joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e70
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x234
push esi
push edi
mov ecx, 9
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x35]
mov byte [esp + 0x34], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x240]
xor ecx, ecx
xor edx, edx
mov esi, dword [sym.imp.MSVCRT.dll_sprintf]
mov cl, byte [eax + 0xf]
mov dl, byte [eax + 0xe]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xd]
mov dl, byte [eax + 0xc]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 0xb]
mov dl, byte [eax + 0xa]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cl, byte [eax + 9]
mov dl, byte [eax + 8]
push ecx
push edx
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 6]
mov dx, word [eax + 4]
mov eax, dword [eax]
push ecx
push edx
push eax
lea ecx, [esp + 0x38]
push str._08X__04X__04X__02X_02X__02X_02X_02X_02X_02X_02X
push ecx
call esi
lea edx, [esp + 0x40]
push str.InprocServer32
push edx
push str.CLSID
lea eax, [esp + 0x74]
push 0x40a6e4
push eax
call esi
add esp, 0x48
lea ecx, [esp + 8]
lea edx, [esp + 0x34]
mov dword [esp + 8], 0
push ecx
push 0x20019
push 0
push edx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
je 0x402f4e
xor eax, eax
add esp, 0x234
ret 0xc
mov ecx, dword [esp + 0x23c]
mov edx, dword [esp]
lea eax, [esp + 0x240]
push eax
push ecx
push 0
push 0
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402f89
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 0x234
ret 0xc
mov eax, 1
add esp, 0x234
ret 0xc

Function at 0x403480
Capabilities:
Create process on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x54
test edx, edx
je 0x4034f8
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 4]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x14]
push ecx
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x4034f8
mov ecx, dword [esp]
push esi
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 8]
push eax
call esi
pop esi
add esp, 0x54
ret 4
Function at 0x405210
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
test ebx, ebx
push edi
jne 0x405225
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push str.Res_Debugview
push 0xa7
mov eax, dword [eax + 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
jne 0x40524e
pop edi
pop esi
pop ebp
pop ebx
ret 4
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
mov ecx, dword [eax + 0x6c]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x40526c
pop edi
pop esi
pop ebp
pop ebx
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
test ebp, ebp
jne 0x405280
pop edi
pop esi
pop ebp
pop ebx
ret 4
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
push esi
mov edx, dword [eax + 0x6c]
push edx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
jne 0x4052a0
pop edi
pop esi
pop ebp
pop ebx
ret 4
push 0
push 0
push 2
push 0
push 0
push 0xc0000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4052c6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
xor esi, esi
cmp edi, esi
mov dword [esp + 0x14], esi
jbe 0x4052fb
mov ecx, edi
lea eax, [esp + 0x14]
push 0
sub ecx, esi
push eax
lea edx, [esi + ebp]
push ecx
push edx
push ebx
mov dword [esp + 0x28], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4052fb
add esi, dword [esp + 0x14]
cmp esi, edi
jb 0x4052d0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4

Function at 0x405310
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea ecx, [esp + 4]
lea edx, [esp + 0x14]
mov dword [esp + 0xc], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
push eax
mov eax, dword [esp + 0x80]
push eax
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x40537e
mov ecx, dword [esp + 4]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 4]
push edx
call esi
mov eax, 1
pop esi
add esp, 0x54
ret 4
xor eax, eax
add esp, 0x54
ret 4
Function at 0x4b2e60
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x70000]
push edi
jmp 0x4b2e7a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4b2e81
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2e70
mov eax, 1
add ebx, ebx
jne 0x4b2e93
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4b2ea4
jne 0x4b2ec3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2ec3
dec eax
add ebx, ebx
jne 0x4b2eb0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4b2e88
add ebx, ebx
jne 0x4b2ebf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4b2f15
xor ecx, ecx
sub eax, 3
jb 0x4b2edb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4b2f4a
