joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push edi
push str.dkar.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [esp + 0xc]
test eax, eax
mov dword [esi], eax
je 0x401115
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.AboutDialog
push eax
call edi
test eax, eax
mov dword [0x4182e8], eax
je 0x4010fb
push str.VerifySN
push dword [esi]
call edi
test eax, eax
mov dword [0x4182dc], eax
je 0x4010fb
push str.RegisterSN
push dword [esi]
call edi
test eax, eax
mov dword [0x4182f0], eax
je 0x4010fb
push str.VerifySNMessageBox
push dword [esi]
call edi
test eax, eax
mov dword [0x4182f4], eax
je 0x4010fb
push str.MessageBoxExpired
push dword [esi]
call edi
test eax, eax
mov dword [0x4182ec], eax
je 0x4010fb
push str.ReadConfigKey
push dword [esi]
call edi
test eax, eax
mov dword [0x4182e0], eax
je 0x4010fb
push str.WriteConfigKey
push dword [esi]
call edi
test eax, eax
mov dword [0x4182f8], eax
je 0x4010fb
push str.CheckForUpdates
push dword [esi]
call edi
test eax, eax
mov dword [0x4182d4], eax
je 0x4010fb
push str.Associate
push dword [esi]
call edi
test eax, eax
mov dword [0x4182e4], eax
je 0x4010fb
push str.SetRegistryKey
push dword [esi]
call edi
test eax, eax
mov dword [0x4182d0], eax
je 0x4010fb
push str.UnAssociate
push dword [esi]
call edi
test eax, eax
mov dword [0x4182d8], eax
je 0x4010fb
push 1
pop eax
jmp 0x401117
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [esi]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
and dword [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
ret

Function at 0x40111a
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
push 0x41
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
push 0x104
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0x10b]
mov byte [ebp - 0x10c], 0x22
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push 0x414110
push eax
call fcn.0040b500
push dword [ebp + 0x14]
lea eax, [ebp - 0x10c]
push eax
call fcn.0040b500
add esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x2001f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
pop edi
jne 0x4011cb
cmp dword [ebp + 0x10], eax
je 0x4011bb
lea eax, [ebp - 0x10c]
push eax
call fcn.0040b470
pop ecx
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4011c7
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4011cf
xor eax, eax
leave
ret
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
leave
ret
Function at 0x401693
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
push dword [ebp + 8]
mov esi, 0x4182fc
xor edi, edi
push str.GetFileSizeMb._1.__s.
push esi
push 3
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00407279
add esp, 0x10
push edi
push edi
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x401744
lea eax, [ebp - 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
jne 0x401709
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetFileSizeMb._2.__08X.__08X.__08X.
push esi
push 1
call fcn.00407279
add esp, 0x18
jmp 0x40173b
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetFileSizeMb._3.__08X.__08X.__08X.
push esi
push 3
call fcn.00407279
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
add esp, 0x18
push 0x14
pop ecx
call fcn.0040b8f0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40175e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetFileSizeMb._4.__08X.__s.
push esi
push 1
call fcn.00407279
add esp, 0x14
push dword [ebp - 4]
push str.GetFileSizeMb._5.__08X.
push esi
push 3
call fcn.00407279
mov eax, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
leave
ret

Function at 0x40289b
Capabilities:
Create thread

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov dword [0x4187fc], eax
mov eax, dword [esp + 0xc]
push esi
push eax
push dword [0x419150]
xor esi, esi
mov dword [0x4187ac], eax
mov dword [0x418800], ecx
push str.CreateProcessDialog._2.__08X.__s.
push 0x4182fc
push 3
mov dword [0x41915c], esi
call fcn.00407279
add esp, 0x14
cmp dword [0x419150], esi
jne 0x402906
push 0x419150
push esi
push esi
push 0x402742
push esi
push esi
mov dword [0x419160], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
mov dword [0x419158], eax
jne 0x40290a
xor eax, eax
pop esi
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push dword [0x419158]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
pop esi
ret
Function at 0x402965
Capabilities:
Connect network resource
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 4], 0x10
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
push dword [ebp - 4]
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 0x14]
mov esi, 0x4182fc
push edi
push eax
push str.ConnectToResource._1.__s.__s.__08X
push esi
push 3
call fcn.00407279
push 2
push 0x41447c
push edi
call fcn.0040b9a0
add esp, 0x24
test eax, eax
jne 0x402a75
lea eax, [edi + 2]
push 0x5c
push eax
call fcn.0040b5f0
pop ecx
test eax, eax
pop ecx
je 0x402a75
inc eax
push 0x5c
push eax
call fcn.0040b5f0
mov ebx, eax
pop ecx
test ebx, ebx
pop ecx
mov dword [ebp + 0xc], ebx
je 0x402a75
push dword [ebp - 4]
lea eax, [ebp - 0x14]
push eax
lea eax, [edi + 2]
push eax
call fcn.004111f0
add esp, 0xc
test eax, eax
je 0x402a75
and byte [ebx], 0
push 0x20
lea eax, [ebp - 0x34]
push 0
push eax
call fcn.0040b6c0
add esp, 0xc
xor eax, eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], edi
push 1
pop ebx
push 0xc
push eax
push eax
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x30], ebx
push dword [ebp + 8]
call sub.MPR.dll_WNetAddConnection3A
test eax, eax
je 0x402a54
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push edi
push str.ConnectToResource._2.__08X.
