joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404b67
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x8e4
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push ebx
push esi
mov dword [ebp - 0x864], eax
mov eax, dword [ebp + 0x7c]
push edi
mov dword [ebp - 0x874], eax
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x85c], ax
lea eax, [ebp - 0x85a]
mov ebx, ecx
push eax
mov dword [ebp - 0x870], ebx
mov edi, edx
call fcn.00408cd0
add esp, 0xc
lea esi, [ebp - 0x85c]
mov dword [ebp - 0x860], esi
test edi, edi
je 0x404bd1
mov dword [ebp - 0x860], edi
mov esi, edi
xor eax, eax
mov word [esi], ax
mov ebx, dword [ebx]
xor edi, edi
mov dword [ebp - 0x86c], eax
cmp ebx, eax
je 0x404d35
cmp dword [ebp - 0x864], eax
je 0x404d35
push 0xc7
push eax
mov byte [ebp - 0x5c], al
lea eax, [ebp - 0x5b]
push eax
call fcn.00408cd0
add esp, 0xc
push edi
push 2
lea eax, [ebp - 0x5c]
push eax
push ebx
mov ebx, dword [sym.imp.WS2_32.dll_recv]
call ebx
cmp eax, 0xffffffff
je 0x404d17
test eax, eax
je 0x404d17
movzx eax, word [ebp - 0x5c]
mov dword [ebp - 0x868], eax
add eax, 2
push eax
xor esi, esi
call fcn.0040b79e
cmp dword [ebp - 0x868], esi
pop ecx
mov edi, eax
jle 0x404d2a
mov eax, dword [ebp - 0x868]
push 0
sub eax, esi
push eax
lea eax, [esi + edi]
push eax
mov eax, dword [ebp - 0x870]
push dword [eax]
call ebx
cmp eax, 0xffffffff
je 0x404cac
test eax, eax
je 0x404cac
add esi, eax
cmp dword [ebp - 0x868], esi
jg 0x404c4e
cmp esi, 5
jl 0x404d2a
push 5
push edi
push str.AS101
sub esi, 5
call fcn.00409e6b
add esp, 0xc
test eax, eax
je 0x404ccc
push 0x41df40
push 0x3ff
push dword [ebp - 0x860]
jmp 0x404d22
push 0x41df40
push 0x3ff
push dword [ebp - 0x860]
call fcn.00409215
add esp, 0xc
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x404d2a
test esi, esi
jle 0x404cdb
lea eax, [edi + 5]
mov ecx, esi
not byte [eax]
inc eax
dec ecx
jne 0x404cd5
mov ebx, dword [ebp - 0x874]
mov eax, dword [ebx]
cmp eax, esi
jl 0x404cfb
push esi
lea eax, [edi + 5]
push eax
push dword [ebp - 0x864]
call fcn.00408eb0
mov dword [ebx], esi
jmp 0x404d0b
push eax
lea eax, [edi + 5]
push eax
push dword [ebp - 0x864]
call fcn.00408eb0
mov dword [ebp - 0x86c], 1
jmp 0x404d27
push 0x41df40
push 0x3ff
push esi
call fcn.00409215
add esp, 0xc
test edi, edi
je 0x404d35
push edi
call fcn.0040b579
pop ecx
mov ecx, dword [ebp + 0x6c]
mov eax, dword [ebp - 0x86c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408cba
add ebp, 0x70
leave
ret
Function at 0x406ed5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x406f05
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x406f00
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x406f2d
mov ecx, dword [esi + 0x1c]
mov eax, dword [esi + 0x18]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x406f16
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x14]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00408eb0
add esp, 0xc
add dword [esi + 0x1c], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x407bd3
Capabilities:
Get common file path

Disassembly:
push ecx
push ebx
xor ebx, ebx
push edi
cmp dword [esi], ebx
jne 0x407c5a
cmp dword [esi + 4], 0xffffffff
jne 0x407c5a
lea edi, [esi + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00409dc5
movzx eax, word [esi + eax*2 + 0x242]
pop ecx
cmp ax, 0x5c
je 0x407c1c
