joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bb26
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
mov edx, dword [ebp + 0xc]
xor ecx, ecx
mov al, byte [ecx + edx]
cmp al, 0x61
jl 0x42bb41
cmp al, 0x7a
jg 0x42bb41
sub al, 0x20
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x42bb31
mov eax, dword fs:[0x30]
mov ebx, dword [eax + 0xc]
add ebx, 0xc
mov esi, dword [ebx]
mov eax, dword [esi + 0x18]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov esi, dword [esi]
cmp ebx, esi
je 0x42bba1
push esi
mov esi, dword [esi + 0x30]
mov edi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp + 0x14]
xor ecx, ecx
mov al, byte [ecx + edx]
cmp al, 0x61
jl 0x42bb84
cmp al, 0x7a
jg 0x42bb84
sub al, 0x20
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [ebp + 0x10]
jl 0x42bb74
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
repe cmpsb byte [esi], byte es:[edi]
pop esi
test ecx, ecx
je 0x42bb9c
jmp 0x42bb5d
mov eax, dword [esi + 0x18]
jmp 0x42bba3
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret 0x10

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401340
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12d
mov dword [ebp - 0x28], 0x16
mov dword [ebp - 0x7f4], str.FFFTWAREFFasses
mov dword [ebp - 0x7a4], str.yysid0afaced1_e828_11d1_9187_b532f1e9575dinprocserver32
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12c
mov dword [ebp - 0x28], 0x15
mov dword [ebp - 0x854], 2
mov dword [ebp - 0x850], 3
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x82c], str.asdf
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea ecx, [ebp - 0x854]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x4380c8], ecx
mov edx, dword [ebp - 0x7f4]
mov byte [edx], 0x53
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 1], 0x4f
mov ecx, dword [ebp - 0x7f4]
mov byte [ecx + 2], 0x46
mov edx, dword [ebp - 0x7f4]
mov byte [edx + 9], 0x43
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 0xa], 0x6c
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x7f4]
push edx
push 0x80000002
call dword [0x4380c8]
test eax, eax
je 0x4014e3
xor eax, eax
jmp 0x401785
mov eax, dword [ebp - 0x7a4]
mov byte [eax], 0x63
mov ecx, dword [ebp - 0x7a4]
mov byte [ecx + 1], 0x6c
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x7a4]
push eax
push 0x80000000
call dword [0x4380c8]
test eax, eax
je 0x401517
xor eax, eax
jmp 0x401785
push 1
mov ecx, dword [0x4380c4]
push ecx
jmp 0x45b410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007560
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x101906f8], 0x13a8
mov dword [0x10190704], 0
mov byte [0x10190708], 0
mov edi, dword [0x101906fc]
add edi, 0xffffea5b
mov dword [0x101906fc], edi
mov dword [0x10190700], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x101906fc]
add eax, 0xfffff29d
mov dword [0x101906f8], eax
mov eax, dword [0x10190700]
add eax, 1
mov dword [0x10190700], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100075b7
xor eax, eax
mov dword [0x101906f8], 0x119a
mov dword [0x10190700], 0
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov dword [0x1019070c], 0
mov dword [ebp - 0x24], eax
xor edx, edx
mov esi, dword [ebp - 0x10]
div esi
mov dword [0x101906f8], 0x21a0
mov edi, dword [0x10190704]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x24]
movzx esi, byte [ebx + esi]
add esi, edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add esi, edx
mov dword [0x1019070c], esi
mov eax, esi
cdq
idiv ecx
mov dword [0x10190704], edx
mov dword [0x101906fc], 0xd15
mov ecx, dword [ebp - 0x24]
mov cl, byte [ebx + ecx]
mov byte [0x10190708], cl
mov cl, byte [ebx + edx]
mov edx, dword [ebp - 0x24]
mov byte [ebx + edx], cl
mov dword [0x101906f8], 0x18ab
mov cl, byte [0x10190708]
mov esi, dword [0x10190704]
mov byte [ebx + esi], cl
mov esi, dword [0x10190700]
add esi, 1
mov dword [0x10190700], esi
cmp esi, 0x100
mov dword [ebp - 0x20], esi
jl 0x10007605