sar eax, 1
mov ebp, eax
jmp 0x4b2ee6
add ebx, ebx
jne 0x4b2ee6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2eb4
inc ecx
add ebx, ebx
jne 0x4b2ef4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4b2eb4
add ebx, ebx
jne 0x4b2f01
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4b2ef6
jne 0x4b2f12
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4b2ef6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4b2f34
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4b2f26
jmp 0x4b2e76
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4b2f34
add edi, ecx
jmp 0x4b2e76
pop esi
mov edi, esi
mov ecx, 0x379b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4b2f52
cmp byte [edi], 0x13
jne 0x4b2f52
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4b2f57
lea edi, [esi + 0xae000]
mov eax, dword [edi]
or eax, eax
je 0x4b2fcf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb4ae8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb4c3c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4b2f84
mov ecx, edi
jns 0x4b2fb3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb4c40]
or eax, eax
je 0x4b2fc9
mov dword [ebx], eax
add ebx, 4
jmp 0x4b2fa1
call dword [esi + 0xb4c50]
mov ebp, dword [esi + 0xb4c44]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4b3003
sub esp, 0xffffff80
jmp 0x4165c1
Function at 0x40281c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x478
push esi
lea eax, [ebp - 0x278]
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionRun
mov esi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
mov edx, 0x20019
push 0
push eax
lea ecx, [ebp - 0x278]
call fcn.00406b4f
test eax, eax
jne 0x4028d9
lea eax, [ebp - 0x174]
push 0x104
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x174]
push 0x5c
push eax
call fcn.00411110
pop ecx
test eax, eax
pop ecx
je 0x402884
inc eax
jmp 0x40288a
lea eax, [ebp - 0x174]
lea ecx, [ebp - 0x70]
push ecx
push str.__._
push eax
call fcn.004110d0
add esp, 0xc
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x200
push eax
lea eax, [ebp - 0x478]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x70]
push 0
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
push dword [ebp - 4]
jne 0x4028d3
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x4028db
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
leave
ret

Function at 0x4028de
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push esi
push edi
lea eax, [ebp - 0x270]
push str.HKLMSoftwareMicrosoftWindowsCurrentVersionRun
mov esi, edx
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 4]
mov edx, 0xf003f
push 0
push eax
lea ecx, [ebp - 0x270]
call fcn.00406b4f
test eax, eax
jne 0x402998
lea eax, [ebp - 0x16c]
push 0x104
push eax
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x16c]
push 0x5c
push eax
call fcn.00411110
mov esi, eax
pop ecx
test esi, esi
pop ecx
je 0x402947
inc esi
jmp 0x40294d
lea esi, [ebp - 0x16c]
lea eax, [ebp - 0x68]
push eax
push str.__._
push esi
call fcn.004110d0
add esp, 0xc
push 0x21f
push edi
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
test eax, eax
je 0x40297d
mov ecx, dword [ebp - 4]
push esi
lea edx, [ebp - 0x68]
call fcn.00406eba
jmp 0x40298a
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x40299a
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x402a33
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
xor edi, edi
mov esi, edx
push edi
push str.TxtAbtInfo
push edi
mov edx, 0x1f6
mov ecx, esi
call fcn.00405e8f
mov ecx, esi
push edi
push 0x41b3d8
push edi
push 1
pop edx
call fcn.00405e8f
mov ecx, esi
push edi
push 0x41b3d0
push edi
push 2
pop edx
call fcn.00405e8f
mov ecx, esi
mov edx, str.DlgAbt
pop edi
pop esi
jmp fcn.004061d4
Function at 0x402c1e
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
xor edi, edi
push edi
push str.TxtOK
push 0x41b3d8
push 1
mov esi, edx
pop ebx
mov edx, ebx
mov ecx, esi
call fcn.00405e8f
mov ecx, esi
push edi
push str.TxtCancel
push 0x41b3d0
push 2
pop edx
call fcn.00405e8f
mov ecx, esi
push edi
push str.MTxtApply
push 0x41b4e8
push 3
pop edx
call fcn.00405e8f
mov edx, 0x213
mov ecx, esi
push ebx
push str.MTxOptResMenu
push edi
call fcn.00405e8f
cmp dword [0x420864], 0x200
push edi
jge 0x402c8d
push str.TxOptAfter
jmp 0x402c92
push str.TxOptAfter2K
push edi
mov edx, 0x21d
mov ecx, esi
call fcn.00405e8f
mov edx, 0x214
mov ecx, esi
push ebx
push str.TxOptRestart
push edi
call fcn.00405e8f