cmp ax, 0x2f
je 0x407c1c
push 0x41dc88
push edi
call fcn.00408d76
pop ecx
pop ecx
push 0x20
call fcn.0040b79e
pop ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0x14], ecx
mov ecx, dword [esp + 0x14]
push eax
mov byte [eax], bl
mov byte [eax + 1], 1
mov byte [eax + 0x10], bl
mov dword [eax + 0x18], ecx
mov dword [eax + 0x1c], ebx
mov dword [eax + 0xc], ebx
call fcn.0040714e
mov dword [esi], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
pop ecx
add eax, 0x200
jmp 0x407c5f
mov eax, 0x1000000
pop edi
pop ebx
pop ecx
ret 8

Function at 0x40888c
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
xor esi, esi
call fcn.00408cd0
add esp, 0xc
test edi, edi
je 0x408944
and dword [ebp - 0x80], esi
mov esi, 0x41de30
push esi
call fcn.00409dc5
pop ecx
test eax, eax
jbe 0x4088ed
push 0x41dd1c
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.004093ab
add esp, 0xc
jmp 0x408921
lea eax, [ebp - 0x7c]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x41fffc
lea eax, [ebp - 0x7c]
push esi
push eax
call fcn.00408dfa
push 0x41dd1c
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.004093ab
add esp, 0x18
xor esi, esi
inc esi
cmp dword [ebp - 0x80], 0
je 0x408944
push dword [ebp - 0x80]
push esi
push 0x200
push edi
call fcn.00409d43
push dword [ebp - 0x80]
call fcn.00409b65
add esp, 0x14
mov ecx, dword [ebp + 0x18c]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00408cba
add ebp, 0x190
leave
ret
Function at 0x40895c
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push esi
push eax
mov dword [ebp - 0x80], esi
call fcn.00408cd0
add esp, 0xc
mov dword [ebp - 0x7c], esi
cmp ebx, esi
je 0x408a2d
push edi
mov edi, str.golfset.ini
push edi
call fcn.00409dc5
pop ecx
test eax, eax
je 0x408a2c
cmp dword [0x423040], 3
mov esi, 0x104
lea eax, [ebp - 0x78]
jne 0x4089de
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x41dc88
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00408dfa
add esp, 0xc
jmp 0x4089e6
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00408dfa
push 0x41dd14
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004093ab
add esp, 0x18
cmp dword [ebp - 0x7c], 0
je 0x408a2c
push dword [ebp - 0x7c]
xor esi, esi
inc esi
push esi
push 0x200
push ebx
call fcn.00409ad1
push dword [ebp - 0x7c]
call fcn.00409b65
add esp, 0x14
mov dword [ebp - 0x80], esi
pop edi
mov ecx, dword [ebp + 0x190]
mov eax, dword [ebp - 0x80]
xor ecx, ebp
pop esi
call fcn.00408cba
add ebp, 0x194
leave
ret

Function at 0x408a46
Capabilities:
Get common file path
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x422044]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
xor eax, eax
xor esi, esi
push 0x206
mov word [ebp - 0x78], ax
lea eax, [ebp - 0x76]
push esi
push eax
mov dword [ebp - 0x80], esi
call fcn.00408cd0
add esp, 0xc
mov dword [ebp - 0x7c], esi
cmp ebx, esi
je 0x408aee
push edi
mov edi, 0x41fffc
push edi
call fcn.00409dc5
pop ecx
test eax, eax
je 0x408aed
lea eax, [ebp - 0x78]
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push edi
lea eax, [ebp - 0x78]
push esi
push eax
call fcn.00408dfa
push 0x41dd14
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x7c]
push eax
call fcn.004093ab
add esp, 0x18
cmp dword [ebp - 0x7c], 0
je 0x408aed
push dword [ebp - 0x7c]
xor esi, esi
inc esi
push esi
push 0x200
push ebx
call fcn.00409ad1
