joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41aef0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
push edi
push esi
sub esp, 0x68
movzx eax, byte [esp + 0x78]
mov esi, dword [esp + 0x84]
mov ebx, dword [esp + 0x7c]
mov ecx, dword [esp + 0x8c]
mov edx, dword [esp + 0x88]
mov edi, dword [esp + 0x80]
test eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
je 0x41af41
cmp eax, 1
jne 0x41afbe
mov dword [esp], 0x41f13c
jmp 0x41af48
mov dword [esp], 0x41f13a
mov edx, 2
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
jne 0x41afda
mov ecx, esp
lea edx, [esp + 8]
lea esi, [esp + 0x10]
mov dword [esp + 0x38], 0x41f178
mov dword [esp + 0x3c], 3
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], 0x419430
mov dword [esp + 0x20], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x24], 0x419410
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 0x419410
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 3
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0041ad00
mov edx, 7
mov dword [esp], 0x41f13e
mov eax, dword [esp + 0x90]
cmp dword [ecx], 0
mov dword [esp + 4], edx
je 0x41af5d
movsd xmm0, qword [ecx + 0x10]
movsd xmm2, qword [ecx]
movsd xmm1, qword [ecx + 8]
mov edx, esp
lea esi, [esp + 0x50]
mov dword [esp + 0x38], 0x41f1ac
mov dword [esp + 0x3c], 4
mov dword [esp + 0x48], 0
mov dword [esp + 0x18], edx
lea edx, [esp + 8]
mov dword [esp + 0x1c], 0x419430
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], 0x416490
lea esi, [esp + 0x10]
mov dword [esp + 0x28], edx
lea edx, [esp + 0x18]
mov dword [esp + 0x2c], 0x419410
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], 0x419410
mov dword [esp + 0x40], edx
mov dword [esp + 0x44], 4
movsd qword [esp + 0x60], xmm0
movsd qword [esp + 0x58], xmm1
movsd qword [esp + 0x50], xmm2
lea ecx, [esp + 0x38]
push eax
push ecx
call fcn.0041ad00
int3

Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
nop
nop
nop
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43101e
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x407ef8
mov ecx, 0x1df6137f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3b8f1b0b
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1085f058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1085f1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1085f07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1085f06a
add dl, dl
jne 0x1085f089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1085f0dc
xor eax, eax
add dl, dl
jne 0x1085f096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1085f17d
add dl, dl
jne 0x1085f0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1085f0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1085f0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1085f0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1085f0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1085f075
mov eax, 1
add dl, dl
jne 0x1085f0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1085f0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1085f0e1
sub eax, ebx
mov ebx, 1
jne 0x1085f128
mov ecx, 1
add dl, dl
jne 0x1085f10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1085f119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1085f105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1085f075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1085f13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1085f14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1085f136
cmp eax, 0x7d00
jae 0x1085f16d
cmp eax, 0x500
jb 0x1085f168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1085f075
cmp eax, 0x7f
