joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40acf4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp dword [0x41d79c], 0
jne 0x40ad0c
cmp dword [0x41d798], 0
je 0x40ad13
xor eax, eax
jmp 0x40ae10
cmp dword [0x41d7a4], 0
je 0x40ae01
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
cmp dword [0x41d7c8], 0
je 0x40ad5c
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [0x41d7cc]
push ecx
call fcn.0040ae14
add esp, 8
cmp eax, dword [0x41d7c8]
jae 0x40ad5c
mov dword [0x41d798], 1
jmp 0x40ae0b
cmp dword [0x411d40], 0xffffffff
je 0x40ad83
mov edx, dword [ebp - 4]
push edx
mov eax, dword [0x411d40]
push eax
call fcn.0040ae14
add esp, 8
cmp eax, 0x190
jae 0x40ad83
jmp 0x40ae0b
mov dword [0x41d79c], 1
push 3
push 0x113
push 0x113
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PeekMessageA]
push 3
push 0x113
push 0x113
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0
push 0x8000
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x41d798], eax
mov dword [0x41d79c], 0
cmp dword [0x41d798], 0
jne 0x40adf4
push 0
call dword [sym.imp.USER32.dll_SetCursor]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x411d40], eax
jmp 0x40ae0b
mov dword [0x41d798], 1
mov eax, dword [0x41d798]
mov esp, ebp
pop ebp
ret

Function at 0x40ae42
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x40ae96
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
test ecx, ecx
je 0x40ae80
mov edx, dword [ebp - 8]
movsx eax, byte [edx]
cmp eax, 0x22
je 0x40ae80
jmp 0x40ae5c
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x22
jne 0x40ae94
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x40aeb0
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
cmp edx, 0x20
jbe 0x40aeb0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 8], eax
jmp 0x40ae96
mov ecx, dword [ebp - 8]
movsx edx, byte [ecx]
test edx, edx
je 0x40aed4
mov eax, dword [ebp - 8]
movsx ecx, byte [eax]
cmp ecx, 0x20
ja 0x40aed4
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.USER32.dll_CharNextA]
mov dword [ebp - 8], eax
jmp 0x40aeb0
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov ecx, dword [ebp - 0x20]
and ecx, 1
test ecx, ecx
je 0x40aefd
mov edx, dword [ebp - 0x1c]
and edx, 0xffff
mov dword [ebp - 0x50], edx
jmp 0x40af04
mov dword [ebp - 0x50], 0xa
mov eax, dword [ebp - 0x50]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call fcn.0040a2b0
mov dword [ebp - 4], eax
call fcn.0040bdf1
push 0
call fcn.0040a61b
add esp, 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40af57
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x41d7bc], 0
jne 0x40af75
push 1
call fcn.0040a61b
add esp, 4
jmp 0x40b029
cmp dword [0x41d7a0], 0
je 0x40af83
call fcn.0040b02d
lea eax, [ebp - 4]
push eax
push str.Control_PanelDesktop
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40b029
mov dword [ebp - 0xc], 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
push 0
push 0
push str.ScreenSaveUsePassword
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b01f
cmp dword [ebp - 8], 0
je 0x40b01f
push str.PASSWORD.CPL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x41d7a0], eax
cmp dword [0x41d7a0], 0
je 0x40b01f
push str.VerifyScreenSavePwd
mov ecx, dword [0x41d7a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x41d7a4], eax
cmp dword [0x41d7a4], 0
je 0x40b01a
mov dword [0x41d7a8], 1
push 1
call fcn.0040a61b
add esp, 4
jmp 0x40b01f
call fcn.0040b02d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40b470
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
push 0x64
push 0x30
push 0x41dcc0
call fcn.0040c210
add esp, 0xc
movsx eax, byte [0x41d7d8]
test eax, eax
je 0x40b667
push 0x41dba0
call fcn.0040c190
add esp, 4
cmp eax, 3
jbe 0x40b667
push 0x41dba0
call fcn.0040c190
add esp, 4
add eax, 0x41dba0
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 2
jne 0x40b4d6
mov dword [ebp - 0x158], 0x411de0
jmp 0x40b4e0
mov dword [ebp - 0x158], str.ff0.
mov ecx, dword [ebp - 0x158]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040c0a0
add esp, 8
push 0x140
push 0
lea eax, [ebp - 0x148]
push eax
call fcn.0040c210
add esp, 0xc
mov dword [ebp - 0x148], 0x80
lea ecx, [ebp - 0x148]
push ecx
push 0x41dba0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40b661
lea edx, [ebp - 0x11c]
push edx
call fcn.0040c190
add esp, 4
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 4
jle 0x40b63e
mov eax, dword [ebp - 0x14c]
lea ecx, [ebp + eax - 0x120]
mov dword [ebp - 0x150], ecx
push str..exe
mov edx, dword [ebp - 0x150]
push edx
call fcn.0040ed70
add esp, 8
test eax, eax
je 0x40b5eb
push str..swf
mov eax, dword [ebp - 0x150]
push eax
call fcn.0040ed70
add esp, 8
test eax, eax
je 0x40b5eb
push str..htm
mov ecx, dword [ebp - 0x150]
push ecx
call fcn.0040ed70
add esp, 8
test eax, eax
je 0x40b5eb
push 0x411e04
mov edx, dword [ebp - 0x150]
push edx
call fcn.0040ed70
add esp, 8
test eax, eax
je 0x40b5eb
push str..gif
mov eax, dword [ebp - 0x150]
push eax
call fcn.0040ed70
add esp, 8
test eax, eax
jne 0x40b5e5
cmp dword [ebp + 8], 0
jne 0x40b5eb
cmp dword [ebp + 8], 2
jne 0x40b63e
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0040c0a0
add esp, 8
push 0x41dba0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 3
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x154]
push ecx
call fcn.0040c270
add esp, 0xc
mov byte [ebp - 0x151], 0
lea edx, [ebp - 0x154]
push edx
call fcn.0040cb8f
add esp, 4
mov byte [eax + 0x41dcc0], 0x31
lea eax, [ebp - 0x148]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b532
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
mov byte [eax], 0
mov esp, ebp
pop ebp
ret

Function at 0x40b66b
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [0x41d7d8]
test eax, eax
jne 0x40b6b8
push 0x41dba0
push 0x100
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40b69f
push 0x411e14
push 0x41dba0
call fcn.0040c0a0
add esp, 8
push str.FlashForge
push 0x41dba0
call fcn.0040c0b0
add esp, 8
mov byte [0x41d7d8], 1
push 0x41dba0
call fcn.0040c190
add esp, 4
cmp eax, 3
jbe 0x40b6d7
push 0
push 0x41dba0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x41dba0
call fcn.0040c190
add esp, 4
movsx ecx, byte [eax + 0x41db9f]
cmp ecx, 0x5c
je 0x40b702
push 0x411e24
push 0x41dba0
call fcn.0040c0b0
add esp, 8
push 0
call fcn.0040b470
add esp, 4
pop ebp
ret
Function at 0x40b70e
Capabilities:
Delete directory
Set current directory

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [0x41d7d8]
test eax, eax
je 0x40b783
push 1
call fcn.0040b470
add esp, 4
push 0x41dba0
call fcn.0040c190
add esp, 4
cmp eax, 3
jbe 0x40b77c
push 0x41dba0
call fcn.0040c190
add esp, 4
mov byte [eax + 0x41db9f], 0
push 0x41dba0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40b77c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x10
jne 0x40b77c
push 0x411e28
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push 0x41dba0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov byte [0x41d7d8], 0
pop ebp
ret
Function at 0x40ba70
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 0x10c], 0
call fcn.0040b66b
cmp dword [ebp + 0xc], 0
je 0x40ba9a
mov dword [ebp - 0x11c], 0x411e38
jmp 0x40baa4
mov dword [ebp - 0x11c], 0x411e3c
mov eax, dword [ebp + 8]
push eax
push 1
mov ecx, dword [ebp - 0x11c]
push ecx
push 0x100
lea edx, [ebp - 0x108]
push edx
call fcn.0040bd15
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
push 0x41d8dc
call fcn.0040c0a0
add esp, 8
mov dword [ebp - 8], str.MOVIE
push 0
call fcn.004045aa
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40bd0b
cmp dword [ebp + 0xc], 0
je 0x40bb89
push 0x41d8dc
call fcn.004055de
add esp, 4
test eax, eax
je 0x40bb1e
mov dword [ebp - 0x10c], 0x41d8dc
jmp 0x40bb4f
lea ecx, [ebp - 0x108]
push ecx
call fcn.004055de
add esp, 4
test eax, eax
je 0x40bb4f
lea edx, [ebp - 0x108]
push edx
push 0x41d8dc
call fcn.0040c0a0
add esp, 8
mov dword [ebp - 0x10c], 0x41d8dc
cmp dword [ebp - 0x10c], 0
je 0x40bb7e
mov eax, 1
test eax, eax
je 0x40bb7e
push 0
push str.STUB
call fcn.00405408
add esp, 8
test eax, eax
jne 0x40bb7e
mov dword [ebp - 0x10c], 0
mov ecx, dword [0x42cffc]
mov dword [ebp - 8], ecx
jmp 0x40bb90
mov dword [ebp - 8], str.PREVIEWF
cmp dword [ebp - 0x10c], 0
jne 0x40bba1
cmp dword [ebp + 0xc], 0
je 0x40bba1
jmp 0x40bbf7
push 0x41d8dc
mov edx, dword [ebp - 8]
push edx
call fcn.00405408
add esp, 8
test eax, eax
je 0x40bbc2
mov dword [ebp - 0x10c], 0x41d8dc
jmp 0x40bbf7
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp - 8]
push ecx
call fcn.00405408
add esp, 8
test eax, eax
je 0x40bbf7
lea edx, [ebp - 0x108]
push edx
push 0x41d8dc
call fcn.0040c0a0
add esp, 8
mov dword [ebp - 0x10c], 0x41d8dc
cmp dword [ebp + 0xc], 0