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10007a80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x101906f8], 0xacb
mov dword [ebp - 0x10], eax
call fcn.100089b0
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x10007ac6
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov dword [0x101906fc], 0x6ce
mov esi, dword [edx + eax + 0x24]
mov dword [0x101906f8], 0xfffffca0
mov edi, dword [edx + eax + 0x18]
cmp edi, 0
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x34], ebx
je 0x10007c07
jmp 0x10007b42
mov eax, dword [ebp - 0x38]
mov ecx, eax
mov edx, dword [ebp - 0x3c]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov bl, cl
mov dword [ebp - 0x40], eax
mov byte [ebp - 0x41], bh
mov byte [ebp - 0x42], cl
mov byte [ebp - 0x43], bl
je 0x10007baa
jmp 0x10007b78
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x2c]
add ecx, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x48]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + ecx*4]
mov dword [0x101906f8], 0xacb
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], ecx
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x38], edx
jmp 0x10007b12
mov eax, dword [ebp - 0x40]
add eax, 1
mov cl, byte [ebp - 0x41]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x42]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dl, byte [ebp - 0x42]
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x43], dl
jne 0x10007b12
mov al, byte [ebp - 0x43]
test al, 1
mov ecx, dword [ebp - 0x50]
mov dword [ebp - 0x58], ecx
jne 0x10007bdb
mov eax, dword [ebp - 0x54]
add eax, 1
mov ecx, dword [ebp - 0x50]
add ecx, 2
mov edx, dword [ebp - 0x30]
cmp eax, edx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
jb 0x10007b52
jmp 0x10007c00
mov eax, dword [ebp - 0x58]
movzx eax, word [eax]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x1c]
mov esi, dword [ebp - 0x1c]
add esi, dword [ecx + eax*4]
mov dword [0x101906f8], 0x1919
mov dword [ebp - 0x34], esi
jmp 0x10007c07
xor eax, eax
mov dword [ebp - 0x34], eax
jmp 0x10007c07
mov eax, dword [ebp - 0x34]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008690
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [0x101906fc], 0x1a0e
mov dword [ebp - 4], 0
mov dword [0x101906f8], 0x7d0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [0x101906f8]
add edx, 0xfffffa13
mov dword [0x101906f8], edx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x101906fc], 0x19a
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jmp 0x1000874f
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x1000874f
jmp 0x10008765
mov eax, 0xfffff83a
mov dword [0x101906f8], 0xe63
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x12], 0x64
mov dword [ebp - 0x20], eax
je 0x100087e2
jmp 0x1000881d
mov eax, 0xffffee12
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x10008809
jmp 0x1000881d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
jne 0x100086ec
mov eax, dword [ebp - 0x18]
mov ecx, 0xffffec88
mov dword [0x101906f8], 0x2b1
mov edx, dword [ebp - 0xc]
cmp word [edx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jne 0x1000881d
mov eax, 0xffffec88
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x18], 0x6f
mov dword [ebp - 0x20], eax
jne 0x1000881d
mov eax, 0x1137
mov dword [0x101906f8], 0x2760
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x16], 0x61
mov dword [ebp - 0x20], eax
jne 0x1000881d
mov eax, 0x1137
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x14], 0x64
mov dword [ebp - 0x20], eax
je 0x10008705
jmp 0x1000881d
mov eax, 0xffffee12
mov dword [0x101906f8], 0x43b
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0x10], 0x6c
mov dword [ebp - 0x20], eax
je 0x1000872f
jmp 0x1000881d
mov eax, 1
mov dword [0x101906f8], 0x26a1
mov dword [ebp - 0x24], eax
jmp 0x1000882a
mov eax, dword [ebp - 0x20]
xor ecx, ecx
mov dword [0x101906fc], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
add esp, 0x24
