joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402c20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x724
mov eax, dword [0x40e668]
mov ecx, dword [str.Common_Programs]
mov edx, dword [str.Programs]
push ebx
push ebp
push esi
push edi
push eax
push ecx
push edx
lea eax, [esp + 0x130]
push 0x104
push eax
call fcn.00406100
push 0x411a00
lea ecx, [esp + 0x13c]
push 0x104
push ecx
call fcn.00406200
lea edx, [esp + 0x144]
push edx
call fcn.004063f0
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
add esp, 0x24
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push str.Icon_03d
push ecx
call ebx
mov ax, word [0x412e54]
add esp, 0xc
cmp ax, 7
je 0x402ce0
cmp ax, 9
je 0x402ce0
push 0x4117f4
lea edx, [esp + 0x330]
push 0x100
push edx
lea eax, [esp + 0x20]
push 0x4117d0
push eax
push str.ShortCut
jmp 0x402d01
push 0x4117f4
lea ecx, [esp + 0x330]
push 0x100
push ecx
lea edx, [esp + 0x20]
push 0x4117d0
push edx
push str.ShortCutX64
call edi
lea eax, [esp + 0x32c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x402e61
lea ecx, [esp + 0x32c]
push 0x40e6e8
push ecx
call fcn.00407c02
add esp, 8
test eax, eax
je 0x402e58
lea edx, [esp + 0x630]
push eax
push edx
call esi
lea eax, [esp + 0x124]
lea ecx, [esp + 0x228]
push eax
push ecx
call esi
lea edx, [esp + 0x630]
lea eax, [esp + 0x228]
push edx
push 0x104
push eax
call fcn.00406200
add esp, 0xc
lea ecx, [esp + 0x228]
push str..lnk
push ecx
call ebp
push 0x40e6e8
push 0
call fcn.00407c02
add esp, 8
test eax, eax
je 0x402e58
lea edx, [esp + 0x42c]
push eax
push edx
call esi
push 0x40e6e8
push 0
call fcn.00407c02
add esp, 8
test eax, eax
jne 0x402ddc
lea eax, [esp + 0x20]
push 0x411b04
push eax
call esi
lea ecx, [esp + 0x42c]
lea edx, [esp + 0x20]
push ecx
push 0x104
push edx
call fcn.00406200
add esp, 0xc
jmp 0x402e0d
mov ecx, dword [0x40e668]
lea edx, [esp + 0x20]
push ecx
push eax
push 0x104
push edx
call fcn.00406330
lea eax, [esp + 0x43c]
lea ecx, [esp + 0x30]
push eax
push 0x104
push ecx
call fcn.00406200
add esp, 0x1c
push 0x40e6e8
push 0
call fcn.00407c02
add esp, 8
test eax, eax
jne 0x402e29
mov byte [esp + 0x530], al
jmp 0x402e34
lea edx, [esp + 0x530]
push eax
push edx
call esi
push 5
lea eax, [esp + 0x534]
push 0x4117d0
lea ecx, [esp + 0x28]
push eax
lea edx, [esp + 0x234]
push ecx
push edx
call fcn.00402af0
add esp, 0x14
inc dword [esp + 0x10]
jmp 0x402c97
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x724
ret

