joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4048fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
and byte [ebp - 0x148], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x147]
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov dword [ebp - 4], esi
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x404975
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0xc], 0x104
mov eax, str.CommonFilesDir
je 0x404955
mov eax, str.ProgramFilesDir
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x148]
push ecx
push esi
push esi
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x148], 0
je 0x4049bb
lea eax, [ebp - 0x148]
mov edi, 0x408248
push esi
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x38], 0x408250
mov dword [ebp - 0x30], edi
call fcn.00406194
mov esi, 0x408244
push 0x40a37c
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], esi
mov dword [ebp - 4], 1
call fcn.004043a9
jmp 0x4049ec
lea eax, [ebp - 0x148]
mov edi, 0x408248
push esi
push eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x1c], 0x408250
mov dword [ebp - 0x14], edi
call fcn.00406194
mov esi, 0x408244
mov dword [ebp - 4], 2
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x28]
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx + 0xc], 0x408250
mov dword [ecx + 0x14], edi
call fcn.00406203
mov edi, dword [ebp + 8]
test byte [ebp - 4], 2
mov dword [edi], esi
je 0x404a18
and dword [ebp - 4], 0xfffffffd
lea ecx, [ebp - 0x28]
call fcn.00406293
test byte [ebp - 4], 1
je 0x404a26
lea ecx, [ebp - 0x44]
call fcn.00406293
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x405d38
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
and dword [ebp - 4], 0
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 4]
push edi
mov ebx, 0xf003f
push eax
push ebx
push 0
mov edi, VariantInit
push str..DefaultControl_PaneldesktopResourceLocale
push edi
mov dword [ebp - 0xc], 0xa
call esi
test eax, eax
jne 0x405d8d
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
push 0
push 0x40a630
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x405de8
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push ebx
push 0
push str..DEFAULTControl_PanelInternational
push edi
call esi
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x405dc2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x18]
push eax
push edi
push edi
push str.Locale
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
cmp dword [ebp - 8], edi
je 0x405dd0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, edi
je 0x405dea
cmp dword [ebp - 4], edi
je 0x405de2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 0x409
jmp 0x405e07
xor edi, edi
lea eax, [ebp - 0x18]
push eax
call fcn.00407337
cmp dword [ebp - 4], edi
pop ecx
mov esi, eax
je 0x405e04
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, si
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40737a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x4073cc
push eax
call fcn.00401c7e
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4073cc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x40a614
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x4073d0
xor al, al
jmp 0x407431
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x40742f
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.00401c7e
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x40742f
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x40741d
mov al, 1
pop ebx
leave
ret 4
Function at 0x4040f0
Capabilities:
Get common file path
Get disk information
Get hostname
Manipulate console buffer
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x14cc
call fcn.00413be0
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [0x44e698]
push ebx
push esi
push edi
mov edi, dword [eax + 4]
mov eax, dword [0x44e69c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0
mov dword [ebp - 0x18], 0x9e3779b9
mov dword [ebp - 0x1c], edx
call fcn.004040e0
mov ecx, dword [0x44e6a0]
mov edx, dword [0x44e6a4]
add dword [ebp - 8], 0x23f
mov ebx, dword [sym.imp.KERNEL32.dll_GetCurrencyFormatA]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], 0x20
