE1334E2D3
push edi
push esi
call fcn.23c57800
test eax, eax
pop ecx
jbe 0x23c5662c
push esi
push str.CrackerIE7Blocker_for__s
call fcn.23c563c9
push esi
lea eax, [ebp - 0x118]
push str.SoftWareMicrosoftWindowsCurrentVersionExtStats_s
push eax
call fcn.23c5888d
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
add esp, 0x14
lea eax, [ebp - 0x10]
mov edi, 0x80000001
push eax
lea eax, [ebp - 0x118]
xor ebx, ebx
push eax
push edi
mov dword [ebp - 0x10], ebx
call esi
test eax, eax
jne 0x23c5662c
lea eax, [ebp - 0x118]
push str.iexplore
push eax
mov dword [ebp - 4], ebx
call fcn.23c57720
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
lea eax, [ebp - 0x118]
push eax
push edi
call esi
test eax, eax
jne 0x23c56623
push 4
lea eax, [ebp - 0x14]
pop esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 8]
push ebx
push eax
push ebx
mov ebx, str.Count
push ebx
mov dword [ebp - 0xc], esi
push dword [ebp - 4]
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
call edi
lea eax, [ebp - 0xc]
push esi
push eax
push esi
push 0
push ebx
push dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
call ebx
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push 0
push eax
push 0
push str.Flags
push dword [ebp - 4]
call edi
lea eax, [ebp - 0xc]
push esi
push eax
push esi
push 0
push str.Flags
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403165
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeW
cmp eax, edi
mov dword [ebp - 4], eax
je 0x4031f2
inc eax
push esi
push eax
call fcn.00407bac
mov esi, eax
cmp esi, edi
pop ecx
je 0x4031f1
push esi
push dword [ebp - 4]
push edi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4031ea
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x412424
push esi
mov dword [ebp - 8], edi
mov dword [ebp - 4], 0x34
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4031ea
mov eax, dword [ebp - 8]
mov cx, word [eax + 0xa]
mov edx, dword [ebp + 0xc]
mov word [edx], cx
mov cx, word [eax + 8]
mov edx, dword [ebp + 0x10]
mov word [edx], cx
mov cx, word [eax + 0xe]
mov edx, dword [ebp + 0x14]
mov word [edx], cx
mov ax, word [eax + 0xc]
mov ecx, dword [ebp + 0x18]
mov word [ecx], ax
inc edi
push esi
call fcn.004099a8
pop ecx
pop esi
mov eax, edi
pop edi
leave
ret

Function at 0x4031f7
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x3ec]
sub esp, 0x46c
mov eax, dword [0x41748c]
xor eax, ebp
mov dword [ebp + 0x3e8], eax
mov eax, dword [ebp + 0x3f4]
push str.xl_netdriver
push eax
call fcn.00403100
test eax, eax
pop ecx
pop ecx
jne 0x4032a2
push 0x104
lea eax, [ebp + 0x1e0]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.System32driversxlnetdriver.sys
lea eax, [ebp + 0x1e0]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp + 0x1e0]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
je 0x40329f
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp + 0x1e0]
push eax
call fcn.00403165
add esp, 0x14
test eax, eax
je 0x40329f
cmp word [ebp - 0x78], 1
jne 0x40329f
cmp word [ebp - 0x74], 2
ja 0x40329f
xor eax, eax
jmp 0x4032a2
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x3e8]
xor ecx, ebp
call fcn.00408736
add ebp, 0x3ec
leave
ret