Function at 0x403410
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
lea eax, [esp]
lea ecx, [esp + 8]
push eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x10]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x18], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x403456
cmp dword [esp + 0xc], 4
jne 0x403456
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
mov dword [edx], eax
mov eax, 1
pop ecx
ret
xor eax, eax
pop ecx
ret
Function at 0x403460
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
ret
Function at 0x403d90
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
sub esp, 0x108
lea ecx, [esp + 8]
push edi
push eax
push str.SystemCurrentControlSetControlPrintMonitors
push str._s_s
push ecx
mov edi, 1
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 4]
lea ecx, [esp + 0xc]
push edx
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x403e1e
push esi
mov esi, dword [esp + 0x114]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [esp + 8]
push eax
push esi
push edi
push 0
push str.InstallPath
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop esi
pop edi
add esp, 0x108
ret
xor eax, eax
pop edi
add esp, 0x108
ret
Function at 0x404ac0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [str.JCPRIWEL_01]
sub esp, 0x440
test eax, eax
je 0x404bdd
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebp
push esi
push edi
mov edi, 0x40edf0
mov esi, edi
mov ecx, dword [esi - 8]
mov eax, dword [esi - 4]
push eax
mov edx, dword [ecx*4 + 0x412d40]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov edi, dword [edi]
mov ebp, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x404bb7
mov eax, dword [esi]
cmp byte [eax], 0x40
jne 0x404b59
inc eax
push eax
lea eax, [esp + 0x54]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x50]
push 0x40f0a8
push ecx
call fcn.00407c02
push 0x40f0a8
push 0
mov edi, eax
call fcn.00407c02
add esp, 0x10
lea edx, [esp + 0x50]
push 0x412b34
push 0x400
push edx
push 0x4117d0
push eax
push edi
jmp 0x404b83
lea eax, [esp + 0x10]
push 0x40
push eax
push ebp
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edx, dword [esi]
push 0x412b34
lea ecx, [esp + 0x54]
push 0x400
push ecx
push 0x4117d0
lea eax, [esp + 0x20]
push edx
push eax
call ebx
mov cl, byte [esp + 0x50]
lea eax, [esp + 0x50]
test cl, cl
je 0x404bab
cmp byte [eax], 0x5c
jne 0x404ba3
cmp byte [eax + 1], 0x6e
jne 0x404ba3
mov byte [eax], 0x20
mov byte [eax + 1], 0xa
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x404b91
lea ecx, [esp + 0x50]
push ecx
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov edx, dword [0x412d54]
push 0
push edx
push 0x30
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0xc]
add esi, 0xc
test eax, eax
mov edi, esi
jne 0x404ae4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x440
ret
Function at 0x404d80
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x184
push ebx
push ebp
push esi
push edi
push 0x104
push 0x412a28
call fcn.00406040
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esp, 8
xor edi, edi
mov byte [0x412d3c], 0
push 0x40f10c
push 0x412da0
call ebp
mov eax, dword [esp + 0x19c]
lea ecx, [esp + 0x50]
push eax
push ecx
call ebp
lea edx, [esp + 0x50]
push 0x40f108
push edx
call fcn.00407c02
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, eax
add esp, 8
test esi, esi
je 0x404e5b
push 2
push 0x40f104
push esi
call fcn.00407ca0
add esp, 0xc
test eax, eax
jne 0x404e08
lea eax, [esi + 2]
push eax
push 0x412da0
call ebp
mov edi, 1
push 5
push str.NoLic
push esi
call fcn.00407ca0
add esp, 0xc
test eax, eax
jne 0x404e23
mov byte [0x412d3c], 1
push 2
push 0x40f0f8
push esi
call fcn.00407ca0
add esp, 0xc
test eax, eax
jne 0x404e42
add esi, 2
push esi
push 0x411c68
call ebp
push 0x40f108
push 0
call fcn.00407c02
mov esi, eax
add esp, 8
test esi, esi
jne 0x404de4
test edi, edi
jne 0x404ebd
lea ecx, [esp + 0x90]
push 0x412a28
push ecx
call ebp
push str.language.ini
lea edx, [esp + 0x94]
push 0x104
push edx
call fcn.00406200
add esp, 0xc
lea eax, [esp + 0x90]
lea ecx, [esp + 0x10]
push eax
push 0x40
push ecx
push 0x4117d0
push str.Lang00
push str.Language
call ebx
lea edi, [esp + 0x10]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x404f7b
mov byte [0x412da0], al
push 0x412a28
push 0x412b34
call ebp
push 0x412da0
push 0x104
push 0x412b34
call fcn.00406200
push str.message.ini
push 0x104
push 0x412b34
call fcn.00406200
add esp, 0x18
push 0x412a28
push 0x41290c
call ebp
push 0x412da0
push 0x104
push 0x41290c
call fcn.00406200
push str.license.txt
push 0x104
push 0x41290c
call fcn.00406200
add esp, 0x18
push 0x412b34
push 0x80
push 0x412cbc
push 0x4117d0
push str.JCPINST
push str.TITLE
call ebx
push 0x412b34
push 0x80
push 0x412c3c
push 0x4117d0
push str.COMPANY
push str.TITLE
call ebx
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x184
ret
mov edx, dword [esp + 0x198]
mov eax, dword [0x411c64]
push 0x412da0
push 0x4056e0
push edx
push 0x92
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
test eax, eax
jne 0x404ebd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x184
ret