jmp 0x404160
mov dword [ebp - 0x10], 2
add dword [ebp - 0x10], 3
mov esi, dword [ebp - 0xc]
mov eax, dword [0x455e24]
shl esi, 4
add esi, dword [ebp - 0x24]
cmp eax, 0xfa9
jne 0x40418c
mov dword [0x455e20], 0xedeb2e40
jmp 0x4041a7
cmp eax, 0x3eb
jne 0x4041a7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [0x4558b0], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x20]
add dword [ebp - 4], edx
xor esi, ecx
cmp dword [0x455e24], 0x9e6
mov dword [0x455e1c], 0xf4ea3dee
jne 0x4041e2
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommConfig]
xor dword [ebp - 4], esi
cmp dword [0x455e24], 0x213
jne 0x404284
push 0
lea eax, [ebp - 0x4cc]
push eax
push 0
push 0
push 0
push 0
call ebx
lea ecx, [ebp - 0xccc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
lea edx, [ebp - 0x38]
push edx
lea eax, [ebp - 0x8cc]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push 0
call dword [sym.imp.KERNEL32.dll_ClearCommBreak]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsA]
push 0
push 0
lea ecx, [ebp - 0x14cc]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea edx, [ebp - 0x30]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
push 0
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
sub edi, dword [ebp - 4]
cmp dword [0x455e24], 0xc
jne 0x404298
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnWire]
mov edx, dword [ebp - 8]
mov eax, edi
shr eax, 5
lea ecx, [edx + edi]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
mov edx, edi
shl edx, 4
add edx, dword [ebp - 0x1c]
xor edx, dword [ebp - 4]
xor edx, ecx
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
sub dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
sub dword [ebp - 8], eax
sub dword [ebp - 0x14], 1
jne 0x404160
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [eax + 4], edi
pop edi
pop esi
mov dword [eax], ecx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401030
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
push 0
mov dword [0x6389f8], 0xffffffff
call dword [0x41fe88]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov ebx, eax
mov eax, dword [esi + 0xe58]
test eax, eax
je 0x40105e
push 0
push eax
call edi
mov eax, dword [esi + 0xe5c]
test eax, eax
je 0x40106d
push 0
push eax
call edi
mov eax, dword [esi + 0xe54]
test eax, eax
je 0x40107c
push 0
push eax
call edi
mov eax, dword [esi + 0xe50]
test eax, eax
je 0x40108b
push 0
push eax
call edi
call fcn.00406550
mov ecx, dword [eax]
mov edi, dword [esp + 0x10]
test ecx, ecx
jne 0x40109e
mov eax, edi
jmp 0x4010a5
call fcn.00406550
mov eax, dword [eax]
push eax
mov eax, dword [esi + 0xe54]
push eax
call fcn.00408b50
add esp, 8
call fcn.00408800
mov ecx, eax
call fcn.00407a50
mov dword [esi + 0x4cc], eax
call fcn.00401010
push str.AUTOPLAY_TITLE
push str._StringMsg_
mov dword [eax], 0
call fcn.00407810
add esp, 8
mov ecx, esi
call fcn.00404d90
push ebx
push edi
mov ecx, esi
call fcn.00405a00
push ebx
push edi
mov ecx, esi
call fcn.004058a0
push ebx
push edi
mov ecx, esi
call fcn.00405dc0
push ebx
push edi
mov ecx, esi
call fcn.00405850
push ebx
push edi
mov ecx, esi
call fcn.004057d0
push ebx
push edi
mov ecx, esi
call fcn.00404e80
call fcn.00401170
test al, al
je 0x40113c
push ebx
push edi
mov ecx, esi
call fcn.00405b20
push ebx
push edi
mov ecx, esi
call fcn.00405d20
push 0
mov ecx, esi
call fcn.00404280
mov al, byte [0x552129]
test al, al
jne 0x40115e
push 0
push 0
push 0x402
push edi
call dword [0x41fedc]
pop edi
pop esi
pop ebx
ret 4

Function at 0x403740
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
je 0x403767
push edi
mov edi, dword [0x41fee4]
push 0
push 0
push 2
push esi
call edi
push 0
push 0
push 2
push esi
call edi
pop edi
pop esi
ret 4
push 1
call fcn.0040bde2
nop
nop

Function at 0x4037e0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [eax + eax*8]
mov ebx, 9
lea esi, [ecx + eax*4 + 0x1020]
mov ecx, dword [esi - 0x120]
push 0
push ecx
call edi
mov edx, dword [esi]
push 0
push edx
call edi
add esi, 4
dec ebx
jne 0x4037fc
pop edi
pop esi
pop ebx
ret 4
Function at 0x403f90
