joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407020
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0x180]
test eax, eax
je 0x40703e
mov eax, dword [eax + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, 1
pop esi
ret
mov ecx, dword [esi + 0x188]
push 0
push 0
lea eax, [esi + 0x18c]
push 0
push 0
push eax
push 0x406fb0
mov dword [eax], esi
mov dword [esi + 0x190], 0
mov dword [esi + 0x194], ecx
call sub.MFC42.DLL_AfxBeginThread
mov dword [esi + 0x180], eax
mov eax, 1
pop esi
ret

Function at 0x407080
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [ecx + 0x180]
test eax, eax
je 0x407094
mov eax, dword [eax + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov eax, 1
ret
Function at 0x407c70
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x409871
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
call fcn.004086f8
xor edi, edi
lea ecx, [esi + 4]
mov dword [esp + 0x14], edi
call fcn.004086f8
mov dword [esi + 0x2c], edi
mov dword [esi + 0x38], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
push edi
mov ecx, esi
mov byte [esp + 0x18], 3
call fcn.00401470
mov dword [esi + 0x28], edi
push 0x4445dc
lea ecx, [esi + 0x3c]
mov dword [esp + 0x18], 4
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x40], edi
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x408210
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x409990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
push ebp
push esi
mov esi, ecx
xor ebx, ebx
push edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
call fcn.004086f8
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x30], 1
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x1c], ebx
call fcn.00404960
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
mov dword [ecx], eax
mov ecx, esi
call fcn.00401a00
cmp al, bl
je 0x40835c
mov ecx, esi
call fcn.004029b0
test al, al
je 0x40835c
mov ecx, dword [esp + 0x40]
call fcn.00404960
push ecx
mov ecx, esp
mov dword [esp + 0x40], esp
mov dword [ecx], eax
mov ecx, esi
call fcn.00401a00
cmp al, bl
je 0x40835c
lea eax, [esp + 0x3c]
mov ecx, esi
push eax
call fcn.004083a0
mov cl, byte [esp + 0x3c]
mov esi, dword [eax]
mov byte [esp + 0x18], cl
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
push 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + 0x34], 2
mov ebp, ecx
lea ecx, [esp + 0x1c]
push ebp
call dword [sym.imp.MSVCP60.dll_private:_bool___thiscall_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Grow_unsigned_int__bool_]
test al, al
je 0x40830d
mov edi, dword [esp + 0x1c]
mov ecx, ebp
mov edx, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x20], ebp
mov byte [eax + ebp], bl
lea ecx, [esp + 0x3c]
mov byte [esp + 0x30], 4
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x1c]
cmp eax, ebx
jne 0x408328
mov eax, dword [sym.imp.MSVCP60.dll_char_const__private:_static_char_const____cdecl_std::basic_string_char__struct_std::char_traits_char___class_std::allocator_char__::_Nullstr_void_::_2::_C]
push eax
lea ecx, [esp + 0x14]
call fcn.004086f2
mov eax, dword [esp + 0x1c]
mov byte [esp + 0x30], 1
cmp eax, ebx
je 0x40835c
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x408353
cmp al, 0xff
je 0x408353
dec al
mov byte [ecx], al
jmp 0x40835c
push ecx
call sub.MFC42.DLL_operatordelete
add esp, 4
mov esi, dword [esp + 0x38]
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0x14], 1
lea ecx, [esp + 0x10]
mov byte [esp + 0x30], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x28]
mov eax, esi
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
pop ebx
add esp, 0x24
ret 0xc
Function at 0x7a6d98
Capabilities:
Encode data using xor

Disassembly:
jmp 0x7a6da2
pushal
call 0x7a6da8
pop ebp
sub ebp, 0x10
sub ebp, 0x3a6d98
mov al, byte [esp + 0x28]
cmp al, 1
je 0x7a6dcc
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x7a6dd5
mov eax, 0x3a6d98
add eax, ebp
add eax, 0x63
mov ecx, 0x60a
mov edx, 0x3b931132
xor byte [eax], dl
inc eax
dec ecx
jne 0x7a6dec
jmp 0x7a6dff
mov ecx, 0xebbb9ff
xor dh, byte [edx]
xor dh, byte [ebx + 0x3232caf3]
xor dh, byte [ecx]
dec dword [edx + 0x32323236]
mov byte [edx], bl
xor dh, byte [edx]
xor al, ch
sal byte [ecx], 1
cli
mov ecx, 0x32323eb3
xor dh, byte [ecx]
idiv dword [edi - 0x4431e9aa]
push ss
bound ebx, qword [edx + 2]
dec ecx
cmp al, 0x32
pop edx
push esp
rcr byte [ecx], 0x32
xor ebx, dword [esi]
push ss
pop edx
mov edx, dword [edx]
nop
cmp ebx, edx
aaa
xor dh, byte [edx]
xor bl, bl
push es
xor dh, byte [edx]
xor bh, byte [edi - 0x4431e9aa]
push ds
push ss
mov ecx, 0x3ab7b9de
xor dh, byte [edx]
xor bh, byte [ecx + 0x32323ea7]
xor bh, byte [ecx + 0x323222bf]
xor dh, bl
invalid
Function at 0x10496058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.104961a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1049607e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049606a
add dl, dl
jne 0x10496089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104960dc
xor eax, eax
add dl, dl
jne 0x10496096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1049617d
add dl, dl
jne 0x104960a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104960b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104960bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104960c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104960d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10496075
mov eax, 1
add dl, dl
jne 0x104960ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104960f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104960e1
sub eax, ebx
mov ebx, 1
jne 0x10496128
mov ecx, 1
add dl, dl