Function at 0x405e90
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x200
mov ecx, dword [esp + 0x210]
lea eax, [esp + 0x100]
push ebx
push esi
mov esi, dword [esp + 0x210]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
mov edi, dword [esp + 0x218]
push esi
push 0x100
push eax
push 0x4117d0
push ecx
push edi
call ebx
mov eax, dword [esp + 0x220]
push esi
lea edx, [esp + 0x10]
push 0x100
push edx
push 0x4117d0
push eax
push edi
call ebx
mov ecx, dword [esp + 0x224]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x214]
lea eax, [esp + 0x110]
push edx
push eax
push ecx
call dword [sym.imp.USER32.dll_MessageBoxA]
pop edi
pop esi
pop ebx
add esp, 0x200
ret
Function at 0x405f20
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x200
mov eax, dword [esp + 0x208]
mov ecx, dword [esp + 0x204]
push ebx
push ebp
push esi
push edi
push eax
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [esp + 0x220]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
mov ebp, eax
mov byte [esp + 0x14], 0
call ebx
test eax, eax
je 0x405f88
mov edi, dword [esp + 0x224]
push edi
call ebx
test eax, eax
je 0x405f88
mov edx, dword [esp + 0x21c]
lea eax, [esp + 0x10]
push edx
push 0x200
push eax
push 0x4117d0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esp + 0x228]
test eax, eax
je 0x405f9f
push 0
push eax
push 0x30
push ebp
call dword [sym.imp.USER32.dll_SendMessageA]
lea ecx, [esp + 0x10]
push ecx
call ebx
test eax, eax
jle 0x405fd2
mov cl, byte [esp + 0x10]
lea eax, [esp + 0x10]
test cl, cl
je 0x405fd2
mov dl, 0x6e
mov cl, 0xa
cmp byte [eax], 0x5c
jne 0x405fca
cmp byte [eax + 1], dl
jne 0x405fca
mov byte [eax], 0x20
mov byte [eax + 1], cl
mov bl, byte [eax + 1]
inc eax
test bl, bl
jne 0x405fba
lea edx, [esp + 0x10]
push edx
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200
ret

Function at 0x406100
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
test ebx, ebx
jne 0x406112
mov ebx, dword [str.Programs]
mov edi, dword [esp + 0x20]
test edi, edi
jne 0x406120
mov edi, dword [str.Common_Programs]
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x406194
mov eax, dword [esp + 0x24]
test eax, eax
je 0x406194
mov ecx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders]
lea eax, [esp + 0x1c]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4061ef
mov esi, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
lea ecx, [esp + 0xc]
push eax
push esi
mov dword [esp + 0x28], edx
mov edx, dword [esp + 0x24]
push ecx
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4061ef
mov eax, dword [esp + 0x1c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
pop ebx
pop ecx
ret
mov edx, dword [str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders]
lea ecx, [esp + 0x1c]
push ecx
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x4061ef
mov esi, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x20]
lea edx, [esp + 0xc]
push ecx
push esi
mov dword [esp + 0x28], eax
mov eax, dword [esp + 0x24]
push edx
push 0
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4061ef
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
pop edi
pop esi
pop ebx
pop ecx
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x406330
Capabilities:
Get common file path

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x30c
push esi
mov esi, dword [esp + 0x314]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x108]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edx, [esp + 4]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esp + 0x320]
mov ecx, dword [str.Startup]
mov edx, dword [str.Startup]
push eax
push ecx
push edx
lea eax, [esp + 0x218]
push 0x104
push eax
call fcn.00406100
lea ecx, [esp + 0x11c]
push ecx
push str._SYSTEMDIR
push esi
call fcn.00406290
lea edx, [esp + 0x24]
push edx
push str._WINDOWSDIR
push esi
call fcn.00406290
push 0x412da0
push str._LANGDIR
push esi
call fcn.00406290
lea eax, [esp + 0x244]
push eax
push str._STARTUPDIR
push esi
call fcn.00406290
add esp, 0x44
mov eax, 1
pop esi
add esp, 0x30c
ret

Function at 0x4063f0
Capabilities:
Create directory

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x104
lea ecx, [esp]
push esi
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov al, byte [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test al, al
lea esi, [esp + 8]
je 0x40644b
mov al, byte [esi]
mov edx, eax
and edx, 0xff
test byte [edx + 0x413381], 4
je 0x406430
inc esi
jmp 0x406443
cmp al, 0x5c
jne 0x406443
lea eax, [esp + 8]
push 0
push eax
mov byte [esi], 0
call edi
mov byte [esi], 0x5c
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x40641a
lea ecx, [esp + 8]
push 0
push ecx
call edi
pop edi
pop esi
add esp, 0x104
ret

Function at 0x406460
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x120
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push ebp
mov ebp, dword [esp + 0x138]
push esi
push edi
xor edi, edi
push edi
push ebp
push eax
call ebx
mov ecx, dword [esp + 0x144]
add esp, 0xc
lea edx, [esp + 0x30]
lea eax, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x140]
push 0x100
push edx
push 0x4117d0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x40653c
mov esi, dword [esp + 0x134]
lea eax, [esp + 0x30]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x4064ed
test cl, cl
je 0x4064e9
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x4064ed
add eax, 2
add esi, 2
test cl, cl
jne 0x4064c9
xor eax, eax
jmp 0x4064f2
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40654a
inc edi
lea eax, [esp + 0x10]
push edi
push ebp
push eax
call ebx
mov ecx, dword [esp + 0x144]
add esp, 0xc
lea edx, [esp + 0x30]
lea eax, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x140]
push 0x100
push edx
push 0x4117d0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jg 0x4064be
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
add esp, 0x120
ret
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x120
ret
Function at 0x406f10
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push ebx
push 0
push 0x80
push 3
push 0
push 0
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406f85
push esi
push edi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x406f7c
lea ecx, [edi + 1]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x406f7c
lea edx, [esp + 0x14]
push 0
push edx
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0x10]
push esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
ret

Function at 0x407010
Capabilities:
Get disk information

Disassembly:
sub esp, 0x164
mov ax, word [0x40f2cc]
mov cl, byte [0x40f2ce]
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageA]
push ebp
mov ebp, dword [esp + 0x170]
push esi
mov esi, dword [esp + 0x178]
push edi
xor edi, edi
cmp esi, 0xffff0000
mov word [esp + 0x10], ax
mov byte [esp + 0x12], cl
mov word [esp + 0x13], di
je 0x407084
cmp esi, edi
je 0x407084
lea edx, [esp + 0x18]
mov dword [esp + 0x18], 8
push edx
push edi
push 0x110c
push ebp
mov dword [esp + 0x2c], esi
call ebx
test byte [esp + 0x20], 0x40
je 0x407084
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x164
ret
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], 0xffff0003
mov dword [esp + 0x48], 0x63
mov dword [esp + 0x4c], 0
mov dword [esp + 0x68], 1
mov dword [esp + 0x64], 2
mov dword [esp + 0x60], 3
mov byte [esp + 0x10], 0x41
lea eax, [esp + 0x10]
lea ecx, [esp + 0x74]
push eax
push 0x40f2c8
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea edx, [esp + 0x74]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x40710c
lea ecx, [esp + 0x10]
lea eax, [esp + 0x10]
push ecx
mov dword [esp + 0x5c], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea edx, [esp + 0x40]
mov dword [esp + 0x5c], eax
push edx
push 0
push 0x1100
push ebp
call ebx
inc edi
mov al, byte [esp + 0x10]
inc al
cmp al, 0x5a
mov byte [esp + 0x10], al
jle 0x4070bd
cmp esi, 0xffff0000
je 0x407145
test esi, esi
je 0x407145
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x40
push eax
push 0
push 0x110d
push ebp
mov dword [esp + 0x2c], esi
mov dword [esp + 0x48], edi
call ebx
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x164
ret
Function at 0x4075e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x30c
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
mov edi, dword [esp + 0x330]
push edi
call esi
mov ebx, dword [esp + 0x32c]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jle 0x407626
lea eax, [esp + 0x18]
push ebx
push eax
call ebp
push edi
lea ecx, [esp + 0x1c]
push 0x104
push ecx
call fcn.00406200
add esp, 0xc
mov edx, dword [str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x320]
lea edx, [esp + 0x11c]
push ecx
push 0x200
push edx
call fcn.00406200
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x11c]
push eax
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40771f
mov edi, dword [esp + 0x324]
push edi
call esi
push eax
mov eax, dword [esp + 0x14]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 1
push 0
push str.DisplayName
push eax
call edi
mov ebp, dword [esp + 0x328]
push ebp
call esi
mov ecx, dword [esp + 0x10]
push eax
push ebp
push 1
push 0
push str.UninstallString
push ecx
call edi
push ebx
call esi
mov edx, dword [esp + 0x10]
push eax
push ebx
push 1
push 0
push str.InstallLocation
push edx
call edi
mov eax, dword [esp + 0x330]
push eax
call esi
test eax, eax
jle 0x407704
lea ecx, [esp + 0x18]
push ecx
call esi
lea edx, [esp + 0x18]
push eax
mov eax, dword [esp + 0x14]
push edx
push 1
push 0
push str.DisplayIcon
push eax
call edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30c
ret