pop ebp
ret
Function at 0x10008cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [0x10190700], 0
mov dword [0x10190704], 0
mov dword [0x10190710], 0
mov dword [0x101906f8], 0x1541
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
je 0x10008e58
jmp 0x10008d38
mov eax, dword [0x10190700]
mov ecx, dword [0x101906f8]
mov edx, dword [0x10190704]
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
jmp 0x10008d51
xor eax, eax
mov ecx, 0x1541
mov edx, eax
mov esi, eax
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
jmp 0x10008d51
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
mov esi, dword [ebp - 0x2c]
mov edi, 0x100
mov ebx, edx
add ebx, 1
add esi, 1
add eax, 0xffffe50f
mov dword [0x101906f8], eax
mov eax, esi
mov dword [ebp - 0x34], edx
cdq
idiv edi
mov dword [0x10190700], edx
mov dword [0x101906fc], 0x1c5a
mov esi, dword [ebp - 0x1c]
movzx esi, byte [esi + edx]
add esi, ecx
mov eax, esi
mov dword [ebp - 0x38], edx
cdq
idiv edi
mov dword [0x10190704], edx
mov dword [0x101906f8], 0xe53
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x38]
mov cl, byte [ecx + esi]
mov byte [0x10190708], cl
mov dword [0x101906fc], 0x1303
mov edi, dword [ebp - 0x1c]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x10190708]
mov edx, dword [0x10190704]
mov byte [edi + edx], cl
mov edx, dword [0x101906f8]
mov ecx, edx
add ecx, 0x1414
mov dword [0x101906f8], ecx
mov ecx, dword [0x10190700]
movzx ecx, byte [edi + ecx]
mov esi, dword [0x10190704]
movzx esi, byte [edi + esi]
add esi, ecx
mov ecx, edx
add ecx, 0xfffff366
mov dword [0x101906f8], ecx
and esi, 0xff
mov dword [0x10190710], esi
mov cl, byte [edi + esi]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x34]
mov ch, byte [esi + edi]
add edx, 0xffffe34d
mov dword [0x101906f8], edx
xor ch, cl
mov edx, dword [ebp - 0x18]
mov byte [edx + edi], ch
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x20], ebx
jne 0x10008d16
jmp 0x10008e58
mov dword [0x101906fc], 0xaeb
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10008e70
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0xa0
lea eax, [esp + 0x28]
lea ecx, [esp + 0x38]
mov edx, dword [0x101906f8]
mov esi, edx
add esi, 0xffffe262
mov dword [0x101906f8], esi
add edx, 0xffffd598
mov dword [0x101906fc], edx
mov dword [esp], eax
mov dword [esp + 0x24], ecx
call fcn.10007c20
lea ecx, [0x100074b0]
mov edx, dword [esp + 0x28]
mov dword [esp + 0x8c], edx
mov dword [esp + 0x5c], 0x16e600
mov edx, dword [0x101906e4]
mov dword [esp + 0x44], edx
mov edx, dword [0x101906e8]
mov dword [esp + 0x68], edx
mov edx, dword [0x101906ec]
mov dword [esp + 0x70], edx
mov edx, dword [0x101906f0]
mov dword [esp + 0x90], edx
mov edx, dword [0x101906f4]
mov dword [esp + 0x4c], edx
mov dword [0x101906f8], 0x2013
mov dword [0x101906fc], 0x1060
mov dword [esp + 0x20], eax
mov dword [esp + 0x1c], ecx
mov eax, dword [esp + 0x1c]
cmp word [eax], 0x5a4d
mov dword [esp + 0x18], eax
jne 0x10008f42
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
je 0x10008f56
mov eax, dword [esp + 0x18]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
jmp 0x10008f1b
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x80], eax
mov dword [0x101906fc], 0x258d
mov eax, dword [eax + ecx + 0x50]
mov dword [esp + 0x88], eax
call fcn.10008690
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
jne 0x10008fc0
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10007750
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x101906f8], 0x1cda
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x401ac7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [0x40c0cc], ebx
jne 0x4056da
push esi
mov esi, dword [ebp + 0x14]
cmp esi, ebx
jle 0x4056e2
mov eax, dword [ebp + 0xc]
shr eax, 4
push 6
inc eax
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, ebx
je 0x401b38
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, ebx
je 0x401b38
and dword [ebp + 0xc], 0xf