jne 0x1049610e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10496119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10496105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10496075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1049613f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1049614a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10496136
cmp eax, 0x7d00
jae 0x1049616d
cmp eax, 0x500
jb 0x10496168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10496075
cmp eax, 0x7f
ja 0x10496170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10496075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1049619e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10496075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x104c8058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x104c81a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x104c807e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104c806a
add dl, dl
jne 0x104c8089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104c80dc
xor eax, eax
add dl, dl
jne 0x104c8096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x104c817d
add dl, dl
jne 0x104c80a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104c80b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104c80bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104c80c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x104c80d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x104c8075
mov eax, 1
add dl, dl
jne 0x104c80ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x104c80f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104c80e1
sub eax, ebx
mov ebx, 1
jne 0x104c8128
mov ecx, 1
add dl, dl
jne 0x104c810e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104c8119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104c8105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104c8075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x104c813f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x104c814a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x104c8136
cmp eax, 0x7d00
jae 0x104c816d
cmp eax, 0x500
jb 0x104c8168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104c8075
cmp eax, 0x7f
ja 0x104c8170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x104c8075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x104c819e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x104c8075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4985f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x60000]
push edi
jmp 0x49860a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x498611
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x498600
mov eax, 1
add ebx, ebx
jne 0x498623
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x498634
jne 0x498653
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x498653
dec eax
add ebx, ebx
jne 0x498640
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x498618
add ebx, ebx
jne 0x49864f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4986a5
xor ecx, ecx
sub eax, 3
jb 0x49866b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4986da
sar eax, 1
mov ebp, eax
jmp 0x498676
add ebx, ebx
jne 0x498676
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x498644
inc ecx
add ebx, ebx
jne 0x498684
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x498644
add ebx, ebx
jne 0x498691
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x498686
jne 0x4986a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x498686
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4986c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4986b6
jmp 0x498606
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4986c4
add edi, ecx
jmp 0x498606
pop esi
mov edi, esi
mov ecx, 0x320a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4986e2
cmp byte [edi], 0x1a
jne 0x4986e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4986e7
lea edi, [esi + 0x95000]
mov eax, dword [edi]
or eax, eax
je 0x49875f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x9c888]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x9c9a0]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x498714
mov ecx, edi
jns 0x498743
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x9c9a4]
or eax, eax
je 0x498759
mov dword [ebx], eax
add ebx, 4
jmp 0x498731
call dword [esi + 0x9c9b4]
mov ebp, dword [esi + 0x9c9a8]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x498793
sub esp, 0xffffff80
jmp 0x455abd
Function at 0x401497
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x437cb0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40152c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e9
cmp dword [ebp + 0x10], ebx
jne 0x401520
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401497
test eax, eax
jne 0x4014fb
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.004058c5
cmp eax, ebx
je 0x401533
push ebx
push dword [0x437cb0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40152c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x437cb0], ebx
jne 0x401529
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401529
jmp 0x40152c
Function at 0x402dc4
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x41fd7c]
sub esi, dword [0x423d88]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
xor ebx, ebx
cmp esi, ebx
mov dword [0x437c20], eax
jle 0x402f22
push dword [0x423d84]
call fcn.00402dad
push ebx
push ebx
push dword [0x423d88]
push dword [0x409014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41fd78], esi
mov dword [0x40fcec], ebx
mov ebp, 0x417d78
mov eax, dword [0x423d80]
sub eax, dword [0x423d84]
mov edi, 0x4000
cmp eax, edi
jg 0x402e39
mov edi, eax
push edi
mov esi, 0x41fd80
push esi
call fcn.00402d7b
test eax, eax
je 0x402f34
add dword [0x423d84], edi
mov dword [0x417d08], esi
mov dword [0x417d0c], edi
cmp dword [0x437bcc], ebx
je 0x402e90
