joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6030e3
Capabilities:
Encode data using xor

Disassembly:
cdq
insd dword es:[edi], dx
pushal
wait
xor eax, 0x7d2a39c8
inc si
jge 0x603153
inc esi
pop ecx
lea esi, [esi + 0x35]
mov al, byte [0xe61338ce]
cmp eax, 0xfe6612e8
dec edi
mov eax, dword [0x43c84e3c]
salc
out 0xe6, al
push edx
dec ecx
xor al, dh
sbb al, 0xa8
leave
and dh, byte [esi]
sbb dword [eax - 0x535dc98a], 0x36657c5f
xor edx, dword [ebx]
cmpsb byte [esi], byte es:[edi]
and dword [ecx - 0x46c423e2], esp
mov esi, 0x87d78e00
in al, dx
push sp
test eax, 0xd673c261
imul ecx, ecx, 0xfffffff3
sub edi, dword [esi + 0x68]
pop esp
jns 0x6030eb
add eax, 0x8a589746
mov bh, 1
int1
add byte [edi], al
pushal
and edx, ebx
lahf
lodsw ax, word [esi]
adc dword [ebx + 0x2b], 0xd69836dd
push ebx
sub ebx, ebp
cwde
salc
push ebx
add esi, dword [ebx - 0x5f9f7512]
mov ah, byte [eax - 0x60]
and al, bh
ror edx, cl
jbe 0x6031b9
fdiv st(6)
push esi
sub ch, byte [ebx]
adc edx, dword [edi + 0x23]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
jmp 0x60318a
and bh, dl
jnp 0x6031c5
cmpsb byte fs:[esi], byte es:[edi]
adc dword [esi + 0x1e9ed9c1], 0x24
xchg ebx, eax
adc al, 0x35
rcr ecx, 0x9e
push ds
and al, 0x93
inc edx
daa
jp 0x603149
mov eax, 0x895667c2
xchg ecx, eax
retf 0x7905
lds eax, [eax]
pop edx
cwde
adc eax, 0xd91ad922
xchg ebx, eax
adc al, 0x3d
ror dword [ecx + 8], cl
xchg edx, eax
cmp eax, 0x920849d3
mov ss, esi
jp 0x6031cd
inc dword [esi]
push es
xchg byte [edx], dh
xchg esi, eax
rcr byte [esi + eax*2], cl
nop
cmp al, 0x62
pop esp
arpl cx, ax
lds edi, [esi + 0x7a]
sub byte [edx - 0x66], bl
les eax, [edi - 0x4486108a]
je 0x603183
imul eax, esi, 0x40e36697
jbe 0x603189
in al, 0x33
add ah, byte [ebx + 0x4390d264]
inc esi
leave
int1
add eax, 0x3f6af82
mov ah, byte [esi]
xchg edx, eax
mov ch, ah
push eax
clc
mov bl, 0xc5
pushfd
lodsd eax, dword [esi]
pop ss
and byte [ebx + 0xb], al
cmp esp, edx
aas
xchg edx, eax
loopne 0x60328b
int 0x58
ret 0x4f86
inc esp
push esi
mov esp, 0xa3d57326
in eax, 0xab
xor byte [ebp + 0x22], bl
in eax, 0xe0
push ebx
test dword [ebx], esp
sbb bl, ah
cmpsb byte [esi], byte es:[edi]
dec ecx
and edx, ebp
adc ebx, dword [ecx]
fcom qword [edi - 0x82c2d23]
in al, 6
inc esi
enter 0x5b4, 0xffffffffffffff8c
mov dh, 0x93
push es
clc
or ch, cl
ja 0x60328d
xchg bl, dh
dec eax
cmp dword [eax - 0x49e7198a], 0xfffffff8
sub dword [edi + 0x7b], edx
sub dword [edi - 0x5082fee], edx
push esp
inc byte [eax + ebx*2]
mov byte [0x8446266], al
push ss
shl byte [eax + 0x70], cl
push es
mov bh, 0xb0
push esi
sti
invalid
Function at 0x61e4e3
Capabilities:
Encode data using xor

Disassembly:
loope 0x61e52a
nop
push ebx
aaa
invalid
lodsd eax, dword [esi]
or byte [ebx - 0x347e7f7d], al
in al, dx
shr dword [0xf1ac878b], 1
push ds
mov ch, 0x53
cmp al, 9
int3
sbb eax, 0x6185b1d7
test dword [ecx + eax + 0x5066729d], edi
mov esp, 0x66729d01
push eax
and eax, dword [eax - 0x13]
xchg ebx, eax
pushal
stosd dword es:[edi], eax
xor byte [esi - 0x64], al
xor esi, esi
pop esp
sbb al, 0xac
mov eax, 0x42e3978a
inc ecx
xchg ecx, eax
mov dh, 0xf3
jecxz 0x61e530
mov bl, 0xe3
add edx, dword [ebx]
dec ecx
test bl, dh
sal byte [ebp + 0x3b], 0x51
xor dword [si - 0x63], edi
fcomp qword [ebp - 0x32bfceb0]
sub byte [esi - 0x42], cl
mov eax, 0xabee3dc3
jae 0x61e556
jl 0x61e4ff
rcr dword [0xeb7730de], 0x38
cmp byte [edi], bh
dec edx
push ebx
invalid

Function at 0x64e2ed
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x6593d8
cmp edx, dword [eax]
je 0x64e30f
add eax, 8
inc ecx
cmp eax, 0x659468
jl 0x64e300
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x6593d8]
jne 0x64e43d
mov eax, dword [0xa5cd44]
cmp eax, 1
je 0x64e417
test eax, eax
jne 0x64e340
cmp dword [0x659304], 1
je 0x64e417
cmp edx, 0xfc
je 0x64e43d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x64e377
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0064ecd0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0064f160
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x64e3ba
lea eax, [ebp - 0x1a4]
push eax
call fcn.0064f160
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x653f9c
push edi
call fcn.00651030
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0064ecd0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0064ece0
lea eax, [ebp - 0xa0]
push 0x653f7c
push eax
call fcn.0064ece0
