joyce8/EMBER2024-capa huggingface dataset:
Function at 0x862d00
Capabilities:
Check http status code

Disassembly:
mov ecx, dword [esp + 8]
mov eax, 0x51eb851f
imul ecx
sar edx, 5
mov eax, edx
push ebx
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
shr eax, 0x1f
mov ebx, dword [edi]
add edx, eax
cmp edx, 2
je 0x862d3c
push str.Couldnt_set_desired_mode
push ebx
call fcn.00846120
add esp, 8
mov eax, 0x11
pop edi
pop esi
pop ebx
ret
cmp ecx, 0xc8
je 0x862d53
push ecx
push str.Got_a__03d_response_code_instead_of_the_assumed_200_n
push ebx
call fcn.00846060
add esp, 0xc
mov eax, dword [esp + 0x18]
cmp eax, 0x13
jne 0x862d6b
push edi
call fcn.008616c0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x14
jne 0x862d7f
push edi
call fcn.00862db0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x15
jne 0x862d93
push edi
call fcn.00862ec0
add esp, 4
mov esi, eax
pop edi
pop esi
pop ebx
ret
cmp eax, 0x16
jne 0x862da3
push edi
call fcn.00862ee0
add esp, 4
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
ret

Function at 0x8634f0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov ebp, dword [ebx + 0x40c]
mov esi, dword [ebx]
lea eax, [esp + 0x20]
push edi
lea ecx, [esp + 0x10]
push eax
push ecx
push ebp
or edi, 0xffffffff
mov dword [esp + 0x30], 0x10
call dword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x86353e
lea edx, [esp + 0x24]
lea eax, [esp + 0x10]
push edx
push eax
push ebp
mov dword [esp + 0x30], 0x10
call dword [sym.imp.WS2_32.dll_accept]
mov edi, eax
push ebp
push ebx
call fcn.0084c010
add esp, 8
cmp edi, 0xffffffff
jne 0x863568
push str.Error_accept__ing_server_connect
push esi
call fcn.00846120
add esp, 8
mov eax, 0x1e
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
push str.Connection_accepted_from_server_n
push esi
call fcn.00846060
push 1
push edi
mov dword [ebx + 0x544], 0
mov dword [ebx + 0x40c], edi
call fcn.00870820
mov dword [ebx + 0x85c], 1
mov eax, dword [esi + 0x600]
add esp, 0x10
test eax, eax
je 0x8635e1
push 1
push esi
call fcn.00846000
mov ecx, dword [esi + 0x604]
push 1
push edi
push ecx
call dword [esi + 0x600]
push 0
push esi
mov edi, eax
call fcn.00846000
add esp, 0x1c
test edi, edi
je 0x8635e1
push ebx
call fcn.00862000
add esp, 4
mov eax, 0x2a
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10
ret
Function at 0x86e560
Capabilities:
Set socket configuration

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
push 0
lea eax, [esp + 8]
push 0
push eax
lea ecx, [esp + 0x18]
push 4
push ecx
push 0
push 0
push 0x4004747b
push esi
call dword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x86e5a2
lea edx, [esp + 0xc]
push 4
push edx
push 0x1001
push 0xffff
push esi
call dword [sym.imp.WS2_32.dll_setsockopt]
pop esi
pop ecx
ret

Function at 0x86eea0
Capabilities:
Get socket status

Disassembly:
mov eax, dword [esp + 8]
sub esp, 8
test eax, eax
push ebx
mov ebx, dword [esp + 0x18]
push esi
mov esi, dword [esp + 0x20]
je 0x86eeba
cmp dword [eax], 0
jne 0x86eed4
test ebx, ebx
je 0x86eec3
cmp dword [ebx], 0
jne 0x86eed4
test esi, esi
je 0x86ef68
cmp dword [esi], 0
je 0x86ef68
mov ecx, dword [esp + 0x24]
push ebp
test ecx, ecx
lea ebp, [esp + 0xc]
jge 0x86eee5
xor ebp, ebp
jmp 0x86ef28
jle 0x86ef1c
mov eax, 0x10624dd3
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, ecx
mov dword [esp + 0xc], edx
mov ecx, 0x3e8
cdq
idiv ecx
lea eax, [edx + edx*4]
lea eax, [eax + eax*4]
lea edx, [eax + eax*4]
mov eax, dword [esp + 0x1c]
shl edx, 3
mov dword [esp + 0x10], edx
jmp 0x86ef28
test ecx, ecx
jne 0x86ef28
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], ecx
test esi, esi
je 0x86ef35
cmp dword [esi], 0
je 0x86ef35
mov edx, esi
jmp 0x86ef37
xor edx, edx
test ebx, ebx
je 0x86ef44
cmp dword [ebx], 0
je 0x86ef44
mov ecx, ebx
jmp 0x86ef46
xor ecx, ecx
test eax, eax
je 0x86ef4f
cmp dword [eax], 0
jne 0x86ef51
xor eax, eax
push ebp
push edx
push ecx
push eax
mov eax, dword [esp + 0x28]
inc eax
push eax
call dword [sym.imp.WS2_32.dll_select]
pop ebp
pop esi
pop ebx
add esp, 8
ret
mov ecx, dword [esp + 0x24]
push ecx
call fcn.0086ee70
add esp, 4
pop esi
pop ebx
add esp, 8
ret
Function at 0x873e30
Capabilities:
Move file