mov edx, 0x216
mov ecx, esi
push ebx
push str.TxOptApply
push edi
call fcn.00405e8f
mov edx, 0x218
mov ecx, esi
push ebx
push str.TxOptAsk
push edi
call fcn.00405e8f
mov edx, 0x21a
mov ecx, esi
push ebx
push str.MTxOptShowUt
push edi
call fcn.00405e8f
mov edx, 0x21c
mov ecx, esi
push edi
push str.MTxOptUtItems
push edi
call fcn.00405e8f
mov edx, 0x220
mov ecx, esi
push ebx
push str.MTxOptShIconMenu
push edi
call fcn.00405e8f
mov edx, 0x224
mov ecx, esi
push ebx
push str.MTxOptShBanner
push edi
call fcn.00405e8f
mov edx, 0x21f
mov ecx, esi
push ebx
push str.MTxOptLoad
push edi
call fcn.00405e8f
mov edx, 0x226
mov ecx, esi
push 3
push str.MTxOptChkEvry
push edi
call fcn.00405e8f
mov edx, 0x22a
mov ecx, esi
push ebx
push str.MTxOptChkSec
push edi
call fcn.00405e8f
mov edx, 0x403
mov ecx, esi
push ebx
push str.MTxOptMChromeChk
push edi
call fcn.00405e8f
mov ecx, esi
mov edx, str.DlgOpt
pop edi
pop esi
pop ebx
jmp fcn.004061d4
Function at 0x40350c
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
mov edi, ecx
lea edx, [ebp - 0x10]
mov dword [ebp - 0x14], edi
mov eax, dword [edi + 0xe00]
mov dword [ebp - 0x1c], eax
imul eax, eax, 0x1a8
lea ecx, [eax + edi + 0xbc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x20], ecx
call fcn.00407652
mov eax, dword [ebp - 8]
mov dword [ebp - 4], str._N__m__L
mov dword [edi + 0xe60], eax
add edi, 0x1598
push 0x420540
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
cmp byte [str._N__m__L], 0
je 0x40371d
push ebx
push esi
mov esi, 0x104
mov ebx, 0x80
mov edx, dword [ebp - 4]
mov al, byte [edx]
cmp al, 0x24
jne 0x4036da
mov al, byte [edx + 1]
inc edx
cmp al, 0x62
mov dword [ebp - 4], edx
jne 0x4035b4
push dword [ebp - 8]
push str._d_bpp
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
jmp 0x4036bb
cmp al, 0x64
jne 0x4035ec
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0xb4], 2
jb 0x4036d5
push ebx
push str.Display__d
mov edx, str.MTxMonitor
lea ecx, [ebp - 0x120]
call fcn.004058a6
mov eax, dword [ebp - 0x1c]
inc eax
push eax
lea eax, [ebp - 0x120]
push eax
jmp 0x40359f
cmp al, 0x44
jne 0x4035f9
mov edx, dword [ebp - 0x20]
push esi
jmp 0x4036ce
cmp al, 0x4c
jne 0x403617
mov edx, ebx
lea ecx, [ebp - 0xa0]
call fcn.00403727
test eax, eax
je 0x4036d5
jmp 0x4036bb
cmp al, 0x6d
jne 0x403653
push ebx
push str._dx_d___d_bpp_
mov edx, str.TxMode
lea ecx, [ebp - 0x120]
call fcn.004058a6
lea eax, [ebp - 0x120]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
jmp 0x4036bb
cmp al, 0x4e
jne 0x403676
push ebx
push str.S3TrayPlus_utility
mov edx, str.TrayIconName
lea ecx, [ebp - 0x120]
call fcn.004058a6
lea edx, [ebp - 0x120]
push esi
jmp 0x4036ce
cmp al, 0x6e
jne 0x403682
push esi
mov edx, 0x41bad0
jmp 0x4036ce
cmp al, 0x72
jne 0x4036a3
push dword [ebp - 0xc]
lea eax, [ebp - 0xa0]
push dword [ebp - 0x10]
push str._dx_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x4036bb
cmp al, 0x75
jne 0x4036c4
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
push eax
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push esi
lea edx, [ebp - 0xa0]
jmp 0x4036ce
cmp al, 0x24
jne 0x4036d5
push esi
mov edx, 0x41b5c0
mov ecx, edi
call fcn.0040345f
inc dword [ebp - 4]
jmp 0x40370f
xor ecx, ecx
test al, al
je 0x4036f9
cmp al, 0x24
je 0x4036f9
cmp ecx, 0x7f
jae 0x4036f9
inc edx
mov byte [ebp + ecx - 0x120], al
mov dword [ebp - 4], edx
inc ecx
mov al, byte [edx]
jmp 0x4036dc
and byte [ebp + ecx - 0x120], 0
push esi
lea edx, [ebp - 0x120]
mov ecx, edi
call fcn.0040345f
mov eax, dword [ebp - 4]
cmp byte [eax], 0
jne 0x40357f
pop esi
pop ebx
mov ecx, edi
call fcn.00406f60
pop edi
leave
ret
Function at 0x403a59
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov esi, ecx
call fcn.00406223
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, 0x200
lea ecx, [ebp - 0x218]
push eax
mov edx, ebx
call fcn.004038c0
mov edi, eax
cmp byte [edi], 0
je 0x403c64
push edi
mov edx, ebx
lea ecx, [ebp - 0x218]
call fcn.004038c0
cmp byte [ebp - 0x218], 0x2f
mov edi, eax
je 0x403ab5
cmp byte [ebp - 0x218], 0x2d
jne 0x403a8a
lea eax, [ebp - 0x217]
push str.startutil
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403c20
lea eax, [ebp - 0x217]
push str.invokeutil
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x403c20
lea eax, [ebp - 0x217]
push str.exit
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403b12
or dword [esi + 0xe4c], 0xffffffff
mov dword [esi + 0x60], 1
jmp 0x403a8a
lea eax, [ebp - 0x217]
push str.setdisplay
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403b79
cmp byte [edi], al
je 0x403c64
push edi
mov edx, ebx
lea ecx, [ebp - 0x218]
call fcn.004038c0
mov edi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x218]
push 0x41b720
push eax
call fcn.004110d0
add esp, 0xc
cmp eax, 1
jne 0x403a8a
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 4], 0
mov dword [esi + 0x5c], eax
je 0x403a8a
push eax
push 2
jmp 0x403c50
lea eax, [ebp - 0x217]
push str.setres
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x403a8a
cmp byte [edi], al
je 0x403c64
push edi
mov edx, ebx
lea ecx, [ebp - 0x218]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x18], eax
call fcn.004038c0
mov edi, eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x218]
push str._dx_dx_d__d
push eax
call fcn.004110d0
add esp, 0x18
cmp eax, 2
jl 0x403a8a
cmp dword [ebp - 4], 0
je 0x403c03
movzx eax, word [ebp - 8]
movzx ecx, word [ebp - 0xc]
shl eax, 0x10
or eax, ecx
push eax
mov eax, dword [ebp - 0x10]
shl eax, 0x10
or al, 3
push eax
jmp 0x403c50
mov eax, dword [ebp - 0x10]
mov dword [0x420a58], eax
mov eax, dword [ebp - 0xc]
mov dword [0x420a54], eax
mov eax, dword [ebp - 8]
mov dword [0x420a50], eax
jmp 0x403a8a
cmp byte [edi], 0
je 0x403c64
push edi
mov edx, ebx
lea ecx, [ebp - 0x218]
call fcn.004038c0
lea ecx, [ebp - 0x218]
mov edi, eax
call fcn.00403975
cmp dword [ebp - 4], 0
mov dword [esi + 0x58], eax
je 0x403a8a
push eax
push 0
push dword [esi + 0xe54]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_PostMessageA]
jmp 0x403a8a
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4067dd
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
lea eax, [ebp - 0x114]
push 0x104
mov esi, edx
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp byte [ebp + eax - 0x115], 0x5c
je 0x406827
lea eax, [ebp - 0x114]
push 0x41bc80
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [esi + 0x2c], 0
je 0x406834
push 0x41b8d0
jmp 0x406839
push 0x41b100
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push str._s_sTrayp.cfg
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov edx, edi
mov ecx, 0x420878
call fcn.00404e53
push 1
pop eax
pop edi
pop esi
leave
ret

Function at 0x406a00
Capabilities:
Get common file path
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x83c
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
push 0x420540
mov esi, ecx
push edx
mov dword [ebp - 0xc], edx
call ebx
and dword [ebp - 4], 0
cmp byte [esi + 1], 0x3a
je 0x406a5b
lea eax, [ebp - 0x42c]
push 0x410
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x42c]
push 0x41bc80
push eax
call edi
lea eax, [ebp - 0x42c]
push esi
push eax
call edi
jmp 0x406a65
lea eax, [ebp - 0x42c]
push esi
push eax
call ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x42c]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
push esi
call fcn.0041101e
mov edi, eax
pop ecx
test edi, edi
je 0x406b3d
push edi
push esi
lea eax, [ebp - 0x42c]
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x406b33
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebp + 8]
movzx ecx, byte [eax + 2]
push ecx
movzx ecx, byte [eax + 3]
push ecx
movzx ecx, byte [eax]
movzx eax, byte [eax + 1]
push ecx
push eax
lea eax, [ebp - 0x83c]
push str.StringFileInfo_02x_02x_02x_02x_s
push eax
call esi
add esp, 0x1c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x83c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
mov dword [ebp - 4], eax
jne 0x406b2b
push dword [ebp + 8]
lea eax, [ebp - 0x83c]
push str.StringFileInfo040904E4_s
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x83c]
push eax
push edi
call sub.VERSION.dll_VerQueryValueA
mov dword [ebp - 4], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call ebx
push edi
call fcn.00410fb5
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x406eba
Capabilities:
Set registry value

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, edx
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [esp + 0x10]
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
ret 4

Function at 0x406ee6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
cmp dword [ebp + 8], 0
push esi
push edi
mov esi, edx
mov edi, ecx
je 0x406f02
push 0x41bce8
jmp 0x406f07
push 0x41bcec
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x100]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x100]
push eax
push 1
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
leave
ret 4