Capabilities:
Identify system language via api

Disassembly:
push str..AutoPlayLangData_
push 0x420104
call fcn.0040bd90
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
test ax, ax
jne 0x403fb3
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
and eax, 0xffff
mov ecx, eax
and ecx, 0x3ff
dec ecx
cmp ecx, 0x38
ja case.0x403fd2.24
xor edx, edx
mov dl, byte [ecx + 0x404154]
jmp dword [edx*4 + 0x4040f4]
and eax, 0xfffffc00
cmp eax, 0x400
jne 0x403fef
push 0x41aab8
jmp 0x4040cd
push 0x41aaac
jmp 0x4040cd
push 0x41aaa0
jmp 0x4040cd
push 0x41aa94
jmp 0x4040cd
push 0x41aa88
jmp 0x4040cd
push 0x41aa7c
jmp 0x4040cd
push 0x41aa70
jmp 0x4040cd
push 0x41aa64
jmp 0x4040cd
push 0x41aa58
jmp 0x4040cd
push 0x41aa4c
jmp 0x4040cd
push 0x41aa40
jmp 0x4040cd
and eax, 0xfffffc00
cmp eax, 0x400
jne 0x404063
push 0x41aa34
jmp 0x4040cd
push 0x41aa28
jmp 0x4040cd
and eax, 0xfffffc00
push 0x41aa1c
cmp eax, 0x800
jmp 0x4040cd
push 0x41aa10
jmp 0x4040cd
push 0x41aa04
jmp 0x4040cd
push 0x41a9f8
jmp 0x4040cd
push 0x41a9ec
jmp 0x4040cd
push str.ar_SA
jmp 0x4040cd
push 0x41a9d4
jmp 0x4040cd
push 0x41a9c8
jmp 0x4040cd
push 0x41a9bc
jmp 0x4040cd
push 0x41a9b0
jmp 0x4040cd
push 0x41a9a4
jmp 0x4040cd
push 0x41a998
jmp 0x4040cd
push str.xx_XX
push 0x420104
call fcn.0040bd66
add esp, 8
push str.lang.dat
push 0x420104
call fcn.0040bd66
add esp, 8
mov eax, 0x420104
ret

Function at 0x404190
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x410
xor eax, eax
push esi
mov esi, ecx
push edi
mov ecx, 0x82
lea edi, [esp + 8]
push eax
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
push eax
push str.INTRO_SCREEN
push str._ConfigInfo_
call fcn.00407240
mov ecx, eax
call fcn.00407dc0
test al, al
je 0x404237
lea ecx, [esp + 0x210]
push str..AutoPlayResData_
push ecx
call fcn.0040bd90
lea edx, [esp + 0x10]
lea eax, [esp + 0x218]
push edx
push eax
call fcn.0040bd66
add esp, 0x10
lea ecx, [esp + 0x210]
push 0xa010
push 0
push 0
push 0
push ecx
push 0
call dword [0x41fed4]
test eax, eax
mov dword [esi + 0xe64], eax
je 0x404237
mov edx, dword [esi + 0xe60]
push eax
push 0
push 0xf7
push edx
call dword [0x41fee4]
mov eax, dword [esi + 0xe60]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
add esp, 0x410
ret
Function at 0x404280
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0xe60]
push 5
push eax
call edi
mov ecx, dword [esi + 0xef4]
push 5
push ecx
call edi
mov edx, dword [esi + 0xeb4]
push 5
push edx
call edi
mov eax, dword [esi + 0xeb0]
push 5
push eax
call edi
mov ecx, dword [esi + 0xebc]
push 5
push ecx
call edi
mov edx, dword [esi + 0xeb8]
push 5
push edx
call edi
mov eax, dword [esi + 0xe84]
push 5
push eax
call edi
mov ecx, dword [esi + 0xe88]
push 5
push ecx
call edi
mov edx, dword [esi + 0xe8c]
push 5
push edx
call edi
mov ebx, dword [esp + 0x14]
push 0
test ebx, ebx
jne 0x404338
mov eax, dword [esi + 0xef8]
push eax
call edi
mov ecx, dword [esi + 0xefc]
push 0
push ecx
call edi
mov edx, dword [esi + 0xee0]
push 0
push edx
call edi
mov eax, dword [esi + 0xee4]
push 0
push eax
call edi
mov ecx, dword [esi + 0xecc]
push 5
push ecx
call edi
mov edx, dword [esi + 0xed0]
push 5
jmp 0x404375
mov eax, dword [esi + 0xecc]
push eax
call edi
mov ecx, dword [esi + 0xed0]
push 0
push ecx
call edi
mov edx, dword [esi + 0xee0]
push 5
push edx
call edi
mov eax, dword [esi + 0xee4]
push 5
push eax
call edi
mov ecx, dword [esi + 0xef8]
push 5
push ecx
call edi
mov edx, dword [esi + 0xefc]
push 5
push edx
call edi
lea eax, [ebx + ebx*8]
mov ebp, 9
lea ebx, [esi + eax*4 + 0xf00]
mov eax, dword [ebx + 0x120]
test eax, eax
je 0x4043a4
push 5
push eax
call edi
mov ecx, dword [ebx + 0x120]
push ecx
mov ecx, esi
call fcn.00403820
mov eax, dword [ebx]
test eax, eax
je 0x4043b9
push 5
push eax
call edi
mov edx, dword [ebx]
mov ecx, esi
push edx
call fcn.00403820
add ebx, 4
dec ebp
jne 0x404387
mov eax, dword [esi + 0xeb4]
mov ecx, esi
push eax
call fcn.00403820
mov ecx, dword [esi + 0xebc]
push ecx
mov ecx, esi
call fcn.00403820
mov edx, dword [esi + 0xeb8]
mov ecx, esi
push edx
call fcn.00403820
mov eax, dword [esi + 0xe88]
mov ecx, esi