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.0084e480
mov ebx, dword [esp + 0x18]
mov ebp, dword [esp + 0x14]
push 1
push ebx
push ebp
mov esi, eax
mov edi, edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x873e91
push edi
push esi
call fcn.0084e480
push edx
push eax
call fcn.0084e520
add esp, 0x10
test edx, edx
jl 0x873e98
jg 0x873e6e
test eax, eax
jb 0x873e98
test edx, edx
jg 0x873e98
jl 0x873e7b
cmp eax, 0x3e8
ja 0x873e98
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
push 1
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x873e53
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
Function at 0x8789d0
Capabilities:
Get hostname

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push esi
mov byte [esi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
mov byte [esi + edi - 1], 0
jne 0x878a02
push 0x2e
push esi
call fcn.00838e80
add esp, 8
test eax, eax
je 0x878a00
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
ret

Function at 0x878a50
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using des via winapi
Encrypt or decrypt via wincrypt

Disassembly:
sub esp, 0x20
push 0xf0000040
push 1
push 0
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x18], 8
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
jne 0x878a79
add esp, 0x20
ret
mov eax, dword [esp + 0x2c]
xor ecx, ecx
mov dword [esp + 0xc], ecx
lea edx, [esp + 0x18]
mov dword [esp + 0x10], ecx
push edx
mov dword [esp + 0x18], ecx
push eax
mov dword [esp + 0x20], ecx
mov byte [esp + 0x14], 8
mov dword [esp + 0x24], ecx
mov byte [esp + 0x15], 2
mov dword [esp + 0x18], 0x6601
mov dword [esp + 0x1c], 8
call fcn.00878b50
lea ecx, [esp + 0x20]
push 8
push ecx
call fcn.0087e180
mov ecx, dword [esp + 0x10]
add esp, 0x10
lea edx, [esp + 8]
lea eax, [esp + 0xc]
push edx
push 0
push 0
push 0x14
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
jne 0x878af8
mov edx, dword [esp]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
add esp, 0x20
ret
mov ecx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov edx, dword [ecx]
mov dword [eax], edx
mov ecx, dword [ecx + 4]
mov edx, dword [esp + 4]
mov dword [eax + 4], ecx
lea ecx, [esp + 4]
push edx
mov edx, dword [esp + 0xc]
push ecx
push eax
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov ecx, dword [esp]
push 0
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 1
add esp, 0x20
ret
Function at 0x87e230
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 0xf0000040
push 1
lea edi, [esi + 4]
push 0
push 0
push esi
mov dword [esi], 0
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x87e26e
mov eax, dword [esi]
push edi
push 0
push 0
push 0x8002
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
ret

Function at 0x87e280
Capabilities:
Hash data via wincrypt

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push eax
mov eax, dword [edx + 4]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
ret

Function at 0x87ec60
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x14]
lea eax, [ecx + eax*2 + 0xc]
push eax
call dword [0x8b8930]
mov edi, eax
add esp, 4
test edi, edi
jne 0x87ec83
pop edi
pop esi
ret
lea eax, [edi + 0xc]
push ebx
mov dword [edi], esi
mov dword [edi + 4], eax
mov ebx, dword [esi + 0xc]
mov edx, eax
add edx, ebx
mov ebx, dword [esp + 0x18]
mov dword [edi + 8], edx
mov ecx, dword [esi + 0x10]
cmp ebx, ecx
push ebp
jbe 0x87ecce
push eax
call dword [esi]
mov eax, dword [esp + 0x1c]
mov ecx, dword [edi + 4]
push ebx
push eax
push ecx
call dword [esi + 4]
mov ebx, dword [edi + 8]
mov eax, dword [esi + 0xc]
mov edx, dword [edi + 4]
add ebx, eax
push edx
push ebx
call dword [esi + 8]
mov eax, dword [esi + 0x14]
add esp, 0x18
mov dword [esp + 0x1c], eax
jmp 0x87ecd2
mov ebx, dword [esp + 0x18]
mov ecx, dword [edi + 4]
push ecx
call dword [esi]
mov edx, dword [edi + 8]
push edx
call dword [esi]
mov eax, dword [esp + 0x24]
add esp, 8
xor ebp, ebp
test eax, eax
jbe 0x87ed38
mov dword [esp + 0x1c], eax
mov ebp, eax
mov al, byte [ebx]
mov cl, byte [0x8b32bc]
xor al, cl
lea ecx, [esp + 0x14]
mov byte [esp + 0x14], al
mov edx, dword [edi + 4]
push 1
push ecx
push edx
call dword [esi + 4]
mov al, byte [ebx]
mov dl, byte [0x8b32bd]
xor al, dl
lea ecx, [esp + 0x20]
mov byte [esp + 0x20], al
mov edx, dword [edi + 8]
push 1
push ecx
push edx
inc ebx
call dword [esi + 4]
mov eax, dword [esp + 0x34]
add esp, 0x18
dec eax
mov dword [esp + 0x1c], eax
jne 0x87ecf1
cmp ebp, dword [esi + 0x10]
jae 0x87ed64
mov eax, dword [edi + 4]
push 1
push 0x8b32bc
push eax
call dword [esi + 4]
mov ecx, dword [edi + 8]
push 1
push 0x8b32bd
push ecx
call dword [esi + 4]
mov eax, dword [esi + 0x10]
add esp, 0x18
inc ebp
cmp ebp, eax
jb 0x87ed3d
pop ebp
mov eax, edi
pop ebx
pop edi
pop esi
ret

Function at 0x881115
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x881135
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.008338c5
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x881158
test byte [esp + 8], 2
je 0x881158
call fcn.00833938
mov dword [eax], 0xd
call fcn.00833941
mov dword [eax], 5
jmp 0x881131
xor eax, eax
ret
Function at 0x401000
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x264], ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, eax
lea edx, [edi - 1]
cmp edx, 0x100
ja 0x4011e4
push 0x5c
pop eax
cmp word [esi + edi*2 - 2], ax
je 0x40104f
mov word [esi + edi*2], ax
inc edi
push 0x2a
pop ecx
lea eax, [esi + edi*2]
mov word [eax], cx
xor ecx, ecx
mov dword [ebp - 0x268], eax
mov word [eax + 2], cx
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp eax, 0xffffffff
je 0x40110d
test byte [ebp - 0x258], 0x10
je 0x4010ea
push 0x41a6a8
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4010e4
push 0x41a6ac
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x4010e4
mov eax, 0x104
sub eax, edi
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [esi + edi*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edx, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x264]
push ebx
push esi
call section..text
pop ecx
pop ecx
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov eax, dword [ebp - 0x25c]
jne 0x401081
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x2a
pop ecx
lea eax, [esi + edi*2]
mov word [eax], cx
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x25c], eax
cmp eax, 0xffffffff
je 0x4011bb
test byte [ebp - 0x258], 0x10
jne 0x40119c
mov eax, 0x104
sub eax, edi
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [esi + edi*2]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x401180
cmp dword [ebp - 0x264], eax
jne 0x401180
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
je 0x401196
test eax, eax
jne 0x401196
cmp dword [ebp - 0x260], eax
je 0x401196
push 4
push eax
push esi
call ebx
mov eax, dword [ebp - 0x25c]
lea ecx, [ebp - 0x258]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
mov eax, dword [ebp - 0x25c]
jne 0x401139
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x268]
xor ecx, ecx
push esi
mov word [eax - 2], cx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x4011e4
test ebx, ebx
je 0x4011e4
cmp dword [ebp - 0x260], eax
je 0x4011e4
push 4
push eax
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040310d
mov esp, ebp
pop ebp
ret
Function at 0x40125d
Capabilities:
Delete file

Disassembly:
push esi
push edi
push str.MoveFileExW
push str.kernel32.dll
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4012a5
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4012a5
test edi, edi
je 0x4012a5
push 4
push eax
push esi
call edi
pop edi
pop esi
ret

Function at 0x4012a8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8a40
call fcn.004133d0
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, edx
mov ebx, ecx
call fcn.00404150
add esp, 0xc
mov dword [ebp - 0x8a1c], 0x104
lea eax, [ebp - 0x8a40]
mov dword [ebp - 0x8a18], esi
mov dword [ebp - 0x8a10], esi
mov dword [ebp - 0x8a14], 0x3fff
push eax
lea eax, [ebp - 0x8a28]
push eax
lea eax, [ebp - 0x8a2c]
push eax
lea eax, [ebp - 0x8a30]
push eax
lea eax, [ebp - 0x8a10]
push eax
lea eax, [ebp - 0x8a34]
push eax
lea eax, [ebp - 0x8a38]
push eax
lea eax, [ebp - 0x8a18]
push eax
push esi
lea eax, [ebp - 0x8a1c]
push eax
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov eax, dword [ebp - 0x8a10]
test eax, eax
je 0x401413
xor eax, eax
mov dword [ebp - 0x8a14], 0x3fff
push eax
push eax
push eax
push eax
mov word [ebp - 0x8a0c], ax
lea eax, [ebp - 0x8a14]
push eax
lea eax, [ebp - 0x8a0c]
push eax
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x401406
lea eax, [ebp - 0x8a0c]
push edi
push eax
call fcn.00403cd1
pop ecx
pop ecx
test eax, eax
jne 0x401426
push 0x800
push eax
lea eax, [ebp - 0xa0c]
mov dword [ebp - 0x8a24], 1
push eax
call fcn.00404150
add esp, 0xc
mov dword [ebp - 0x8a20], 0x400
lea eax, [ebp - 0x8a20]
push eax
lea eax, [ebp - 0xa0c]
push eax
lea eax, [ebp - 0x8a24]
push eax
push 0
lea eax, [ebp - 0x8a0c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401406
lea eax, [ebp - 0xa0c]
push edi
push eax
call fcn.00403cd1
pop ecx
pop ecx
test eax, eax
jne 0x401426
inc esi
cmp esi, dword [ebp - 0x8a10]
jb 0x401359
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040310d
mov esp, ebp
pop ebp
ret
xor eax, eax
inc eax
jmp 0x401415
Function at 0x40142b
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x808], 0
push ebx
push esi
push edi
push str.IsWow64Process
push str.kernel32
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x401477
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
lea eax, [ebp - 0x818]
push eax
mov eax, dword [ebp - 0x808]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push str.SYSTEMCurrentControlSetControlSession_Manager
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40156e
push 0x800
lea eax, [ebp - 0x804]
mov dword [ebp - 0x810], 7
push 0
push eax
call fcn.00404150
add esp, 0xc
mov dword [ebp - 0x80c], 0x400
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
lea eax, [ebp - 0x810]
push eax
push 0
push str.PendingFileRenameOperations
push dword [ebp - 0x818]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x818]
mov esi, eax
call edi
test esi, esi
jne 0x40156e
mov eax, dword [ebp - 0x80c]
lea esi, [ebp - 0x804]
and dword [ebp - 0x814], 0
mov dword [ebp - 0x81c], eax
test eax, eax
je 0x40156e
push ebx
push esi
call fcn.00403cd1
pop ecx
pop ecx
test eax, eax
jne 0x4015bb
push esi
call fcn.004048e7
mov ecx, dword [ebp - 0x814]
inc ecx
add ecx, eax
push esi
mov dword [ebp - 0x814], ecx
call fcn.004048e7
pop ecx
pop ecx
lea esi, [esi + eax*2]
mov eax, dword [ebp - 0x81c]
add esi, 2
cmp dword [ebp - 0x814], eax
jb 0x401530
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [ebp - 0x814]
push eax
mov eax, dword [ebp - 0x808]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
call esi
test eax, eax
jne 0x4015c2
mov ecx, dword [ebp - 0x814]
mov edx, ebx
call fcn.004012a8
push dword [ebp - 0x814]
test eax, eax
je 0x4015c0
call edi
xor eax, eax
inc eax
jmp 0x40160b
call edi
lea eax, [ebp - 0x814]
push eax
mov eax, dword [ebp - 0x808]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push 0x80000001
call esi
test eax, eax
jne 0x401609
mov ecx, dword [ebp - 0x814]
mov edx, ebx
call fcn.004012a8
push dword [ebp - 0x814]
test eax, eax
jne 0x4015b9
call edi
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040310d
mov esp, ebp
pop ebp
ret
Function at 0x40161c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
call fcn.004048e7
pop ecx
mov edi, eax
push 0x5c
pop eax
cmp word [esi + edi*2 - 2], ax
je 0x40164b
mov word [esi + edi*2], ax
inc edi
xor eax, eax
mov word [esi + edi*2], ax
mov ebx, str.LMIR
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push ebx
call fcn.004048e7
pop ecx
push 4
pop ecx
cmp eax, ecx
ja 0x401668
mov ecx, eax
xor ebx, ebx
add edi, ecx
inc ebx
push ebx
lea eax, [esi + edi*2]
push str._04X.tmp
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push str.LMIR
inc ebx
call fcn.004048e7
mov ecx, edi
add esp, 0x10
sub ecx, eax
lea ecx, [esi + ecx*2]
call fcn.0040142b
test eax, eax
jne 0x4016b4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4016c3
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4016bc
cmp ebx, 0xffff
jl 0x40166d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
xor eax, eax
inc eax
jmp 0x4016be