ja 0x1085f170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1085f075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1085f19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1085f075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4061b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4000
call fcn.00406fa0
push ebx
push esi
push edi
lea eax, [ebp - 0x4000]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x2000
push eax
call dword [sym.imp.SHLWAPI.dll_wvnsprintfW]
cmp dword [0x411050], 0xffffffff
jne 0x4061f3
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
cmp eax, 0xffffffff
mov dword [0x411050], eax
je 0x406258
lea eax, [ebp - 0x4000]
test eax, eax
jne 0x406203
xor ebx, ebx
xor esi, esi
jmp 0x40623b
lea eax, [ebp - 0x4000]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.00406fa0
xor ebx, ebx
mov esi, esp
push ebx
push ebx
push edi
push esi
lea eax, [ebp - 0x4000]
push 0xffffffffffffffff
push eax
push ebx
push ebx
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp + 0xc]
push ebx
push eax
push esi
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push esi
push dword [0x411050]
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x400c]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4062aa
Capabilities:
Accept command line arguments

Disassembly:
and dword [0x4111d0], 0
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edi, [eax + 1]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x4062e3
xor eax, eax
jmp 0x4063a4
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov dl, 0x22
cmp byte [esi], dl
jne 0x40630d
inc esi
mov dword [0x4111d0], esi
mov al, byte [esi]
test al, al
je 0x406306
cmp al, dl
je 0x406306
inc esi
jmp 0x4062f9
cmp byte [esi], 0
jne 0x406329
jmp 0x4062dc
mov dword [0x4111d0], esi
mov al, byte [esi]
test al, al
je 0x406324
cmp al, 0x20
je 0x406324
cmp al, 9
je 0x406324
inc esi
jmp 0x406313
cmp byte [esi], 0
je 0x40632d
and byte [esi], 0
inc esi
push 1
mov eax, 0x4111d4
pop edi
mov cl, byte [esi]
test cl, cl
je 0x406340
cmp cl, 0x20
je 0x406345
cmp cl, 9
jne 0x406348
inc esi
jmp 0x406335
mov cl, byte [esi]
test cl, cl
je 0x4063a2
cmp cl, dl
jne 0x406369
inc esi
inc edi
mov dword [eax], esi
add eax, 4
and dword [eax], 0
mov cl, byte [esi]
test cl, cl
je 0x406385
cmp cl, dl
je 0x406385
inc esi
jmp 0x40635c
mov dword [eax], esi
add eax, 4
inc edi
and dword [eax], 0
mov cl, byte [esi]
test cl, cl
je 0x406385
cmp cl, 0x20
je 0x406385
cmp cl, 9
je 0x406385
inc esi
jmp 0x406372
cmp byte [esi], 0
je 0x4063a2
and byte [esi], 0
inc esi
cmp eax, 0x4121d0
jl 0x406335
push edi
push 0x4012a8
call fcn.00406274
pop ecx
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret
Function at 0x4063a8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
call fcn.004062aa
mov ebx, dword [0x4111d0]
mov dword [ebp - 4], eax
test ebx, ebx
jne 0x4063c9
and dword [0x4121d4], ebx
jmp 0x4063fa
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00406fa0
mov edi, esp
push esi
push edi
xor eax, eax
push 0xffffffffffffffff
push ebx
push eax
push eax
mov word [edi], ax
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [0x4121d4], edi
push 0
push 0x4111d0
push dword [ebp - 4]
call fcn.00406bfb
add esp, 0xc
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x406bfb
Capabilities:
Delete file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
xor ebx, ebx
push edi
push ebx
mov edi, 0x80004005
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x406d57
push 0x401310
push ebx
call fcn.0040b5de
cmp dword [ebp + 8], 3
jne 0x406d4c
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call fcn.00406b9d
mov esi, eax
cmp esi, ebx
je 0x406d4c
mov eax, dword [ebp + 0xc]
push 0x104
push dword [eax + 4]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [ebp - 0x114]
push eax
push ebx
