joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4088b8
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push str.DeleteStartupReg
call fcn.004028a7
pop ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push 0x41a744
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408997
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x40890f
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x408914
cmp dword [ebp + 0xc], ebx
jne 0x40891f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408997
mov dword [ebp - 8], ebx
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x104
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
cmp edi, ebx
jne 0x408970
push dword [ebp + 0xc]
lea eax, [ebp - 0x114]
push eax
call fcn.00410050
test eax, eax
pop ecx
pop ecx
je 0x40897d
cmp edi, 0x103
je 0x40898d
inc dword [ebp - 8]
jmp 0x408923
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret

Function at 0x40899a
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push str.DeleteStartupRegW
call fcn.004028a7
pop ecx
lea eax, [ebp - 4]
push eax
push 0xf003f
xor ebx, ebx
push ebx
push 0x41a744
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x408a79
push dword [ebp + 8]
call fcn.0040ef55
test eax, eax
pop ecx
je 0x4089f1
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x4089f6
cmp dword [ebp + 0xc], ebx
jne 0x408a01
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x408a79
mov dword [ebp - 8], ebx
push edi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x104
push dword [ebp - 4]
mov dword [ebp - 0xc], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov edi, eax
cmp edi, ebx
jne 0x408a52
push dword [ebp + 0xc]
lea eax, [ebp - 0x114]
push eax
call fcn.00410050
test eax, eax
pop ecx
pop ecx
je 0x408a5f
cmp edi, 0x103
je 0x408a6f
inc dword [ebp - 8]
jmp 0x408a05
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
leave
ret
Function at 0x408a7c
Capabilities:
Delete file

Disassembly:
mov eax, 0x4193bb
call fcn.0040f528
sub esp, 0x164
push ebx
push str.DelOldIconRegFileW
call fcn.004028a7
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00407ceb
push dword [ebp + 0x10]
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00407ceb
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00407fe0
push eax
push str.SubKey
call fcn.00402932
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00407fe0
push eax
push str.Entry
call fcn.00402932
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x10]
call fcn.00407fe0
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
call fcn.00403e31
cmp dword [ebp - 0x28], ebx
mov byte [ebp - 4], 2
je 0x408c1f
push 0x41a32c
lea ecx, [ebp - 0x20]
call fcn.00407ceb
push 0x104
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00407fe0
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00403bc8
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00407659
lea ecx, [ebp - 0x1c]
call fcn.00407fe0
push eax
push str.csParam_n
call fcn.00402932
pop ecx
pop ecx
push 0x41a91c
lea ecx, [ebp - 0x1c]
call fcn.00407fe0
push eax
call fcn.00410050
cmp eax, ebx
pop ecx
pop ecx
jne 0x408b8b
push 0x41a918
lea ecx, [ebp - 0x1c]
call fcn.00407fe0
push eax
call fcn.00410050
cmp eax, ebx
pop ecx
pop ecx
je 0x408c13
push esi
mov esi, 0x41a914
push esi
push eax
call fcn.00410050
cmp eax, ebx
pop ecx
pop ecx
je 0x408c12
push edi
lea edi, [eax + 1]
push esi
push edi
call fcn.00410050
cmp eax, ebx
pop ecx
pop ecx
je 0x408c11
push edi
lea ecx, [ebp - 0x14]
mov byte [eax], bl
call fcn.00407ceb
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.00407fe0
push eax
push str.Path
call fcn.00402932
pop ecx
pop ecx
lea eax, [ebp - 0x170]
push eax
push ebx
lea ecx, [ebp - 0x14]
call fcn.004078da
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x408c05
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x14]
call fcn.00407fe0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00407659
pop edi
pop esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00407659
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00403bbd
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00407659
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407659
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x408c4f
Capabilities:
Delete file

Disassembly:
mov eax, 0x4193bb
call fcn.0040f528
sub esp, 0x164
push ebx
push str.DelOldIconRegFileW
call fcn.004028a7
pop ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.00407d89
push dword [ebp + 0x10]
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00407d89
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.00407fe0
push eax
push str.SubKey
call fcn.00402932
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
call fcn.00407fe0
push eax
push str.Entry
call fcn.00402932
pop ecx
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x10]
call fcn.00407fe0
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
call fcn.00403e31
cmp dword [ebp - 0x28], ebx
mov byte [ebp - 4], 2
je 0x408df2
push 0x41a32c
lea ecx, [ebp - 0x20]
call fcn.00407ceb
push 0x104
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.00407fe0
push eax
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x30]
call fcn.00403bc8
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 5
call fcn.00407659
lea ecx, [ebp - 0x1c]
call fcn.00407fe0
push eax
push str.csParam
call fcn.00402932
pop ecx
pop ecx
push 0x41a91c
lea ecx, [ebp - 0x1c]
call fcn.00407fe0
push eax
call fcn.00410050
cmp eax, ebx
pop ecx
pop ecx
jne 0x408d5e
push 0x41a918
lea ecx, [ebp - 0x1c]
call fcn.00407fe0
push eax
call fcn.00410050
cmp eax, ebx
pop ecx
pop ecx
je 0x408de6
push esi
mov esi, 0x41a914
push esi
push eax
call fcn.00410050
cmp eax, ebx
pop ecx
pop ecx
je 0x408de5
push edi
lea edi, [eax + 1]
push esi
push edi
call fcn.00410050
cmp eax, ebx
pop ecx
pop ecx
je 0x408de4
push edi
lea ecx, [ebp - 0x14]
mov byte [eax], bl
call fcn.00407ceb
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 6
call fcn.00407fe0
push eax
push str.Path
call fcn.00402932
pop ecx
pop ecx
lea eax, [ebp - 0x170]
push eax
push ebx
lea ecx, [ebp - 0x14]
call fcn.004078da
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x408dd8
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x14]
call fcn.00407fe0
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.00407659
pop edi
pop esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.00407659
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.00403bbd
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00407659
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407659
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4096aa
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
push edi
mov esi, 0x104
push esi
lea eax, [ebp - 0x108]
push 0
push eax
mov ebx, ecx
call fcn.0040eef0
lea edi, [ebx + 0x118]
mov eax, dword [edi]
add esp, 0xc
mov ecx, edi
call dword [eax + 0x14]
cmp eax, 1
push esi
jne 0x4096f7
cmp dword [0x41fd34], 0
lea eax, [ebp - 0x108]
push eax
lea ecx, [ebx + 8]
push 1
jmp 0x409709
lea ecx, [ebp - 0x108]
xor eax, eax
cmp dword [0x41fd34], eax
push ecx
mov ecx, edi
push eax
je 0x409718
call fcn.00407f85
push eax
call fcn.004069ac
jmp 0x409723
call fcn.00407f7d
push eax
call fcn.00406858
add esp, 0x10
cmp byte [ebp - 0x108], 0
jne 0x409733
xor eax, eax
jmp 0x409780
lea eax, [ebp - 4]
push eax
push 0xf003f
xor edi, edi
push edi
lea eax, [ebp - 0x108]
push eax
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, edi
jne 0x409779
push 4
push edi
push 4
push edi
push str.TrayIconEnable
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, edi
sete al
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409bff
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
push edi
push dword [ebp + 8]
push str.CMainFrame::StartExe_:_lpszCmdLine
call fcn.00402932
push 0x44
pop edi
push edi
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.0040eef0
add esp, 0x14
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 0x54], edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, esi
je 0x409c58
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x409c60
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
mov eax, 0x41947a
call fcn.0040f528
sub esp, 0x114
push ebx
push esi
push edi
push str.CMainFrame::UniChkDelPrn_:_start
mov esi, ecx
call fcn.004028a7
pop ecx
lea eax, [ebp - 0x10]
lea edi, [esi + 0x118]
push eax
mov ecx, edi
call fcn.00407fa3
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00407c9a
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.00407fe0
push eax
push str.PrinterName
call fcn.00402932
pop ecx
pop ecx
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.00407659
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00407659
xor eax, eax
inc eax
cmp dword [esi + 0x47c], eax
je 0x409e38
push str.enter_:_OpenPrinterW
mov dword [ebp - 0x1c], ebx
call fcn.004028a7
pop ecx
push ebx
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.00407f98
push eax
call sub.WINSPOOL.DRV_OpenPrinterW
push str.exit_:_OpenPrinterW
mov edi, eax
call fcn.004028a7
push edi
push str.result
call fcn.00402a6e
add esp, 0xc
cmp edi, 1
jne 0x409d2f
push dword [ebp - 0x1c]
call sub.WINSPOOL.DRV_ClosePrinter
xor eax, eax
inc eax
jmp 0x409e38
lea edi, [esi + 0x798]
mov eax, dword [edi]
cmp eax, ebx
je 0x409d4a
push eax
push dword [esi + 0x430]
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [edi], ebx
push str.Delete_Reg_HKCU_run
call fcn.004028a7
pop ecx
lea edi, [esi + 0x118]
mov ecx, edi
call fcn.00407f85
cmp word [eax], bx
mov ecx, edi
jne 0x409d6c
lea ecx, [esi + 8]
call fcn.00407f85
mov ecx, edi
mov dword [ebp - 0x10], eax
call fcn.00407f85
push dword [ebp - 0x10]
xor ecx, ecx
cmp word [eax], bx
push str.softwareMicrosoftWindowsCurrentVersionRun
sete cl
mov esi, 0x80000001
push esi
mov dword [ebp - 0x18], ecx
call fcn.00408c4f
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
push 0xf003f
push ebx
push 0x41a744
push esi
mov dword [ebp - 0x14], ebx
call edi
test eax, eax
jne 0x409dd0
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [ebp - 0x120]
push ebx
push eax
call fcn.0040eef0
push 0x104
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x18]
push dword [ebp - 0x10]
call fcn.004069ac
add esp, 0x1c
cmp dword [ebp - 0x18], ebx
mov eax, str.SoftwareEPSONSTM3STMDataEPNTarget
jne 0x409e0b
mov eax, str.SoftwareEPSONSTM3STMDataEPLTarget
lea ecx, [ebp - 0x14]
push ecx
push 0xf003f
push ebx
push eax
push esi
call edi
test eax, eax
jne 0x409e36
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40a09f
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
push ebx
push esi
push edi
xor ebx, ebx
mov edi, 0x104
push edi
lea eax, [ebp - 0x118]
push ebx
push eax
mov esi, ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.0040eef0
push edi
lea eax, [ebp - 0x320]
push ebx
push eax
call fcn.0040eef0
add esp, 0x18
cmp dword [0x41fd34], ebx
push ebx
push edi
lea ecx, [ebp - 0x118]
push ecx
lea ecx, [ebp - 0x10]
push ecx
lea eax, [esi + 0x14]
mov dword [ebp - 0x10], ebx
lea ecx, [esi + 8]
push eax
je 0x40a111
call fcn.00407f85
push eax
lea ecx, [esi + 0x118]
call fcn.00407f85
push eax
call fcn.00407569
jmp 0x40a128
call fcn.00407f7d
push eax
lea ecx, [esi + 0x118]
call fcn.00407f7d
push eax
call fcn.004074ef
add esp, 0x1c
cmp byte [ebp - 0x118], bl
je 0x40a14f
lea eax, [ebp - 0x118]
push eax
push edi
lea eax, [esi + 0x228]
push eax
call fcn.004010dd
test eax, eax
jne 0x40a247
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x118]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40a208
push str.TrayIconSelected
push edi
lea eax, [ebp - 0x21c]
push eax
call fcn.004010dd
test eax, eax
je 0x40a197
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a247
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x48c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push str.TrayIconEnable
push edi
lea eax, [ebp - 0x21c]
push eax
call fcn.004010dd
test eax, eax
jne 0x40a189
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0xc], ebx
push dword [ebp - 4]
mov dword [ebp - 0x14], eax
je 0x40a18c
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], ebx
je 0x40a24b
lea eax, [esi + 0x694]
cmp byte [eax], bl
je 0x40a24b
push eax
push ebx
push str.TrayIconSelected
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esi + 0x48c], eax
lea eax, [esi + 0x694]
push eax
push ebx
push str.TrayIconEnable
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
jne 0x40a24b
xor eax, eax
jmp 0x40a269
lea eax, [esi + 0x14]
push eax
lea eax, [esi + 0x124]
push eax
push edi
add esi, 0x590
push esi
call fcn.00404536
xor eax, eax
add esp, 0x10
inc eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a530
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
mov esi, ecx
xor ebx, ebx
push ebx
lea eax, [esi + 0x228]
push eax
push 0x80000001
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40a5af
push edi
lea eax, [ebp - 8]
push eax
lea edi, [esi + 0x48c]
push edi
push ebx
push ebx
push str.TrayIconSelected
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov dword [ebp - 0xc], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], ebx
jne 0x40a59d
push ebx
push dword [edi]
mov ecx, esi
call fcn.00409f03
push dword [esi + 0x430]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
pop edi
jmp 0x40a5b1
xor eax, eax
pop esi
pop ebx
leave
ret 8
Function at 0x40c449
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 0xc]
sub eax, 0x203
push ebx
push esi
push edi
mov esi, ecx
je 0x40c54b
dec eax
jne 0x40c561
call fcn.0040a5e9
test eax, eax
jne 0x40c48b
push 0
push 0
push 0x10
push dword [esi + 0x430]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
jmp 0x40c563
push dword [esi + 0x430]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x430]
call dword [sym.imp.USER32.dll_SetFocus]
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call edi
push 0x10
mov ebx, eax
call edi
push 0x20
mov dword [ebp + 0xc], eax
call edi
xor edi, edi
cmp bx, di
jge 0x40c4e1
cmp word [ebp + 0xc], di
jge 0x40c4e1
cmp ax, di
jge 0x40c4e1
push edi
push edi
push 0x10
push dword [esi + 0x430]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x40c561
lea eax, [ebp - 8]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push edi
push dword [esi + 0x434]
call dword [sym.imp.USER32.dll_GetSubMenu]
mov edi, dword [esi + 0x430]
mov ebx, dword [sym.imp.USER32.dll_GetWindowLongA]
mov dword [ebp + 0xc], eax
jmp 0x40c511
call dword [sym.imp.USER32.dll_GetParent]
mov edi, eax
push 0xfffffffffffffff0
push edi
call ebx
test eax, 0x40000000
push edi
jne 0x40c509
call dword [sym.imp.USER32.dll_DrawMenuBar]
xor ebx, ebx
push ebx
push edi
push ebx
push dword [ebp - 4]
push dword [ebp - 8]
push 2
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push ebx
push ebx
push ebx
push dword [esi + 0x430]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x40c561
mov ecx, esi
call fcn.0040a5e9
test eax, eax
je 0x40c471
mov ecx, esi
call fcn.0040b084
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x40ce56
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x41f0c8]
push esi
push edi
push 0x25
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x98]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x98]
push eax
xor esi, esi
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x40cea4
cmp dword [ebp - 0x94], 5
jb 0x40cea4
inc esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
call fcn.00410cf1
leave
ret
Function at 0x40db13
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push edi
mov edi, ecx
jne 0x40db2f
call fcn.0040daaa
xor eax, eax
jmp 0x40dbcd
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
push ebx
call esi
test eax, eax
mov dword [edi + 4], eax
jne 0x40db4d
mov ecx, edi
call fcn.0040daaa
xor eax, eax
jmp 0x40dbcc
push 3
push ebx
call esi
test eax, eax
mov dword [edi + 8], eax
je 0x40db42
push 5
push ebx
call esi
test eax, eax
mov dword [edi + 0xc], eax
je 0x40db42
push 8
push ebx
call esi
test eax, eax
mov dword [edi + 0x10], eax
je 0x40db42
push 0xa
push ebx
call esi
test eax, eax
mov dword [edi + 0x14], eax
je 0x40db42
push 0xc
push ebx
call esi
test eax, eax
mov dword [edi + 0x18], eax
je 0x40db42
push 0xe
push ebx
call esi
test eax, eax
mov dword [edi + 0x1c], eax
je 0x40db42
push 0x10
push ebx
call esi
test eax, eax
mov dword [edi + 0x20], eax
je 0x40db42
push 0x12
push ebx
call esi
test eax, eax
mov dword [edi + 0x24], eax
je 0x40db42
push 7
push ebx
call esi
test eax, eax
mov dword [edi + 0x28], eax
je 0x40db42
push 0x14
push ebx
call esi
test eax, eax
mov dword [edi + 0x2c], eax
je 0x40db42
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
pop ebp
ret 4

Function at 0x40dc5d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
push edi
mov edi, ecx
jne 0x40dc79
call fcn.0040dbfa
xor eax, eax
jmp 0x40dcfb
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 2
push ebx
call esi
test eax, eax
mov dword [edi + 4], eax
jne 0x40dc97
mov ecx, edi
call fcn.0040dbfa
xor eax, eax
jmp 0x40dcfa
push 4
push ebx
call esi
test eax, eax
mov dword [edi + 8], eax
je 0x40dc8c
push 6
push ebx
call esi
test eax, eax
mov dword [edi + 0xc], eax
je 0x40dc8c
push 9
push ebx
call esi
test eax, eax
mov dword [edi + 0x10], eax
je 0x40dc8c
push 0xb
push ebx
call esi
test eax, eax
mov dword [edi + 0x14], eax
je 0x40dc8c
push 0xd
push ebx
call esi
test eax, eax
mov dword [edi + 0x18], eax
je 0x40dc8c
push 0xf
push ebx
call esi
test eax, eax
mov dword [edi + 0x1c], eax
je 0x40dc8c
push 0x11
push ebx
call esi
test eax, eax
mov dword [edi + 0x20], eax
je 0x40dc8c
push 0x13
push ebx
call esi
test eax, eax
mov dword [edi + 0x24], eax
je 0x40dc8c
xor eax, eax
inc eax
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x40e01f
Capabilities:
Read .ini file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x90
mov eax, dword [0x41f0c8]
push ebx
mov ebx, ecx
mov dword [ebp - 4], eax
mov eax, dword [ebx + 8]
test eax, eax
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x8c], ebx
mov dword [ebp - 0x90], esi
jne 0x40e1bb
test esi, esi
je 0x40e059
cmp word [esi], ax
jne 0x40e060
xor eax, eax
jmp 0x40e1bb
push edi
push esi
mov ecx, ebx
call fcn.0040dede
mov edx, eax
test edx, edx
je 0x40e12c
push 0x20
pop ecx
push edx
xor eax, eax
push 0x40
lea edi, [ebp - 0x84]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x84]
push eax
push 0x41a888
push 0x41b57c
push 0x41b530
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov edi, eax
test edi, edi
jbe 0x40e12c
mov eax, dword [ebx + 4]
test eax, eax
mov dword [ebp - 0x88], eax
jne 0x40e0c8
push esi
mov ecx, ebx
call fcn.0040ddef
test eax, eax
mov dword [ebp - 0x88], eax
je 0x40e116
push dword [ebp - 0x88]
call fcn.0040d8df
lea edi, [eax + edi + 2]
lea eax, [edi + edi]
push eax
call fcn.0040d855
mov esi, eax
test esi, esi
je 0x40e116
lea eax, [ebp - 0x84]
push eax
push dword [ebp - 0x88]
push 0x41b504
push edi
push esi
call fcn.00405167
add esp, 0x14
test eax, eax
je 0x40e10e
push esi
call fcn.0040d74e
xor esi, esi
test esi, esi
jne 0x40e1b5
lea eax, [ebp - 0x84]
push eax
call fcn.0040d967
mov esi, eax
test esi, esi
jne 0x40e1b5
push 0x41b510
call fcn.0040d967
mov ebx, dword [ebx + 4]
test ebx, ebx
mov esi, eax
jne 0x40e156
push dword [ebp - 0x90]
mov ecx, dword [ebp - 0x8c]
call fcn.0040ddef
mov ebx, eax
test ebx, ebx
je 0x40e1af
push ebx
call fcn.0040d8df
mov edi, eax
push esi
inc edi
call fcn.0040d8df
lea edi, [edi + eax + 1]
cmp edi, 2
jbe 0x40e1af
lea eax, [edi + edi]
push eax
call fcn.0040d855
test eax, eax
mov dword [ebp - 0x88], eax
je 0x40e1af
push esi
push ebx
push 0x41b504
push edi
push eax
call fcn.00405167
add esp, 0x14
test eax, eax
jne 0x40e1a4
push esi
call fcn.0040d74e
mov esi, dword [ebp - 0x88]
jmp 0x40e1af
push dword [ebp - 0x88]
call fcn.0040d74e
mov ebx, dword [ebp - 0x8c]
mov dword [ebx + 8], esi
mov eax, esi
pop edi
mov ecx, dword [ebp - 4]
pop esi
pop ebx
call fcn.00410cf1
leave
ret 4