cmp dword [0x437ca0], ebx
jne 0x402e90
mov eax, dword [0x41fd78]
sub eax, dword [0x41fd7c]
push ebx
sub eax, dword [esp + 0x1c]
add eax, dword [0x423d88]
mov dword [0x40fcec], eax
call fcn.00402cdc
pop ecx
mov ecx, 0x417cf0
mov dword [0x417d10], ebp
mov dword [0x417d14], 0x8000
call fcn.004060ae
test eax, eax
jl 0x402f39
mov esi, dword [0x417d10]
sub esi, ebp
je 0x402eee
push ebx
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push dword [0x409014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x402f3e
cmp esi, dword [esp + 0x10]
jne 0x402f3e
add dword [0x423d88], esi
cmp dword [0x417d0c], ebx
jne 0x402e5f
jmp 0x402efa
cmp dword [0x417d0c], ebx
jne 0x402f39
cmp edi, ebx
je 0x402f39
mov eax, dword [0x41fd7c]
mov ecx, eax
sub ecx, dword [0x423d88]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x402e23
push ebx
push ebx
push eax
push dword [0x409014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.00402cdc
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
or eax, 0xffffffff
jmp 0x402f2c
push 0xfffffffffffffffd
pop eax
jmp 0x402f2c
push 0xfffffffffffffffe
jmp 0x402f3b
Function at 0x402f42
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x402f6e
mov ecx, dword [0x437c18]
push edi
add eax, ecx
push edi
push eax
push dword [0x409014]
mov dword [0x41fd7c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402dc4
cmp eax, edi
jl 0x403067
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x409014]
call ebx
test eax, eax
je 0x403063
cmp dword [ebp - 4], esi
jne 0x403063
push dword [ebp + 8]
add dword [0x41fd7c], esi
call fcn.00402dc4
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x403066
cmp dword [ebp + 0x10], edi
jne 0x403032
cmp dword [ebp + 8], edi
jle 0x40305e
mov esi, 0x41fd80
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x402fe2
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x409014]
call ebx
test eax, eax
je 0x403063
cmp edi, dword [ebp - 4]
jne 0x403063
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40302e
cmp dword [ebp + 0x14], edi
jne 0x40302e
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x41fd7c], eax
cmp dword [ebp + 8], 0
jg 0x402fd5
jmp 0x40305e
push 0xfffffffffffffffe
jmp 0x403065
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x40303d
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409014]
call ebx
test eax, eax
je 0x403063
mov eax, dword [ebp - 4]
add dword [0x41fd7c], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403066
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x4054b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x42f1d0
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x42f1d0], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4054eb
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405632
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40564f
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405652
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405681
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x4056c5
test edi, edi
jne 0x40568c
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4056bf

Function at 0x4056c9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40573a
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x1400
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405729
cmp dword [ebp + 0x14], 1
je 0x40572b
cmp dword [ebp + 0x14], 2
je 0x40572b
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x13ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405983
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42f218
push esi
call fcn.004057e2
push esi
call fcn.004055bb
mov edi, eax
test edi, edi
jne 0x4059a4
xor eax, eax
jmp 0x4059fc
push edi
call fcn.00405804
test byte [0x437c28], 0x80
je 0x4059bd
mov al, byte [edi]
test al, al
je 0x4059a0
cmp al, 0x5c
je 0x4059a0
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x4059dd
push esi
call fcn.0040589e
test eax, eax
je 0x4059d7
test byte [eax], 0x10
je 0x405a01
push esi
call fcn.0040595c
push esi
call ebx
cmp eax, edi
jg 0x4059c8
push esi
call fcn.0040592f
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4059fb
Function at 0x405cb8
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.004058c5
mov esi, dword [esp + 0x18]
test eax, eax
je 0x405cdc
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405e15
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x430618], 0x4c554e
mov edi, 0x400
mov ebp, 0x430618
test esi, esi
je 0x405d20
push 1
push 0
push esi
call fcn.00405652
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405e1b
cmp eax, edi
jg 0x405e1b
push edi
mov esi, 0x430f58
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405e1b
cmp eax, edi
jg 0x405e1b
push esi
push ebp
push str._s_s_r_n
push 0x430a18
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x437bcc]
push dword [eax + 0x128]
push esi
call fcn.00405a5b
push 4
push 0xc0000000
push esi
call fcn.00405652
mov ebp, eax
mov dword [esp + 0x14], ebp
cmp ebp, 0xffffffff
je 0x405e15
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405e0e
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405e0e
cmp edi, dword [esp + 0x18]
jne 0x405e0e
push str._Rename__r_n
push esi
call fcn.00405a05
test eax, eax
jne 0x405e22
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.004057e2
add edi, 0xa
mov eax, edi
push ebx
push 0x430a18
add eax, esi
push eax
call fcn.0040560e
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x437c90]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x40762c
add eax, 0xa
push eax
call fcn.00405a05
test eax, eax
je 0x405dd9
inc eax
lea ecx, [esi + edi]
mov ebp, eax
cmp eax, ecx
jae 0x405e49
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405e3e
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405ddb