joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002c7a8
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002c84a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002c83e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
push 4
push 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
mov eax, dword [ebp - 4]
push dword [eax + 0x34]
push 0x5301
push 0x6411
call fcn.10012c24
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1002c83c
push 4
push 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push 0
push 0x5301
push 0x6411
call fcn.10012c24
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1002c848
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1002c862
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0xbb0
push dword [ebp - 0x18]
push 1
call fcn.10027a2a
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10037186
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068266
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x4e89
mov dword [ebp - 0x48], 0x1000ac48
cmp dword [ebp - 0x24], 0x4f3c
jle 0x10037264
push 0
push 0x175f
push 0x1cf2
push 0x112b
push 0x1884
call dword [sym.imp.GDI32.dll_CreateBitmap]
and dword [ebp - 0x1c], 0
jmp 0x100371ec
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4040
jge 0x10037264
and dword [ebp - 0x14], 0
jmp 0x10037202
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6bcf
jge 0x10037262
and dword [ebp - 0x18], 0
jmp 0x10037218
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x46ce
jge 0x10037260
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
or edx, dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.1000de7e
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10013118
push eax
call fcn.100520df
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1001310e
jmp 0x10037211
jmp 0x100371fb
jmp 0x100371e5
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100372b6
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100372ac
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100372aa
push 0
push 0xaa3
push 0x135d
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
jmp 0x100372b4
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
jmp 0x100372ef
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x100372e4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100372ef
push 0xcf
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x4b4e
jge 0x10037305
push dword [ebp - 0x48]
call fcn.100520df
pop ecx
jmp 0x10037321
or dword [ebp - 4], 0xffffffff
jmp 0x1003732b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10063855
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1006e750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.100559f8
mov dword [ebp - 0x14], eax
cmp dword [0x106124dc], esi
jne 0x10063948
push 0x800
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100638d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10063a28
push esi
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10063a28
push 0x10007528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10063a28
push eax
call ebx
push 0x10007534
push edi
mov dword [0x106124dc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007544
push edi
mov dword [0x106124e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007558
push edi
mov dword [0x106124e4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106124ec], eax
test eax, eax
je 0x10063945
push 0x10007574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106124e8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006396d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10063960
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10063982
push 4
pop eax
jmp 0x10063a2a
cmp dword [ebp - 0x14], esi
je 0x10063982
push dword [0x106124dc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10063967
mov eax, dword [0x106124e8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100639e0
cmp dword [0x106124ec], edi
je 0x100639e0
push eax
call ebx
push dword [0x106124ec]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100639e0
test eax, eax
je 0x100639e0
call ecx
test eax, eax
je 0x100639d5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100639d5
test byte [ebp - 8], 1
jne 0x100639e0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10063a10
mov eax, dword [0x106124e0]
cmp eax, edi
je 0x10063a0d
push eax
call ebx
test eax, eax
je 0x10063a0d
call eax
mov esi, eax
test esi, esi
je 0x10063a0d
mov eax, dword [0x106124e4]
cmp eax, edi
je 0x10063a0d
push eax
call ebx
test eax, eax
je 0x10063a0d
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106124dc]
call ebx
test eax, eax
je 0x10063a28
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10063a2a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10052f03
mov esp, ebp
pop ebp
ret
Function at 0x401040
Capabilities:
Create process on windows
Disable system features via registry on windows
Print debug messages
Set registry value

Disassembly:
sub esp, 0x60
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4010a2
push 4
lea edx, [esp + 0xc]
push edx
push 4
push eax
mov eax, dword [esp + 0x10]
push str.EnableLUA
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
push 0x104
call fcn.00425c76
mov esi, eax
push str.bcdedit__set_nx_alwaysoff
push esi
call fcn.004170ff
xor eax, eax
add esp, 0xc
mov ecx, 0x11
lea edi, [esp + 0x24]
rep stosd dword es:[edi], eax
push esi
mov dword [esp + 0x28], 0x44
mov word [esp + 0x58], ax
mov dword [esp + 0x54], 1
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x28]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40112b
mov ecx, dword [esp + 0x14]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call edi
mov eax, dword [esp + 0x18]
push eax
call edi
push esi
call fcn.00425c71
add esp, 4
pop edi
or eax, 0xffffffff
pop esi
add esp, 0x60
ret

Function at 0x401c20
Capabilities:
Check os version
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x431b4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb4
mov eax, dword [0x442184]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov dword [esp + 0xb4], eax
xor eax, eax
mov ecx, 0x27
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x14], 0x9c
call esi
xor edi, edi
cmp eax, edi
jne 0x401c91
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], 0x94
call esi
test eax, eax
jne 0x401c91
mov eax, 1
jmp 0x401d10
call fcn.00425d0d
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ecx
push 0x4347e4
lea edx, [esp + 0x18]
push str._s_d_d
push edx
mov dword [esp + 0xd8], edi
call fcn.00401ad0
mov esi, dword [esp + 0x20]
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [esp + 0x14], 6
jne 0x401ce9
cmp dword [esp + 0x18], edi
jne 0x401ce9
mov edi, 1
lea eax, [esi - 0x10]
mov dword [esp + 0xc4], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x401d0e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, edi
mov ecx, dword [esp + 0xbc]
mov dword fs:[0], ecx
mov ecx, dword [esp + 0xb4]
call fcn.00417188
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x402a20
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402a39
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x402a4d
pop esi
pop edi
xor eax, eax
pop ebx
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x402a6e
cmp esi, eax
jae 0x402a47
dec ecx
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x402a60
cmp esi, eax
jae 0x402a47
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x402b00
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x63c
mov eax, dword [0x442184]
push edi
mov dword [esp + 0x63c], eax
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x110], 0
mov ecx, 0x41
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
push 0x104
lea eax, [esp + 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x100
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x530]
push edx
lea eax, [esp + 0x42c]
push eax
lea ecx, [esp + 0x328]
push ecx
lea edx, [esp + 0x224]
push edx
lea eax, [esp + 0x18]
push eax
call fcn.00417fa5
lea ecx, [esp + 0x334]
push ecx
lea edx, [esp + 0x230]
push edx
lea eax, [esp + 0x24]
push str._s_ssetup_client.ini
push eax
call fcn.004170ff
lea edi, [esp + 0x134]
add esp, 0x24
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x402bc0
mov ecx, dword [str._setup_client.ini]
mov edx, dword [0x434b1c]
mov eax, dword [0x434b20]
mov dword [edi], ecx
mov ecx, dword [0x434b24]
mov dword [edi + 4], edx
mov dx, word [0x434b28]
mov dword [edi + 8], eax
push 0
mov dword [edi + 0xc], ecx
lea eax, [esp + 0x114]
push eax
lea ecx, [esp + 0x10]
push ecx
mov word [edi + 0x10], dx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x63c]
mov eax, 1
call fcn.00417188
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x402c40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
lea eax, [esp]
push eax
push 0xf003f
push 0
push str.SOFTWAREGreatSkyDes
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402cb1
mov eax, dword [esp]
test eax, eax
je 0x402cb1
mov ecx, 4
mov dword [esp + 8], ecx
mov dword [esp + 0xc], ecx
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