Function at 0x4079d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
je 0x407a8e
mov eax, dword [esp + 0x10]
cmp eax, 1
jne 0x407a31
mov eax, dword [esp + 8]
test eax, eax
jne 0x407a1d
mov eax, 1
add esp, 0x94
ret
xor ecx, ecx
cmp eax, 0x5a
sete cl
add ecx, 2
mov eax, ecx
add esp, 0x94
ret
cmp eax, 2
jne 0x407a8e
mov eax, dword [esp + 4]
cmp eax, 4
jne 0x407a46
add esp, 0x94
ret
cmp eax, 5
jne 0x407a74
mov eax, dword [esp + 8]
test eax, eax
jne 0x407a5f
mov eax, 5
add esp, 0x94
ret
call fcn.00407940
neg eax
sbb eax, eax
neg eax
add eax, 6
add esp, 0x94
ret
cmp eax, 6
jne 0x407a8e
call fcn.00407940
neg eax
sbb eax, eax
neg eax
add eax, 8
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret
Function at 0x100013d6
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10001406
mov eax, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
call eax
mov dword [ebp - 0x14], eax
jmp 0x10001523
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x1b8
mov dword [ebp - 0x1c], eax
je 0x10001478
jmp 0x10001452
mov eax, dword [ebp - 0x10]
mov ecx, 0xa53151
mov dword [ebp - 8], ecx
mov ecx, esp
lea edx, [ebp - 8]
mov dword [ecx + 8], edx
mov dword [ecx + 4], 0x2be
mov dword [ecx], 0xae00e1
mov ecx, dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov dword [ebp - 0x20], eax
call ecx
sub esp, 0xc
mov ecx, dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [ebp - 0x24], eax
call ecx
mov ecx, dword [sym.imp.USER32.dll_GetInputState]
mov dword [ebp - 0x28], eax
call ecx
xor ecx, ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
mov ecx, 0xe
mov dword [ebp - 0x18], eax
xor edx, edx
div ecx
cmp edx, 2
jne 0x100013f2
mov eax, dword [sym.imp.USER32.dll_GetCaretBlinkTime]
call eax
mov dword [ebp - 0x30], eax
jmp 0x100013f2
mov eax, esp
mov dword [eax + 8], 0x6a4
mov dword [eax + 4], 0x833
mov dword [eax], 0x833
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
call eax
sub esp, 0xc
mov ecx, dword [ebp - 0x20]
sub ecx, 0xc
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
je 0x100013e3
jmp 0x100014ac
mov eax, dword [ebp - 0x20]
sub eax, 0x5b
mov dword [ebp - 0x3c], eax
jne 0x10001523
jmp 0x100014b9
mov byte [ebp - 9], 6
mov eax, esp
lea ecx, [ebp - 9]
mov dword [eax], ecx
mov dword [eax + 0x18], 0xf25
mov dword [eax + 0x14], 0xdb9
mov dword [eax + 0x10], 0x5a3
mov dword [eax + 0xc], 0x1ba
mov dword [eax + 8], 0x5a2
mov dword [eax + 4], 0x1ba
mov eax, dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
call eax
sub esp, 0x1c
mov dword [ebp - 4], 0x59e
mov ecx, esp
lea edx, [ebp - 4]
mov dword [ecx + 4], edx
mov dword [ecx], 0xce68f5
mov ecx, dword [sym.imp.KERNEL32.dll_GetConsoleMode]
mov dword [ebp - 0x40], eax
call ecx
sub esp, 8
mov dword [ebp - 0x44], eax
jmp 0x100013e3
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x10b
mov dword [ebp - 0x10], eax
jne 0x10001406
add esp, 0x60
pop ebp
ret