joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427890
Capabilities:
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x4320d0]
mov ecx, dword [ebp + 0x94]
push ebx
push esi
mov dword [ebp + 0x88], eax
xor edx, edx
push edi
xor eax, eax
cmp ecx, dword [eax*8 + 0x4320f8]
je 0x4278c5
inc eax
cmp eax, 0x13
jb 0x4278b6
mov esi, eax
shl esi, 3
cmp ecx, dword [esi + 0x4320f8]
jne 0x4279eb
mov eax, dword [0xd68120]
cmp eax, 1
je 0x4279c3
cmp eax, edx
jne 0x4278f5
cmp dword [0x431e14], 1
je 0x4279c3
cmp ecx, 0xfc
je 0x4279eb
push 0x104
lea eax, [ebp - 0x80]
push eax
push edx
mov byte [ebp + 0x84], dl
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x42792b
lea eax, [ebp - 0x80]
push str._program_name_unknown_
push eax
call fcn.004292b0
pop ecx
pop ecx
lea edi, [ebp - 0x80]
mov eax, edi
push eax
call fcn.00426050
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x42795f
mov eax, edi
push eax
call fcn.00426050
mov edi, eax
lea eax, [ebp - 0x80]
sub eax, 0x3b
push 3
add edi, eax
push 0x42db00
push edi
call fcn.0042a7d0
add esp, 0x10
push edi
call fcn.00426050
push dword [esi + 0x4320fc]
mov ebx, eax
call fcn.00426050
lea eax, [ebx + eax + 0x1c]
pop ecx
add eax, 3
pop ecx
and eax, 0xfffffffc
call fcn.00423410
mov ebx, esp
push str.Runtime_Error__n_nProgram:
push ebx
call fcn.004292b0
push edi
push ebx
call fcn.004292c0
push 0x42dae0
push ebx
call fcn.004292c0
push dword [esi + 0x4320fc]
push ebx
call fcn.004292c0
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebx
call fcn.0042a6cb
add esp, 0x2c
jmp 0x4279eb
push edx
lea eax, [ebp + 0x94]
push eax
lea esi, [esi + 0x4320fc]
push dword [esi]
call fcn.00426050
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
lea esp, [ebp - 0x8c]
mov ecx, dword [ebp + 0x88]
call fcn.00427406
pop edi
pop esi
pop ebx
add ebp, 0x8c
leave
ret
Function at 0x429bd4
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.00423410
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x429c6f
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0xd680d4]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x429c6f
cmp eax, 1
je 0x429c90
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x429c6f
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x429c3c
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x429c6b
xor eax, eax
inc eax
jmp 0x429caf
cmp edi, eax
jae 0x429c73
xor eax, eax
jmp 0x429caf
cmp eax, esi
jae 0x429c7a
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0xd680d4]
jmp 0x429c93
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x42a6cb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0xd682d0], ebx
push esi
push edi
jne 0x42a74b
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x42a786
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x42dd4c
push edi
call esi
test eax, eax
mov dword [0xd682d0], eax
je 0x42a786
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0xd682d4], eax
call esi
cmp dword [0xd680d4], 2
mov dword [0xd682d8], eax
jne 0x42a74b
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0xd682e0], eax
je 0x42a74b
push str.GetProcessWindowStation
push edi
call esi
mov dword [0xd682dc], eax
mov eax, dword [0xd682dc]
test eax, eax
je 0x42a790
call eax
test eax, eax
je 0x42a777
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0xd682e0]
test eax, eax
je 0x42a777
test byte [ebp - 8], 1
jne 0x42a790
cmp dword [0xd680e0], 4
jb 0x42a78a
or byte [ebp + 0x12], 0x20
jmp 0x42a7af
xor eax, eax
jmp 0x42a7bf
or byte [ebp + 0x12], 4
jmp 0x42a7af
mov eax, dword [0xd682d4]
test eax, eax
je 0x42a7af
call eax
mov ebx, eax
test ebx, ebx
je 0x42a7af
mov eax, dword [0xd682d8]
test eax, eax
je 0x42a7af
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0xd682d0]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42ae0e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x42ae3c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x42ae43
cmp ebx, dword [eax + 4]
jae 0x42ae43
xor eax, eax
jmp 0x42b033
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x42ae54
xor eax, eax
inc eax
jmp 0x42b032
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x42ae6a
cmp ecx, edx
jae 0x42afaf
cmp dword [eax + 4], 0
je 0x42ae73
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x42ae5b
cmp dword [ebp + 8], 0