push dword [esi + 0x6593dc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0064ece0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00650fa4
add esp, 0x2c
pop edi
jmp 0x64e43d
lea eax, [ebp + 8]
lea esi, [esi + 0x6593dc]
push 0
push eax
push dword [esi]
call fcn.0064f160
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x402c00
pop dword [ebp - 0x3c]
mov eax, 0x402c00
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0xc4dbd729
sub dword [ebp - 0x4c], 0x768991de
mov dword [ebp - 0x48], 0x9974a16d
sub dword [ebp - 0x48], 0x67415528
mov dword [ebp - 0x44], 0x571a50e4
sub dword [ebp - 0x44], 0xace0cb6
mov dword [ebp - 0x40], 0xf56a98a6
add dword [ebp - 0x40], 0xa95675a
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x632515de
sub eax, 0x62e49552
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0xf6e75ad9
add dword [ebp - 0x4c], 0x7d8b0e7d
mov dword [ebp - 0x48], 0x81354a42
add dword [ebp - 0x48], 0xc0371733
mov dword [ebp - 0x44], 0x7e35fe61
add dword [ebp - 0x44], 0xe5396e0b
mov dword [ebp - 0x40], 0xddc8700b
sub dword [ebp - 0x40], 0xddc8700b
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x6c217f6d
add eax, 0x941f0167
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x39392
push 0
call eax
mov ecx, 0x4689e86f
sub ecx, 0x4689964c
mov esi, eax
mov edi, 0xd827966e
add edi, 0x28197992
add edi, dword [ebp - 0x3c]
mov edx, 0xc94b62d8
sub edx, 0xff2cadd4
xor dword [ebp - 0x20], 0x8826335f
mov ebx, dword [edi]
sub dword [ebp - 0x1c], 0xa1f08c24
add ebx, edx
sub dword [ebp - 0x30], eax
mov dword [esi], ebx
sub dword [ebp - 0x30], 0xc016cb73
add esi, 0x2a458994
add esi, 0xd5ba7670
add edi, 4
loop 0x402d1d
add eax, 0x13b5f
mov ebx, eax
add eax, 0xc89b8a2a
add eax, 0x376475db
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x41dcf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x19000]
push edi
or ecx, 0xffffffff
jmp 0x41dd12
mov al, byte [esi + eax*2]
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x41dd19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x41dd08
mov eax, 1
add ebx, ebx
jne 0x41dd2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x41dd20
jne 0x41dd3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41dd20
xor ecx, ecx
sub eax, 1
jb 0x41dd50
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xfffffffb
je 0x41ddc2
mov dword [ebp + 1], eax
invalid
add ebx, ebx
jne 0x41dd5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x41dd68
mov ebx, dword [esi]
sub esi, 0x7c
adc ebx, ebx
adc ecx, ecx
jne 0x41dd8c
inc ecx
add ebx, ebx
je 0x41dd78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x41dd6d
jne 0x41dd89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x41dd6d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x41ddac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x41dd9d
jmp 0xe041dd0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x41ddac
add edi, ecx
jmp 0xfc41dd0e
pop esi
mov edi, esi
mov ecx, 0xd8
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x41ddca
cmp byte [edi], 5
jne 0x41ddca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x41ddcf
lea edi, [esi + 0x1b000]
mov eax, dword [edi]
or eax, eax
je 0x41de3e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1da44]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1dad0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x41ddfc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1dad4]
or eax, eax
je 0x41de38
mov dword [ebx], eax
add ebx, 4
jmp 0x41de19
call dword [esi + 0x1dad8]
popal
jmp 0x4010e1
Function at 0x401970
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x4063a0]
test esi, esi
jle 0x401a80
mov edi, dword [0x4063a4]
xor ebx, ebx
lea edx, [edi + 0xc]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x4019a4
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401a25
add ebx, 1
add edx, 0x14
cmp ebx, esi
jne 0x401990
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401aa7
mov eax, dword [0x4063a4]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov edx, dword [0x4063a4]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp], eax
mov dword [esp + 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401a87
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x401a1e
sub eax, 4
and eax, 0xfffffffb
jne 0x401a30
add dword [0x4063a0], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