je 0x40bc54
mov eax, 1
test eax, eax
je 0x40bc4a
cmp dword [ebp - 0x10c], 0
je 0x40bc4a
mov dword [ebp - 0x118], 0xfa123456
mov ecx, dword [ebp - 8]
push ecx
call fcn.00404aed
add esp, 4
mov dword [ebp - 0x114], eax
push 0
lea edx, [ebp - 0x110]
push edx
push 8
lea eax, [ebp - 0x118]
push eax
mov ecx, dword [0x411450]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
call fcn.004055de
add esp, 4
xor edx, edx
cmp dword [ebp - 0x10c], 0
setne dl
mov byte [0x41d9dc], dl
cmp dword [ebp + 0xc], 0
je 0x40bccb
cmp dword [ebp - 0x10c], 0
je 0x40bccb
call fcn.00405ee7
test eax, eax
jne 0x40bccb
push str.gscr.dll
push 0
push str..dll
push 0x100
lea eax, [ebp - 0x108]
push eax
call fcn.0040bd15
add esp, 0x14
lea ecx, [ebp - 0x108]
push ecx
push 0x41d7dc
call fcn.0040c0a0
add esp, 8
push 0x41d7dc
push str.KMDL
call fcn.00405408
add esp, 8
mov byte [0x41d9dd], 1
mov edx, dword [ebp - 4]
push edx
call fcn.004048e9
add esp, 4
push str.__.___
push 0
push str..___
push 0x100
lea eax, [ebp - 0x108]
push eax
call fcn.0040bd15
add esp, 0x14
push 0x411e7c
lea ecx, [ebp - 0x108]
push ecx
call section..text
add esp, 8
mov eax, dword [ebp - 0x10c]
mov esp, ebp
pop ebp
ret
Function at 0x40bd15
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov byte [eax], 0
cmp dword [0x41d694], 0
jne 0x40bd5a
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040b893
add esp, 0x10
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 8], eax
jmp 0x40bdb0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x40bdb0
mov edx, dword [ebp + 8]
push edx
call fcn.0040c190
add esp, 4
mov ecx, dword [ebp + 8]
lea edx, [ecx + eax - 1]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax - 1]
cmp ecx, 0x5c
je 0x40bdb0
push 0x411e84
mov edx, dword [ebp + 8]
push edx
call fcn.0040c0b0
add esp, 8
cmp dword [ebp - 8], 0
je 0x40bde0
push 0x5c
mov eax, dword [ebp + 8]
push eax
call fcn.0040c070
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40bde0
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp - 4]
add edx, 1
push edx
call fcn.0040c0a0
add esp, 8
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40bdf1
Capabilities:
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
movsx eax, byte [0x41d9dc]
test eax, eax
je 0x40be50
push 0x41d8dc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40be49
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40be49
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41d8dc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40be49
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41d8dc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [0x41d9dc], 0
movsx ecx, byte [0x41d9dd]
test ecx, ecx
je 0x40beac
push 0x41d7dc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40bea5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40bea5
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41d7dc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40bea5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x41d7dc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [0x41d9dd], 0
push 0x41d8dc
call fcn.004011ee
add esp, 4
call fcn.0040b70e
pop ebp
ret
Function at 0x40bec0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1d4
mov dword [ebp - 0xcc], 6
call fcn.00403e32
cmp dword [ebp + 8], 0
jne 0x40beed
mov dword [ebp - 0xcc], 6
jmp 0x40bf92
push str.screensaver
push str.Audi_LeMans
call fcn.0040b270
add esp, 8
test eax, eax
jne 0x40bf19
push str.screen_saver
push str.Audi_LeMans
call fcn.0040b270
add esp, 8
test eax, eax
je 0x40bf51
push str.Audi_LeMans
push str.Do_you_wish_to_uninstall___s__
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x24
push str.Audi_LeMans
lea ecx, [ebp - 0xc8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0xcc], eax
jmp 0x40bf92
movsx edx, byte [str.Do_you_wish_to_uninstall_the__Audi_LeMans__screensaver_]
test edx, edx
je 0x40bf92
push str.Audi_LeMans
push str.Do_you_wish_to_uninstall_the__Audi_LeMans__screensaver_
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x24
push str.Audi_LeMans
lea ecx, [ebp - 0xc8]
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0xcc], eax
cmp dword [ebp - 0xcc], 6
jne 0x40c02e
push str.Display_Properties
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [ebp - 0xd4], eax
cmp dword [ebp - 0xd4], 0
je 0x40bfd9
push 0
push 0
push 0x12
mov edx, dword [ebp - 0xd4]
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push str.Audi_LeMans.exe
push str.SOFTWAREMicrosoftWindowsCurrentVersionUnInstall_s
lea eax, [ebp - 0xc8]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str..scr
lea ecx, [ebp - 0xc8]
push ecx
call fcn.0040c190
add esp, 4
lea edx, [ebp + eax - 0xcc]
push edx
call fcn.0040c0a0
add esp, 8