push str.Install
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402cb7
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x10
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0x10
ret

Function at 0x402cd0
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
test eax, eax
mov dword [esp], 0
jne 0x402cfd
push str.SOFTWAREGreatSkyDes
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, 1
add esp, 8
ret 4
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x2001f
push 0
push 0x434b61
push 0
push str.SOFTWAREGreatSkyDes
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x402d5f
mov eax, dword [esp]
test eax, eax
je 0x402d5f
push 4
lea edx, [esp + 0x10]
push edx
push 4
push 0
push str.Install
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x402d67
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret 4
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret 4
Function at 0x402d80
Capabilities:
Copy file
Get common file path
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x33c
mov eax, dword [0x442184]
push ebx
mov dword [esp + 0x33c], eax
push esi
push edi
xor eax, eax
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x230], 0
mov ecx, 0x43
lea edi, [esp + 0x231]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x120], 0
mov ecx, 0x43
lea edi, [esp + 0x121]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x402ed7
mov ecx, dword [ebp + 8]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x238]
push 0x434b64
push eax
call fcn.004170ff
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
lea eax, [esp + 0x138]
push 0x434b64
push eax
call fcn.004170ff
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileA]
add esp, 0x20
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
lea ecx, [esp + 0x248]
push ecx
mov dword [esp + 0x2c], 0
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x402ed7
push 0
push 0
push 3
push 0
push 3
push SysReAllocString
lea edx, [esp + 0x138]
push edx
call esi
mov esi, eax
cmp esi, 0xffffffff
je 0x402e9e
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileSize]
push 0
push edi
call ebx
push 0
push esi
mov dword [esp + 0x1c], eax
call ebx
cmp dword [esp + 0x14], eax
je 0x402ea6
mov dword [esp + 0x10], 1
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
cmp esi, 0xffffffff
je 0x402eb7
push esi
call edi
mov eax, dword [esp + 0x10]
test eax, eax
je 0x402ed7
push 0
lea eax, [esp + 0x124]
push eax
lea ecx, [esp + 0x238]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esp + 0x344]
call fcn.00417188
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x402ef0
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
cmp esi, 0xffffffff
je 0x402f8a
test esi, esi
je 0x402f8a
push ebp
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [esp + 0x20]
mov edx, dword [ecx]
mov ebp, dword [esp + 0x10]
lea edi, [edx + ebp]
cmp edi, eax
jle 0x402f28
pop edi
pop ebp
xor eax, eax
pop esi
ret
mov eax, dword [esp + 0x18]
push ebx
mov bl, byte [edi + eax]
mov edi, dword [esp + 0x20]
test edi, edi
je 0x402f55
inc edx
cmp bl, 0x20
mov dword [ecx], edx
push ecx
jne 0x402f6c
push 1
push eax
push esi
push ebp
call fcn.00402ef0
add esp, 0x14
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
ret
test bl, bl
je 0x402f80
cmp bl, 0x20
je 0x402f80
cmp bl, 0xd
je 0x402f80
cmp bl, 0xa
je 0x402f80
inc edx
mov dword [ecx], edx
push ecx
push 0
push eax
push esi
push ebp
call fcn.00402ef0
add esp, 0x14
pop ebx
pop edi
pop ebp
xor eax, eax
pop esi
ret
pop ebx
pop edi
pop ebp
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x402f90
Capabilities:
Get file size

Disassembly:
push edi
mov edi, dword [esp + 0xc]
cmp edi, 0xffffffff
je 0x402ff4
test edi, edi
je 0x402ff4
push ebx
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [esp + 0x20]
mov edx, dword [esi]
mov ebx, dword [esp + 0x10]
lea ecx, [edx + ebx]
cmp ecx, eax
jg 0x402fe5
mov eax, dword [esp + 0x18]
mov cl, byte [ecx + eax]
test cl, cl
je 0x402feb
cmp cl, 0x20
je 0x402feb
cmp cl, 0xd
je 0x402feb
cmp cl, 0xa
je 0x402feb
push esi
push 1
push eax
inc edx
push edi
push ebx
mov dword [esi], edx
call fcn.00402f90
add esp, 0x14
pop esi
pop ebx
xor eax, eax
pop edi
ret
pop esi
pop ebx
mov eax, 1
pop edi
ret
xor eax, eax
pop edi
ret

Function at 0x403000
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x324
mov eax, dword [0x442184]
push edi
mov dword [esp + 0x324], eax
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x218], 0
mov ecx, 0x40
lea edi, [esp + 0x219]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x110], 0
mov ecx, 0x40
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x103
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.HkSys.bak
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x220]
push str._s_s
push edx
call fcn.004170ff
push str.HkSys.cpy
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x128]
push str._s_s
push ecx
call fcn.004170ff
add esp, 0x20
push 0
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [esp + 0x324]
call fcn.00417188
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x403150
Capabilities:
Delete file
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x364
mov eax, dword [0x442184]
push ebx
push esi
push edi
mov dword [esp + 0x36c], eax
xor eax, eax
xor ebx, ebx
mov byte [esp + 0x50], bl
mov ecx, 0x40
lea edi, [esp + 0x51]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0xfa
lea eax, [esp + 0x54]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x50]
push 0x5c
push ecx
call fcn.00417e2f
mov eax, dword [0x434bb4]
mov cx, word [0x434bb8]
mov dword [esp + 0x5c], eax
xor eax, eax
mov word [esp + 0x60], cx
mov edx, dword [0x434bb0]
mov byte [esp + 0x18], bl
mov ecx, 0xf
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov byte [esp + 0x160], bl
mov ecx, 0x40
lea edi, [esp + 0x161]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [esp + 0x268], bl
xor eax, eax
add esp, 8
mov ecx, 0x40
lea edi, [esp + 0x261]
rep stosd dword es:[edi], eax
mov dword [esp + 0x50], edx
lea edx, [esp + 0x50]
push edx
push ebx
stosw word es:[edi], ax
push str.ItemCount
push str.Setup
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
xor esi, esi
cmp eax, ebx
mov dword [esp + 0xc], eax
jle 0x4032e1
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x403240
push esi
lea eax, [esp + 0x14]
push str.Item_d1
push eax
call fcn.004170ff
add esp, 0xc
lea ecx, [esp + 0x50]
push ecx
push 0x104
lea edx, [esp + 0x160]
push edx
push 0x434b61
lea eax, [esp + 0x20]
push eax
push str.Setup
call edi
test eax, eax
jbe 0x403284
lea ecx, [esp + 0x158]
push ecx
call ebx
push esi
lea edx, [esp + 0x14]
push str.Item_d2
push edx
call fcn.004170ff
add esp, 0xc
lea eax, [esp + 0x50]
push eax
push 0x104
lea ecx, [esp + 0x268]
push ecx
push 0x434b61
lea edx, [esp + 0x20]
push edx
push str.Setup
call edi
test eax, eax
jbe 0x4032d4
lea eax, [esp + 0x260]
push eax
lea ecx, [esp + 0x15c]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov eax, dword [esp + 0xc]
inc esi
cmp esi, eax
jl 0x403240
mov ecx, dword [esp + 0x36c]
call fcn.00417188
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x318
mov eax, dword [0x442184]
push esi
push edi
mov dword [esp + 0x31c], eax
xor eax, eax
mov byte [esp + 8], 0
mov ecx, 0x40
lea edi, [esp + 9]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
push 0
push 0
push 0x25
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jl 0x403457
mov byte [esp + 0x110], 0
xor eax, eax
mov ecx, 0x81
lea edi, [esp + 0x111]
rep stosd dword es:[edi], eax
lea ecx, [esp + 8]
push ecx
stosw word es:[edi], ax
lea edx, [esp + 0x114]
push str._sHkInstall.dll
push edx
stosb byte es:[edi], al
call fcn.004170ff
add esp, 0xc
lea eax, [esp + 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x403457
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HkIsInstall
push esi
call edi
test eax, eax
je 0x403450
mov ecx, dword [ebp + 8]
test ecx, ecx
lea ecx, [esp + 8]
push ecx
je 0x40343e
call eax
test eax, eax
jne 0x403474
push str.HkInstall
jmp 0x403449
call eax
test eax, eax
je 0x403474
push str.HkUninstall
push esi
call edi
test eax, eax
jne 0x40346d
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x31c]
call fcn.00417188
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
lea edx, [esp + 8]
push edx
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [esp + 0x31c]
mov eax, 1
call fcn.00417188
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x4034a0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0x2001f
push 0
push 0x434b61
push 0
push edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4034e9
xor eax, eax
add esp, 8
ret 0xc
push edi
mov edi, dword [esp + 4]
test edi, edi
je 0x40352b
mov edx, dword [esp + 0x18]
mov eax, edx
push esi
lea esi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403500
sub eax, esi
push eax
mov eax, dword [esp + 0x1c]
push edx
push 1
push 0
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
pop esi
je 0x403534
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
add esp, 8
ret 0xc
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop edi
add esp, 8
ret 0xc