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x406d4c
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x114]
test eax, eax
jne 0x406cab
and dword [ebp + 8], 0
jmp 0x406ce3
lea eax, [ebp - 0x114]
push eax
call edi
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00406fa0
mov eax, esp
xor ecx, ecx
push esi
mov dword [ebp + 8], eax
mov word [eax], cx
push eax
lea eax, [ebp - 0x114]
push 0xffffffffffffffff
push eax
push ecx
push ecx
call ebx
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax + 4]
test eax, eax
mov dword [ebp - 4], eax
jne 0x406cf4
xor edi, edi
jmp 0x406d19
push eax
call edi
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.00406fa0
mov edi, esp
push esi
push edi
push 0xffffffffffffffff
push dword [ebp - 4]
xor eax, eax
mov word [edi], ax
push eax
push eax
call ebx
push dword [ebp + 8]
push edi
call fcn.00406a67
mov edi, eax
test edi, edi
jl 0x406d3f
mov eax, dword [ebp + 0xc]
push dword [eax + 8]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x406d4c
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.0040b695
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
lea esp, [ebp - 0x224]
test edi, edi
setge al
pop edi
pop esi
dec eax
pop ebx
leave
ret
Function at 0x4088a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 0x10], esi
jbe 0x4088d7
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and ecx, 0xff
movzx eax, byte [esi + eax]
xor eax, ecx
push eax
call fcn.00408887
mov ecx, dword [ebp + 8]
shr ecx, 8
xor eax, ecx
inc esi
cmp esi, dword [ebp + 0x10]
mov dword [ebp + 8], eax
jb 0x4088ae
mov eax, dword [ebp + 8]
pop esi
pop ebp
ret 0xc

Function at 0x40a2c8
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
lea eax, [ebp - 0x10]
push edi
push eax
mov dword [ebp - 4], 0x80004005
push dword [ebp + 8]
call fcn.0040a184
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x40a3b5
mov ecx, dword [ebp - 0x10]
xor esi, esi
xor ebx, ebx
push esi
neg ecx
sbb ecx, ecx
push esi
and ecx, 0xfffffffe
push esi
add ecx, 4
push ecx
push esi
push eax
call fcn.0040cf59
mov edi, eax
cmp edi, esi
mov dword [ebp - 8], edi
je 0x40a366
push esi
push esi
push esi
push 4
push edi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ebx, eax
cmp ebx, esi
je 0x40a366
push 0x24
call fcn.0040730c
cmp eax, esi
pop ecx
je 0x40a346
push dword [ebp + 8]
mov ecx, eax
push ebx
push edi
push dword [ebp - 0xc]
call fcn.0040a3e4
mov edi, eax
jmp 0x40a348
xor edi, edi
cmp edi, esi
je 0x40a366
cmp dword [edi + 0x18], esi
je 0x40a3ad
mov ecx, edi
call fcn.0040a53e
cmp eax, esi
mov dword [ebp - 4], eax
jl 0x40a3ad
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
jmp 0x40a3bd
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 2
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x4000000
push 0x3031756a
call fcn.0040c831
add esp, 0x10
cmp ebx, esi
je 0x40a396
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 8], esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
je 0x40a3a6
push dword [ebp - 8]
call esi
push dword [ebp - 0xc]
call esi
jmp 0x40a3bd
mov eax, dword [edi]
push edi
call dword [eax + 8]
jmp 0x40a3bd
call fcn.0040a3c7
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40a53e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, ecx
push 0
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xc
mov ebx, 0x80004005
sbb esi, esi
mov dword [ebp - 4], eax
and esi, ebx
jl 0x40a5af
mov ecx, edi
call fcn.0040a5da
mov esi, eax
test esi, esi
jl 0x40a5af
mov ecx, dword [edi + 0x20]
mov edx, dword [ecx + 8]
mov eax, edx
imul eax, eax, 0x44
add eax, 0xc
cmp dword [ebp - 4], eax
jb 0x40a597
test edx, edx
jbe 0x40a594
add ecx, 0x44
add eax, dword [ecx]
add ecx, 0x44
dec edx
jne 0x40a58c
cmp dword [ebp - 4], eax
sbb esi, esi
and esi, ebx
jl 0x40a5af
call fcn.00409e4c
test eax, eax
je 0x40a5d3
mov ecx, edi
call fcn.0040a671
jmp 0x40a5d3
add edi, 0x18
lea ecx, [ebp - 0x10]
push edi
call fcn.0040cf6d
lea eax, [ebp - 0x10]
push eax
push 1
push 0x4000000
push 0x3031756e
call fcn.0040c831
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ad50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
cmp dword [0x412fa4], 0
je 0x40ad70
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x40adaf
push esi
lea ecx, [ebp - 0x218]
push dword [ebp + 8]
push dword [ebp + 0xc]
call fcn.0040abb8
mov eax, dword [ebp - 4]
push dword [ebp - 0x214]
add eax, eax
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [ebp - 0x218]
call fcn.0040ac66
lea ecx, [ebp - 0x218]
mov esi, eax
call fcn.0040ac71
mov eax, esi
pop esi
leave
ret 8

Function at 0x40af07
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
cmp dword [0x412fa4], 0
je 0x40af2d
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x40af8f
push esi
lea ecx, [ebp - 0x52c]
push dword [ebp + 8]
call fcn.0040aaab
push dword [ebp + 0xc]
lea ecx, [ebp - 0x318]
call fcn.0040aaab
push dword [ebp + 0x14]
lea ecx, [ebp - 0x104]
call fcn.0040aba0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x314]
push dword [ebp - 0x528]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [ebp - 0x318]
mov esi, eax
call fcn.0040aa82
lea ecx, [ebp - 0x52c]
call fcn.0040aa82
mov eax, esi
pop esi
leave
ret 0x10

Function at 0x40aff7
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x430
cmp dword [0x412fa4], 0
je 0x40b026
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x40b114
push ebx
push esi
push edi
lea ecx, [ebp - 0x430]
push dword [ebp + 0xc]
call fcn.0040aaab
mov esi, dword [ebp + 0x1c]
lea eax, [ebp + 0xc]
neg esi
sbb esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
and esi, eax
lea eax, [ebp - 4]
push esi
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp - 0x42c]
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
jne 0x40b104
cmp dword [ebp - 4], eax
jbe 0x40b0eb
cmp dword [ebp - 4], 2
ja 0x40b0eb
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x40b080
mov eax, dword [eax]
shr eax, 1
jmp 0x40b082
xor eax, eax
push eax
lea ecx, [ebp - 0x21c]
push dword [ebp + 0x18]
call fcn.0040abb8
push esi
mov eax, dword [ebp - 8]
push dword [ebp - 0x218]
add eax, eax
mov dword [ebp + 0xc], eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x42c]
push dword [ebp + 8]
call edi
mov ebx, eax
test ebx, ebx
je 0x40b0c4
lea ecx, [ebp - 0x21c]
call fcn.0040ac71
jmp 0x40b104
cmp dword [ebp - 0x218], 0
je 0x40b0db
lea ecx, [ebp - 0x21c]
call fcn.0040ac37
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x40b0b7
mov ecx, dword [ebp + 0xc]
add ecx, ecx
mov dword [eax], ecx
jmp 0x40b0b7
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x42c]
push dword [ebp + 8]
call edi
mov ebx, eax
lea ecx, [ebp - 0x430]
call fcn.0040aa82
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret 0x18
Function at 0x40b224
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x958
cmp dword [0x412fa4], 0
je 0x40b253
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x40b301
push esi
lea ecx, [ebp - 0x744]
push dword [ebp + 8]
call fcn.0040aaab
push dword [ebp + 0xc]
lea ecx, [ebp - 0x530]
call fcn.0040aaab
push dword [ebp + 0x10]
lea ecx, [ebp - 0x958]
call fcn.0040aaab
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x31c]
call fcn.0040aba0
push dword [ebp + 0x18]
lea ecx, [ebp - 0x218]
push dword [ebp + 0x14]
call fcn.0040abb8
lea eax, [ebp - 0x31c]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x214]
push dword [ebp - 0x954]
push dword [ebp - 0x52c]
push dword [ebp - 0x740]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x218]
mov esi, eax
call fcn.0040ac37
lea ecx, [ebp - 0x218]
call fcn.0040ac71
lea ecx, [ebp - 0x958]
call fcn.0040aa82
lea ecx, [ebp - 0x530]
call fcn.0040aa82
lea ecx, [ebp - 0x744]
call fcn.0040aa82
mov eax, esi
pop esi
leave
ret 0x18

Function at 0x40b780
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
cmp dword [0x412828], edi
jne 0x40b7f8
push 0xc
mov dword [0x412828], 1
call fcn.0040b800
test eax, eax
je 0x40b7f8
lea eax, [ebp - 4]
push eax
push 1
push edi
push 0x4040f8
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40b7f8
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0xc]
push eax
push edi
push edi
push 0x4040e0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40b7ef
cmp dword [ebp - 0xc], edi
sete al
mov dword [0x41282c], eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x41282c]
pop edi
leave
ret
Function at 0x40b800
Capabilities:
Check os version

Disassembly:
cmp dword [0x4128cc], 0
push ebx
push esi
push edi
push 1
pop ebx
jne 0x40b83e
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edi, 0x412830
push edi
mov dword [0x4128cc], ebx
mov dword [0x412830], 0x9c
call esi
test eax, eax
jne 0x40b83e
push edi
mov dword [0x412830], 0x94
call esi
mov eax, dword [esp + 0x10]
cmp eax, 0x11
ja case.default.0x40b84b
jmp dword [eax*4 + 0x40ba45]
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x40ba3f
test byte [0x4128c8], 0x10
je case.default.0x40b84b
cmp dword [0x412834], 5
jb case.default.0x40b84b
mov eax, ebx
jmp 0x40ba3f
call fcn.0040b780
jmp 0x40ba3f
mov al, byte [0x4128ca]
cmp al, bl
je 0x40b86f
cmp al, 3
je 0x40b86f
cmp al, 2
jmp 0x40ba37
cmp byte [0x4128ca], bl
jne case.default.0x40b84b
cmp dword [0x412834], 5
jmp 0x40b9eb
mov al, byte [0x4128ca]
cmp al, 3
je 0x40b8ca
cmp al, 2
jne case.default.0x40b84b
cmp dword [0x412834], 5
jne case.default.0x40b84b
mov al, byte [0x4128c8]
test al, 2
je case.default.0x40b84b
test al, 0x80
jmp 0x40b9eb
mov al, byte [0x4128ca]
cmp al, 3
je 0x40b8fc
cmp al, 2
jne case.default.0x40b84b
cmp dword [0x412834], 5
jne case.default.0x40b84b
test byte [0x4128c8], 0x80
je case.default.0x40b84b
jmp 0x40b87c
mov al, byte [0x4128ca]
cmp al, 3
je 0x40b92c
cmp al, 2
jne case.default.0x40b84b
test byte [0x4128c8], 0x82
jmp 0x40b8a7
mov eax, dword [0x4128c8]
and eax, 0x40
jmp 0x40ba3f
xor eax, eax
cmp dword [0x412840], ebx
jmp 0x40b958
xor eax, eax
cmp dword [0x412840], 2
sete al
jmp 0x40ba3f
cmp dword [0x412840], ebx
jmp 0x40ba22
cmp dword [0x412840], ebx
jne case.default.0x40b84b
cmp dword [0x412834], 4
jne case.default.0x40b84b
cmp dword [0x412838], 0
jne case.default.0x40b84b
cmp word [0x41283c], 0x3b6
jmp 0x40b9eb
cmp dword [0x412840], ebx
jne case.default.0x40b84b
mov eax, dword [0x412834]
cmp eax, 4
ja 0x40b87c
jne case.default.0x40b84b
cmp dword [0x412838], 0xa
jmp 0x40b876
cmp dword [0x412840], ebx
jne case.default.0x40b84b
cmp dword [0x412834], 4
jne case.default.0x40b84b
cmp dword [0x412838], 0xa
jne case.default.0x40b84b
cmp word [0x41283c], 0x7ce
jne case.default.0x40b84b
jmp 0x40b87c
cmp dword [0x412840], ebx
mov eax, dword [0x412834]
jne 0x40ba11
cmp eax, 4
jne 0x40ba14
cmp dword [0x412838], 0x5a
jae 0x40b87c
cmp eax, 4
jbe case.default.0x40b84b
jmp 0x40b87c
cmp dword [0x412840], 2
jne case.default.0x40b84b
cmp dword [0x412834], 4
jmp 0x40b876
cmp dword [0x412840], 2
je 0x40b86f
xor eax, eax
pop edi
pop esi
pop ebx
ret 4

Function at 0x40bb37
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x18]
add eax, eax
mov dword [ebp + 0x18], eax
lea eax, [ebp + 0x18]
push eax
lea eax, [ebp + 0x14]
push dword [ebp + 0x14]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40bb69
cmp dword [ebp + 0x14], 1
je 0x40bb69
push 0xd
pop eax
pop ebp
ret 0x14