lea eax, [ebp - 0xc8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call fcn.00403310
mov esp, ebp
pop ebp
ret
Function at 0x40de98
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4122f8
cmp edx, dword [eax]
je 0x40deba
add eax, 8
inc ecx
cmp eax, 0x412388
jl 0x40deab
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4122f8]
jne 0x40dfe8
mov eax, dword [0x41da34]
cmp eax, 1
je 0x40dfc2
test eax, eax
jne 0x40deeb
cmp dword [0x411f44], 1
je 0x40dfc2
cmp edx, 0xfc
je 0x40dfe8
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40df22
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040c0a0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040c190
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40df65
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040c190
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40f6c0
push edi
call fcn.0040c270
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040c0a0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040c0b0
lea eax, [ebp - 0xa0]
push 0x40f6a0
push eax
call fcn.0040c0b0
push dword [esi + 0x4122fc]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040c0b0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x40f678
push eax
call fcn.0040ecb1
add esp, 0x2c
pop edi
jmp 0x40dfe8
lea eax, [ebp + 8]
lea esi, [esi + 0x4122fc]
push 0
push eax
push dword [esi]
call fcn.0040c190
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x4030bb
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x4030f3
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x4030e1
mov al, 1
jmp 0x40313d
cmp dword [ebx + 0x54], ecx
jne 0x4030ea
mov al, 2
jmp 0x40313d
cmp dword [ebx + 0x7c], ecx
jne 0x40313d
mov al, 3
jmp 0x40313d
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x403108
mov al, 4
jmp 0x40313d
cmp ecx, 5
jne 0x403128
cmp ebx, 0
jne 0x403116
mov al, 5
jmp 0x40313d
cmp ebx, 1
jne 0x40311f
mov al, 6
jmp 0x40313d
cmp ebx, 2
jne 0x403128
mov al, 7
jmp 0x40313d
cmp ecx, 6
jne 0x403134
cmp ebx, 0
jne 0x403136
mov al, 8
jmp 0x40313d
cmp ebx, 1
jne 0x40313d
mov al, 9
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a460
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x46604b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0045aed7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40a4e2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00458dfa
mov eax, dword [eax]
push 0xbee1f0
push eax
call fcn.0044bad4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0045b162
test bl, bl
je 0x40a4e2
push 0xbee1f0
lea ecx, [esp + 0xc]
call fcn.0045b4f2
push 0xbf1d38
lea ecx, [esp + 0xc]
call fcn.0045b4f2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40a51e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0045b162
jmp 0x40a5e9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40a5a2
lea edx, [esp + 0x7c]
push 0xbf1d34
push edx
call fcn.0044bad4
add esp, 8
test eax, eax
je 0x40a5a2
lea eax, [esp + 0x7c]
push 0xbf1d30
push eax
call fcn.0044bad4
add esp, 8
test eax, eax
je 0x40a5a2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40a532
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0045b162
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40ade0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40ae42
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40ae50
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x4660cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0xbf8300]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x40af88
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x40aeb6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045b162
xor eax, eax
jmp 0x40afff
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0045b29f
push esi
lea ecx, [esp + 0xc]
call fcn.0045b52e
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0xbf1d70
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40afdd
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push 0x80000000
call fcn.0040ade0
test eax, eax
jne 0x40afdd
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x80000000
mov ecx, edi
call fcn.0040ade0
test eax, eax
jne 0x40afdd
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.0044cb10
mov esi, eax
add esp, 8
test esi, esi
jne 0x40afbc
lea ecx, [esp + 0x14]
push 0xbf1d48
push ecx
call fcn.0044ca90
mov esi, eax
add esp, 8
test esi, esi
jne 0x40afbc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x40afbf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0045b24f
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40aece
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0045b162
xor eax, eax
jmp 0x40afff
mov byte [esi], 0
push 0xbf1d44
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0045b162
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4