push dword [ebp - 0x7c]
call fcn.00409b65
add esp, 0x14
mov dword [ebp - 0x80], esi
pop edi
mov ecx, dword [ebp + 0x190]
mov eax, dword [ebp - 0x80]
xor ecx, ebp
pop esi
call fcn.00408cba
add ebp, 0x194
leave
ret
Function at 0x408bfe
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x408c1e
mov eax, dword [ebp + 8]
call fcn.00408c69
test eax, eax
je 0x408c64
push edi
push esi
push esi
push 2
push esi
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x408c63
push esi
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, dword [ebp + 0xc]
cmp eax, dword [ebp + 0x10]
jne 0x408c5c
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, esi
pop esi
pop ebp
ret

Function at 0x408c69
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x408c7c
xor eax, eax
pop esi
ret
test al, 1
je 0x408c83
xor eax, 1
test al, 4
je 0x408c8a
xor eax, 4
test al, 2
je 0x408c91
xor eax, 2
test al, 0x20
je 0x408c98
xor eax, 0x20
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, esi
pop esi
ret

Function at 0x408cba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422044]
jne 0x408cc4
repz ret
jmp fcn.0040c865
Function at 0x414e6d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040cd6a
and dword [ebp - 4], 0
cmp dword [0x424430], 0
mov ebx, eax
jne 0x414f1e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x414fcf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x414fcf
push eax
call fcn.0040ccf8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x424430], eax
call esi
push eax
call fcn.0040ccf8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x424434], eax
call esi
push eax
call fcn.0040ccf8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x424438], eax
call esi
push eax
call fcn.0040ccf8
pop ecx
mov dword [0x424440], eax
test eax, eax
je 0x414f1e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040ccf8
pop ecx
mov dword [0x42443c], eax
mov eax, dword [0x42443c]
cmp eax, ebx
je 0x414f76
cmp dword [0x424440], ebx
je 0x414f76
push eax
call fcn.0040cd73
push dword [0x424440]
mov esi, eax
call fcn.0040cd73
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x414f76
test edi, edi
je 0x414f76
call esi
test eax, eax
je 0x414f6d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x414f6d
test byte [ebp - 0xc], 1
jne 0x414f76
or dword [ebp + 0x10], 0x200000
jmp 0x414faf
mov eax, dword [0x424434]
cmp eax, ebx
je 0x414faf
push eax
call fcn.0040cd73
pop ecx
test eax, eax
je 0x414faf
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x414faf
mov eax, dword [0x424438]
cmp eax, ebx
je 0x414faf
push eax
call fcn.0040cd73
pop ecx
test eax, eax
je 0x414faf
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x424430]
call fcn.0040cd73
pop ecx
test eax, eax
je 0x414fcf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x414fd1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x403203
pop dword [ebp - 0x3c]
mov eax, 0x435f77e6
sub eax, 0x431f45e3
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x9968595b
add dword [ebp - 0x4c], 0xb4e9ebf0
mov dword [ebp - 0x48], 0x28473319
add dword [ebp - 0x48], 0x9ec192c
mov dword [ebp - 0x44], 0xd6dfdb3f
sub dword [ebp - 0x44], 0x8a939711
mov dword [ebp - 0x40], 0x53c3ccf5
sub dword [ebp - 0x40], 0x53c3ccf5
lea eax, [ebp - 0x4c]
push eax
mov eax, 0x2bb14210
add eax, 0xd48f2e54
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x77dbd80d
sub dword [ebp - 0x4c], 0x3696eb7
mov dword [ebp - 0x48], 0xf97252cd
add dword [ebp - 0x48], 0x47fa0ea8
mov dword [ebp - 0x44], 0x22c77a9a
add dword [ebp - 0x44], 0x40a7f1d2
mov dword [ebp - 0x40], 0x5bd1c789
add dword [ebp - 0x40], 0xa42e3877
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0x6f49d7f4
add eax, 0x90f698b4
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x3aa09
push 0
call eax
mov ecx, 0xab395eb1
add ecx, 0x54c6f971
xor ebx, ebx
add ebx, eax
mov edi, str.Ze_r8b
add edi, dword [ebp - 0x3c]
mov edx, 0xb3580e8e
sub dword [ebp - 0x18], 0xfd7d9b84
mov esi, dword [edi]
xor dword [ebp - 0x34], esi
xor esi, edx
mov dword [ebp - 0xc], 0xa14a1813
mov dword [ebx], esi
xor dword [ebp - 0x28], 0x37d1dda6
add ebx, 4
add edi, 0xf662af0f
sub edi, 0xf662af0b
loop 0x40331b
add eax, 0x93ac8e95
add eax, 0x6c54c4c6
mov ebx, eax
add eax, 0x905e5b8c
add eax, 0x6fa1a479
mov ecx, 0x400000
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x4035e1
Capabilities:
Delete file
Read .ini file

Disassembly:
mov eax, 0x1000
call fcn.00406cb0
push ebx
push ebp
push esi
push edi
push dword [0x40da28]
mov edi, dword [sym.imp.kernel32.dll_GetPrivateProfileStringA]
mov ebp, 0x1000
lea eax, [esp + 0x14]
push ebp
mov ebx, 0x40c444
push eax
push ebx
mov esi, 0x40be44
push str.title
push esi
call edi
lea eax, [esp + 0x10]
push 0x50
push eax
push 0x40c580
call fcn.004031f4
add esp, 0xc
lea eax, [esp + 0x10]
push dword [0x40da28]
push ebp
push eax
push ebx
push str.info
push esi
call edi
lea eax, [esp + 0x10]
push ebp
push eax
push 0x40c700
call fcn.004031f4
add esp, 0xc
push dword [0x40da28]
push 0x50
push 0x40d8a0
push ebx
push str.build_info
push esi
call edi
push dword [0x40da28]
mov ebp, dword [sym.imp.kernel32.dll_GetPrivateProfileIntA]
push 1
push str.target_compile
push esi
call ebp
push dword [0x40da28]
mov dword [0x40c458], eax
push 1
push str.target_optimize
push esi
call ebp
push dword [0x40da28]
mov dword [0x40d898], eax
push 0xa
push 0x40d8f0
push ebx
push str.target_version
push esi
call edi
push dword [0x40da28]
push 0x50
push 0x40d840
push ebx
push str.name
push str.metadata
call edi
push dword [0x40da28]
push 0x104
push 0x40c5e0
push ebx
push str.install_script
push esi
call edi
push dword [0x40da28]
push 0xa
mov ebp, 0x40da40
push ebp
push ebx
push str.user_access_control
push esi
call edi
push str.force
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403720
call fcn.004031f4
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
jmp 0x40374c
push str.auto
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
jne 0x403753
call fcn.004031f4
test eax, eax
je 0x403786
call fcn.004034d3
test eax, eax
jne 0x403786
call fcn.004031f4
test eax, eax
je 0x403786
call fcn.004031f4
jmp 0x4037c9
cmp byte [0x40da40], 0
je 0x403786
push str.none
push ebp
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x403786
push 0
push str.oops
push str.Bad_user_access_control_value
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x40c580
call fcn.004031f4
push eax
mov dword [0x40d900], eax
call fcn.004031f4
pop ecx
pop ecx
push dword [0x40c564]
call dword [sym.imp.kernel32.dll_UnmapViewOfFile]
mov eax, dword [0x40da28]
test eax, eax
je 0x4037b9
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [0x40da4c]
test eax, eax
je 0x4037c9
