joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416d40
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov esi, eax
mov dword [ebp - 0x410], esi
test esi, esi
je 0x416ee3
push 0xf01ff
push 0x434f88
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [ebp - 0x40c], eax
test eax, eax
je 0x416ed5
xor eax, eax
push 0x3fe
push eax
lea ecx, [ebp - 0x406]
push ecx
mov word [ebp - 0x408], ax
call fcn.00426670
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0xc
mov esi, 1
mov edx, dword [ebp - 0x40c]
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x416e37
call ebx
cmp eax, 0x420
je 0x416e98
call ebx
push eax
push esi
lea eax, [ebp - 0x408]
push 0x441d50
push eax
call edi
lea ecx, [ebp - 0x408]
push ecx
call fcn.00403960
add esp, 0x14
cmp esi, 3
je 0x416e78
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
inc esi
cmp esi, 3
jle 0x416dc0
mov eax, dword [ebp - 0x410]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
push esi
lea edx, [ebp - 0x408]
push 0x441d00
push edx
call edi
lea eax, [ebp - 0x408]
add esp, 0xc
push eax
call fcn.00403960
mov ecx, dword [ebp - 0x40c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x40c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x408]
push str._Resume_Updater__wmcUpdater
push eax
call edi
lea ecx, [ebp - 0x408]
push ecx
call fcn.00403960
mov edx, dword [ebp - 0x40c]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push 0x441df8
jmp 0x416ee8
push str._Resume_Updater_
call fcn.00403960
mov ecx, dword [ebp - 4]
add esp, 4
pop edi
pop esi
xor ecx, ebp
xor al, al
pop ebx
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
Function at 0x417430
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x228
lea ecx, [ebp - 0x22c]
push 0
push ecx
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], 0x22c
call fcn.00426670
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea edx, [ebp - 0x230]
mov esi, eax
push edx
push esi
mov dword [ebp - 0x234], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4174f5
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0041e957
add esp, 8
test eax, eax
jne 0x4174e2
mov edx, dword [ebp - 0x228]
push edx
push eax
push 1
call ebx
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4174a0
pop ebx
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
Function at 0x4179a0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x103
lea ecx, [ebp - 0x23b]
push 0
push ecx
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 0
call fcn.00426670
push 0x103
lea edx, [ebp - 0x137]
push 0
push edx
mov byte [ebp - 0x138], 0
call fcn.00426670
xor eax, eax
add esp, 0x18
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
push 0x104
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edi, edi
jmp 0x417a50
push 0x104
lea ecx, [ebp - 0x138]
push 0
push ecx
call fcn.00426670
push edi
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x138]
push str._sinfoem_i.inf
push eax
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x138]
push ecx
push 0x20
xor eax, eax
lea edx, [ebp - 0x34]
push edx
push 0x4389a0
push 0x4424ec
push str.Strings
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call esi
test eax, eax
je 0x417b25
lea eax, [ebp - 0x34]
push str.SunMoon_Rise
push eax
call fcn.0042b74c
add esp, 8
test eax, eax
jne 0x417b25
lea ecx, [ebp - 0x138]
push ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0x4389a0
push str.DriverName
push str.Strings
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call esi
test eax, eax
je 0x417b25
lea eax, [ebp - 0x14]
push 0x43ad10
push eax
call fcn.0042b74c
add esp, 8
test eax, eax
jne 0x417b25
lea ecx, [ebp - 0x138]
push 0x5c
push ecx
call fcn.00420940
add esp, 8
test eax, eax
jne 0x417b45
inc edi
cmp edi, 0x3e7
jl 0x417a50
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x240]
push 0xc
inc eax
push eax
push edx
call fcn.0041eb90
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
Function at 0x417b70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x442514
call fcn.00403960
xor eax, eax
add esp, 4
xor ebx, ebx
push 0x3e
lea ecx, [ebp - 0x66]
push ebx
push ecx
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov word [ebp - 0x68], ax
call fcn.00426670
add esp, 0xc
push 0x3fe
lea eax, [ebp - 0x56e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x570], dx
call fcn.00426670
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x16f]
push ebx
push ecx
mov byte [ebp - 0x170], bl
call fcn.00426670
lea edx, [ebp - 0x24]
add esp, 0xc
push edx
call fcn.004179a0
add esp, 4
test eax, eax
je 0x417d39
lea eax, [ebp - 0x68]
push eax
lea ebx, [ebp - 0x24]
call fcn.0040aed0
add esp, 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x570]
push str.PnP___s__Exist.
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x570]
add esp, 0xc
push eax
call fcn.00403960
add esp, 4
mov ecx, ebx
push ecx
lea edx, [ebp - 0x170]
push str.pnputil.exe__f__d__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x417c88
lea ecx, [ebp - 0x594]
push ecx
call eax
movzx eax, word [ebp - 0x594]
test eax, eax
je 0x417cc3
cmp eax, 9
jne 0x417cc3
call fcn.004055a0
push 0
cmp eax, 1
jne 0x417cba
lea edx, [ebp - 0x170]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
call fcn.00405600
jmp 0x417cd4
lea eax, [ebp - 0x170]
push eax
jmp 0x417ccc
push 0
lea ecx, [ebp - 0x170]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
cmp esi, 0x1f
ja 0x417cf8
push str.PnP_Delete_Result_Fail___
call fcn.00403960
add esp, 4
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x24]
push edx
call fcn.004179a0
add esp, 4
test eax, eax
je 0x417d32
push str.PnP_Delete_Fail___
call fcn.00403960
add esp, 4
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
push str.PnP_Delete_Success___
jmp 0x417d3e
push str.PnP_oemX.inf_not_Exist.
call fcn.00403960
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
Function at 0x418320
Capabilities:
Delete file
Delete service
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4c
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x41853e
push 0xf01ff
push 0x440d18
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
je 0x41853e
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xa0e]
push ecx
mov word [ebp - 0xa10], ax
call fcn.00426670
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
xor esi, esi
mov word [ebp - 0x210], dx
call fcn.00426670
add esp, 0xc
lea ecx, [ebp - 0xa2c]
push ecx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [ebp - 0x210]
push str.C:Program_FilesWW2017CFwmcSystem7.exe
push edx
xor edi, edi
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.0041ee1e
add esp, 0x10
test eax, eax
jne 0x418441
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ebx, [ebx]
cmp edi, 0x1e
je 0x41843b
push 0x434910
call fcn.00417430
add esp, 4
push 0x80
lea ecx, [ebp - 0x210]
push ecx
call ebx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0041ee1e
add esp, 8
test eax, eax
je 0x4183f0
mov ebx, dword [ebp - 0xa4c]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xa48]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0xa44], 1
je 0x4184a8
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
inc esi
push esi
lea edx, [ebp - 0xa10]
push 0x442660
push edx
call edi
lea eax, [ebp - 0xa10]
add esp, 0xc
push eax
call fcn.00403960
add esp, 4
cmp esi, 5
je 0x4184ba
lea ecx, [ebp - 0xa2c]
push ecx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp esi, 5
jle 0x418441
push 0x44268c
call fcn.00403960
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x4184c4
push str.PbkW
call fcn.00403960
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x418505
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xa10]
push 0x4426cc
push edx
call edi
lea eax, [ebp - 0xa10]
add esp, 0xc
push eax
call fcn.00403960
add esp, 4
mov dword [0x447924], 0
jmp 0x41852c
lea ecx, [ebp - 0xa10]
push 0x4426f8
push ecx
call edi
lea edx, [ebp - 0xa10]
push edx
call fcn.00403960
add esp, 0xc
mov dword [0x447924], 1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
Function at 0x419090
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00426670
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x412]
push eax
mov word [ebp - 0x414], dx
call fcn.00426670
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x20c]
push str.C:Program_FilesWW2017CFWM7F.cab
push ecx
call edi
lea edx, [ebp - 0x414]
push str.C:Program_FilesWW2017CFwmcRMS7.exe
push edx
call edi
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0041ee1e
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x30
test eax, eax
jne 0x419149
push esi
mov esi, 0x447638
mov edi, edi
mov ecx, dword [esi]
push ecx
lea edx, [ebp - 0x20c]
push str.C:Program_FilesWW2017CF_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call ebx
add esi, 4
cmp esi, 0x4476b4
jl 0x419120
pop esi
lea ecx, [ebp - 0x414]
push ecx
call ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041e7be
mov esp, ebp
pop ebp
ret
Function at 0x41b5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x41b603
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x41b67d
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.004259e0
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x41b651
sub eax, edi
jmp 0x41b653
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x41b642
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x41b670
sub eax, edi
jmp 0x41b672
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x41b661
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x41b732
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x41b6a3
mov ebx, ecx
test ebx, ebx
je 0x41b6f6
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x41b6c5
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.0041c120
jmp 0x41b6de
cmp eax, 2
jne 0x41b6e4
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x41b6d7
xor eax, eax
jmp 0x41b6e1
mov edx, ebx
call fcn.0041c7c0
mov edx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.004259e0
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x41b71e
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x41b732
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x41b600
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41c7a0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x41c7ab
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.0041c7c0
Function at 0x41e7be
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x446044]
jne 0x41e7c8
repz ret
jmp fcn.0042105e

Function at 0x41ed9f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x41edc6
call fcn.0042232f
mov dword [eax], esi
call fcn.0042231c
push 0x16
pop esi
mov dword [eax], esi
call fcn.004222ca
mov eax, esi
jmp 0x41ee1b
test dword [ebp + 0xc], 0xfffffff9
jne 0x41edac
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x41edf3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00422342
pop ecx
call fcn.0042231c
mov eax, dword [eax]
jmp 0x41ee1b
test al, 0x10
jne 0x41ee19
test al, 1
je 0x41ee19
test byte [ebp + 0xc], 2
je 0x41ee19
call fcn.0042232f
mov dword [eax], 5
call fcn.0042231c
mov dword [eax], 0xd
jmp 0x41edea
xor eax, eax
pop esi
pop ebp
ret
Function at 0x428fc4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x446044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00421b81
and dword [ebp - 0x14], 0
cmp dword [0xc605a8], 0
mov dword [ebp - 0x18], eax
jne 0x429077
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42911f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x433ce0
push ebx
call edi
test eax, eax
je 0x42911f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0xc605a8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0xc605ac], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0xc605b0], eax
call edi
push eax
call esi
mov dword [0xc605b8], eax
test eax, eax
je 0x429077
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0xc605b4], eax
mov eax, dword [0xc605b4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4290d0
cmp dword [0xc605b8], ecx
je 0x4290d0
push eax
call esi
push dword [0xc605b8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4290d0
test ebx, ebx
je 0x4290d0
call edi
test eax, eax
je 0x4290c7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4290c7
test byte [ebp - 8], 1
jne 0x4290d0
or dword [ebp + 0x10], 0x200000
jmp 0x429103
mov eax, dword [0xc605ac]
cmp eax, dword [ebp - 0x18]
je 0x429103
push eax
call esi
test eax, eax
je 0x429103
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x429103
mov eax, dword [0xc605b0]
cmp eax, dword [ebp - 0x18]
je 0x429103
push eax
call esi
test eax, eax
je 0x429103
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0xc605a8]
call esi
test eax, eax
je 0x42911f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x429121
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041e7be
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Copy file
Get common file path
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1b8
mov eax, dword [0x407030]
mov ecx, dword [0x4051a8]
mov dx, word [0x4051ac]
push esi
mov dword [esp + 0x1b8], eax
mov eax, dword [str.vp6vfw.dll]
push edi
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], eax
mov al, byte [0x4051ae]
push 0x105
lea ecx, [esp + 0xb4]
push ecx
mov word [esp + 0x1c], dx
mov byte [esp + 0x1e], al
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + 0xb0]
dec edi
lea ecx, [ecx]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x401060
mov dx, word [0x4051a0]
lea eax, [esp + 0xc]
mov word [edi], dx
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401078
lea edi, [esp + 0xb0]
sub eax, edx
dec edi
lea esp, [esp]
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x401090
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
push 0
lea eax, [esp + 0xb4]
rep movsb byte es:[edi], byte [esi]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
xor eax, eax
lea edx, [esp + 0x18]
mov ecx, 0x25
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push str.system.ini
lea eax, [esp + 0xb4]
push eax
push str.vidc.VP60
push str.Drivers32
call esi
push str.system.ini
lea ecx, [esp + 0xb4]
push ecx
push str.vidc.VP61
push str.Drivers32
call esi
push 0x405158
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov eax, dword [esp + 0x28]
test eax, eax
je 0x401169
lea edx, [esp + 8]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersiondrivers.desc
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov ecx, dword [esp + 8]
push 0xc
push str.EA_VP6_Codec
push 1
push 0
lea eax, [esp + 0x1c]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x1bc]
xor eax, eax
call fcn.004011b0
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10