joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5b4d14
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x6287a8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.005a35df
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.005a35df
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x5b4d8b
cmp word [ecx], dx
je 0x5b4d8b
mov eax, dword [0x5f8cac]
push edi
dec eax
push eax
push 0x5f8b98
call fcn.005b4cb3
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x5b4dfe
cmp word [eax], dx
je 0x5b4dfe
mov eax, dword [edi]
test eax, eax
je 0x5b4daf
cmp word [eax], dx
je 0x5b4daf
lea eax, [ebp - 0x10]
push eax
call fcn.005b4696
jmp 0x5b4db8
lea eax, [ebp - 0x10]
push eax
call fcn.005b4731
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x5b4e28
mov eax, dword [0x5f8b94]
push dword [ebp - 0x14]
dec eax
push eax
push 0x5f8888
call fcn.005b4cb3
add esp, 0xc
test al, al
je 0x5b4e28
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x5b4df3
cmp word [eax], di
je 0x5b4df3
lea eax, [ebp - 0x10]
push eax
call fcn.005b4696
pop ecx
jmp 0x5b4e2a
lea eax, [ebp - 0x10]
push eax
call fcn.005b4731
jmp 0x5b4df0
mov eax, dword [edi]
test eax, eax
je 0x5b4e15
cmp word [eax], dx
je 0x5b4e15
lea eax, [ebp - 0x10]
push eax
call fcn.005b462d
pop ecx
jmp 0x5b4e28
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x5b4ef3
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.005b4b38
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x5b4ef3
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x5b4ef3
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x5b4ef3
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x5b4e80
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.005a6b95
test ebx, ebx
je 0x5b4eee
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.005a6b95
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5b4ef3
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x5b4ef3
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.005bdde2
add esp, 0x10
xor eax, eax
inc eax
jmp 0x5b4ef5
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00556488
leave
ret
Function at 0x5be2b9
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.005be0dd
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x5be428
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x5be428
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x5be3dd
jg 0x5be315
test eax, eax
je 0x5be3d3
push 1
push 0x1000
call fcn.005a5e3b
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5be338
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5be3ca
push 0x8000
push ebx
call fcn.005a0a65
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x5be361
jg 0x5be35c
cmp ecx, 0x1000
jb 0x5be361
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005a8506
add esp, 0x10
cmp eax, 0xffffffff
je 0x5be3a6
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x5be35c
jl 0x5be38d
test ecx, ecx
jne 0x5be34e
push dword [ebp - 0xc]
push ebx
call fcn.005a0a65
push esi
call fcn.005a38dc
add esp, 0xc
xor ebx, ebx
jmp 0x5be436
cmp byte [edi + 0x24], 0
je 0x5be3bd
cmp dword [edi + 0x20], 5
jne 0x5be3bd
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x5be3c8
mov ebx, dword [edi + 0x18]
jmp 0x5be3ca
xor ebx, ebx
push esi
call fcn.005a38dc
pop ecx
jmp 0x5be436
test ecx, ecx
jg 0x5be39f
jl 0x5be3dd
test eax, eax
jae 0x5be39f
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005aa635
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x5be3fd
cmp byte [edi + 0x1c], 0
je 0x5be39f
jmp 0x5be42e
push ebx
call fcn.005b287a
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x5be39f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5be436
cmp byte [edi + 0x1c], 0
je 0x5be433
mov ebx, dword [edi + 0x18]
jmp 0x5be436
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005aa635
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x5bf5e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5bf60d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5bf60d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401000
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x147c
call fcn.0042a4e0
push ebx
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.00426af0
mov eax, dword [0x441270]
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor ecx, ecx
inc ecx
add esp, 0xc
mov dword [ebp - 0x58], 0x44
test byte [eax + 0x56be], cl
mov edi, 0x206
je 0x4010bc
push eax
lea eax, [ebp - 0x1478]
mov dword [ebp - 0x264], ecx
call fcn.00405a09
push edi
lea eax, [ebp - 0x25e]
push esi
push eax
mov word [ebp - 0x260], si
call fcn.00426af0
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x784]
mov word [ebp + eax - 0x260], cx
inc eax
inc eax
cmp cx, si
jne 0x40106f
push 0x4300b0
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x784]
push eax
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [0x441270]
test byte [eax + 0x56be], 2
je 0x40113d
push eax
lea eax, [ebp - 0x1478]
mov dword [ebp - 0x264], 2
call fcn.00405a09
push edi
lea eax, [ebp - 0x25e]
push esi
push eax
mov word [ebp - 0x260], si
call fcn.00426af0
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x784]
mov word [ebp + eax - 0x260], cx
inc eax
inc eax
cmp cx, si
jne 0x4010f5
push 0x4300d0
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x784]
push eax
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401142
Capabilities:
Create process on windows
Parse url

Disassembly:
mov eax, 0x42d7ad
call fcn.0042d00c
sub esp, 0x14c
push ebx
push esi
call fcn.004042d8
push 0x114
call fcn.004208a6
pop ecx
mov dword [ebp - 0x14], eax
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 4], ebx
je 0x401184
push ebx
push dword [ebp + 8]
mov ebx, eax
call fcn.004076a3
mov esi, eax
mov dword [ebp - 0x10], esi
xor ebx, ebx
jmp 0x401189
mov dword [ebp - 0x10], ebx
mov esi, ebx
or dword [ebp - 4], 0xffffffff
push 0x864
call fcn.004208a6
pop ecx
mov dword [ebp - 0x14], eax
cmp eax, ebx
mov dword [ebp - 4], 1
je 0x4011b7
push ebx
push str.install:___uninstall.html
push dword [ebp + 8]
push eax
call fcn.00406fed
jmp 0x4011b9
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xd4], 0xa
je 0x4011cf
mov ecx, eax
mov eax, esi
call fcn.00409192
push edi
mov edi, dword [0x441270]
lea eax, [edi + 0x2630]
mov dword [ebp - 0x14], eax
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4011e2
sub eax, edx
je 0x40129a
cmp dword [edi + 0x56c6], ebx
je 0x4012c5
mov esi, 0x103
push esi
lea eax, [ebp - 0x157]
push ebx
push eax
mov dword [ebp - 0x54], 0x3c
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x158], bl
call fcn.00426af0
mov ecx, dword [ebp - 0x14]
push edi
push fcn.004035f6
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
lea eax, [ebp - 0x158]
call fcn.00403b0f
lea eax, [ebp - 0x158]
add esp, 0x20
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x401258
lea ecx, [ebp - 0x54]
push ecx
sub eax, esi
push ebx
push eax
lea eax, [ebp - 0x158]
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlA]
cmp dword [ebp - 0x48], 3
je 0x401280
cmp dword [ebp - 0x48], 4
jne 0x401297
push 1
push ebx
push ebx
lea eax, [ebp - 0x158]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, dword [ebp - 0x10]
push 0x864
call fcn.004208a6
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov dword [ebp - 4], 3
pop edi
je 0x401311
push ebx
push str.install:___uninstall_marketing.html
push dword [ebp + 8]
push eax
call fcn.00406fed
jmp 0x401313
push 0x864
call fcn.004208a6
pop ecx
mov dword [ebp - 0x18], eax
cmp eax, ebx
mov dword [ebp - 4], 2
je 0x4012f7
mov ecx, dword [0x441270]
push ebx
add ecx, 0x2630
push ecx
push dword [ebp + 8]
push eax
call fcn.00406fed
jmp 0x4012f9
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xd4], 0xa
je 0x40129a
mov ecx, eax
mov eax, esi
call fcn.00409192
jmp 0x40129a
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0xd4], 0xa
je 0x401329
mov ecx, eax
mov eax, esi
call fcn.00409192
call fcn.0040974b
test eax, eax
je 0x401349
push ebx
push ebx
push dword [0x441270]
push 0x12
call fcn.00403b97
add esp, 0x10
call fcn.004015ab
mov esi, dword [ebp - 0x10]
call fcn.0040135f
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4014ba
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x190
call fcn.00403280
test eax, eax
jne 0x4014e6
push 0x30
push str.Cannot_start_install
push str.There_is_a_problem_with_the_install_program.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x401515
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.00401ba6
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov eax, dword [0x441270]
add eax, 0x74e3
push eax
call fcn.004118b6
xor eax, eax
pop ecx
inc eax
mov esp, ebp
pop ebp
ret

Function at 0x4015ab
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x260]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x364]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x441270]
test byte [eax + 0x56be], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
je 0x40160b
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x57c9
push eax
lea eax, [ebp - 0x364]
push eax
call edi
mov eax, dword [0x441270]
test byte [eax + 0x56be], 2
je 0x40162b
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x50b4
push eax
lea eax, [ebp - 0x364]
push eax
call edi
push esi
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push 0x4000000
push 3
push esi
push 1
push esi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push ebx
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x564]
push str._s__cleanup__d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x44
pop edi
push edi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.00426af0
add esp, 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x564]
push eax
push esi
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4016e2
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5c
push dword [ebp + 0xc]
call fcn.00420860
test eax, eax
pop ecx
pop ecx
je 0x401715
mov byte [eax], 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebp
ret
Function at 0x401b0d
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
push dword [ebp + 0xc]
and dword [esp + 0x20], 0
and dword [esp + 0x1c], 0
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.0040ec09
pop ecx
push 8
pop edx
lea eax, [esp + 0x18]
lea ecx, [esp]
call fcn.0040f344
mov ecx, dword [esp + 0x18]
shr ecx, 3
push 0x38
and ecx, 0x3f
pop eax
cmp ecx, eax
jb 0x401b70
push 0x78
pop eax
sub eax, ecx
push 0x437520
lea ecx, [esp + 0xc]
call fcn.0040ec09
lea eax, [esp + 4]
push eax
push 8
pop eax
lea ecx, [esp + 0x10]
call fcn.0040ec09
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0x10
pop edx
lea eax, [esp + 8]
call fcn.0040f344
mov esp, ebp
pop ebp
ret

Function at 0x401ba6
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4301e0
push eax
mov dword [0x441b8c], eax
call esi
push str.user32
mov dword [0x441b90], eax
call edi
push str.SetWindowTextW
push eax
mov dword [0x441b94], eax
call esi
push str.GetWindowTextW
push dword [0x441b94]
mov dword [0x441b98], eax
call esi
mov dword [0x441b9c], eax
xor eax, eax
cmp dword [0x441b90], eax
pop edi
pop esi
je 0x401c1c
cmp dword [0x441b98], eax
mov byte [0x441b88], 1
jne 0x401c21
mov byte [0x441b88], al
push 0x90
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x94], 0x94
call fcn.00426af0
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
sbb al, al
inc al
mov byte [0x441b88], al
leave
ret
Function at 0x401eab
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x36c
push ebx
push esi
push edi
push 0x1a4
xor esi, esi
lea eax, [ebp - 0x25c]
push esi
push eax
call fcn.00426af0
mov ebx, dword [sym.imp.GDI32.dll_GetDeviceCaps]
add esp, 0xc
mov dword [ebp - 0x260], 0x1a8
mov dword [ebp - 0xc], esi
push esi
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 0xc]
push esi
call dword [sym.imp.USER32.dll_EnumDisplayDevicesA]
test eax, eax
setne al
test al, al
je 0x40208a
test byte [ebp - 0x1bc], 1
mov byte [ebp - 1], 0
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
je 0x402082
push 0x103
lea eax, [ebp - 0x367]
push esi
push eax
mov byte [ebp - 0x368], 0
call fcn.00426af0
lea eax, [ebp - 0x23c]
push eax
push dword [ebp - 0xc]
lea eax, [ebp - 0x368]
push str.found_device__d__name:__s_nResolutions_Supported:_n_n
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x1c
lea eax, [ebp - 0x368]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 7
pop ecx
xor eax, eax
mov byte [ebp - 0xb8], 0
lea edi, [ebp - 0xb7]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x7c
stosb byte es:[edi], al
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.00426af0
add esp, 0xc
lea eax, [ebp - 0xb8]
push eax
push esi
lea eax, [ebp - 0x25c]
push eax
mov word [ebp - 0x94], 0x9c
call dword [sym.imp.USER32.dll_EnumDisplaySettingsA]
test eax, eax
setne al
test al, al
je 0x401fbe
mov ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp - 8]
jb 0x401fbe
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0x4c]
mov dword [ebp - 0x10], ecx
inc esi
test al, al
jne 0x401f5c
mov edi, 0x400
cmp dword [ebp - 0x10], edi
jl 0x401fda
cmp dword [ebp - 8], 0x300
jl 0x401fda
mov byte [ebp - 1], 1
push 0
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
push 8
push esi
call ebx
push 0xa
push esi
mov dword [ebp - 0x14], eax
call ebx
push 0xc
push esi
mov dword [ebp - 0x18], eax
call ebx
push 0x74
push esi
call ebx
cmp dword [ebp - 0x14], edi
jl 0x402010
cmp dword [ebp - 0x18], 0x300
mov byte [ebp - 2], 1
jge 0x402014
mov byte [ebp - 2], 0
lea eax, [ebp - 0x23c]
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40201c
sub eax, edx
mov esi, edx
mov edx, eax
mov eax, 0x441384
mov edi, eax
dec edi
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x402031
mov ecx, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, eax
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x40204a
mov eax, dword [ebp - 8]
mov esi, 0x4302b8
movsw word es:[edi], word [esi]
mov dword [0x44137c], eax
mov eax, dword [ebp - 0x10]
mov dword [0x441380], eax
mov al, byte [ebp - 2]
mov byte [0x441b84], al
mov al, byte [ebp - 1]
mov byte [0x441b85], al
mov byte [0x441b86], 0
xor esi, esi
inc dword [ebp - 0xc]
jmp 0x401ee1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4020e2
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push esi
lea edx, [ebp - 0x108]
push edi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4020f5
xor edi, edi
cmp byte [ebp - 0x108], 0
je 0x402139
lea esi, [ebp + edi - 0x108]
cmp byte [esi], 0x5c
jne 0x40212e
cmp edi, 2
jle 0x40212e
lea eax, [ebp - 0x108]
push eax
mov byte [esi], 0
call fcn.00409b75
pop ecx
mov byte [esi], 0x5c
inc edi
cmp byte [ebp + edi - 0x108], 0
jne 0x40210a
lea eax, [ebp - 0x108]
push eax
call fcn.00409b75
pop ecx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
leave
ret

Function at 0x4022df
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x514
push esi
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x40231d
mov eax, 0x441f10
jmp 0x4023aa
push edi
push esi
call fcn.00420778
pop ecx
mov edi, eax
push edi
push esi
push dword [ebp - 0x10]
lea eax, [ebp - 0x114]
push eax
call sub.VERSION.dll_GetFileVersionInfoA
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 4]
movzx ecx, word [eax + 2]
movzx eax, word [eax]
push 0x430ba4
push ecx
push eax
lea eax, [ebp - 0x514]
push str.StringFileInfo_04x_04x_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x514]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0xc]
mov esi, 0x441f10
mov edx, esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x402396
push edi
call fcn.00421456
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x402409
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0x1c], esi
je 0x402428
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push str.BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho
call fcn.00419ae4
add esp, 0xc
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40245e
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
pop ebp
ret
Function at 0x40246b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 8]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4024d0
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push edi
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
mov eax, dword [ebx]
inc eax
push eax
call fcn.00420778
pop ecx
push ebx
mov edi, eax
push edi
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
test eax, eax
je 0x4024d0
test edi, edi
je 0x4024ce
push edi
call fcn.00421456
pop ecx
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x4024f3
test edi, edi
je 0x4024fd
push dword [ebx]
push edi
push str.BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho
call fcn.00419ae4
add esp, 0xc
test edi, edi
je 0x4024fd
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x403280
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.004027aa
test eax, eax
pop ecx
pop ecx
mov edi, 0x74eb
push edi
je 0x403312
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
lea esi, [eax + ecx - 0xe18]
mov dword [ebp - 4], esi
call fcn.004208a6
pop ecx
push edi
mov ebx, eax
push 0
push ebx
call fcn.00426af0
mov eax, dword [ebp - 8]
mov dword [ebx + 0x74e3], eax
mov eax, dword [esi]
mov dword [ebx + 0x74e7], eax
mov eax, dword [ebp - 4]
mov edi, ebx
mov ecx, 0x386
rep movsd dword es:[edi], dword [esi]
mov dword [0x441270], ebx
add eax, 4
add ebx, 0xe18
add esp, 0xc
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x4032ff
jmp 0x4033d8
call fcn.004208a6
pop ecx
push edi
mov ebx, eax
push 0x4378d0
push ebx
call fcn.00426780
add esp, 0xc
push 0x103
lea eax, [ebp - 0x10f]
push esi
push eax
mov byte [ebp - 0x110], 0
call fcn.00426af0
add esp, 0xc
push str.data.cab
lea edi, [ebp - 0x110]
call fcn.004074d9
push esi
push esi
push 3
push esi
push 1
push SysReAllocStringLen
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x4033ab
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea edi, [ebx + 0x74e7]
push eax
mov dword [edi], eax
call fcn.00420778
pop ecx
push esi
lea ecx, [ebp - 8]
push ecx
push dword [edi]
mov dword [ebx + 0x74e3], eax
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4033b7
mov dword [ebx + 0x74e7], esi
mov dword [ebx + 0x74e3], esi
mov dword [0x441270], ebx
mov eax, 0x4378d4
add ebx, 0xe18
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
inc eax
inc eax
cmp cx, si
jne 0x4033ca
push dword [0x441270]
call fcn.00402a0f
pop ecx
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret