joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000633e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.100060e4
xchg ebx, eax
xor al, 0xd1
xchg edi, eax
lea eax, [ebp - 0x58]
push eax
call fcn.100060f4
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.100060a9
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x100063d2
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.100060e4
aas
and eax, 0x458d7dd4
rcl byte [eax - 0x18], 0xc5
cld
invalid

Function at 0x100068fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x353], 0
mov byte [ebp - 0x352], 0xda
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi

Function at 0x10006930
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x39a80001], esi
test dword [ebp + 0x4afffffc], esi
invalid
invalid
invalid

Function at 0x10006950
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [esi - 0x3a]
test dword [ecx + 0x56fffffc], edi
mov byte [ebp - 0x346], 0x6d

Function at 0x10006960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.100060f4
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.100060a9
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
invalid
test dword [esp + edi*8 - 1], edi
invalid
Function at 0x10007dda
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
invalid
test dword [ecx - 8], ebx
Function at 0x100082ab
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push eax
call fcn.100060e4
xchg ebx, eax
cmp eax, 0xf88b0f7c
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.100060e4
xchg esi, eax
outsd dx, dword [esi]
aam 0xe3
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
idiv dword [eax + 0x50746547]
cmp dword [esi], eax
jne 0x100082d1
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x100082d1
invalid
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..data
mov ebx, 0x408f6c
nop
mov ecx, 0x578557ab
nop
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data_1
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x23194103
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x40138d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
push dword [ebp + 8]
call esi
push dword [ebp + 0xc]
mov edi, eax
call esi
lea eax, [edi + eax + 1]
push eax
call fcn.00402de7
mov dword [ebp - 4], eax
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
pop ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
mov dword [ebp - 0x58], 0x44
pop ecx
push dword [ebp + 8]
stosd dword es:[edi], eax
push dword [ebp - 4]
xor eax, eax
lea edi, [ebp - 0x54]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x40b0dc
push dword [ebp - 4]
call esi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, ebx
je 0x401437
cmp dword [ebp + 0x10], ebx
je 0x401427
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
push dword [ebp - 0x10]
call edi
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4017ac
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x35c
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x12c]
push str.0x_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x35c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x35c]
push 0x40b0e0
push eax
call fcn.00402981
pop ecx
lea eax, [ebp - 0x35c]
pop ecx
mov esi, str.Caption
push eax
lea eax, [ebp - 0x258]
push 0x12c
push eax
push 0x40de28
lea eax, [ebp - 0x12c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
test eax, eax
jne 0x40183c
lea eax, [ebp - 0x12c]
push str.0x0409
push eax
call ebx
lea eax, [ebp - 0x12c]
push eax
push 3
push 0x40e34c
push esi
call fcn.00401958
lea eax, [ebp - 0x12c]
push eax
push 4
push 0x40e478
push str.Cancel
call fcn.00401958
lea eax, [ebp - 0x12c]
push eax
push 5
push 0x40e5a4
push str.LocalLaunch
call fcn.00401958
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 8
push eax
push str.Copying
call fcn.00401958
add esp, 0x40
lea eax, [ebp - 0x258]
mov esi, 0x40e6d0
push eax
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.__s
push esi
call edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 0xa
push eax
push 0x40b120
call fcn.00401958
add esp, 0x10
lea eax, [ebp - 0x258]
push eax
push esi
call edi
push 0x40b11c
push esi
call edi
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x258]
push 9
push eax
push str.Scanning
call fcn.00401958
add esp, 0x10
lea eax, [ebp - 0x258]
mov esi, 0x40e7fc
push eax
push esi
call ebx
push 0x40b11c
push esi
call fcn.00403150
lea eax, [ebp - 0x12c]
push eax
push 6
push 0x40e928
push str.PrepMessage
call fcn.00401958
lea eax, [ebp - 0x12c]
push eax
push 7
push 0x40ea54
push str.WaitMessage
call fcn.00401958
add esp, 0x28
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401bc9
Capabilities:
Extract resource via kernel32 functions
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x401cb5
mov esi, 0x40eb80
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.00402b6d
pop ecx
test eax, eax
pop ecx
je 0x401cb5
push 0x40b160
push 0x69
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [ebp - 4], ebx
mov dword [ebp - 8], eax
je 0x401cb5
cmp edi, ebx
je 0x401cb5
cmp eax, ebx
je 0x401cb5
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
setne al
mov esi, eax
cmp esi, ebx
je 0x401cb1
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [ebp - 4]
push ebx
push eax
push esi
mov dword [ebp - 4], ebx
push dword [ebp - 8]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401ca8
cmp dword [ebp - 4], esi
jne 0x401ca8
push 1
pop esi
jmp 0x401caa
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x401cb7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401d56
Capabilities:
Delete file

Disassembly:
cmp byte [0x40eb80], 0
push esi
je 0x401d82
xor esi, esi
push 0x40eb80
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401d82
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 0xa
jl 0x401d62
pop esi
ret
Function at 0x401efe
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
cmp dword [0x40eda4], 0
jne 0x402019
and byte [ebp - 0x104], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
push dword [ebp + 8]
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.00402a0b
lea eax, [ebp - 0x104]
push eax
call fcn.00401e4f
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push 0x40b164
push eax
call edi
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402019
cmp dword [0x40eda4], 0
jne 0x402012
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call fcn.00402a0b
pop ecx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x104]
push eax
call edi
test byte [ebp - 0x244], 0x10
je 0x401fe0
cmp byte [ebp - 0x218], 0x2e
je 0x401ffc
lea eax, [ebp - 0x104]
push eax
call fcn.00401efe
pop ecx
jmp 0x401ffc
inc dword [0x40ed98]
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.00402cd3
add dword [0x40ed9c], eax
pop ecx
pop ecx
lea eax, [ebp - 0x244]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401f8d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40201e
Capabilities:
Create directory
Delete file
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
push ebx
push esi
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 4]
and byte [ebp - 0x210], al
mov dword [ebp - 8], ebx
stosd dword es:[edi], eax
push 0x40
lea edi, [ebp - 0x20f]
pop ecx
and byte [ebp - 0x33c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x4a
xor eax, eax
pop ecx
lea edi, [ebp - 0x33b]
rep stosd dword es:[edi], eax
and byte [ebp - 0x468], bl
push 0x4a
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x467]
and byte [ebp - 0x10c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x210]
mov esi, 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x4020b4
lea eax, [ebp - 0x210]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x402123
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00402a63
pop ecx
test eax, eax
pop ecx
je 0x402123
mov eax, dword [0x40ed9c]
xor ecx, ecx
cmp ecx, dword [ebp - 4]
ja 0x40212f
jb 0x4020dd
cmp eax, dword [ebp - 8]
jae 0x40212f
mov esi, 0x40ec84
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00402b6d
pop ecx
test eax, eax
pop ecx
je 0x402123
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x402123
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x402123
cmp dword [0x40eda4], ebx
je 0x40211b
push ebx
push ebx
jmp 0x40221b
push 1
pop eax
jmp 0x40222e
push ebx
call fcn.00401cbc
pop ecx
jmp 0x40222c
movzx eax, word [0x40de30]
push eax
lea eax, [ebp - 0x33c]
push str.0x_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x10c]
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10c]
push 0x40b0e0
push eax
call fcn.00402981
pop ecx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
pop ecx
lea eax, [ebp - 0x10c]
mov esi, 0x12c
push eax
mov edi, 0x40e34c
push esi
push edi
push 0x40de28
lea eax, [ebp - 0x33c]
push str.Caption
push eax
call ebx
test eax, eax
jne 0x4021ae
push esi
push edi
push 3
push dword [0x40dd20]
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x468]
push esi
push eax
push 0x40de28
lea eax, [ebp - 0x33c]
push str.NoSpace
push eax
call ebx
test eax, eax
jne 0x4021ea
lea eax, [ebp - 0x468]
push esi
push eax
push 1
push dword [0x40dd20]
call dword [sym.imp.USER32.dll_LoadStringA]
push 4
lea eax, [ebp - 0x468]
push edi
push eax
push dword [0x40ed90]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x402217
push dword [0x40ed90]
push 0x40de38
call fcn.00401245
pop ecx
pop ecx
push 0
push 0
push 0x415
push dword [0x40ed90]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402233
Capabilities:
Create directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34c
push ebx
push esi
xor ebx, ebx
push edi
cmp dword [0x40eda4], ebx
jne 0x4023a6
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
rep stosd dword es:[edi], eax
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call fcn.00402a0b
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
mov dword [esp], 0x40b164
push eax
call edi
lea eax, [ebp - 0x34c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4023a6
cmp dword [0x40eda4], ebx
jne 0x40239d
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call esi
lea eax, [ebp - 0x108]
push eax
call fcn.00402a0b
pop ecx
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x108]
push eax
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00402a0b
pop ecx
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x20c]
push eax
call edi
mov eax, dword [ebp - 0x34c]
and eax, 0x10
test al, al
jne 0x40234d
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.004023ab
jmp 0x402383
cmp byte [ebp - 0x320], 0x2e
je 0x402385
lea eax, [ebp - 0x20c]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x402370
push ebx
call fcn.00401cbc
jmp 0x402384
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00402233
pop ecx
pop ecx
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4022cd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4023ab
Capabilities:
Copy file
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push ebx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x513]
mov byte [ebp - 0x514], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x207]
mov byte [ebp - 0x208], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x30b]
mov byte [ebp - 0x30c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.004029bd
lea eax, [ebp - 0x30c]
push eax
push dword [ebp + 0xc]
call fcn.0040299c
add esp, 0x10
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x30c]
push eax
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x514]
push 0x40e6d0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x514]
push eax
push 0x3ec
push dword [0x40ed90]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
cmp dword [0x40eda4], ebx
jne 0x4024f4
push esi
lea eax, [ebp - 0x208]
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
add dword [0x40eda0], eax
push dword [0x40eda0]
call fcn.00402748
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
pop ebx
leave
ret

Function at 0x4024f8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
lea eax, [ebp - 0x108]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x40b0e0
push eax
call fcn.00402981
pop ecx
lea eax, [ebp - 0x108]
pop ecx
push eax
push 0
push str.QTInstall
push str.32Bit
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 1
jne 0x40258c
push 0
call fcn.00407eb0
test ax, ax
pop ecx
jne 0x40257b
call fcn.00408060
lea eax, [ebp - 4]
push eax
push 0x7174696d
call fcn.00407c60
pop ecx
pop ecx
call fcn.00408080
call fcn.00408010
cmp dword [ebp - 4], 0x4128000
jge 0x40258c
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call fcn.0040258e
pop ecx
pop ecx
leave
ret
Function at 0x40258e
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x568
movzx eax, word [ebp + 8]
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x25c]
push str.0x_04x
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov esi, 0x104
lea eax, [ebp - 0x464]
push dword [ebp + 0xc]
mov ebx, 0x40de28
push esi
push eax
push ebx
lea eax, [ebp - 0x25c]
push str.QTInstallCaption
push eax
call edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x360]
push esi
push eax
push ebx
lea eax, [ebp - 0x25c]
push str.QTInstallMsg
push eax
call edi
lea eax, [ebp - 0x464]
push 0x34
push eax
lea eax, [ebp - 0x360]
push eax
push dword [0x40ed90]
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x4026e0
push dword [ebp + 0xc]
lea eax, [ebp - 0x568]
push esi
push eax
push ebx
push str.QTInstallDir
push str.32Bit
call edi
push esi
lea eax, [ebp - 0x158]
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x158]
push eax
call fcn.0040299c
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
pop ecx
pop ecx
lea eax, [ebp - 0x568]
push eax
lea eax, [ebp - 0x158]
push eax
call edi
lea eax, [ebp - 0x158]
push str.QuickTimeInstaller.exe
push eax
call edi
push 0x44
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00403230
push 0x10
lea eax, [ebp - 0x10]
push esi
push eax
mov dword [ebp - 0x28], 1
mov word [ebp - 0x24], si
call fcn.00403230
add esp, 0x18
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x158]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4026e0
push 0xffffffffffffffff
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402a63
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
and byte [ebp - 0x114], 0
push 1
xor eax, eax
pop ebx
lea edi, [ebp - 0x113]
push 0x40
lea esi, [ebp - 0x114]
pop ecx
rep stosd dword es:[edi], eax
push dword [ebp + 8]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [ebp - 0x114], 0x5c
jne 0x402aba
cmp byte [ebp - 0x113], 0x5c
jne 0x402aba
push 2
lea esi, [ebp - 0x112]
pop ebx
xor ecx, ecx
test ebx, ebx
jle 0x402adc
mov al, byte [esi]
test al, al
je 0x402adc
cmp al, 0x5c
je 0x402ace
cmp al, 0x2f
jne 0x402ad7
inc ecx
cmp ecx, ebx
jne 0x402ad7
inc esi
and byte [esi], 0
inc esi
cmp ecx, ebx
jl 0x402ac0
lea eax, [ebp - 0x114]
push eax
call fcn.00402a0b
mov dword [esp], str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
push str.GetDiskFreeSpaceExA
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, eax
test ecx, ecx
je 0x402b28
and dword [ebp - 0xc], 0
xor eax, eax
lea edi, [ebp - 8]
push eax
stosd dword es:[edi], eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push dword [ebp + 0xc]
push eax
call ecx
mov esi, eax
jmp 0x402b5f
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov esi, eax
test esi, esi
je 0x402b5f
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
imul ecx, dword [ebp - 0x10]
imul ecx, dword [ebp - 4]
mov dword [eax], ecx
and dword [eax + 4], 0
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x402b6d
Capabilities:
Get common file path

Disassembly:
push esi
push edi
xor esi, esi
xor edi, edi
cmp edi, 5
jge 0x402ba3
push dword [esp + 0x10]
push 0
push 0x40b204
push dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
mov esi, eax
test esi, esi
jne 0x402b9e
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
inc edi
test esi, esi
je 0x402b73
mov eax, esi
pop edi
pop esi
ret