joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472b30
Capabilities:
Encrypt data using rc4 prga
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x498cc0
push 0x45dcc0
mov eax, dword fs:[0]
push eax
add esp, 0xffffffc8
push ebx
push esi
push edi
mov eax, dword [0x4a05d0]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
cmp dword [ebp + 8], 0
jne 0x472b7a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x1c]
movzx edx, word [ecx]
cmp edx, 0x5a4d
je 0x472bb0
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x34]
jmp 0x472d3b
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp - 0x24]
cmp dword [edx], 0x4550
je 0x472be8
push 0xbf
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x38]
jmp 0x472d3b
mov eax, dword [ebp - 0x24]
movzx ecx, word [eax + 0x14]
test ecx, ecx
jne 0x472c14
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x3c]
jmp 0x472d3b
mov edx, dword [ebp - 0x24]
movzx eax, word [edx + 0x14]
mov ecx, dword [ebp - 0x24]
lea edx, [ecx + eax + 0x18]
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x28], 0
jmp 0x472c37
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x24]
movzx edx, word [ecx + 6]
cmp dword [ebp - 0x28], edx
jae 0x472ce6
push str..detour
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
add eax, dword [ebp - 0x20]
push eax
call fcn.004600f0
add esp, 8
test eax, eax
jne 0x472ce1
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 0x28
mov edx, dword [ebp - 0x20]
cmp dword [edx + ecx + 0xc], 0
je 0x472c82
mov eax, dword [ebp - 0x28]
imul eax, eax, 0x28
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + eax + 0x10], 0
jne 0x472c84
jmp 0x472ce6
mov edx, dword [ebp - 0x28]
imul edx, edx, 0x28
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
add ecx, dword [eax + edx + 0xc]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0x40
jb 0x472cb1
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 4], 0x727444
je 0x472cb3
jmp 0x472ce6
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 8], 0
jne 0x472cc7
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx]
mov dword [eax + 8], edx
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x40]
jmp 0x472d3b
jmp 0x472c2e
push 0xc0
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 0x44], 0
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x44]
jmp 0x472d3b
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x472ff0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
cmp dword [ecx], 0x678
jne 0x473011
mov edx, dword [ebp - 0x18]
mov eax, dword [edx]
cmp eax, dword [ebp + 0xc]
jbe 0x473023
push 0xc1
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x47316b
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x14]
push ecx
push 0x40
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x473168
lea eax, [ebp - 4]
push eax
push 0x40
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x47314c
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 4]
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x1c
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x10]
push eax
call fcn.0045f9a0
add esp, 0xc
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x18]
add eax, 0x5c
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x14]
push edx
call fcn.0045f9a0
add esp, 0xc
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x18], 0
je 0x473129
lea ecx, [ebp - 0x10]
push ecx
push 0x40
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x473127
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0xc]
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x664
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
push ecx
call fcn.0045f9a0
add esp, 0xc
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 0xc]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 8], 1
jmp 0x473130
mov dword [ebp - 8], 1
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 8]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ecx + 4]
push edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 8
Function at 0x473480
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x4a5630]
mov dword [ebp - 4], eax
jmp 0x473499
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 4]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x4734b6
lea eax, [ebp - 8]
push eax
push 0x40
push 0x10000
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x473490
mov esp, ebp
pop ebp
ret