je 0x401b1d
mov ecx, dword [ebp + 0xc]
dec ecx
movzx edx, word [eax]
lea eax, [eax + edx*2 + 2]
jne 0x401b13
movzx ebx, word [eax]
lea ecx, [esi - 1]
cmp ebx, ecx
jge 0x4056e9
push edi
mov edi, dword [ebp + 0x10]
mov ecx, ebx
lea esi, [eax + 2]
rep movsw word es:[edi], word [esi]
pop edi
mov eax, dword [ebp + 0x10]
and word [eax + ebx*2], 0
mov eax, ebx
pop esi
pop ebx
pop ebp
ret 0x10
pop ebx
pop ebp
jmp dword [sym.imp.USER32.dll_LoadStringW]
xor eax, eax
jmp 0x401b42
mov ebx, ecx
jmp 0x401b2b

Function at 0x401e09
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x40c0b4]
xor eax, dword [ebp + 4]
push esi
mov esi, ecx
push dword [esi + 4]
mov dword [ebp - 4], eax
mov dword [esi], 0x401ea4
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x401e94
push 0xffffffffffffffeb
push dword [esi + 4]
call fcn.00401631
cmp esi, eax
jne 0x401e94
push 0
push 0xffffffffffffffeb
push dword [esi + 4]
call fcn.004023ec
and byte [ebp - 0x110], 0
push pe_nt_image_headers32
lea eax, [ebp - 0x110]
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea ecx, [ebp - 0x110]
mov dword [ebp - 0xc], ecx
xor eax, eax
lea ecx, [ebp - 0x10]
push ecx
inc eax
push eax
push 0
push 2
mov dword [ebp - 0x10], eax
call fcn.004021c9
push eax
push 0x30357864
call fcn.00403fec
add esp, 0x10
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.004012b8
leave
ret

Function at 0x402320
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
cmp dword [0x40c0cc], 0
jne 0x40578c
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x214]
call fcn.00401729
push dword [ebp + 0xc]
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.004017d1
mov eax, esi
pop esi
leave
ret 8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x402364
Function at 0x402ab6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x95c
mov eax, dword [0x40c0b4]
xor eax, dword [ebp + 4]
cmp dword [0x40c0cc], 0
mov dword [ebp - 4], eax
jne 0x405951
push esi
push dword [ebp + 8]
lea ecx, [ebp - 0x748]
call fcn.00401729
push dword [ebp + 0xc]
lea ecx, [ebp - 0x534]
call fcn.00401729
push dword [ebp + 0x10]
lea ecx, [ebp - 0x95c]
call fcn.00401729
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x320]
call fcn.004034e1
push dword [ebp + 0x18]
lea ecx, [ebp - 0x21c]
push dword [ebp + 0x14]
call fcn.00402b94
lea eax, [ebp - 0x320]
push eax
push dword [ebp + 0x18]
push dword [ebp - 0x218]
push dword [ebp - 0x958]
push dword [ebp - 0x530]
push dword [ebp - 0x744]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x21c]
mov esi, eax
call fcn.00402c98
lea ecx, [ebp - 0x21c]
call fcn.00402c88
lea ecx, [ebp - 0x95c]
call fcn.004017d1
lea ecx, [ebp - 0x534]
call fcn.004017d1
lea ecx, [ebp - 0x748]
call fcn.004017d1
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004012b8
leave
ret 0x18
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x402b85

Function at 0x402e21
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x40c0b4]
xor eax, dword [ebp + 4]
mov dword [ebp - 4], eax
mov eax, dword [0x40c9b8]
or eax, dword [0x40c9bc]
jne 0x402eeb
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0x402f0c
push 0x80000002
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x402eeb
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x402f04
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402ee2
cmp dword [ebp - 0x14], 1
jne 0x402ee2
push ebx
push esi
lea eax, [ebp - 0x118]
mov dword [ebp - 8], eax
push edi
lea eax, [ebp - 8]
push eax
call fcn.00402f31
mov esi, eax
lea eax, [ebp - 8]
push eax
call fcn.00402f31
mov edi, eax
lea eax, [ebp - 8]
push eax
call fcn.00402f31
mov ebx, eax
lea eax, [ebp - 8]
push eax
call fcn.00402f31
push eax
push ebx
push edi
push esi
call fcn.00402031
pop edi
pop esi
mov dword [0x40c9b8], eax
mov dword [0x40c9bc], edx
pop ebx
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, dword [0x40c9b8]
mov edx, dword [0x40c9bc]
call fcn.004012b8
leave
ret
