joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402257
Capabilities:
Delete file
Move file
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x9c70
call fcn.00403600
cmp dword [ebp + 8], 0
je 0x402297
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0xa14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0xa14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0xa14]
mov dword [ebp - 4], ecx
jmp 0x40229d
mov edx, dword [ebp + 0xc]
mov dword [ebp - 4], edx
lea eax, [ebp - 0xc64]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0xffffffff
je 0x4023ba
cmp dword [0x40db88], 1
jne 0x40239a
push 0x40d96c
lea edx, [ebp - 0x1464]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.wininit.ini
lea eax, [ebp - 0x1464]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 4]
push ecx
push str.NUL_s
lea edx, [ebp - 0x1c64]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x1c64]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - reloc.KERNEL32.dll_RtlUnwind], eax
lea ecx, [ebp - 0x1464]
push ecx
push 0x8000
lea edx, [ebp - 0x9c64]
push edx
push 0x40a4dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionW]
mov dword [ebp - 0x9c70], eax
mov eax, dword [ebp - 0x9c70]
lea ecx, [ebp + eax*2 - 0x9c64]
mov dword [ebp - 0x9c68], ecx
lea edx, [ebp - 0x1c64]
push edx
mov eax, dword [ebp - 0x9c68]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp - reloc.KERNEL32.dll_RtlUnwind]
mov edx, dword [ebp - 0x9c68]
mov word [edx + ecx*2 + 2], 0
lea eax, [ebp - 0x1464]
push eax
lea ecx, [ebp - 0x9c64]
push ecx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileSectionW]
mov dword [ebp - 8], eax
jmp 0x4023ab
push 4
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x4023c1
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x402514
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x104
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402537
xor eax, eax
jmp 0x4025d4
mov ecx, dword [ebp + 8]
push ecx
call fcn.00401b4f
add esp, 4
push 0x104
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40255f
xor eax, eax
jmp 0x4025d4
mov eax, dword [ebp + 0xc]
push eax
call fcn.00401b4f
add esp, 4
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40a4fc
mov eax, dword [ebp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00401b4f
add esp, 4
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [0x40db88], 2
je 0x4025b4
cmp dword [0x40db88], 3
jne 0x4025cf
push str.Drivers
mov ecx, dword [ebp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov edx, dword [ebp + 0x14]
push edx
call fcn.00401b4f
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4029f3
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe24
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x218]
push edx
call fcn.00401b4f
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40abb0
lea edx, [ebp - 0x218]
push edx
call fcn.004039a8
add esp, 8
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x402b6f
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x220]
push eax
push 0x800
lea ecx, [ebp - 0xe20]
push ecx
call fcn.0040393d
add esp, 0xc
test eax, eax
je 0x402b60
push 0x40abb4
lea edx, [ebp - 0xe20]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x402ab3
mov dword [ebp - 0xc], 1
push str.COMPANYKEY_IBM__n
lea eax, [ebp - 0xe20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x402ad0
mov dword [ebp - 0x10], 1
push 0x400
lea ecx, [ebp - 0xe20]
push ecx
lea edx, [ebp - 0x620]
push edx
call fcn.00403760
add esp, 0xc
push str.IBM3780
lea eax, [ebp - 0x620]
push eax
call fcn.004036e0
add esp, 8
test eax, eax
jne 0x402b33
push str.IBM3781
lea ecx, [ebp - 0x620]
push ecx
call fcn.004036e0
add esp, 8
test eax, eax
jne 0x402b33
push str.IBM0057
lea edx, [ebp - 0x620]
push edx
call fcn.004036e0
add esp, 8
test eax, eax
je 0x402b3d
mov dword [ebp - 0x21c], 1
cmp dword [ebp - 0xc], 0
je 0x402b5b
cmp dword [ebp - 0x10], 0
je 0x402b5b
cmp dword [ebp - 0x21c], 0
je 0x402b5b
mov dword [ebp - 4], 1
jmp 0x402b60
jmp 0x402a73
mov eax, dword [ebp - 0x220]
push eax
call fcn.00403689
add esp, 4
cmp dword [ebp - 4], 0
je 0x402be1
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x40ac30
lea edx, [ebp - 0x218]
push edx
call fcn.004034d0
add esp, 8
mov dword [ebp - 0xe24], eax
cmp dword [ebp - 0xe24], 0
jne 0x402bbf
push str..INF
lea eax, [ebp - 0x218]
push eax
call fcn.004034d0
add esp, 8
mov dword [ebp - 0xe24], eax
cmp dword [ebp - 0xe24], 0
je 0x402be1
mov ecx, dword [ebp - 0xe24]
mov word [ecx + 2], 0x70
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x402ca9
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1060
call fcn.00403600
mov dword [ebp - 4], 1
cmp dword [0x40db88], 2
je 0x402ccf
cmp dword [0x40db88], 3
jne 0x402ce9
push 1
push str.SeShutdownPrivilege
call fcn.0040127c
add esp, 8
test eax, eax
jne 0x402ce9
xor eax, eax
jmp 0x402f0d
cmp dword [0x40db80], 0
je 0x402d03
push 0
push 0
push 0
call dword [0x40db80]
jmp 0x402f0a
cmp dword [0x40db88], 1
jne 0x402f0a
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x818]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x818]
push edx
call fcn.00401b4f
add esp, 4
push 0x40ac70
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x40ac88
lea ecx, [ebp - 0x818]
push ecx
call fcn.004039a8
add esp, 8
mov dword [ebp - 0x860], eax
cmp dword [ebp - 0x860], 0
je 0x402f0a
push str._Version__n
mov edx, dword [ebp - 0x860]
push edx
call fcn.00403a58
add esp, 8
push str.Signature_CHICAGO__n
mov eax, dword [ebp - 0x860]
push eax
call fcn.00403a58
add esp, 8
push str.ClassMouse_n
mov ecx, dword [ebp - 0x860]
push ecx
call fcn.00403a58
add esp, 8
push str.ClassGUID4D36E96F_E325_11CE_BFC1_08002BE10318_n
mov edx, dword [ebp - 0x860]
push edx
call fcn.00403a58
add esp, 8
push str.ProviderIBM_Corporation_n
mov eax, dword [ebp - 0x860]
push eax
call fcn.00403a58
add esp, 8
push 0x40ad10
mov ecx, dword [ebp - 0x860]
push ecx
call fcn.00403a58
add esp, 8
push str._DefaultUninstall__n
mov edx, dword [ebp - 0x860]
push edx
call fcn.00403a58
add esp, 8
push str.DelFilesTrackPoint.UsrDel_n
mov eax, dword [ebp - 0x860]
push eax
call fcn.00403a58
add esp, 8
push 0x40ad44
mov ecx, dword [ebp - 0x860]
push ecx
call fcn.00403a58
add esp, 8
push str._TrackPoint.UsrDel__n
mov edx, dword [ebp - 0x860]
push edx
call fcn.00403a58
add esp, 8
push str.daemon.exe___00000001_n
mov eax, dword [ebp - 0x860]
push eax
call fcn.00403a58
add esp, 8
push 0x40ad78
mov ecx, dword [ebp - 0x860]
push ecx
call fcn.00403a58
add esp, 8
push str._DestinationDirs__n
mov edx, dword [ebp - 0x860]
push edx
call fcn.00403a58
add esp, 8
push str.TrackPoint.UsrDel11_n
mov eax, dword [ebp - 0x860]
push eax
call fcn.00403a58
add esp, 8
mov ecx, dword [ebp - 0x860]
push ecx
call fcn.00403689
add esp, 4
push str.tp4boot.dat
mov edx, dword [ebp + 8]
push edx
call fcn.00402257
add esp, 8
push str.rundll_setupx.dll_InstallHinfSection_DefaultUninstall_132
lea eax, [ebp - 0x1060]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0x818]
push ecx
lea edx, [ebp - 0x1060]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x44
push 0
lea eax, [ebp - 0x85c]
push eax
call fcn.00403a00
add esp, 0xc
mov dword [ebp - 0x85c], 0x44
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x85c]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1060]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x403025
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0x40db80
call fcn.00402ff3
add esp, 4
push 0x40db8c
call fcn.00402ff3
add esp, 4
push 0x40d964
call fcn.00402ff3
add esp, 4
push 0x40db7c
call fcn.00402ff3
add esp, 4
push 0x40d968
call fcn.00402ff3
add esp, 4
push 0x40e39c
call fcn.00402ff3
add esp, 4
push 0x40d960
call fcn.00402ff3
add esp, 4
push 0x40db78
call fcn.00402ff3
add esp, 4
push 0x40e394
call fcn.00402ff3
add esp, 4
push 0x40e398
call fcn.00402ff3
add esp, 4
push 0x40db84
call fcn.00402ff3
add esp, 4
push 0x40db74
call fcn.00402ff3
add esp, 4
push str.setupapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x40e3a0], eax
cmp dword [0x40e3a0], 0
jne 0x4030e2
jmp 0x403208
push str.SetupPromptReboot
mov eax, dword [0x40e3a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40db80], eax
push str.SetupDiEnumDeviceInfo
mov ecx, dword [0x40e3a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40e390], eax
push str.SetupDiDeleteDeviceInfo
mov edx, dword [0x40e3a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40d968], eax
push str.SetupDiDestroyDeviceInfoList
mov eax, dword [0x40e3a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40e39c], eax
push str.SetupDiCallClassInstaller
mov ecx, dword [0x40e3a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40d964], eax
push str.SetupDiBuildDriverInfoList
mov edx, dword [0x40e3a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40db8c], eax
push str.SetupDiClassGuidsFromNameW
mov eax, dword [0x40e3a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40db7c], eax
push str.SetupDiGetClassDevsW
mov ecx, dword [0x40e3a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40db78], eax
push str.SetupDiGetDeviceRegistryPropertyW
mov edx, dword [0x40e3a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40e398], eax
push str.SetupDiGetDeviceInstallParamsW
mov eax, dword [0x40e3a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40e394], eax
push str.SetupDiSetDeviceInstallParamsW
mov ecx, dword [0x40e3a0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40db84], eax
push str.SetupDiSetSelectedDriverW
mov edx, dword [0x40e3a0]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40db74], eax
push str.SetupDiEnumDriverInfoW
mov eax, dword [0x40e3a0]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x40d960], eax
pop ebp
ret
Function at 0x406585
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40d1a8
cmp edx, dword [eax]
je 0x4065a7
add eax, 8
inc ecx
cmp eax, 0x40d238
jl 0x406598
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40d1a8]
jne 0x4066d5
mov eax, dword [0x40e3ac]
cmp eax, 1
je 0x4066af
test eax, eax
jne 0x4065d8
cmp dword [0x40b0b4], 1
je 0x4066af
cmp edx, 0xfc
je 0x4066d5
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40660f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407e40
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407730
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x406652
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407730
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4094f4
push edi
call fcn.004082f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407e40
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407e50
lea eax, [ebp - 0xa0]
push 0x4094d4
push eax
call fcn.00407e50
push dword [esi + 0x40d1ac]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407e50
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408265
add esp, 0x2c
pop edi
jmp 0x4066d5
lea eax, [ebp + 8]
lea esi, [esi + 0x40d1ac]
push 0
push eax
push dword [esi]
call fcn.00407730
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
sub eax, 0x407245
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
jl 0x432030
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43201e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219

Function at 0x1114738
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01114888
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x111475e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x111474a
add dl, dl
jne 0x1114769
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x11147bc
xor eax, eax
add dl, dl
jne 0x1114776
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x111485d
add dl, dl
jne 0x1114785
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1114790
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x111479b
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11147a6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x11147b2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1114755
mov eax, 1
add dl, dl
jne 0x11147ca
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x11147d5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11147c1
sub eax, ebx
mov ebx, 1
jne 0x1114808
mov ecx, 1
add dl, dl
jne 0x11147ee
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x11147f9
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x11147e5
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1114755
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x111481f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x111482a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1114816
cmp eax, 0x7d00
jae 0x111484d
cmp eax, 0x500
jb 0x1114848
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1114755
cmp eax, 0x7f
ja 0x1114850
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1114755
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x111487e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1114755
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x40149d
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x7c7170]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401532
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014ef
cmp dword [ebp + 0x10], ebx
jne 0x401526
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.0040149d
test eax, eax
jne 0x401501
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d6
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00406004
cmp eax, ebx
je 0x401539
push ebx
push dword [0x7c7170]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401532
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x7c7170], ebx
jne 0x40152f
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x40152f
jmp 0x401532
Function at 0x4059cf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x7b9250
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x7b9250], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405a0a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405bab
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405bc8
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x405bcb
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x405bfa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405c3e
test edi, edi
jne 0x405c05
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x405c38

Function at 0x405c42
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405cb3
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x2004
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405ca2
cmp dword [ebp + 0x14], 1
je 0x405ca4
cmp dword [ebp + 0x14], 2
je 0x405ca4
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x2003], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x405e23
Capabilities:
Check if file exists
Get file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x405e48
mov eax, dword [0x40a058]
cmp eax, 0xffffffff
je 0x405e3f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [0x40a058], 0xffffffff
jmp 0x405ec5
cmp dword [0x7be3e8], ebx
je 0x405ec5
push esi
cmp byte [0x7c2c20], bl
je 0x405e90
cmp dword [0x40a058], 0xffffffff
jne 0x405e99
mov esi, 0x7c2c20
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push 4
push 0x40000000
push esi
call fcn.00405bcb
mov dword [0x40a058], eax
cmp eax, 0xffffffff
je 0x405ec4
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [0x40a058], 0xffffffff
je 0x405ec4
push 0x408d44
mov esi, 0x7be400
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
lea ecx, [ebp + 8]
push ecx
push eax
push esi
push dword [0x40a058]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
pop ebp
ret 4
Function at 0x406432
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x7b9298
push esi
call fcn.00405d59
push esi
call fcn.00405adc
mov edi, eax
test edi, edi
jne 0x406453
xor eax, eax
jmp 0x4064ab
push edi
call fcn.00405d88
test byte [0x7c70e8], 0x80
je 0x40646c
mov al, byte [edi]
test al, al
je 0x40644f
cmp al, 0x5c
je 0x40644f
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x40648c
push esi
call fcn.00405fdd
test eax, eax
je 0x406486
test byte [eax], 0x10
je 0x4064b0
push esi
call fcn.0040640b
push esi
call ebx
cmp eax, edi
jg 0x406477
push esi
call fcn.004063de
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4064aa
Function at 0x40670f
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x408eb4
mov edi, 0x7bb2a0
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebx, 0x400
test esi, esi
je 0x40675e
push 1
push 0
push esi
call fcn.00405bcb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x40689b
cmp eax, ebx
jg 0x40689b
push ebx
mov esi, 0x7bdbe8
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x40689b
cmp eax, ebx
jg 0x40689b
push esi
push edi
push str._s_s_r_n
push 0x7bb7e0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x7c7094]
push dword [eax + 0x128]
push esi
call fcn.004064b4
push 4
push 0xc0000000
push esi
call fcn.00405bcb
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, 0xffffffff
je 0x40689b
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406894
push 0
lea eax, [esp + 0x14]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406894
cmp edi, dword [esp + 0x10]
jne 0x406894
push str._Rename__r_n
push esi
call fcn.00405b31
test eax, eax
jne 0x406826
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x40685f
push 0x408ea8
add eax, 0xa
push eax
call fcn.00405b31
mov ebp, eax
test ebp, ebp
je 0x40685b
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x406850
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x406846
sub ebp, esi
lea eax, [ebp + 1]
mov ebp, dword [esp + 0x1c]
jmp 0x406861
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
push 0x7bb7e0
add eax, esi
push eax
call fcn.00405b87
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret