joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b340
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x444
lea eax, [ebp - 4]
mov dword [ebp - 0x10], ecx
push eax
push 0x42b780
push 1
push 0
push 0x42b7a0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40b4f2
push edi
lea eax, [ebp - 0x444]
push 0x104
push eax
call fcn.00417329
add esp, 8
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp - 0xc]
push dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x23c]
push eax
call fcn.004174a6
lea eax, [ebp - 0x138]
push eax
push 0x42aebc
call fcn.004170a7
mov edi, eax
add esp, 0xc
cmp edi, 0xffffffff
je 0x40b4d9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push esi
mov eax, dword [ebp - 4]
lea edx, [ebp + 8]
push edx
push 0x42b790
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
js 0x40b4b6
mov eax, dword [ebp + 8]
mov ecx, 0x434b58
push 0
mov esi, dword [eax]
lea eax, [ebp - 0x114]
push eax
call fcn.0040c080
push eax
push dword [ebp + 8]
call dword [esi + 0x14]
test eax, eax
jne 0x40b4ad
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x340]
push 1
push 0
push 0x104
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0xc]
lea eax, [ebp - 0x340]
push eax
call fcn.0040d310
add esp, 4
test eax, eax
je 0x40b4ad
push dword [ebp + 0xc]
push eax
call fcn.00415cc4
add esp, 8
test eax, eax
jne 0x40b4ad
push eax
push eax
push eax
push str.delete_old_shortcuts
mov ecx, 0x434b58
call fcn.00401900
test eax, eax
je 0x40b499
push eax
mov eax, dword [ebp - 0x10]
push 0x403
push dword [eax + 0x138]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x114]
push eax
call ebx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
lea eax, [ebp - 0x138]
push eax
push edi
call fcn.004170b2
add esp, 8
test eax, eax
je 0x40b3f2
push edi
call fcn.00417081
add esp, 4
pop esi
pop ebx
lea eax, [ebp - 0x444]
push eax
call fcn.004174a6
mov eax, dword [ebp - 4]
add esp, 4
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x40b500
Capabilities:
Create process on windows
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
jle 0x40b725
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x40b725
push 0
push 0
push 0
push str.running_ext
mov ecx, 0x434b58
call fcn.00401900
test eax, eax
je 0x40b54d
push eax
push 0x402
push dword [esi + 0x138]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call ebx
cmp dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
jle 0x40b70c
nop dword [eax]
test edi, edi
je 0x40b586
push edi
push 0x403
push dword [esi + 0x138]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x1f4
call ebx
inc dword [esi + 0x264]
push 0
push dword [esi + 0x264]
push 0x402
push 0x401
push dword [esi + 0x138]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ecx, esi
call fcn.00408490
test eax, eax
jne 0x40b71a
push 0x44
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00413c60
mov eax, 5
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], ax
xorps xmm0, xmm0
mov eax, dword [esi + 4]
push edi
mov dword [ebp - 0x2c], 1
movups xmmword [ebp - 0x14], xmm0
push dword [eax + 0x460]
lea eax, [ebp - 0x15c]
push str.RUNDLL32.EXE_SETUPAPI.DLL_InstallHinfSection_DefaultInstall_132__s_s
push 0x104
push eax
call fcn.00405340
add esp, 0x20
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x40ba80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x248], eax
test eax, eax
je 0x40b645
push eax
mov dword [esi + 0x24c], 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x15c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40b6af
push 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40b69b
call fcn.0040d350
push 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40b681
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b6c5
push 0
push str.CreateProcess___Failed
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x248], 0
mov dword [esi + 0x24c], 0
je 0x40b6e5
push 0x64
call ebx
cmp dword [esi + 0x248], 0
jne 0x40b6d8
mov eax, edi
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b6f0
mov ecx, dword [ebp + 0xc]
sub eax, edx
inc edi
inc ecx
add edi, eax
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp + 8]
jl 0x40b570
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40b740
Capabilities:
Create process on windows
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x15c
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, ecx
jle 0x40b965
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x40b965
push 0
push 0
push 0
push str.running_ext
mov ecx, 0x434b58
call fcn.00401900
test eax, eax
je 0x40b78d
push eax
push 0x402
push dword [esi + 0x138]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x1f4
call ebx
cmp dword [ebp + 8], 0
mov dword [ebp + 0xc], 0
jle 0x40b94c
nop dword [eax]
test edi, edi
je 0x40b7c6
push edi
push 0x403
push dword [esi + 0x138]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x1f4
call ebx
inc dword [esi + 0x264]
push 0
push dword [esi + 0x264]
push 0x402
push 0x401
push dword [esi + 0x138]
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ecx, esi
call fcn.00408490
test eax, eax
jne 0x40b95a
push 0x44
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00413c60
mov eax, 5
mov dword [ebp - 0x58], 0x44
mov word [ebp - 0x28], ax
xorps xmm0, xmm0
mov eax, dword [esi + 4]
push edi
add eax, 0x84
mov dword [ebp - 0x2c], 1
push eax
push str.RUNDLL32.EXE_SETUPAPI.DLL_InstallHinfSection_DefaultInstall_132__s_s
lea eax, [ebp - 0x15c]
push 0x104
push eax
movups xmmword [ebp - 0x14], xmm0
call fcn.00405340
add esp, 0x20
mov dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x40ba80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x248], eax
test eax, eax
je 0x40b885
push eax
mov dword [esi + 0x24c], 1
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x15c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40b8ef
push 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x40b8db
call fcn.0040d350
push 0x1f4
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x40b8c1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b905
push 0
push str.CreateProcess___Failed
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [esi + 0x248], 0
mov dword [esi + 0x24c], 0
je 0x40b925
push 0x64
call ebx
cmp dword [esi + 0x248], 0
jne 0x40b918
mov eax, edi
lea edx, [eax + 1]
nop word [eax + eax]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b930
mov ecx, dword [ebp + 0xc]
sub eax, edx
inc edi
inc ecx
add edi, eax
mov dword [ebp + 0xc], ecx
cmp ecx, dword [ebp + 8]
jl 0x40b7b0
pop ebx
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
pop ebx
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 8
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x40b980
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, ecx
mov eax, dword [esi + 4]
cmp dword [eax + 0x4d4], 0
je 0x40ba78
cmp dword [eax + 0x4d8], 0
jle 0x40ba78
push dword [eax + 0x460]
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.00415b43
push str.embed_
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.00415b9d
mov eax, dword [esi + 4]
push dword [eax + 0x4d4]
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.00415b9d
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00416b06
add esp, 0x2c
test eax, eax
jne 0x40ba78
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x4d8]
sub eax, 1
jne 0x40ba6e
push 0x104
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x42a618
lea eax, [ebp - 0x208]
push 0x104
push eax
call fcn.00415b9d
mov eax, dword [esi + 4]
push dword [eax + 0x4d4]
lea eax, [ebp - 0x208]
push 0x104
push eax
call fcn.00415b9d
add esp, 0x18
lea eax, [ebp - 0x208]
push 1
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40d3d0
Capabilities:
Create process on windows
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0
push 0
push 4
call fcn.0040ce10
add esp, 0xc
test al, al
je 0x40d43d
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push 0
push 0
push 0
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push 0
push dword [ebp - 4]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov esp, ebp
pop ebp
ret
push 1
push str.rundll32.exe_shell32.dll_SHExitWindowsEx_2
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret

Function at 0x40da40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push esi
push edi
lea eax, [ebp - 4]
mov esi, ecx
push eax
push 0x11
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [esi + 4]
add eax, 0x84
push eax
lea eax, [ebp - 0x128]
push 0x104
push eax
call fcn.00415b43
mov eax, dword [ebp - 4]
add esp, 0xc
mov edi, dword [ebp + 8]
mov ecx, 0x434b58
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x24], edi
push 0
push 0
push 0
push str.folder_to_install
mov dword [ebp - 0x1c], eax
call fcn.00401900
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x128]
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x14], 0x60
push eax
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
call dword [sym.imp.SHELL32.dll_SHBrowseForFolderA]
push eax
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test eax, eax
je 0x40dc01
lea eax, [ebp - 0x128]
push eax
mov eax, dword [esi + 4]
add eax, 0x84
push 0x104
push eax
call fcn.00415b43
lea eax, [ebp - 0x128]
push eax
mov eax, dword [esi + 4]
add eax, 0x188
push 0x104
push eax
call fcn.00415b43
mov eax, dword [esi + 4]
push 0x42a618
add eax, 0x84
push 0x104
push eax
call fcn.00415b9d
mov ecx, dword [esi + 4]
lea eax, [ecx + 0x28c]
push eax
lea eax, [ecx + 0x84]
push 0x104
push eax
call fcn.00415b9d
mov eax, dword [esi + 4]
push 0x42a618
add eax, 0x84
push 0x42b354
push eax
call fcn.0040e2a0
mov edx, dword [esi + 4]
add esp, 0x3c
add edx, 0x84
nop dword [eax]
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [edx], cl
lea edx, [edx + 1]
test cl, cl
jne 0x40db70
mov eax, dword [esi + 4]
cmp dword [eax + 0x4dc], 0
je 0x40dbc5
cmp byte [eax + 0x390], cl
je 0x40dbc5
push 0x42a618
add eax, 0x188
push 0x104
push eax
call fcn.00415b9d
mov ecx, dword [esi + 4]
lea eax, [ecx + 0x390]
push eax
lea eax, [ecx + 0x188]
push 0x104
push eax
call fcn.00415b9d
add esp, 0x18
mov eax, dword [esi + 4]
add eax, 0x84
push eax
push 0x3fa
push edi
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [esi + 4]
add eax, 0x84
push eax
lea eax, [esi + 0xc]
push 0x104
push eax
call fcn.00415b43
add esp, 0xc
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40dc10
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
lea eax, [ebp - 0x104]
push esi
push 0x104
push 0
push eax
mov esi, ecx
call fcn.00413c60
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x400
push eax
push str._ProgramFiles_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp dword [0x434010], 1
lea eax, [ebp - 0x104]
push 0x42a618
push 0x104
push eax
jne 0x40dce2
call fcn.00415b9d
mov eax, dword [esi + 4]
add eax, 0x84
push eax
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.00415b9d
mov eax, dword [esi + 4]
add eax, 0x84
push eax
push 0x104
push 0x4356f8
call fcn.00415b43
lea eax, [ebp - 0x104]
push eax
mov eax, dword [esi + 4]
add eax, 0x84
push 0x104
push eax
call fcn.00415b43
add esp, 0x30
lea eax, [ebp - 0x104]
push eax
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov dword [0x434010], 0
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4
call fcn.00415b9d
push 0x4356f8
lea eax, [ebp - 0x104]
push 0x104
push eax
call fcn.00415b9d
add esp, 0x18
lea eax, [ebp - 0x104]
push eax
push 0x3fa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x40ea50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x7e9
push ebx
mov dword [ebp - 4], ecx
call edi
push 0x7ea
push ebx
call edi
mov esi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0xba
push eax
call esi
mov ecx, dword [ebp - 4]
push 1
push 0
mov dword [ecx + 0x114], eax
mov ecx, 0x434b58
call fcn.00401630
push eax
push 0x30
push 0x7ea
push ebx
call edi
push eax
call esi
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00413c60
add esp, 0xc
lea eax, [ebp - 0x104]
push 0x104
push eax
push dword [0x434b50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x104]
push 0x5c
push eax
call fcn.00413b20
add esp, 8
test eax, eax
jne 0x40eafb
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
push str.localeuscvr_eula.txt
mov byte [eax + 1], 0
lea eax, [ebp - 0x104]
push 0x100
push eax
call fcn.00415b9d
push 0x7d000
call fcn.0041758a
add esp, 0x10
mov esi, eax
lea eax, [ebp - 0x104]
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40eb71
push 0
lea eax, [ebp + 8]
push eax
push 0x7cfff
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
push 0x7ea
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00415b3e
add esp, 4
push 0x7ea
push ebx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ecx, dword [ebp - 4]
push eax
call fcn.0040e7c0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40f0a0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x429644
push eax
mov dword fs:[0], esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0x18]
mov dword [ebp - 4], 0
lea eax, [esi + esi*2]
lea edi, [ecx + eax*4]
movzx eax, word [ebp + 0xc]
lea ebx, [edi + 0x268]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 8]
push eax
push dword [0x434b50]
call fcn.00410870
mov dword [ebx], eax
lea ecx, [edi + 0x270]
lea eax, [ebp + 0x14]
push eax
call fcn.00410350
test esi, esi
jle 0x40f113
push 0
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [edi + 0x26c], 0
jmp 0x40f127
push 5
push dword [ebx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [edi + 0x26c], 1
mov edx, dword [ebp + 0x14]
or eax, 0xffffffff
mov dword [ebp - 4], 0xffffffff
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40f149
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov ecx, dword [ebp - 0xc]
mov eax, 1
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40f9c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp eax, 0x7e4
ja 0x40fa9e
je 0x40fa2d
sub eax, 2
jne case.default.0x40faac
cmp dword [edi + 0x320], eax
jne 0x40fa12
mov esi, dword [ebp + 8]
push esi
call fcn.0040eeb0
test eax, eax
je case.default.0x40faac
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 0x2e0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 0x26c], 0
mov eax, dword [edi + 0x2e0]
lea eax, [eax + eax*2]
push dword [edi + eax*4 + 0x268]
call esi
inc dword [edi + 0x2e0]
mov eax, dword [edi + 0x2e0]
push 5
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 0x26c], 1
mov eax, dword [edi + 0x2e0]
lea eax, [eax + eax*2]
push dword [edi + eax*4 + 0x268]
call esi
push 1
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
add eax, 0xfffff81b
cmp eax, 3
ja case.default.0x40faac
jmp dword [eax*4 + 0x40fb8c]
mov eax, dword [edi + 0x2e0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 0x26c], 0
mov eax, dword [edi + 0x2e0]
lea eax, [eax + eax*2]
push dword [edi + eax*4 + 0x268]
call esi
dec dword [edi + 0x2e0]
mov eax, dword [edi + 0x2e0]
push 5
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 0x26c], 1
mov eax, dword [edi + 0x2e0]
lea eax, [eax + eax*2]
push dword [edi + eax*4 + 0x268]
call esi
push 1
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov esi, dword [ebp + 8]
push esi
call fcn.004109f0
push esi
mov ecx, edi
call fcn.00410c10
push 0
push 0
push 0x10
push esi
mov dword [edi + 0x320], 1
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push 0
push 2
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push 0
push 0xf020
push 0x112
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x40fab3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
push edi
mov edi, ecx
cmp eax, 0x7e4
ja 0x40fa9e
je 0x40fa2d
sub eax, 2
jne case.default.0x40faac
cmp dword [edi + 0x320], eax
jne 0x40fa12
mov esi, dword [ebp + 8]
push esi
call fcn.0040eeb0
test eax, eax
je case.default.0x40faac
push 0
push esi
call dword [sym.imp.USER32.dll_EndDialog]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_EndDialog]
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov eax, dword [edi + 0x2e0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 0x26c], 0
mov eax, dword [edi + 0x2e0]
lea eax, [eax + eax*2]
push dword [edi + eax*4 + 0x268]
call esi
inc dword [edi + 0x2e0]
mov eax, dword [edi + 0x2e0]
push 5
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 0x26c], 1
mov eax, dword [edi + 0x2e0]
lea eax, [eax + eax*2]
push dword [edi + eax*4 + 0x268]
call esi
push 1
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
add eax, 0xfffff81b
cmp eax, 3
ja case.default.0x40faac
jmp dword [eax*4 + 0x40fb8c]
mov eax, dword [edi + 0x2e0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 0x26c], 0
mov eax, dword [edi + 0x2e0]
lea eax, [eax + eax*2]
push dword [edi + eax*4 + 0x268]
call esi
dec dword [edi + 0x2e0]
mov eax, dword [edi + 0x2e0]
push 5
lea eax, [eax + eax*2]
mov dword [edi + eax*4 + 0x26c], 1
mov eax, dword [edi + 0x2e0]
lea eax, [eax + eax*2]
push dword [edi + eax*4 + 0x268]
call esi
push 1
push 0
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_InvalidateRect]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
mov esi, dword [ebp + 8]
push esi
call fcn.004109f0
push esi
mov ecx, edi
call fcn.00410c10
push 0
push 0
push 0x10
push esi
mov dword [edi + 0x320], 1
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push 0
push 2
push 0x111
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
push 0
push 0xf020
push 0x112
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_PostMessageA]
pop edi
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x410800
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x410815
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x410856
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x410852
nop word [eax + eax]
cmp esi, edx
jae 0x410856
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x410840
cmp esi, edx
jb 0x41085b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x410c10
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
lea eax, [ebp - 0x64]
push edi
push 0x64
push 0
push eax
mov edi, ecx
call fcn.00413c60
add esp, 0xc
mov ecx, edi
push dword [ebp + 8]
call fcn.004109f0
push 0x103
lea eax, [ebp - 0x168]
push eax
push dword [0x434b50]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x168]
push 0x5c
push eax
call fcn.0041c163
add esp, 8
test eax, eax
jne 0x410c6a
pop edi
mov esp, ebp
pop ebp
ret 4
push str.setup.inf
mov byte [eax + 1], 0
lea eax, [ebp - 0x168]
push 0x104
push eax
call fcn.00415b9d
add esp, 0xc
lea eax, [ebp - 0x168]
push eax
push 0x103
lea eax, [ebp - 0x26c]
push eax
push 0x42a6d0
push str.apps
push str.Contents
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x26c]
push 0x42af38
push eax
call fcn.0041c210
add esp, 0xc
test eax, eax
je 0x410cde
push eax
lea eax, [ebp - 0x64]
push str._s.exe
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x64]
push eax
mov eax, dword [edi + 4]
add eax, 0x84
push eax
lea eax, [ebp - 0x370]
push 0x42a688
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x370]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov eax, 1
pop edi
mov esp, ebp
pop ebp
ret 4

Function at 0x4174a6
Capabilities:
Get common file path
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417345

Function at 0x41e6cd
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0041e54c

Function at 0x423190
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00422e50