push esi
push ebx
call fcn.00407279
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x402a6d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ConnectToResource._3.__08X
push esi
push 3
call fcn.00407279
add esp, 0x10
mov eax, ebx
mov ecx, dword [ebp + 0xc]
mov byte [ecx], 0x5c
jmp 0x402a78
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402f99
Capabilities:
Get file size
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x40310b
push ebx
push 0x80
push 3
push ebx
push ebx
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp - 0xc], esi
je 0x40310b
lea eax, [ebp - 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x403017
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov edi, eax
push dword [ebp - 4]
push dword [ebp + 8]
push edi
push str.AddDiskBlobToFile._1.__08X.__s.__08X.__08X.
push 0x4182fc
push 1
call fcn.00407279
add esp, 0x1c
jmp 0x40305c
cmp dword [ebp - 8], ebx
jne 0x403027
cmp eax, 0x7fffffff
jae 0x403027
xor ecx, ecx
jmp 0x40302a
lea ecx, [ebp - 8]
push ebx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x403069
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov edi, eax
push dword [ebp - 4]
push edi
push str.AddDiskBlobToFile._2.__08X.__08X.__08X.
push 0x4182fc
push 1
call fcn.00407279
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
jmp 0x403105
mov edi, dword [ebp + 0xc]
lea eax, [ebp - 4]
push ebx
push eax
push dword [edi]
mov dword [ebp - 4], ebx
push dword [edi + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
call esi
test eax, eax
je 0x4030d3
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x4030d3
lea eax, [ebp - 4]
push ebx
push eax
push 4
push str.DPDL
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x4030d3
cmp dword [ebp - 4], 4
jne 0x4030d3
lea eax, [ebp - 4]
push ebx
push eax
push 4
push edi
mov dword [ebp - 4], ebx
push dword [ebp - 0xc]
call esi
test eax, eax
je 0x4030d3
cmp dword [ebp - 4], 4
jne 0x4030d3
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x40310d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 8]
mov esi, eax
push dword [ebp - 4]
push dword [edi]
push dword [edi + 4]
push esi
push str.AddDiskBlobToFile._3.__08X.__08X.__08X.__08X.__08X.
push 0x4182fc
push 1
call fcn.00407279
add esp, 0x20
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4033f1
Capabilities:
Encrypt data using rc4 via winapi
Encrypt or decrypt via wincrypt
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push 0xf0000000
cmp esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
push 1
je 0x40343e
mov ebx, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
push str.Microsoft_Enhanced_Cryptographic_Provider_v1.0
lea eax, [ebp - 4]
push edi
push eax
call ebx
test eax, eax
jne 0x403456
push 0xf0000000
push 1
push str.Microsoft_Strong_Cryptographic_Provider
lea eax, [ebp - 4]
push edi
push eax
call ebx
jmp 0x40344e
push str.Microsoft_Base_Cryptographic_Provider_v1.0
lea eax, [ebp - 4]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x403557
lea eax, [ebp - 8]
push eax
push edi
push edi
push 0x8004
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x403530
push edi
push dword [ebp + 0xc]
call fcn.0040b470
pop ecx
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x403530
neg esi
sbb esi, esi
lea eax, [ebp - 0xc]
and esi, 0x58
push eax
add esi, 0x28
mov ebx, 0x6801
shl esi, 0x10
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4034e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x80090009
jne 0x4034e4
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp - 8]
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4034e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40353d
mov eax, dword [ebp + 8]
push eax
push dword [eax + 4]
push edi
push 1
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x40350f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0xc]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
jmp 0x40353d
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push 1
pop eax
jmp 0x403559
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp dword [ebp - 8], edi
mov esi, eax
je 0x403546
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403646
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
mov esi, 0x4182fc
push str.IsReadOnlyFilePath._1.__s.
push esi
push 3
call fcn.00407279
push 0x5c
push edi
call fcn.0040b730
add esp, 0x18
test eax, eax
je 0x403708
push edi
push dword [ebp + 8]
call fcn.00402965
pop ecx
test eax, eax
pop ecx
je 0x403708
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4036a5
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsReadOnlyFilePath._3.__08X.__08X.
jmp 0x4036f8
push ebx
push str.IsReadOnlyFilePath._4.__08X.
push esi
push 3
call fcn.00407279
mov dword [ebp + 8], ebx
add esp, 0x10
or dword [ebp + 8], 1
push dword [ebp + 8]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
call edi
test eax, eax
je 0x4036eb
mov eax, ebx
and al, 0xfe
push eax
push dword [ebp + 0xc]
call edi
test eax, eax
je 0x4036eb
cmp dword [ebp + 8], 0
je 0x403729
push ebx
push dword [ebp + 0xc]
call edi
test eax, eax
jne 0x403729
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsReadOnlyFilePath._5.__08X.__08X.
push esi
push 3
call fcn.00407279
add esp, 0x14
push 1
pop eax
jmp 0x40372b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
push edi
push ebx
push str.IsReadOnlyFilePath._2.__08X.__s.
push esi
push 2
call fcn.00407279
add esp, 0x14
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x404fc5
Capabilities:
Check if file exists
Create thread
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8
mov dl, byte [0x4182fc]
push ebx
push esi
push edi
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x67]
mov byte [ebp - 0x68], dl
push 7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x27]
mov byte [ebp - 0x28], dl
rep stosd dword es:[edi], eax
mov ebx, 0x18c
mov esi, 0x418620
stosw word es:[edi], ax
push ebx
push 0
push esi
stosb byte es:[edi], al
call fcn.0040b6c0
mov edi, dword [ebp + 0xc]
add esp, 0xc
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
push 2
push edi
call dword [0x419c64]
test eax, eax
je 0x4050d1
mov eax, dword [ebp + 8]
mov dword [0x418728], edi
mov edi, 0x100
mov dword [0x418720], eax
mov eax, dword [ebp + 0x10]
push edi
push esi
mov dword [0x418724], eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x5c
push esi
call fcn.0040b5f0
pop ecx
test eax, eax
pop ecx
je 0x40506f
push 0x5c
push esi
call fcn.0040b5f0
and byte [eax + 1], 0
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
push 0
push esi
call fcn.0040b6c0
lea eax, [ebp - 0xa8]
push 0x40
push eax
push 0x585
call fcn.00406e92
lea eax, [ebp - 0x68]
push 0x40
push eax
push 0x8fe
call fcn.00406e92
lea eax, [ebp - 0x28]
push 0x4142a8
push eax
call fcn.0040b4f0
lea eax, [ebp - 0x28]
push 1
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0xa8]
push esi
push eax
push dword [ebp + 8]
call fcn.0040b0bd
add esp, 0x44
test eax, eax
jne 0x4050dc
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4051ad
push 0x418878
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov al, byte [ebp - 8]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
add al, 0x41
cmp byte [0x418620], al
je 0x4051ab
push esi
call fcn.0040ba8c
test eax, eax
pop ecx
je 0x405114
call edi
cmp eax, 2
jne 0x4051ab
push 0x41872c
push dword [ebp + 8]
call fcn.004015a6
pop ecx
test eax, eax
pop ecx
je 0x4051ab
push 0xffffffffffffffff
push 0
push 0x57c
call fcn.00406e92
add esp, 0xc
push eax
push dword [ebp + 8]
push 0xfffffffffffffffa
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowLongA]
push eax
call fcn.0040289b
add esp, 0xc
test eax, eax
jne 0x40515e
call edi
mov edi, eax
jmp 0x405186
xor eax, eax
push 0x419154
push eax
push esi
push 0x404e25
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
mov dword [0x41915c], eax
jne 0x405195
call edi
mov edi, eax
call fcn.00402923
push ebx
push 0
push esi
call fcn.0040b6c0
add esp, 0xc
push edi
jmp 0x4051ae
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 1
pop eax
jmp 0x4051b6
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40694a
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push esi
cmp eax, ebx
push edi
mov byte [ebp - 1], bl
mov dword [ebp - 8], ebx
jne 0x40697e
lea eax, [ebp - 0x110]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x110]
lea ecx, [ebp - 8]
push ecx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
cmp esi, ebx
je 0x4069f2
push esi
call fcn.0040b718
pop ecx
mov edi, eax
push edi
push esi
push ebx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4069e7
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4142b4
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4069e7
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 8]
mov ecx, eax
and ecx, 0xffff
shr eax, 0x10
push ecx
push eax
push str._d._02d
push dword [ebp + 0xc]
call fcn.0040bf0d
add esp, 0x10
mov byte [ebp - 1], 1
cmp edi, ebx
je 0x4069f2
push edi
call fcn.0040b6ac
pop ecx
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4070ab
Capabilities:
Get common file path

Disassembly:
push esi
push edi
mov esi, 0x4195b8
push 0x105
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [esp + 0xc]
push str._DK__s.log
push 0x4195bb
call fcn.0040bf0d