Function at 0x4016c8
Capabilities:
Create directory

Disassembly:
push ebx
push edi
mov edi, edx
mov ebx, ecx
push str.SHGetSpecialFolderPathW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x4016e9
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x401736
push 0
push 0x1c
push ebx
push 0
call eax
test eax, eax
je 0x4016de
push 0x41a7d0
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push str.Applet
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x401728
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4016de
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
call fcn.004048e7
pop ecx
pop edi
pop ebx
ret

Function at 0x401739
Capabilities:
Set current directory

Disassembly:
push ecx
push esi
push edi
mov edi, ecx
mov esi, edx
xor eax, eax
push str.shell32.dll
mov word [edi], ax
mov word [esi], ax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x40179e
mov edx, eax
mov ecx, edi
call fcn.004016c8
test eax, eax
je 0x40179e
cmp eax, 0x103
ja 0x40179e
push esi
mov ecx, edi
call fcn.0040161c
pop ecx
test eax, eax
jne 0x40177d
push 2
pop eax
jmp 0x4017a1
push esi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test eax, eax
jne 0x40179a
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call fcn.004011f5
pop ecx
push 3
jmp 0x40177a
xor eax, eax
jmp 0x4017a1
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
ret
Function at 0x401c4a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x41c004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x20
pop eax
mov esi, edx
mov word [ebp - 0x418], ax
xor ebx, ebx
xor eax, eax
push ebx
push 0x80
cmp word [esi], bx
setne al
lea eax, [eax*2 + 2]
push eax
push ebx
push 1
push 0x40000000
push str.params.txt
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401d4c
push 2
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
call fcn.004048e7
mov ebx, eax
pop ecx
test ebx, ebx
je 0x401d45
push 0x410
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.00404150
and dword [ebp - 0x420], 0
lea eax, [ebp - 0x414]
push ebx
push esi
push 0x410
push eax
lea eax, [ebp - 0x420]
push eax
call fcn.004074e9
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x41c]
add esp, 0x20
xor ebx, ebx
push ebx
push eax
push 1
lea eax, [ebp - 0x418]
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x41c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.00407110
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
push edi
call esi
push ebx
lea eax, [ebp - 0x41c]
push eax
push 1
lea eax, [ebp - 0x418]
push eax
push edi
call esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040310d
mov esp, ebp
pop ebp
ret

Function at 0x401d5d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
mov esi, str.logo.bmp
test ecx, ecx
je 0x401d7e
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401d7e
xor eax, eax
inc eax
jmp 0x401e0b
push 0xa
push 0x2711
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [0x41d2c0], eax
test eax, eax
je 0x401d9c
call fcn.00401935
jmp 0x401d9e
mov eax, edi
test eax, eax
je 0x401e0b
mov ecx, dword [0x41d2cc]
mov eax, dword [0x41d2c8]
cmp ecx, 0x36
jb 0x401df5
mov edx, 0x4d42
cmp word [eax], dx
jne 0x401df5
cmp dword [eax + 2], ecx
jne 0x401df5
cmp dword [eax + 0xe], 0x28
je 0x401dd3
cmp dword [eax + 0xe], 0x6c
je 0x401dd3
cmp dword [eax + 0xe], 0x7c
jne 0x401df5
cmp dword [eax + 0x12], 0x4e
jne 0x401df5
cmp dword [eax + 0x16], 0x20
je 0x401de5
cmp dword [eax + 0x16], 0xffffffe0
jne 0x401df5
push 1
push edi
mov edx, esi
xor ecx, ecx
call fcn.004019a6
pop ecx
pop ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00401979
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret
Function at 0x401e0e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
xor edi, edi
mov esi, str.rescue.ico
test ecx, ecx
je 0x401e2c
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x401e2c
xor eax, eax
inc eax
jmp 0x401e76
push 0xa
push 0x2716
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [0x41d2c0], eax
test eax, eax
je 0x401e4a
call fcn.00401935
jmp 0x401e4c
mov eax, edi
test eax, eax
je 0x401e74
push 1
push edi
mov edx, esi
xor ecx, ecx
call fcn.004019a6
pop ecx
pop ecx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
call fcn.00401979
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, edi
pop edi
pop esi
ret