push eax
call fcn.00403820
mov ecx, dword [esi + 0xe8c]
push ecx
mov ecx, esi
call fcn.00403820
mov edx, dword [esi + 0xeb0]
mov ecx, esi
push edx
call fcn.00403820
mov eax, dword [esi + 0xef4]
mov ecx, esi
push eax
call fcn.00403820
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x404440
mov ecx, dword [esi + 0xed0]
push ecx
mov ecx, esi
call fcn.00403820
mov edx, dword [esi + 0xecc]
push edx
jmp 0x404471
mov eax, dword [esi + 0xee4]
mov ecx, esi
push eax
call fcn.00403820
mov ecx, dword [esi + 0xee0]
push ecx
mov ecx, esi
call fcn.00403820
mov edx, dword [esi + 0xefc]
mov ecx, esi
push edx
call fcn.00403820
mov eax, dword [esi + 0xef8]
push eax
mov ecx, esi
call fcn.00403820
mov ecx, dword [esi + 0xe84]
push ecx
mov ecx, esi
call fcn.00403820
pop edi
pop esi
pop ebp
pop ebx
ret 4
Function at 0x4098c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x310
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x220]
push 0
push eax
push str.MAIN_FILE_VERSION
mov edi, ecx
push str._AutoPlay_
mov bl, 1
mov dword [esp + 0x24], 8
call fcn.00407240
mov ecx, eax
call fcn.00407dc0
mov esi, dword [0x41fed8]
test al, al
jne 0x409912
push 0x40
push str.Error
push str.MAIN_FILE_VERSION
push 0
call esi
xor bl, bl
lea ecx, [esp + 0x120]
push 0
push ecx
push str.PRODUCT_REGISTRY_PARENT
push str._Product_
call fcn.00407240
mov ecx, eax
call fcn.00407dc0
test al, al
jne 0x409948
push 0x40
push str.Error
push str.PRODUCT_REGISTRY_PARENT
push 0
call esi
xor bl, bl
lea edx, [esp + 0x20]
push 0
push edx
push str.PRODUCT_REGISTRY_KEY
push str._Product_
call fcn.00407240
mov ecx, eax
call fcn.00407dc0
test al, al
jne 0x40998a
push 0x40
push str.Error
push str.PRODUCT_REGISTRY_KEY
push 0
call esi
xor bl, bl
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x310
ret 4
test bl, bl
je 0x409a78
lea eax, [esp + 0x120]
mov ecx, edi
push eax
call fcn.00409810
mov ebp, eax
test ebp, ebp
jne 0x4099c5
push 0x40
push str.Error
push str.PRODUCT_REGISTRY_PARENT
push eax
call esi
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x310
ret 4
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
push 0xf003f
push 0
push edx
push ebp
call dword [0x41fe38]
test eax, eax
jne 0x409a6e
mov al, byte [0x552129]
test al, al
jne 0x409a1c
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov dl, byte [esp + 0x18]
xor ecx, ecx
cmp dl, 0x30
lea esi, [edi + 2]
setne cl
add ecx, 0x30
mov word [esi], cx
jmp 0x409a32
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x14]
lea esi, [edi + 2]
push edx
push esi
push 0
push eax
call dword [0x41fe40]
test eax, eax
jne 0x409a71
cmp word [esi], 0x30
jne 0x409a71
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [esp + 0x324]
push str._auto
push edx
call fcn.0040c28a
add esp, 8
test eax, eax
pop edi
pop esi
pop ebp
pop ebx
sete al
add esp, 0x310
ret 4
mov byte [edi], 0
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov al, bl
pop ebp
pop ebx
add esp, 0x310
ret 4
Function at 0x45a8a0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x3e000]
push edi
or ebp, 0xffffffff
jmp 0x45a8c2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x45a8c9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45a8b8
mov eax, 1
add ebx, ebx
jne 0x45a8db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x45a8ec
jne 0x45a90b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45a90b
dec eax
add ebx, ebx
jne 0x45a8f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x45a8d0
add ebx, ebx
jne 0x45a907
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x45a95d
xor ecx, ecx
sub eax, 3
jb 0x45a923
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x45a992
sar eax, 1
mov ebp, eax
jmp 0x45a92e
add ebx, ebx
jne 0x45a92e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45a8fc
inc ecx
add ebx, ebx
jne 0x45a93c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x45a8fc
add ebx, ebx
jne 0x45a949
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x45a93e
jne 0x45a95a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x45a93e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x45a97c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x45a96e
jmp 0x45a8be
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x45a97c
add edi, ecx
jmp 0x45a8be
pop esi
mov edi, esi
mov ecx, 0x8b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x45a99a
cmp byte [edi], 5
jne 0x45a99a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x45a99f
lea edi, [esi + 0x58000]
mov eax, dword [edi]
or eax, eax
je 0x45aa17
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x5a0c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x5a104]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x45a9cc
mov ecx, edi
jns 0x45a9fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x5a108]
or eax, eax
je 0x45aa11
mov dword [ebx], eax
add ebx, 4
jmp 0x45a9e9
call dword [esi + 0x5a118]
mov ebp, dword [esi + 0x5a10c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x45aa4b
sub esp, 0xffffff80
jmp 0x40138c
Function at 0x100013af
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x100013f0
mov eax, esp
mov dword [eax], 0xa6b92e
mov eax, dword [sym.imp.USER32.dll_ShowCaret]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x281
mov dword [ecx], 0x281
mov ecx, dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
mov dword [ebp - 8], eax
call ecx
sub esp, 8
mov dword [ebp - 0xc], eax
jmp 0x10001447
mov eax, dword [ebp - 4]
mov ecx, esp
mov dword [ecx + 8], 0xc6ff96
mov dword [ecx + 4], 0x8ac21
mov dword [ecx], 0xf68
mov dword [ebp - 0x10], eax
call sub.USER32.dll_PackDDElParam
sub esp, 0xc
mov ecx, esp
mov dword [ecx], 0x414
mov ecx, dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 0x14], eax
call ecx
sub esp, 4
mov ecx, dword [ebp - 0x10]
sub ecx, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
je 0x100013bc
jmp 0x1000143a
mov eax, dword [ebp - 0x10]
sub eax, 0x3c
mov dword [ebp - 0x20], eax
je 0x10001467
jmp 0x10001447
mov eax, dword [sym.imp.KERNEL32.dll_GetLastError]
call eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
cmp ecx, 0x61
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], ecx
je 0x10001476
jmp 0x100013f0
mov eax, dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
call eax
mov dword [ebp - 0x28], eax
jmp 0x100013bc
add esp, 0x34
pop ebp
ret
Function at 0x1015cdd9
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
call fcn.1000108e
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x24], ecx
je 0x1015cea5
jmp 0x1015ce9b
mov eax, dword [esp + 0x20]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
jmp 0x1015ceda
lea eax, [esp + 0x28]
mov dword [esp], eax
call fcn.1015cb38
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x6c], ecx
mov dword [esp + 0x50], 0x123400
mov dword [0x101845b4], 0x15a6
mov ecx, dword [0x101845a0]
mov dword [esp + 0x70], ecx
mov ecx, dword [0x101845a4]
mov dword [esp + 0x84], ecx
mov ecx, dword [0x101845a8]
mov dword [esp + 0x88], ecx
mov ecx, dword [0x101845ac]
mov dword [esp + 0x5c], ecx
mov dword [esp + 0x14], eax
lea eax, [0x1015df19]
mov ecx, dword [0x101845b0]
mov dword [esp + 0x8c], ecx
mov dword [0x101845b8], 0x109b
mov dword [esp + 0x18], eax
jmp 0x1015ceda
mov eax, dword [esp + 0x24]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
lea eax, [esp + 0x38]
mov ecx, dword [0x101845b4]
add ecx, 0xffffefd3
mov dword [0x101845b4], ecx
mov dword [esp + 0x10], eax
call fcn.1015d2dd
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0xc], ecx
je 0x1015ce20
jmp 0x1015cf5f
mov eax, dword [esp + 0x18]
cmp word [eax], 0x5a4d
mov dword [esp + 0x20], eax
jne 0x1015ce01
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
jne 0x1015ce01
lea eax, [esp + 0x38]
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x64], ecx
mov dword [0x101845b4], 0xfffff682
mov edx, dword [esp + 8]
mov esi, dword [ecx + edx + 0x50]
mov dword [esp + 0x74], esi
mov esi, dword [esp + 0x30]
mov dword [esp], eax
mov dword [esp + 4], esi
call fcn.1015d9b8
mov ecx, esp
lea edx, [esp + 0x38]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov ecx, dword [0x101845b4]
add ecx, 0xffffe5c3
mov dword [0x101845b8], ecx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
jmp 0x1015ce9b