push 0x4151fc
push esi
call fcn.0040c581
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x4070f8
push 0x4151f8
push esi
call fcn.0040c581
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x40711a
mov eax, dword [esp + 0x10]
cmp eax, 9
jbe 0x407104
push 3
pop eax
add eax, 0x30
push edi
push eax
call fcn.0040c53d
push edi
call fcn.0040c4e7
add esp, 0xc
push 1
pop eax
and byte [0x4195b8], 0
pop edi
pop esi
ret

Function at 0x407124
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, 0x4195b8
push 0x105
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push dword [esp + 8]
push str.DK__s.log
push 0x4195bb
call fcn.0040bf0d
push esi
call fcn.0040ba8c
and byte [0x4195b8], 0
and dword [0x4196c0], 0
add esp, 0x10
push 1
pop eax
pop esi
ret

Function at 0x407165
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x415288]
push ebx
push esi
mov esi, 0x4195b8
push edi
push esi
mov dword [ebp - 4], eax
call fcn.0040b470
cmp eax, 5
pop ecx
ja 0x4071ea
and dword [0x4196c0], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 8], 0
mov ebx, eax
test ebx, ebx
je 0x4071ea
test bl, 1
je 0x4071e3
mov al, byte [ebp - 8]
add al, 0x41
mov byte [ebp - 4], al
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
jne 0x4071e3
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push str._sDK__s.log
push esi
call fcn.0040bf0d
push 0x4151fc
push esi
call fcn.0040c581
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x4071f1
inc dword [ebp - 8]
shr ebx, 1
jne 0x4071a1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
push edi
call fcn.0040c594
sub eax, 0x30
pop ecx
cmp eax, 9
mov dword [0x4196c0], eax
jbe 0x40720f
mov dword [0x4196c0], 3
push edi
call fcn.0040c4e7
xor eax, eax
lea ecx, [ebp - 0x210]
push eax
push ecx
lea ecx, [ebp - 0x418]
push ecx
lea ecx, [ebp - 0x314]
push eax
push ecx
lea ecx, [ebp - 0x10c]
push ecx
push eax
push dword [ebp + 0xc]
call fcn.004069fa
add esp, 0x24
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push eax
push str.Start_logfile__n____s__Ver__s__n___Module:__s__Ver:__s
push 0x4182fc
push 1
call fcn.00407279
add esp, 0x1c
push 1
pop eax
jmp 0x4071ec
Function at 0x407598
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetWindow]
push 5
push dword [ebp + 8]
call edi
mov esi, eax
lea eax, [ebp - 0x34]
push 0x32
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextA]
push dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push eax
call fcn.0040c780
pop ecx
test eax, eax
pop ecx
je 0x4075dc
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_GetWindowLongA]
cmp eax, dword [ebp + 0x10]
je 0x4075e9
push 2
push esi
call edi
mov esi, eax
test esi, esi
je 0x4075ed
jmp 0x4075af
mov eax, esi
jmp 0x4075ef
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x4075f3
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
push 0
push dword [ebp + 8]
call fcn.0040b33f
pop ecx
lea eax, [ebp - 0x30]
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
lea eax, [ebp - 0x20]
push eax
push 9
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.USER32.dll_GetWindowRect]
push eax
call ebx
lea eax, [ebp - 0x40]
mov edi, 0x3021
push eax
push edi
push dword [ebp + 8]
call esi
push eax
call ebx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov ecx, edx
mov dword [ebp - 0x10], edx
sub ecx, eax
sub eax, dword [ebp - 0x38]
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [ebp - 0x28]
xor eax, eax
sub ebx, dword [ebp - 0x10]
push 5
push eax
push eax
push dword [ebp - 0xc]
push ebx
push eax
push edi
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 8]
xor eax, eax
push 5
push eax
push eax
add ecx, ebx
push dword [ebp - 0xc]
add ecx, dword [ebp - 4]
push ecx
push eax
push 9
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp - 0x28]
xor eax, eax
push 5
push eax
push eax
sub ecx, ebx
push dword [ebp - 0xc]
sub ecx, dword [ebp - 4]
push ecx
push eax
push 1
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
push edi
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.USER32.dll_EnableWindow]
push eax
call ebx
push 1
push 9
push dword [ebp + 8]
call esi
push eax
call ebx
push 0
push 2
push dword [ebp + 8]
call esi
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0xffffffffffffffff
push 0
push 0x7d4
call fcn.00406e92
add esp, 0xc
push eax
push 1
push dword [ebp + 8]
call esi
mov ebx, dword [sym.imp.USER32.dll_SetWindowTextA]
push eax
call ebx
push 0xffffffffffffffff
push 0
push 0x7d0
call fcn.00406e92
add esp, 0xc
push eax
push edi
push dword [ebp + 8]
call esi
push eax
call ebx
pop edi
pop esi
pop ebx
leave
ret