add ebx, dword [0x4063a4]
mov eax, dword [esp + 0x14]
mov edx, dword [esp + 0x20]
mov dword [ebx + 4], eax
mov dword [ebx + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0x40
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x401a1e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
xor esi, esi
jmp 0x4019ae
mov eax, dword [0x4063a4]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x401ee0
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x4063b0]
sub esp, 4
test ebx, ebx
je 0x401f35
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x401f2e
test esi, esi
je 0x401f2e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x401f10
mov dword [esp], 0x4063b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403c70
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov dword [esp], 2
lea ebx, [esp + 0x24]
call dbg.__acrt_iob_func
mov dword [esp + 8], 0x1b
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], str.Mingw_w64_runtime_failure:_n
call sym._fwrite
mov dword [esp], 2
call dbg.__acrt_iob_func
mov edx, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp], eax
mov dword [esp + 4], edx
call sym._vfprintf
call sym._abort
nop
nop
nop
nop
nop
Function at 0x401040
Capabilities:
Enumerate process modules
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x140c
call fcn.00434a40
mov eax, dword [0x440034]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0xffc
lea eax, [ebp - 0x1400]
push esi
push eax
mov dword [ebp - 0x1404], esi
call sub.MSVCR100.dll_memset
push 0x3ff
lea ecx, [ebp - 0x403]
push esi
push ecx
mov dword [ebp - 0x1408], esi
mov byte [ebp - 0x404], 0
call sub.MSVCR100.dll_memset
add esp, 0x18
jmp 0x4010a0
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x1408]
push edx
push 0x1000
lea eax, [ebp - 0x1404]
push eax
call dword [sym.imp.PSAPI.DLL_EnumProcesses]
test eax, eax
je 0x4010a0
mov eax, dword [ebp - 0x1408]
shr eax, 2
xor ebx, ebx
mov dword [ebp - 0x140c], eax
test eax, eax
je 0x4010a0
lea ecx, [ecx]
push 0x400
lea ecx, [ebp - 0x404]
push 0
push ecx
call sub.MSVCR100.dll_memset
mov eax, dword [ebp + ebx*4 - 0x1404]
add esp, 0xc
push eax
xor edi, edi
push edi
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x40116a
push 0x400
lea edx, [ebp - 0x404]
push edx
push esi
call dword [sym.imp.PSAPI.DLL_GetProcessImageFileNameA]
test eax, eax
je 0x40112e
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40116a
lea eax, [ebp - 0x404]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401142
sub eax, edx
cmp eax, 0x15
jl 0x40116a
lea eax, [ebp + eax - 0x419]
push str.Windowsexplorer.exe
push eax
call dword [sym.imp.MSVCR100.dll__stricmp]
add esp, 8
test eax, eax
je 0x40117c
inc ebx
cmp ebx, dword [ebp - 0x140c]
jb 0x4010e0
jmp 0x4010a0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + ebx*4 - 0x1404]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043434a
mov esp, ebp
pop ebp
ret
Function at 0x401440
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x435069
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x440034]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x24], eax
mov dword [ebx + 0x14], 0xf
mov dword [ebx + 0x10], eax
mov dword [ebp - 0x28], ebx
mov byte [ebx], al
mov dword [ebp - 4], eax
push 0x288
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x1c], 0x288
mov dword [ebp - 0x20], eax
call fcn.00403d8d
mov esi, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov edi, eax
add esp, 4
lea eax, [ebp - 0x1c]
push eax
push edi
call esi
cmp eax, 0x6f
jne 0x4014cb
push edi
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00403d8d
mov edi, eax
add esp, 8
mov dword [ebp - 0x20], edi
lea edx, [ebp - 0x1c]
push edx
push edi
call esi
test eax, eax
jne 0x40153b
mov eax, dword [edi + 0x190]
xor esi, esi
test eax, eax
je 0x40152f
movzx edx, byte [edi + esi + 0x194]
dec eax
mov ecx, esi
sub ecx, eax
neg ecx
sbb ecx, ecx
and ecx, 0x2d
push ecx
push edx
lea eax, [ebp - 0x18]
push str._02X_c
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
lea eax, [ebp - 0x18]
add esp, 0x10
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x401510
sub eax, ecx
push eax
lea eax, [ebp - 0x18]
mov ecx, ebx
call fcn.004037a0
mov eax, dword [edi + 0x190]
inc esi
cmp esi, eax
jb 0x4014e2
cmp dword [ebx + 0x10], 0
jne 0x40153b
mov edi, dword [edi]
test edi, edi
jne 0x4014d6
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x40154c
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043434a
mov esp, ebp
pop ebp
ret
Function at 0x4016b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov eax, dword [0x440034]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x38]
push eax
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionczhandle
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401700
mov ecx, dword [ebp - 0x38]
push ecx
mov byte [0x44006c], al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043434a
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x38]
push edx
push str.SoftwareMicrosoftWindowsCurrentVersionczhandle
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x4017ac
mov ecx, dword [ebp - 0x38]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 4
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x3c]
push eax
push 4
push 0
push str.cznv
push ecx
call esi
lea edx, [ebp - 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x2e]
movzx ecx, word [ebp - 0x32]
movzx edx, word [ebp - 0x34]
push eax
push ecx
push edx
lea eax, [ebp - 0x24]
push 0x43dfa8
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, eax
add eax, eax
push eax
mov eax, dword [ebp - 0x38]
lea edx, [ebp - 0x24]
push edx
push 1
push 0
push str.record
push eax
call esi
mov ecx, dword [ebp - 0x38]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov byte [0x44006c], 1
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043434a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov byte [0x44006c], 1
xor eax, eax
pop esi
call fcn.0043434a
mov esp, ebp
pop ebp
ret

Function at 0x4017d0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x440034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall3C391AEB_1C44_48E2_9895_C609C893E1FA
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x118], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401890
lea edx, [ebp - 0x118]
push edx
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0
push str.DisplayIcon
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.CzNewTips.exe
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x110]
push edx
call fcn.004011a0
mov eax, dword [ebp - 0x114]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043434a
mov esp, ebp
pop ebp
ret
Function at 0x4018a0
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x440034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x10c]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall3C391AEB_1C44_48E2_9895_C609C893E1FA
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x110], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401971
lea edx, [ebp - 0x110]
push edx
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebp - 0x114]
push ecx
push 0
push str.DisplayIcon
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.CzMiniPage.exe
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
setne al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043434a
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor al, al
call fcn.0043434a
mov esp, ebp
pop ebp
ret

Function at 0x401990
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x440034]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x10f]
push 0
push eax
mov byte [ebp - 0x110], 0
call sub.MSVCR100.dll_memset
add esp, 0xc
lea ecx, [ebp - 0x114]
push ecx
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall3C391AEB_1C44_48E2_9895_C609C893E1FA
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x118], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401aa6
lea edx, [ebp - 0x118]
push edx
mov edx, dword [ebp - 0x114]
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x11c]
push ecx
push 0
push str.DisplayIcon
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
push str.CzMiniPage.exe
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x401a99
lea eax, [ebp - 0x110]
push eax
call fcn.004011a0
add esp, 4
cmp esi, 1
jne 0x401a60
push esi
jmp 0x401a91
push 0
call dword [sym.imp.MSVCR100.dll__time64]
add esp, 4
push eax
call dword [sym.imp.MSVCR100.dll_srand]
add esp, 4
call dword [sym.imp.MSVCR100.dll_rand]
cdq
mov ecx, 0x258
idiv ecx
imul edx, edx, 0x3e8
push edx
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.00402690
add esp, 4
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043434a
mov esp, ebp
pop ebp
ret