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1000
ret
Function at 0x403c88
Capabilities:
Delete file
Read file on windows

Disassembly:
mov eax, 0x1014
call fcn.00406cb0
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_strchr]
push edi
push 0x5b
push dword [esp + 0x1028]
call esi
xor edi, edi
pop ecx
cmp eax, edi
pop ecx
je 0x403cc0
inc eax
push 0x5d
push eax
mov dword [esp + 0x18], eax
call esi
mov ebx, eax
pop ecx
cmp ebx, edi
pop ecx
jne 0x403cc7
xor eax, eax
jmp 0x403e40
and byte [ebx], 0
inc ebx
push ebx
push 0x40c330
mov dword [esp + 0x14], ebx
call sub.MSVCRT.dll_strcmp
pop ecx
test eax, eax
pop ecx
je 0x403e3d
push ebp
push edi
push edi
mov dword [esp + 0x24], str._remove
mov dword [esp + 0x28], edi
mov dword [esp + 0x20], ebx
call dword [sym.imp.MSVCRT.dll__tempnam]
mov esi, dword [sym.imp.MSVCRT.dll_freopen]
mov ebp, eax
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov edi, 0x40b9d4
add eax, 0x40
push eax
push edi
push ebp
call esi
add esp, 0x14
test eax, eax
jne 0x403d32
push eax
push eax
push str.freopen_stderr
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
push edi
push ebp
call esi
add esp, 0xc
test eax, eax
jne 0x403d5a
push eax
push eax
push str.freopen_stdout
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0x14]
call dword [sym.imp.kernel32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403d9f
lea eax, [esp + 0x18]
push eax
push 2
push ebx
push esi
call fcn.004031f4
add esp, 0x10
cmp eax, 0x80000000
jne 0x403d98
mov eax, dword [sym.imp.MSVCRT.dll__iob]
push str._Could_not_load_Python_
add eax, 0x40
push eax
call dword [sym.imp.MSVCRT.dll_fprintf]
pop ecx
pop ecx
push esi
call dword [sym.imp.kernel32.dll_FreeLibrary]
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov edi, dword [sym.imp.MSVCRT.dll_fflush]
add eax, 0x40
push eax
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
mov esi, dword [sym.imp.MSVCRT.dll_fclose]
add eax, 0x40
push eax
call esi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call edi
mov eax, dword [sym.imp.MSVCRT.dll__iob]
add eax, 0x20
push eax
call esi
push 0x40b970
push ebp
call dword [sym.imp.MSVCRT.dll_fopen]
mov edi, eax
lea eax, [esp + 0x3c]
push edi
push 0x1000
push 1
push eax
call dword [sym.imp.MSVCRT.dll_fread]
push edi
mov ebx, eax
call esi
push ebp
call dword [sym.imp.MSVCRT.dll_remove]
and byte [esp + ebx + 0x54], 0
add esp, 0x30
cmp byte [esp + 0x24], 0
pop ebp
je 0x403e2d
push 0
lea eax, [esp + 0x24]
push str.uninstall_script
push eax
call dword [sym.imp.USER32.dll_GetFocus]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
push dword [esp + 0xc]
push 0x40c330
call sub.MSVCRT.dll_strcpy
pop ecx
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
add esp, 0x1014
ret
Function at 0x413420
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x114]
push ebx
push esi
push edi
mov dword [ebp - 0x10c], 0
mov dword [0x5d4260], 0
mov dword [ebp - 4], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp + eax - 0x108], 0
mov dword [ebp - 0x110], eax
mov ecx, eax
xor edx, edx
mov eax, ebp
call fcn.00413600
mov eax, dword [ebp - 0x110]
lea ecx, [eax + 1]
mov eax, dword [0x5d4260]
mov edx, dword [eax]
lea eax, [ebp - 0x108]
call fcn.00403620
call sub.kernel32.dll_GetCommandLineA
mov dword [0x5664c0], eax
mov ebx, eax
jmp 0x4135c3
add ebx, 1
movzx eax, byte [ebx]