je 0x42ae95
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x42afaf
cmp eax, esi
jae 0x42afaf
mov eax, dword [0xd682e8]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x42aeba
cmp dword [esi*4 + 0xd682f0], edi
je 0x42afb3
inc esi
cmp esi, eax
jl 0x42aea8
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x42b02f
cmp dword [ebp - 8], 0x1000000
jne 0x42b02f
test byte [ebp - 0xc], 0xcc
je 0x42af38
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x42b02f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x42b02f
cmp word [eax + 0x18], 0x10b
jne 0x42b02f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x42b02f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x42af38
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x42af38
test byte [ecx + 0x27], 0x80
jne 0x42afaf
push 1
push 0xd68330
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x42ae4c
mov ecx, dword [0xd682e8]
test ecx, ecx
mov edx, ecx
jle 0x42af6c
lea eax, [ecx*4 + 0xd682ec]
cmp dword [eax], edi
je 0x42af6c
dec edx
sub eax, 4
test edx, edx
jg 0x42af60
test edx, edx
jne 0x42af9d
push 0xf
pop ebx
cmp ecx, ebx
jg 0x42af79
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x42af91
lea eax, [edx*4 + 0xd682f0]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x42af7f
cmp ecx, 0x10
jge 0x42af9d
inc ecx
mov dword [0xd682e8], ecx
push 0
push 0xd68330
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x42ae4c
xor eax, eax
jmp 0x42b032
test esi, esi
jle 0x42ae4c
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push 0xd68330
call ebx
test eax, eax
jne 0x42ae4c
cmp dword [esi*4 + 0xd682f0], edi
je 0x42b009
mov eax, dword [0xd682e8]
lea esi, [eax - 1]
test esi, esi
jl 0x42aff7
cmp dword [esi*4 + 0xd682f0], edi
je 0x42aff3
dec esi
jns 0x42afe7
test esi, esi
jge 0x42b007
cmp eax, 0x10
jge 0x42b002
inc eax
mov dword [0xd682e8], eax
lea esi, [eax - 1]
jmp 0x42b009
je 0x42b021
xor ecx, ecx
test esi, esi
jl 0x42b021
lea eax, [ecx*4 + 0xd682f0]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x42b00f
push 0
push 0xd68330
call ebx
jmp 0x42ae4c
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42b037
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.00423410
mov eax, dword [0x4320d0]
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, dword [0xd68580]
mov dword [ebp - 4], eax
jae 0x42b17a
mov eax, ebx
sar eax, 5
mov eax, dword [eax*4 + 0xd685a0]
mov ecx, ebx
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x42b17a
push 1
push esi
push ebx
call fcn.00428585
add esp, 0xc
cmp eax, 0xffffffff
mov dword [ebp - 0x1008], eax
je 0x42b184
push 2
push esi
push ebx
call fcn.00428585
add esp, 0xc
cmp eax, 0xffffffff
je 0x42b184
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
test edi, edi
jle 0x42b124
push 0x1000
lea eax, [ebp - 0x1004]
push esi
push eax
call fcn.00429550
push 0x8000
push ebx
call fcn.0042be59
add esp, 0x14
mov dword [ebp + 8], eax
mov eax, 0x1000
cmp edi, eax
jge 0x42b0e3
mov eax, edi
push eax
lea eax, [ebp - 0x1004]
push eax
push ebx
call fcn.00423e8f
add esp, 0xc
cmp eax, 0xffffffff
je 0x42b101
sub edi, eax
test edi, edi
jg 0x42b0d8
jmp 0x42b117
cmp dword [0xd680cc], 5
jne 0x42b114
mov dword [0xd680c8], 0xd
or esi, 0xffffffff
push dword [ebp + 8]
push ebx
call fcn.0042be59
pop ecx
pop ecx
jmp 0x42b164
jge 0x42b164
push 0
push dword [ebp + 0xc]
push ebx
call fcn.00428585
push ebx
call fcn.004284f2
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, 0xffffffff
jne 0x42b164
mov dword [0xd680c8], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0xd680cc], eax
push 0
push dword [ebp - 0x1008]
push ebx
call fcn.00428585
add esp, 0xc
mov eax, esi
pop edi
jmp 0x42b187
mov dword [0xd680c8], 9
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00427406
leave
ret
Function at 0x401560
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0xc
push esi
push 0x44a650
push eax
call fcn.004314de
mov esi, eax
add esp, 8
test esi, esi
je 0x4015f0
push ebx
push edi
push 2
push 0
push esi
call fcn.004319f6
push esi
call fcn.00431901
push 0
push 0
push esi
mov edi, eax
call fcn.004319f6
push edi
call fcn.00414bd7
push esi
push edi
mov ebx, eax
push 1
push ebx
call fcn.0043174e
push edi
lea ecx, [esp + 0x40]
push ebx
push ecx
call fcn.004011e0
push esi
call fcn.004311e8