Function at 0x4734c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4a5640], eax
je 0x4734de
mov eax, 0x10dd
jmp 0x4735bf
mov eax, dword [0x4a5650]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x47355c
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x47353a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x47353a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.00473630
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.00439ae5
add esp, 4
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
jmp 0x4734e6
mov dword [0x4a5650], 0
call fcn.004735d0
mov ecx, dword [0x4a564c]
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0
je 0x4735a9
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
push ecx
call fcn.00439ae5
add esp, 4
mov edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
jmp 0x473574
mov dword [0x4a564c], 0
mov dword [0x4a5640], 0
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x473b30
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
cmp dword [eax], 0x52727464
je 0x473b45
xor eax, eax
jmp 0x473bba
mov ecx, dword [ebp + 8]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
add edx, 0x10000
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
jmp 0x473b72
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
cmp dword [ebp - 0x10], 0x38d
jae 0x473bb5
mov edx, dword [ebp - 0x10]
imul edx, edx, 0x48
mov eax, dword [ebp - 0xc]
cmp dword [eax + edx + 0x40], 0
je 0x473bb3
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 4]
jb 0x473baf
mov ecx, dword [ebp - 0x10]
imul ecx, ecx, 0x48
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + ecx + 0x40]
cmp eax, dword [ebp - 8]
jb 0x473bb3
xor eax, eax
jmp 0x473bba
jmp 0x473b69
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x473c60
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x4a5644], 0
je 0x473c79
mov eax, dword [0x4a5644]
jmp 0x473d19
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x473c8b
xor eax, eax
jmp 0x473d19
push 8
call fcn.00439ab6
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x473ce1
mov dword [ebp - 4], 8
cmp dword [ebp - 8], 0
je 0x473cca
mov ecx, dword [ebp - 8]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.00439ae5
add esp, 4
mov dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov dword [0x4a5644], eax
mov dword [0x4a5648], 0
mov eax, dword [ebp - 4]
jmp 0x473d19
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x473cfb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x473cab
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 8]
mov edx, dword [0x4a564c]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
mov dword [0x4a564c], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x474540
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.00474610
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x4745fc
cmp dword [ebp - 4], 0x50000000
jb 0x47457c
cmp dword [ebp - 4], 0x80000000
ja 0x47457c
mov dword [ebp - 4], 0x80010000
jmp 0x474555
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0045db90
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4745a2
jmp 0x4745fc
cmp dword [ebp - 0x10], 0x10000
jne 0x4745e5
cmp dword [ebp - 0x14], 0x10000
jb 0x4745e5
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4745d8
mov eax, dword [ebp - 0x24]
jmp 0x4745fe
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4745f7
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x14]
push ecx
call fcn.00474610
add esp, 4
mov dword [ebp - 4], eax
jmp 0x474555
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x474640
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.00474710
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x474704
cmp dword [ebp - 4], 0x50000000
jb 0x474681
cmp dword [ebp - 4], 0x80000000
ja 0x474681
mov dword [ebp - 4], 0x4fff0000
jmp 0x47465a
push 0x1c
push 0
lea edx, [ebp - 0x20]
push edx
call fcn.0045db90
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x4746a7
jmp 0x474704
cmp dword [ebp - 0x10], 0x10000
jne 0x4746ea
cmp dword [ebp - 0x14], 0x10000
jb 0x4746ea
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x4746dd
mov eax, dword [ebp - 0x24]
jmp 0x474706
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x4746ff
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x10000
push ecx
call fcn.00474710
add esp, 4
mov dword [ebp - 4], eax
jmp 0x47465a
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x474740
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0xc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x4a5640], eax
je 0x474765
mov eax, 0x10dd
jmp 0x4748fd
cmp dword [0x4a5644], 0
je 0x474778
mov eax, dword [0x4a5644]
jmp 0x4748fd
cmp dword [ebp + 8], 0
jne 0x474788
mov eax, 6
jmp 0x4748fd
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x4747b1
mov dword [ebp - 0xc], 6
mov ecx, dword [ebp - 0xc]
mov dword [0x4a5644], ecx
mov edx, dword [ebp + 8]
mov dword [0x4a5648], edx
mov eax, dword [ebp - 0xc]
jmp 0x4748fd
push 0x18
call fcn.00439ab6
add esp, 4
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x47480a
mov dword [ebp - 0xc], 8
mov ecx, dword [ebp - 0xc]
mov dword [0x4a5644], ecx
cmp dword [ebp - 0x18], 0
je 0x4747f9
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
push eax
call fcn.00439ae5
add esp, 4
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp + 8]
mov dword [0x4a5648], ecx
mov eax, dword [ebp - 0xc]
jmp 0x4748fd
push 0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
push eax
call fcn.004731c0
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.004731c0
mov dword [ebp + 0xc], eax
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x36]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x40]
sub edx, dword [ebp - 8]
mov dword [ebp - 4], edx
cmp dword [ebp - 8], 0
je 0x47484a
cmp dword [ebp - 8], 0x1e
jbe 0x474866
mov dword [ebp - 0xc], 9
cmp dword [0x4a5638], 0
je 0x474861
jmp 0x4747da
jmp 0x4747d1
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x44]
cmp ecx, dword [ebp + 0xc]
je 0x47488d
mov dword [ebp - 0xc], 9
cmp dword [0x4a5638], 0
je 0x474888
jmp 0x4747da
jmp 0x4747d1
mov dword [ebp - 0x14], 0
lea edx, [ebp - 0x14]
push edx
push 0x40
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4748ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0xc], eax
jmp 0x4747d1
mov edx, dword [ebp - 0x18]
mov dword [edx + 4], 1
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
mov dword [eax + 8], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 0x14], ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [0x4a5650]
mov dword [edx], eax
mov ecx, dword [ebp - 0x18]
mov dword [0x4a5650], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 8
Function at 0x403df8
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x403fb0
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x403e59
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x403fcc
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x403ec6
xor eax, eax
push ebp
push 0x403ebf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x403ea8
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x403fec
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ec6
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpyA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x403fa7
cmp byte [ebp - 0xd], 0
jne 0x403f08
cmp byte [ebp - 0x12], 0
je 0x403fa7
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x403f21
dec ebx
cmp byte [ebx], 0x2e
je 0x403f30
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x403f20
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x403fa7
inc ebx
cmp byte [ebp - 0x12], 0
je 0x403f5d
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x403fa7
cmp byte [ebp - 0xd], 0
je 0x403fa7
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x403fa7
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpyA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406128
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x406232
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40617b
push 0x105
lea eax, [ebp - 0x109]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA_2
mov ecx, eax
lea edx, [ebp - 0x109]
mov eax, dword [ebp - 4]
call fcn.004030f4
jmp 0x406219
call sub.kernel32.dll_GetCommandLineA_1
mov ebx, eax
mov eax, ebx
call fcn.004060dc
mov ebx, eax
mov edi, ebx
mov eax, ebx
call fcn.004060fc
mov ebx, eax
test esi, esi
je 0x4061a3
dec esi
test esi, esi
jl 0x4061a3
cmp edi, ebx
jne 0x406182
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x110]
mov edx, edi
call fcn.00403134
mov eax, dword [ebp - 0x110]
mov ecx, ebx
sub ecx, edi
mov edx, 1
call fcn.00403380
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040317c
cmp eax, 2
jl 0x406219
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp byte [eax], 0x22
jne 0x406219
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040317c
mov edx, dword [ebp - 4]
mov edx, dword [edx]
cmp byte [edx + eax - 1], 0x22
jne 0x406219
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.0040317c
mov ecx, eax
sub ecx, 2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov edx, 2
call fcn.00403380
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406239
lea eax, [ebp - 0x110]
call fcn.00403010
ret