Function at 0x40328d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x40c0b4]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
push 0x46
pop ecx
mov dword [ebp - 4], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x120], ebx
lea edi, [ebp - 0x11c]
push 0x40c994
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, dword [ebp + 8]
xor esi, esi
inc esi
push esi
mov dword [0x40c0dc], eax
call fcn.00403345
cmp eax, ebx
mov dword [0x40c0cc], eax
jne 0x405d70
mov dword [0x40c9ac], ebx
cmp dword [0x40c0cc], ebx
mov dword [ebp - 0x120], 0x11c
jne 0x405d8a
push 4
call fcn.00403345
test eax, eax
jne 0x405dcb
mov dword [0x40c9b0], ebx
call dword [sym.imp.KERNEL32.dll_GetACP]
mov dword [0x40c9b4], eax
call fcn.004033c1
push dword [ebp + 0xc]
call fcn.004020d5
push dword [ebp + 0xc]
call fcn.0040394c
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.004012b8
leave
ret 8
push 4
call fcn.00403345
test eax, eax
mov dword [0x40c9ac], esi
je 0x4032e8
jmp 0x4032e2
cmp dword [0x40c9ac], ebx
jne 0x4032fe
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x4032fe
cmp dword [ebp - 0x118], esi
jae 0x405dc0
cmp dword [ebp - 0x11c], 6
jb 0x4032fe
mov dword [0x40ccb0], esi
jmp 0x4032fe
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
mov dword [0x40c9b0], esi
jne 0x403313
jmp 0x40330d
Function at 0x403345
Capabilities:
Check os version

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
push edi
mov edi, 0x40c9c0
push edi
mov dword [0x40ca5c], ebx
mov dword [0x40c9c0], 0x9c
call esi
test eax, eax
je 0x405e62
pop edi
pop esi
jmp 0x403356
xor eax, eax
cmp dword [0x40c9d0], 2
sete al
jmp 0x4033bd
push ebx
xor ebx, ebx
inc ebx
cmp dword [0x40ca5c], 0
je 0x402077
mov eax, dword [esp + 8]
cmp eax, 0x11
ja case.default.0x40335f
jmp dword [eax*4 + 0x403366]
cmp dword [0x40c9d0], 2
je 0x403845
xor eax, eax
pop ebx
ret 4
cmp dword [0x40c9d0], ebx
jne case.default.0x40335f
mov eax, dword [0x40c9c4]
cmp eax, 4
ja 0x40383e
jne case.default.0x40335f
cmp dword [0x40c9c8], 0xa
jb case.default.0x40335f
mov eax, ebx
jmp 0x4033bd
cmp dword [0x40c9c4], 5
jmp 0x403838
test al, al
js case.default.0x40335f
jmp 0x40383e
jne case.default.0x40335f
jmp 0x40383e
jbe case.default.0x40335f
jmp 0x40383e
push edi
mov dword [0x40c9c0], 0x94
call esi
jmp 0x40209f
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
jmp 0x4033bd
test byte [0x40ca58], 0x10
je case.default.0x40335f
jmp 0x403845
call fcn.004088a1
jmp 0x4033bd
mov al, byte [0x40ca5a]
cmp al, bl
je 0x403845
cmp al, 3
je 0x403845
cmp al, 2
jmp 0x4033b5
cmp byte [0x40ca5a], bl
jne case.default.0x40335f
cmp dword [0x40c9c4], 5
jmp 0x403858
mov al, byte [0x40ca5a]
cmp al, 3
je 0x405ee5
cmp al, 2
jne case.default.0x40335f
cmp dword [0x40c9c4], 5
jne case.default.0x40335f
mov al, byte [0x40ca58]
test al, 2
je case.default.0x40335f
jmp 0x40384e
mov al, byte [0x40ca5a]
cmp al, 3
je 0x405f15
cmp al, 2
jne case.default.0x40335f
cmp dword [0x40c9c4], 5
jne case.default.0x40335f
test byte [0x40ca58], 0x80
je case.default.0x40335f
jmp 0x40383e
mov al, byte [0x40ca5a]
cmp al, 3
je 0x405f45
cmp al, 2
jne case.default.0x40335f
test byte [0x40ca58], 0x82
jmp 0x405ec2
mov eax, dword [0x40ca58]
and eax, 0x40
jmp 0x4033bd
xor eax, eax
cmp dword [0x40c9d0], ebx
jmp 0x4020af
cmp dword [0x40c9d0], ebx
jmp 0x406010
cmp dword [0x40c9d0], ebx
jne case.default.0x40335f
cmp dword [0x40c9c4], 4
jne case.default.0x40335f
cmp dword [0x40c9c8], 0
jne case.default.0x40335f
cmp word [0x40c9cc], 0x3b6
jmp 0x403858
cmp dword [0x40c9d0], ebx
jne case.default.0x40335f
cmp dword [0x40c9c4], 4
jne case.default.0x40335f
cmp dword [0x40c9c8], 0xa
jne case.default.0x40335f
cmp word [0x40c9cc], 0x7ce
jmp 0x403858
cmp dword [0x40c9d0], ebx
mov eax, dword [0x40c9c4]
jne 0x406001
cmp eax, 4
jne 0x403860
cmp dword [0x40c9c8], 0x5a
jae 0x40383e
cmp eax, 4
jmp 0x403860
cmp dword [0x40c9d0], 2
jne case.default.0x40335f
cmp dword [0x40c9c4], 4
jmp 0x403838