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x54]
mov edx, dword [esp + 0x50]
mov esi, dword [esp + 0x4c]
mov dword [eax + 8], edi
lea edi, [ecx + edx]
add esp, 0x40
add edi, esi
push ebx
mov dword [eax + 4], edi
mov dword [eax + 0x10], edx
mov dword [eax + 0xc], esi
mov dword [eax + 0x14], ecx
call fcn.00414bdc
add esp, 4
pop edi
pop ebx
xor eax, eax
pop esi
add esp, 0xc
ret

Function at 0x4017b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4017c9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401804
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401800
lea ebx, [ebx]
cmp esi, eax
jae 0x401804
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4017f0
cmp esi, eax
jb 0x40180a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x418059
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
cmp dword [ebp + 0xc], ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
je 0x41809f
call fcn.0041f5e4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41809f
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
mov dword [ebp - 4], eax
je 0x4180e2
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
je 0x4180cb
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x4180cb
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x4180df
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x41e28b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push ebp
push esi
push edi
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov ebp, ecx
je 0x41e2ce
call fcn.0041f5e4
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x41e2ce
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41e2e9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push ebx
mov ecx, ebp
call fcn.0041de42
test ebx, ebx
mov esi, eax
je 0x41e2e7
test edi, edi
je 0x41e2e7
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x421a52
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x421a80
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x421a9e
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004219bc
jmp 0x421a9e
mov eax, dword [esi + 0x14]
test eax, eax
je 0x421a9e
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.004219bc
test edi, edi
mov eax, edi
jne 0x421a88
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x465fd8]
test ecx, ecx
je 0x421b61
jmp 0x421a51
ret 8

Function at 0x431f5a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x462fec]
jne 0x431f64
repz ret
jmp fcn.004392fc
Function at 0x4421f4
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00438d45
xor ebx, ebx
cmp dword [0x466d80], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x4422c9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x442234
xor eax, eax
jmp 0x44238d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x44f270
push edi
call esi
cmp eax, ebx
je 0x44222d
push eax
call fcn.00438ce2
mov dword [esp], 0x44f260
push edi
mov dword [0x466d80], eax
call esi
push eax
call fcn.00438ce2
mov dword [esp], 0x44f24c
push edi
mov dword [0x466d84], eax
call esi
push eax
call fcn.00438ce2
mov dword [0x466d88], eax
lea eax, [ebp - 8]
push eax
call fcn.00433306
test eax, eax
pop ecx
pop ecx
je 0x442297
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00436c7b
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x4422c9
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00438ce2
cmp eax, ebx
pop ecx
mov dword [0x466d90], eax
je 0x4422c9
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00438ce2
pop ecx
mov dword [0x466d8c], eax
mov eax, dword [0x466d8c]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x442342
cmp dword [0x466d90], esi
je 0x442342
push eax
call fcn.00438d4e
pop ecx
call eax
cmp eax, ebx
je 0x44230f
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x466d90]
call fcn.00438d4e
pop ecx
call eax
test eax, eax
je 0x44230f
test byte [ebp - 0x18], 1
jne 0x442342
lea eax, [ebp - 0xc]
push eax
call fcn.0043333d
test eax, eax
pop ecx
je 0x44232a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00436c7b
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x442339
or dword [ebp + 0x10], 0x200000
jmp 0x442373
or dword [ebp + 0x10], 0x40000
jmp 0x442373
mov eax, dword [0x466d84]
cmp eax, esi
je 0x442373
push eax
call fcn.00438d4e
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x442373
mov eax, dword [0x466d88]
cmp eax, esi
je 0x442373
push dword [ebp - 4]
push eax
call fcn.00438d4e
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x466d80]
call fcn.00438d4e
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4463be
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x462fec]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00446353
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004336e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x44640d
cmp dword [ebp - 0x1c], 5
jb 0x446425
jmp 0x446421
cmp dword [ebp - 0x10], 1
jne 0x446425
cmp dword [ebp - 0x1c], 4
ja 0x446421
jne 0x446425
cmp dword [ebp - 0x18], 0
jbe 0x446425
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x450474
call fcn.00446244
test eax, eax
jge 0x446446
mov byte [0x4644a4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00431f5a
add ebp, 0x78
leave
ret
Function at 0x401153
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0xa
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 8]
call fcn.004047a0
add esp, 0xc
lea edx, [ebp - 0x14]
push 0x408970
push 0x100
push dword [ebp + 0xc]
push str.No_resource
push edx
push str.Messages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp + 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x401192
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
lea eax, [ebp - 0x54]
push edi
xor esi, esi
push 0x44
push esi
push eax
call fcn.00402d30
add esp, 0xc
lea eax, [ebp - 0x10]
mov dword [ebp - 0x54], 0x44
push eax
lea ecx, [ebp - 0x54]
push ecx
push esi
push esi
push 0x4000020
push 1
push esi
push esi
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4011f7
cmp dword [ebp + 0xc], esi
je 0x4011e3
push 0xffffffffffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40123b
mov esi, 0x4070e0
mov edi, 0x407aa4
push esi
push 0x4074c8
push 0xa5
call fcn.00401153
add esp, 8
push eax
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x40
push esi
push 0xaa
call fcn.00401153
add esp, 8
push eax
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x401241
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
cmp esi, 0x99
jl 0x401260
cmp esi, 0x9d
jle 0x401286
cmp esi, 0xfa
je 0x4012bf
push 0x10
push 0x4074c8
push 0x96
call fcn.00401153
add esp, 8
push eax
push 0x4070e0
push esi
call fcn.00401153
add esp, 8
push eax
jmp 0x4012d7
push dword [ebp + 0x10]
push 0x4074c8
push esi
call fcn.00401153
add esp, 8
mov esi, 0x4078b0
push eax
push esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x10
push 0x4070e0
push 0x96
call fcn.00401153
add esp, 8
push eax
push esi
jmp 0x4012d7
push 0x10
push 0x4074c8
push 0x96
call fcn.00401153
add esp, 8
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x401355
Capabilities:
Delete directory
Persist via run registry key
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push esi
lea eax, [ebp - 0x40c]
push edi
xor esi, esi
push 0x3e8
push esi
push eax
call fcn.00402d30
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4013e5
mov edi, 0x100
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x40c]
push ecx
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 8], edi
push esi
push str.Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x30c]
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
lea edi, [ebp - 8]
push edi
push ecx
push eax
push esi
push str.Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401455
mov edi, 0x100
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0xc]
push edx
mov dword [ebp - 8], edi
push esi
push str.Common_Programs
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x10c]
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
lea edi, [ebp - 8]
push edi
push ecx
push eax
push esi
push str.Common_Desktop
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x408970
lea eax, [ebp - 0x618]
push 0x100
xor esi, esi
push eax
push 0x40606c
push str.Group
push str.Shortcuts
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp + esi - 0x40c]
lea eax, [ebp - 0x618]
push eax
lea edx, [ebp - 0x80c]
push ecx
add esi, 0x100
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x80c]
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
cmp esi, 0x320
jl 0x40147d
pop edi
pop esi
mov esp, ebp
pop ebp
ret