sub eax, 1
cmp eax, 0x20
jb 0x4134a8
cmp byte [ebx], 0
je 0x4135cc
nop
mov byte [ebp - 0x114], 0
mov edi, ebx
mov dword [ebp - 0x110], 0
jmp 0x413523
mov al, byte [ebx]
cmp al, 1
jb 0x413518
sub al, 0x20
jbe 0x4134e8
sub al, 2
je 0x4134fc
jmp 0x413518
mov al, byte [ebp - 0x114]
test al, al
je 0x413528
add dword [ebp - 0x110], 1
jmp 0x413520
cmp byte [ebx + 1], 0x22
je 0x413513
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x413520
add ebx, 1
jmp 0x413520
add dword [ebp - 0x110], 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x4134d8
test dword [ebp - 0x10c], 0xffffffff
je 0x4135bc
mov ecx, dword [ebp - 0x110]
mov edx, dword [ebp - 0x10c]
mov eax, ebp
call fcn.00413600
mov byte [ebp - 0x114], 0
mov ebx, edi
mov eax, dword [0x5d4260]
mov edx, dword [ebp - 0x10c]
mov esi, dword [eax + edx*4]
jmp 0x4135b3
mov al, byte [ebx]
cmp al, 1
jb 0x4135a8
sub al, 0x20
jbe 0x413578
sub al, 2
je 0x41358c
jmp 0x4135a8
mov al, byte [ebp - 0x114]
test al, al
je 0x4135b8
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
jmp 0x4135b0
cmp byte [ebx + 1], 0x22
je 0x4135a3
mov al, byte [ebp - 0x114]
test al, al
sete byte [ebp - 0x114]
jmp 0x4135b0
add ebx, 1
jmp 0x4135b0
mov al, byte [ebx]
mov byte [esi], al
add esi, 1
nop
add ebx, 1
cmp byte [ebx], 0
jne 0x413568
mov byte [esi], 0
nop
add dword [ebp - 0x10c], 1
cmp byte [ebx], 0
jne 0x4134ab
mov ebx, dword [ebp - 0x10c]
mov dword [0x5d4250], ebx
lea edx, [ebx + 1]
shl edx, 2
mov eax, 0x5d4260
call fcn.004107f0
mov eax, dword [0x5d4260]
mov dword [eax + ebx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x426e50
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x108]
mov dword [ebp - 4], eax
mov dword [ebp - 0x108], 0
xor eax, eax
push fcn.00426e40
push ebp
push 0x4142a0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xff
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push 1
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
xor cx, cx
mov edx, 0xff
call fcn.004093b0
mov eax, dword [ebp - 0x108]
mov edx, dword [ebp - 4]
call fcn.00445c50
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00426e40
mov esp, ebp
pop ebp
ret
Function at 0x426f00
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 0x10]
mov edx, 0x587220
lea eax, [ebp - 0xc]
call fcn.0040e5d0
mov dword [ebp - 0x10], 0
xor eax, eax
push fcn.00426ee0
push ebp
push 0x4142a0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, str.Parametr
call fcn.004089c0
push 0
lea eax, [ebp - 0x10]
call fcn.00426e50
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, str.DirectYdirecty.exe
call fcn.00408ac0
mov edx, 1
mov eax, 0x5d1cc4
call fcn.005626a0
mov dword [ebp - 4], eax
xor eax, eax
push fcn.00426ed0
push ebp
push 0x4142a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x80000001
call fcn.00562660
mov eax, dword [ebp - 4]
mov cl, 1
mov edx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.005628d0
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x10]
call fcn.00562ab0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
call fcn.00409580
test eax, eax
je 0x426fc4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00562c70
lea esi, [esi]
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00426ed0
xor eax, eax
pop edx
add esp, 0xc
mov dword fs:[eax], edx
mov eax, ebp
call fcn.00426ee0
mov esp, ebp
pop ebp
ret