Function at 0x406240
Capabilities:
Get file attributes

Disassembly:
call fcn.00404f18
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x406254
dec eax
and al, 0x10
sete al
ret

Function at 0x406308
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406372
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403134
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004062c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406379
lea eax, [ebp - 0x10c]
call fcn.00403010
ret

Function at 0x406380
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4063ea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403134
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004062c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4063f1
lea eax, [ebp - 0x10c]
call fcn.00403010
ret
Function at 0x4063f8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406462
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x105]
push eax
push 0x105
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00403134
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.004062c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406469
lea eax, [ebp - 0x10c]
call fcn.00403010
ret

Function at 0x4064dc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov esi, ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x406574
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebx + 0x18], 0
jne 0x406529
mov eax, dword [ebx + 0x19]
call fcn.00403340
push eax
push esi
mov eax, edi
call fcn.00403340
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403340
push eax
call sub.kernel32.dll_GetPrivateProfileIntA
mov dword [ebp - 4], eax
jmp 0x40655e
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x19]
call fcn.00403340
push eax
lea edx, [ebp - 8]
mov eax, esi
call fcn.00405ec4
mov eax, dword [ebp - 8]
call fcn.00403340
push eax
mov eax, edi
call fcn.00403340
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403340
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40657b
lea eax, [ebp - 8]
call fcn.00403010
ret

Function at 0x406588
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff800
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp byte [ebx + 0x18], 0
jne 0x4065ef
mov byte [ebp - 0x800], 0
mov eax, dword [ebx + 0x19]
call fcn.00403340
push eax
push 0x800
lea eax, [ebp - 0x800]
push eax
mov eax, esi
call fcn.00403340
push eax
mov eax, edi
call fcn.00403340
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403340
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x800]
mov ecx, 0x800
call fcn.00403164
jmp 0x406620
mov eax, dword [ebp + 8]
mov edx, esi
call fcn.004030a8
mov eax, dword [ebx + 0x19]
call fcn.00403340
push eax
mov eax, esi
call fcn.00403340
push eax
mov eax, edi
call fcn.00403340
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00403340
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4081dc
Capabilities:
Get graphical window text

Disassembly:
xchg edx, eax
movzx ecx, byte [edx + 0x3a]
jecxz 0x4081eb
mov edx, dword [edx + 0x36]
jmp fcn.00403134
mov ecx, dword [edx + 0x18]
jecxz 0x4081e3
push ebx
push esi
xchg ebx, eax
mov esi, ecx
push esi
call sub.user32.dll_GetWindowTextLengthA
mov edx, eax
inc eax
push eax
mov eax, ebx
call fcn.004034ac
pop edx
mov ecx, dword [ebx]
jecxz 0x408213
push edx
push ecx
push esi
call sub.user32.dll_GetWindowTextA
pop esi
pop ebx
ret