joyce8/EMBER2024-capa huggingface dataset:
Function at 0x68401020
Capabilities:
Create thread

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x30]
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [0x68403180], eax
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0x684017c0
mov dword [esp + 4], 0
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 0x10002
sub esp, 0x18
add esp, 0x2c
ret
Function at 0x68401ca0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x1c
mov dword [esp], edx
mov eax, dword [esp]
xor edx, edx
lea esi, [esi]
nop
movzx ecx, byte [eax + edx]
xor cl, byte [esi + edx]
mov byte [esp + edx + 0x18], cl
add edx, 1
cmp edx, 4
jne 0x68401cb8
movzx edx, byte [esp + 0x18]
mov dword [esp], eax
movzx ebp, byte [edx + 0x68404140]
movzx edx, byte [esp + 0x19]
movzx ecx, byte [edx + 0x68404240]
movzx edx, byte [esp + 0x1a]
movzx eax, byte [edx + 0x68404140]
movzx edx, byte [esp + 0x1b]
movzx edx, byte [edx + 0x68404240]
mov esi, eax
mov byte [esp + 0xa], al
mov byte [esp + 7], dl
mov edx, ecx
xor edx, 0xe
test cl, cl
cmovns edx, ecx
xor esi, 0xe
rol dl, 1
mov edi, edx
mov byte [esp + 8], dl
xor edi, ebp
test al, al
cmovns esi, eax
mov edx, edi
mov eax, esi
rol al, 1
mov esi, eax
mov byte [esp + 0xb], al
xor esi, 0xe
test al, al
cmovns esi, eax
mov eax, esi
rol al, 1
xor edx, eax
mov byte [esp + 9], al
movzx eax, byte [esp + 7]
mov esi, eax
mov edi, eax
xor esi, 0xe
test al, al
cmovns esi, edi
mov eax, esi
rol al, 1
mov edi, eax
mov esi, eax
xor edi, 0xe
test al, al
cmovns edi, esi
xor edx, esi
mov eax, edi
rol al, 1
mov edi, eax
mov eax, ebp
xor edx, edi
mov byte [esp + 0x14], dl
mov edx, ebp
xor edx, 0xe
test al, al
movzx eax, byte [esp + 0xb]
cmovs ebp, edx
xor ecx, eax
xor cl, byte [esp + 9]
mov edx, ebp
xor ecx, edi
rol dl, 1
mov ebp, edx
xor ecx, edx
xor ebp, 0xe
test dl, dl
mov byte [esp + 0x15], cl
cmovns ebp, edx
mov ecx, ebp
rol cl, 1
mov ebp, ecx
movzx ecx, byte [esp + 8]
mov edi, ecx
xor edi, 0xe
test cl, cl
cmovns edi, ecx
mov ecx, edi
rol cl, 1
mov edi, ecx
movzx ecx, byte [esp + 0xa]
xor cl, byte [esp + 8]
xor ecx, esi
xor ecx, ebp
xor ecx, edi
mov byte [esp + 0x16], cl
movzx ecx, byte [esp + 7]
xor ecx, eax
mov eax, dword [esp]
xor edx, ecx
xor edx, ebp
xor edx, edi
mov byte [esp + 0x17], dl
xor edx, edx
lea esi, [esi]
movzx ecx, byte [eax + edx]
mov byte [ebx + edx], cl
add edx, 1
cmp edx, 4
jne 0x68401de8
mov dword [esp], eax
lea esi, [esi]
movzx ecx, byte [esp + edx + 0x10]
xor cl, byte [eax + edx]
mov byte [ebx + edx], cl
add edx, 1
cmp edx, 8
jne 0x68401e00
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x68401e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
push esi
mov esi, ecx
push ebx
mov ebx, eax
sub esp, 0x20
mov dword [esp + 4], edx
xor edx, edx
mov dword [esp], eax
mov eax, dword [esp + 4]
lea esi, [esi]
nop
movzx ecx, byte [eax + edx]
xor cl, byte [esi + edx]
mov byte [esp + edx + 0x1c], cl
add edx, 1
cmp edx, 4
jne 0x68401e40
movzx edx, byte [esp + 0x1c]
mov dword [esp + 4], eax
mov dword [esp], ebx
movzx edi, byte [edx + 0x68404240]
movzx edx, byte [esp + 0x1d]
movzx ebp, byte [edx + 0x68404140]
movzx edx, byte [esp + 0x1e]
movzx ecx, byte [edx + 0x68404240]
movzx edx, byte [esp + 0x1f]
mov byte [esp + 0xb], cl
movzx eax, byte [edx + 0x68404140]
mov ecx, ebp
mov edx, ebp
xor edx, 0xe
test cl, cl
cmovns edx, ebp
mov byte [esp + 0xd], al
rol dl, 1
mov ecx, edx
xor edx, 0xe
mov ebx, ecx
test cl, cl
mov byte [esp + 0xf], cl
cmovns edx, ebx
rol dl, 1
mov ecx, edx
xor ecx, 0xe
test dl, dl
cmovs edx, ecx
rol dl, 1
mov ebx, edx
mov byte [esp + 0xe], dl
xor ebx, edi
mov ecx, ebx
movzx ebx, byte [esp + 0xb]
mov edx, ebx
mov esi, ebx
xor edx, 0xe
test bl, bl
cmovns edx, esi
mov esi, eax
xor esi, 0xe
rol dl, 1
xor ecx, edx
test al, al
cmovns esi, eax
mov ebx, ecx
mov ecx, esi
rol cl, 1
mov esi, ecx
xor ecx, 0xe
mov eax, esi
test al, al
cmovns ecx, esi
rol cl, 1
mov eax, ecx
xor eax, 0xe
test cl, cl
cmovs ecx, eax
xor ebx, esi
mov eax, ecx
mov ecx, ebx
rol al, 1
xor ecx, eax
mov byte [esp + 0xc], al
mov eax, edi
xor eax, 0xe
mov byte [esp + 0x18], cl
mov ecx, eax
mov eax, edi
test al, al
cmovs edi, ecx
mov eax, edi
rol al, 1
mov edi, eax
mov ecx, eax
xor edi, 0xe
test al, al
cmovns edi, ecx
mov eax, edi
rol al, 1
mov edi, eax
xor eax, 0xe
mov ebx, edi
test bl, bl
cmovs edi, eax
xor ebp, edx
mov eax, edi
mov edi, ebp
mov ebp, edx
rol al, 1
xor ebp, 0xe
test dl, dl
cmovs edx, ebp
rol dl, 1
mov ebp, edx
xor ebp, 0xe
test dl, dl
cmovs edx, ebp
mov ebp, eax
xor edi, esi
movzx esi, byte [esp + 0xb]
xor edi, ebp
movzx eax, byte [esp + 0xc]
rol dl, 1
xor edi, edx
mov ebx, edi
movzx edi, byte [esp + 0xf]
mov byte [esp + 0x19], bl
movzx ebx, byte [esp + 0xe]
xor esi, edi
xor esi, ebx
xor esi, eax
mov eax, dword [esp + 4]
xor esi, ecx
mov ebx, esi
movzx esi, byte [esp + 0xd]
mov byte [esp + 0x1a], bl
mov ebx, dword [esp]
xor esi, edi
xor ecx, esi
xor ecx, ebp
xor edx, ecx
mov byte [esp + 0x1b], dl
xor edx, edx
nop
movzx ecx, byte [eax + edx]
mov byte [ebx + edx], cl
add edx, 1
cmp edx, 4
jne 0x68401fb0
mov dword [esp], ebx
mov dword [esp + 4], eax
lea esi, [esi]
lea esi, [esi]
movzx ecx, byte [esp + edx + 0x14]
xor cl, byte [eax + edx]
mov byte [ebx + edx], cl
add edx, 1
cmp edx, 8
jne 0x68401fd0
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x4018cc
Capabilities:
Create process on windows
Get common file path
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x411418], 0
je 0x4019a9
xor edx, edx
push ebp
push 0x4019a2
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x411031], 0
je 0x4018fe
push 0x411420
call sub.KERNEL32.DLL_SetFilePointer
mov byte [0x411418], 0
mov eax, dword [0x411478]
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
xor eax, eax
mov dword [0x411478], eax
mov ebx, dword [0x411440]
jmp 0x401931
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_OpenProcess
mov ebx, dword [ebx]
cmp ebx, 0x411440
jne 0x40191f
mov eax, 0x411440
call fcn.004011cc
mov eax, 0x411450
call fcn.004011cc
mov eax, 0x41147c
call fcn.004011cc
mov eax, dword [0x411438]
test eax, eax
je 0x401977
mov edx, dword [eax]
mov dword [0x411438], edx
push eax
call sub.KERNEL32.DLL_GetWindowsDirectoryA
mov eax, dword [0x411438]
test eax, eax
jne 0x401960
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4019a9
cmp byte [0x411031], 0
je 0x401997
push 0x411420
call sub.KERNEL32.DLL_TerminateProcess
push 0x411420
call sub.KERNEL32.DLL_WinExec
ret
pop ebx
pop ebp
ret
Function at 0x401edc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x411418], 0
jne 0x401f03
call fcn.00401808
test al, al
jne 0x401f03
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x402057
xor ecx, ecx
push ebp
push 0x402050
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x411031], 0
je 0x401f24
push 0x411420
call sub.KERNEL32.DLL_SetFilePointer
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x401f34
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x401fd3
mov eax, ebx
test eax, eax
jns 0x401f49
add eax, 3
sar eax, 2
mov edx, dword [0x411478]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x401fd3
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x401f84
mov eax, ebx
test eax, eax
jns 0x401f73
add eax, 3
sar eax, 2
mov ecx, dword [0x411478]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x401faa
mov ecx, ebx
test ecx, ecx
jns 0x401f8d
add ecx, 3
sar ecx, 2
mov edi, dword [0x411478]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x41140c]
sub ebx, 4
add dword [0x411410], ebx
call fcn.00402c80
jmp 0x402057
cmp ebx, dword [0x411470]
jg 0x402025
sub dword [0x411470], ebx
cmp dword [0x411470], 0xc
jge 0x401ff7
add ebx, dword [0x411470]
xor eax, eax
mov dword [0x411470], eax
mov eax, dword [0x411474]
add dword [0x411474], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x41140c]
sub ebx, 4
add dword [0x411410], ebx
call fcn.00402c80
jmp 0x402057
mov eax, ebx
call fcn.00401de8
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402057
cmp byte [0x411031], 0
je 0x40204f
push 0x411420
call sub.KERNEL32.DLL_TerminateProcess
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x402064
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x41141c], eax
cmp byte [0x411418], 0
jne 0x40209c
call fcn.00401808
test al, al
jne 0x40209c
mov dword [0x41141c], 8
mov dword [ebp - 4], 8
jmp 0x4021fd
xor ecx, ecx
push ebp
push 0x4021f6
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x411031], 0
je 0x4020bd
push 0x411420
call sub.KERNEL32.DLL_SetFilePointer
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x4020d8
mov dword [0x41141c], 9
jmp 0x4021cd
dec dword [0x41140c]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x411410], eax
test bl, 1
je 0x402138
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x402108
test edx, 0x80000003
je 0x402117
mov dword [0x41141c], 0xa
jmp 0x4021cd
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x40212f
mov dword [0x41141c], 0xa
jmp 0x4021cd
add ebx, edx
mov esi, eax
call fcn.004019ac
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x411474]
jne 0x402178
sub dword [0x411474], ebx
add dword [0x411470], ebx
cmp dword [0x411470], 0x3c00
jle 0x402169
call fcn.00401c84
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00402c80
jmp 0x4021fd
mov edx, dword [eax]
test dl, 2
je 0x40219b
and edx, 0x7ffffffc
cmp edx, 4
jge 0x402196
mov dword [0x41141c], 0xb
jmp 0x4021cd
or dword [eax], 1
jmp 0x4021c4
mov eax, edi
cmp dword [eax + 4], 0
je 0x4021ae
cmp dword [eax], 0
je 0x4021ae
cmp dword [eax + 8], 0xc
jge 0x4021ba
mov dword [0x41141c], 0xb
jmp 0x4021cd
mov edx, dword [eax + 8]
add ebx, edx
call fcn.004019ac
mov edx, ebx
mov eax, esi
call fcn.00401bfc
mov eax, dword [0x41141c]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4021fd
cmp byte [0x411031], 0
je 0x4021f5
push 0x411420
call sub.KERNEL32.DLL_TerminateProcess
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4028d4
Capabilities:
Get graphical window text
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x40296c
push 0x80000002
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x40294c
xor eax, eax
push ebp
push 0x402945
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402988
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_MapVirtualKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40294c
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_GetWindowTextA
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x4029cc
Capabilities:
Set thread local storage value

Disassembly:
cmp byte [0x40f004], 0
je 0x4029eb
push eax
push eax
push edx
push esp
push 2
push 0
push 0xeedfae4
call sub.KERNEL32.DLL_TlsSetValue
add esp, 8
pop eax
ret
Function at 0x402a00
Capabilities:
Set thread local storage value

Disassembly:
push esp
push 1
push 0
push 0xeedfae0
call sub.KERNEL32.DLL_TlsSetValue
add esp, 4
pop eax
ret
cmp byte [0x40f004], 1
jbe 0x402a10
push eax
push ebx
jmp 0x4029ec
ret

Function at 0x402a78
Capabilities:
Set thread local storage value

Disassembly:
push eax
push edx
cmp byte [0x40f004], 1
jbe 0x402a92
push esp
push 2
push 0
push 0xeedfae3
call sub.KERNEL32.DLL_TlsSetValue
pop edx
pop eax
ret

Function at 0x4035c0
Capabilities:
Log keystrokes via polling

Disassembly:
xor edx, edx
mov dx, word [eax]
test edx, 0x4000
jne 0x4035f5
cmp edx, 8
jb 0x4035f5
cmp edx, 0x100
je 0x4035e8
cmp edx, 0x101
jne 0x4035fb
jmp dword [0x4113d0]
mov word [eax], 0
add eax, 8
jmp fcn.004030d4
mov word [eax], 0
ret
push eax
call sub.user32.dll_GetKeyboardState
ret

Function at 0x403648
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb0
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x4037cc
call sub.KERNEL32.DLL_GetLocalTime
mov ebx, eax
test ebx, ebx
je 0x4036ad
push 0x4037dc
push ebx
call sub.KERNEL32.DLL_GetModuleFileNameA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4036ad
push 0x105
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call dword [ebp - 0xc]
test eax, eax
je 0x4036ad
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
jmp 0x4037c2
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x4036ed
mov eax, dword [ebp - 4]
cmp byte [eax + 1], 0x5c
jne 0x4037c2
mov eax, dword [ebp - 4]
add eax, 2
call fcn.00403634
mov ebx, eax
cmp byte [ebx], 0
je 0x4037c2
lea eax, [ebx + 1]
call fcn.00403634
mov ebx, eax
cmp byte [ebx], 0
je 0x4037c2
jmp 0x4036f3
mov ebx, dword [ebp - 4]
add ebx, 2
mov esi, ebx
sub esi, dword [ebp - 4]
lea eax, [esi + 1]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
jmp 0x4037a9
lea eax, [ebx + 1]
call fcn.00403634
mov edi, eax
mov eax, edi
sub eax, ebx
mov edx, eax
add edx, esi
inc edx
cmp edx, 0x105
jg 0x4037c2
inc eax
push eax
push ebx
lea eax, [ebp - 0x24f]
add eax, esi
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
lea eax, [ebp - 0x14a]
push eax
lea eax, [ebp - 0x24f]
push eax
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4037c2
push ebx
call sub.KERNEL32.DLL_FreeLibrary
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetTempPathA
lea edx, [esi + 1]
add eax, edx
inc eax
cmp eax, 0x105
jg 0x4037c2
mov byte [ebp + esi - 0x24f], 0x5c
lea eax, [ebp - 0x11e]
push eax
lea eax, [ebp - 0x24f]
add eax, esi
inc eax
push eax
call sub.KERNEL32.DLL_GetProcAddress
lea eax, [ebp - 0x11e]
push eax
call sub.KERNEL32.DLL_GetTempPathA
inc eax
add esi, eax
mov ebx, edi
cmp byte [ebx], 0
jne 0x403711
lea eax, [ebp - 0x24f]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4037f0
Capabilities:
Get common file path
Get file size
Get graphical window text
Log keystrokes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetLastError
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4039ac
push 0x80000001
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x403851
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x4039c8
push 0x80000001
call sub.user32.dll_IsWindowVisible
test eax, eax
jne 0x4038c3
xor eax, eax
push ebp
push 0x4038bc
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.00403648
push eax
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_MapVirtualKeyA
test eax, eax
je 0x4038a5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x4039e8
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_MapVirtualKeyA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4038c3
mov eax, dword [ebp - 8]
push eax
call sub.user32.dll_GetWindowTextA
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetProcAddress
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetPrivateProfileIntA
push eax
call sub.KERNEL32.DLL_GetFileSize
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x4039a4
cmp byte [ebp - 0xd], 0
jne 0x403905
cmp byte [ebp - 0x12], 0
je 0x4039a4
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x40391e
dec ebx
cmp byte [ebx], 0x2e
je 0x40392d
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x40391d
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x4039a4
inc ebx
cmp byte [ebp - 0x12], 0
je 0x40395a
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_GetProcAddress
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
mov esi, eax
test esi, esi
jne 0x4039a4
cmp byte [ebp - 0xd], 0
je 0x4039a4
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetProcAddress
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
mov esi, eax
test esi, esi
jne 0x4039a4
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_GetProcAddress
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_GetPrivateProfileStringA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404f90
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x4050e4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.004030d4
lea eax, [ebp - 4]
mov edx, esi
call fcn.0040316c
jmp 0x40507f
lea ecx, [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x4050fc
call fcn.00404c70
cmp dword [ebx], 0
je 0x404ffe
mov eax, ebx
mov edx, 0x4050fc
call fcn.0040327c
cmp dword [ebx], 0
jne 0x405025
mov eax, dword [ebp - 8]
call fcn.00403274
cmp eax, 2
jne 0x405025
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x405025
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00403128
jmp 0x40507f
push 0x200
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov edx, dword [ebx]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 8]
call fcn.004032c0
mov eax, dword [ebp - 0x16c]
call fcn.00403438
push eax
call sub.shell32.dll_SHGetFileInfoA
cmp byte [ebp - 0x15c], 0
je 0x405075
lea eax, [ebp - 8]
lea edx, [ebp - 0x15c]
mov ecx, 0x104
call fcn.00403238
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.0040327c
cmp dword [ebp - 4], 0
jne 0x404fdd
lea edx, [ebp - 0x170]
mov eax, dword [ebx]
call fcn.004051fc
cmp dword [ebp - 0x170], 0
jne 0x4050b9
lea edx, [ebp - 0x174]
mov eax, esi
call fcn.004051fc
mov edx, dword [ebp - 0x174]
mov eax, ebx
call fcn.0040327c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4050eb
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.004030f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004030f8
ret
Function at 0x40631c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403428
xor eax, eax
push ebp
push 0x4064b9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.0040629c
cmp dword [ebp - 0xc], 1
jge 0x406358
mov dword [ebp - 8], 0xffffffff
jmp 0x4064a3
xor edx, edx
push ebp
push 0x40649c
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 0x22]
mov ecx, 2
mov eax, dword [ebp - 0xc]
call fcn.004062fc
cmp word [ebp - 0x22], 0x5a4d
je 0x40638f
mov dword [ebp - 8], 0xffffffff
call fcn.00402c80
jmp 0x4064a3
mov edx, 0x3c
mov eax, dword [ebp - 0xc]
call fcn.00406310
lea edx, [ebp - 0x10]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.004062fc
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00406310
lea edx, [ebp - 0x22]
mov ecx, 2
mov eax, dword [ebp - 0xc]
call fcn.004062fc
cmp word [ebp - 0x22], 0x4550
je 0x4063e0
mov dword [ebp - 8], 0xffffffff
call fcn.00402c80
jmp 0x4064a3
mov edx, dword [ebp - 0x10]
add edx, 0x54
mov eax, dword [ebp - 0xc]
call fcn.00406310
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.004062fc
mov edx, dword [ebp - 0x10]
add edx, 0x14
mov eax, dword [ebp - 0xc]
call fcn.00406310
lea edx, [ebp - 0x16]
mov ecx, 2
mov eax, dword [ebp - 0xc]
call fcn.004062fc
mov edx, dword [ebp - 0x10]
add edx, 6
mov eax, dword [ebp - 0xc]
call fcn.00406310
lea edx, [ebp - 0x18]
mov ecx, 2
mov eax, dword [ebp - 0xc]
call fcn.004062fc
movzx eax, word [ebp - 0x16]
add eax, dword [ebp - 0x10]
add eax, 0x18
movzx edx, word [ebp - 0x18]
dec edx
shl edx, 3
lea edx, [edx + edx*4]
add edx, eax
add edx, 0x10
mov eax, dword [ebp - 0xc]
call fcn.00406310
lea edx, [ebp - 0x1c]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.004062fc
lea edx, [ebp - 0x20]
mov ecx, 4
mov eax, dword [ebp - 0xc]
call fcn.004062fc
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064a3
mov eax, dword [ebp - 0xc]
push eax
call fcn.004044fc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4064c0
lea eax, [ebp - 4]
call fcn.004030d4
ret
Function at 0x406d6c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, 0x130
push 0
push 0
dec ecx
jne 0x406d74
push ecx
push ebx
push esi
push edi
mov edi, eax
xor eax, eax
push ebp
push 0x406fce
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.004030d4
xor ebx, ebx
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x800
lea eax, [ebp - 0xc]
push eax
push 0x406fe0
push 0x80000002
call sub.advapi32.dll_RegSetValueExA
test eax, eax
jne 0x406df4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x959]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0x406ff4
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_CharNextA
test eax, eax
jne 0x406df4
lea eax, [ebp - 4]
lea edx, [ebp - 0x959]
mov ecx, 0x801
call fcn.00403238
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegOpenKeyA
cmp dword [ebp - 4], 0
je 0x406fa3
mov dword [ebp - 0x158], 0x80
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x960]
mov ecx, 0x407008
mov edx, dword [ebp - 4]
call fcn.004032c0
mov eax, dword [ebp - 0x960]
call fcn.00403438
push eax
call fcn.00404524
mov esi, eax
cmp esi, 0xffffffff
je 0x406fa3
lea eax, [ebp - 0x968]
push eax
lea eax, [ebp - 0x96c]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.00403238
mov edx, dword [ebp - 0x96c]
mov al, 0x2e
call fcn.004066b8
mov edx, 0x104
sub edx, eax
push edx
lea eax, [ebp - 0x970]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.00403238
mov edx, dword [ebp - 0x970]
mov al, 0x2e
call fcn.004066b8
inc eax
push eax
lea eax, [ebp - 0x974]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.00403238
mov eax, dword [ebp - 0x974]
pop edx
pop ecx
call fcn.0040347c
mov eax, dword [ebp - 0x968]
lea edx, [ebp - 0x964]
call fcn.00404ca8
mov eax, dword [ebp - 0x964]
mov edx, 0x407018
call fcn.00403384
jne 0x406f88
push dword [ebp - 4]
push 0x407024
lea eax, [ebp - 0x97c]
lea edx, [ebp - 0x12c]
mov ecx, 0x104
call fcn.00403238
push dword [ebp - 0x97c]
lea eax, [ebp - 0x978]
mov edx, 3
call fcn.00403334
mov eax, dword [ebp - 0x978]
lea ecx, [ebp - 8]
lea edx, [ebp - 0x18]
call fcn.004067f4
test bl, bl
jne 0x406f3b
cmp dword [ebp - 0x18], 0
jne 0x406f3b
xor eax, eax
jmp 0x406f3d
mov al, 1
mov ebx, eax
cmp dword [ebp - 0x18], 0
je 0x406f88
push 0x407030
lea edx, [ebp - 0x984]
mov eax, dword [ebp - 0x18]
call fcn.00406570
push dword [ebp - 0x984]
push 0x407044
push 0x407050
push dword [ebp - 8]
lea eax, [ebp - 0x980]
mov edx, 5
call fcn.00403334
mov edx, dword [ebp - 0x980]
mov eax, edi
call fcn.00405c80
lea eax, [ebp - 0x158]
push eax
push esi
call fcn.0040452c
test eax, eax
jne 0x406e47
push esi
call fcn.0040451c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406fd5
lea eax, [ebp - 0x984]
mov edx, 0xa
call fcn.004030f8
lea eax, [ebp - 8]
mov edx, 2
call fcn.004030f8
ret