joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a2b3
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x447708
mov eax, dword fs:[0]
push eax
mov eax, 0x1040
call fcn.00428050
mov eax, dword [0x46053c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
mov esi, dword [ebp + 8]
call fcn.00401534
xor ecx, ecx
lea eax, [ebp - 0x1044]
push eax
push ecx
push dword [esi]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1044], ecx
call sub.msi.dll_MsiOpenProductW
test eax, eax
jne 0x40a463
push str.SELECT__Message__FROM__Error__WHERE_Error.Error
lea ecx, [ebp - 0x1048]
call fcn.004018b9
push 0xa
pop ecx
xor eax, eax
mov byte [ebp - 4], 1
push 0xa
lea edi, [ebp - 0x38]
rep stosd dword es:[edi], eax
push 0x14
lea eax, [ebp - 0x38]
push eax
push dword [ebp + 0xc]
call fcn.004352f6
lea eax, [ebp - 0x38]
push eax
call fcn.0042c48c
add esp, 0x14
lea ecx, [ebp - 0x1048]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.00403d5e
xor esi, esi
mov dword [ebp - 0x103c], esi
lea eax, [ebp - 0x1040]
mov byte [ebp - 4], 3
push eax
push dword [ebp - 0x1048]
mov dword [ebp - 0x1040], esi
push dword [ebp - 0x1044]
call sub.msi.dll_MsiEnumClientsA
test eax, eax
jne 0x40a42d
push esi
push dword [ebp - 0x1040]
call sub.msi.dll_MsiViewModify
test eax, eax
jne 0x40a42d
cmp dword [ebp - 0x103c], eax
je 0x40a3b7
push dword [ebp - 0x103c]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
lea eax, [ebp - 0x103c]
mov dword [ebp - 0x103c], esi
push eax
push dword [ebp - 0x1040]
call sub.msi.dll_MsiDatabaseIsTablePersistentA
test eax, eax
jne 0x40a42d
push 0x1000
lea eax, [ebp - 0x1038]
push esi
push eax
call fcn.00428c30
add esp, 0xc
mov dword [ebp - 0x104c], 0x800
lea eax, [ebp - 0x104c]
push eax
lea eax, [ebp - 0x1038]
push eax
push 1
push dword [ebp - 0x103c]
call sub.msi.dll_MsiRecordSetStreamA
test eax, eax
jne 0x40a42d
lea eax, [ebp - 0x1038]
push eax
call fcn.0042c48c
pop ecx
push eax
lea eax, [ebp - 0x1038]
mov ecx, ebx
push eax
call fcn.00401822
cmp dword [ebp - 0x103c], 0
je 0x40a441
push dword [ebp - 0x103c]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
cmp dword [ebp - 0x1040], 0
je 0x40a455
push dword [ebp - 0x1040]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0x1048]
lea ecx, [ecx - 0x10]
call fcn.004017a5
cmp dword [ebp - 0x1044], 0
je 0x40a477
push dword [ebp - 0x1044]
call sub.msi.dll_MsiConfigureFeatureFromDescriptorA
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00427b1a
leave
ret
Function at 0x40a491
Capabilities:
Read .ini file

Disassembly:
push 4
mov eax, 0x446727
call fcn.00427f6a
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call fcn.0040e19e
mov ecx, dword [ebp + 8]
push eax
call fcn.00401339
push 0x7d
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], 1
pop ebx
mov ecx, dword [ebp + 8]
add ebx, ebx
push ebx
call fcn.00401723
mov ecx, dword [ebp + 0x14]
push dword [ecx]
push ebx
push eax
mov eax, dword [ebp + 0x10]
push 0x44a2e8
push dword [eax]
mov eax, dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp + 8]
mov esi, eax
push 0xffffffffffffffff
call fcn.004017cb
lea ecx, [esi + 1]
cmp ebx, ecx
jbe 0x40a4c0
mov eax, dword [ebp + 8]
call fcn.00427f33
ret 0x10
Function at 0x40bf7b
Capabilities:
Delete file
Shutdown system

Disassembly:
push 0x28
mov eax, 0x4479ad
call fcn.00427f9e
mov ebx, ecx
xor edi, edi
cmp dword [ebx + 0xec], edi
jne 0x40c15e
cmp dword [ebx + 0xe4], edi
jne 0x40c15e
call fcn.0040e19e
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401339
mov dword [ebp - 4], edi
call fcn.0040e19e
push eax
lea ecx, [ebp - 0x28]
call fcn.00401339
mov byte [ebp - 4], 1
call fcn.0040e19e
push eax
lea ecx, [ebp - 0x30]
call fcn.00401339
mov esi, dword [ebx + 0x50]
mov byte [ebp - 4], 2
test esi, esi
jne 0x40bfe3
mov eax, edi
jmp 0x40bfea
push esi
call fcn.0042c48c
pop ecx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.00401822
mov ecx, dword [ebx + 0x11c]
test ecx, ecx
je 0x40c00c
call fcn.0040527b
mov esi, str.Adobe_Acrobat_Reader
test eax, eax
je 0x40c011
mov esi, str.Adobe_Acrobat
push esi
call fcn.0042c48c
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00401822
mov esi, dword [ebp - 0x28]
lea eax, [ebp - 0x34]
push 0x90
push eax
mov ecx, ebx
mov dword [ebx + 0x50], esi
call fcn.0040a505
push esi
push dword [eax]
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 3
push eax
call fcn.00401600
mov ecx, dword [ebp - 0x34]
add esp, 0xc
mov byte [ebp - 4], 2
lea ecx, [ecx - 0x10]
call fcn.004017a5
cmp dword [ebx + 0x174], edi
mov esi, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
jne 0x40c143
cmp dword [ebx + 0x170], 0
je 0x40c08e
push 0
push 0x10024
push esi
call fcn.004087e5
add esp, 0xc
cmp eax, 6
jne 0x40c143
mov eax, dword [ebx + 0x140]
mov dword [ebx + 0x50], edi
cmp dword [eax - 0xc], 0
je 0x40c0af
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebx + 0x140]
call fcn.00401534
and dword [ebx + 0xe0], 0
lea eax, [ebp - 0x24]
and dword [ebp - 0x24], 0
xor ebx, ebx
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40c10c
lea eax, [ebp - 0x1c]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov ebx, eax
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
test ebx, ebx
je 0x40c10c
xor ecx, ecx
lea eax, [ebp - 0x20]
push ecx
push ecx
push ecx
push eax
push ecx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ebx, eax
push 1
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_InitiateSystemShutdownW]
test ebx, ebx
je 0x40c134
xor ecx, ecx
lea eax, [ebp - 0x20]
push ecx
push ecx
push ecx
push eax
push ecx
push dword [ebp - 0x24]
mov dword [ebp - 0x14], ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
cmp dword [ebp - 0x24], 0
je 0x40c143
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [edi - 0x10]
call fcn.004017a5
mov ecx, dword [ebp - 0x28]
lea ecx, [ecx - 0x10]
call fcn.004017a5
lea ecx, [esi - 0x10]
call fcn.004017a5
call fcn.00427f48
ret
Function at 0x40c280
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x46053c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x11c
lea eax, [ebp - 0x120]
push edi
xor esi, esi
push esi
push eax
call fcn.00428c30
add esp, 0xc
mov dword [ebp - 0x120], edi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 5
jne 0x40c2d6
xor eax, eax
inc eax
cmp dword [ebp - 0x118], 2
cmove esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00427b1a
leave
ret
Function at 0x40cea8
Capabilities:
Set registry value

Disassembly:
push 0x10
mov eax, 0x447a77
call fcn.00427f6a
mov ebx, dword [ebp + 0x14]
lea ecx, [ebp - 0x18]
xor edi, edi
push ebx
mov esi, edi
call fcn.004018b9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], edi
mov eax, dword [eax - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push 0xf023f
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40cf2a
mov ecx, dword [ebp + 0x18]
cmp ecx, 1
je 0x40cf03
cmp ecx, 2
je 0x40cf03
mov eax, dword [ebp - 0x14]
jmp 0x40cf08
mov eax, dword [ebp - 0x14]
add eax, eax
push eax
push ebx
push ecx
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x10]
neg eax
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40cf68
push str.Failed_to_register_value:
call fcn.0042c48c
pop ecx
push eax
push str.Failed_to_register_value:
mov ecx, 0x461d14
call fcn.00401822
test ebx, ebx
je 0x40cf52
push ebx
call fcn.0042c48c
pop ecx
mov edi, eax
push edi
push ebx
mov ecx, 0x461d14
call fcn.00403d5e
mov ecx, 0x461c48
call fcn.0040c3c8
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004017a5
mov eax, esi
call fcn.00427f33
ret
Function at 0x40cf7b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push edi
push eax
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
mov ebx, 0xf023f
push ebx
push edi
push edi
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d06d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, 0x461d14
test eax, eax
jne 0x40cff5
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40d02f
inc edi
jmp 0x40d069
push str.RegOpenKeyEx_Failed_for:
call fcn.0042c48c
pop ecx
push eax
push str.RegOpenKeyEx_Failed_for:
mov ecx, ebx
call fcn.00401822
test esi, esi
jne 0x40d015
mov eax, edi
jmp 0x40d01c
push esi
call fcn.0042c48c
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.00403d5e
mov ecx, 0x461c48
call fcn.0040c3c8
mov esi, str.Failed_to_register_DWORD_value:
push esi
call fcn.0042c48c
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.00401822
mov esi, dword [ebp + 0x10]
test esi, esi
jne 0x40d04f
mov eax, edi
jmp 0x40d056
push esi
call fcn.0042c48c
pop ecx
push eax
push esi
mov ecx, ebx
call fcn.00403d5e
mov ecx, 0x461c48
call fcn.0040c3c8
mov eax, edi
jmp 0x40d0a9
mov ebx, str.RegCreateKeyEx_failed_for:
push ebx
call fcn.0042c48c
pop ecx
push eax
push ebx
mov ebx, 0x461d14
mov ecx, ebx
call fcn.00401822
test esi, esi
je 0x40d094
push esi
call fcn.0042c48c
pop ecx
mov edi, eax
push edi
push esi
mov ecx, ebx
call fcn.00403d5e
mov ecx, 0x461c48
call fcn.0040c3c8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d0ae
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword [ebp + 0x14]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
mov edi, eax
mov ebx, 0xf003f
lea eax, [ebp - 4]
push eax
push esi
push ebx
push esi
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push ebx
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d11c
lea eax, [edi + edi]
push eax
push dword [ebp + 0x14]
push 1
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x410f9f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
mov ebx, ecx
push edi
cmp dword [ebp + 8], esi
je 0x410fde
call fcn.0041db13
push 0xf0
push dword [ebp + 8]
mov edi, dword [eax + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x410fde
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x410fe6
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
push esi
mov ecx, ebx
call fcn.0040d4c4
pop edi
pop esi
pop ebx
pop ebp
ret 4

Function at 0x4116c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41174f
cmp dword [esi + 0x20], 0
je 0x41174f
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41174f
cmp dword [ebp + 8], 0
je 0x41174f
xor edi, edi
mov ebx, edi
call fcn.0041db13
push 0x451738
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 8], eax
test eax, eax
je 0x411733
mov ebx, dword [ebp - 4]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 8]
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41174f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
push edi
push ebx
push esi
call fcn.00420636
mov edi, eax
add esp, 0xc
test edi, edi
je 0x41174b
mov ecx, esi
call fcn.00411481
mov eax, edi
jmp 0x411751
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x415a50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x84], ebx
test ebx, 0xffff0000
jne 0x415a7b
cmp dword [edi + 0x80], 0
jne 0x415a7b
movzx eax, bx
mov dword [edi + 0x80], eax
call fcn.0041db13
push 5
push ebx
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.00415ca8
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41c020
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x41c073
push esi
push dword [ebp + 8]
call fcn.0041c20e
mov edi, eax
test edi, edi
je 0x41c06e
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x41c06e
mov eax, dword [ebp - 8]
jmp 0x41c085
mov eax, dword [ebp + 0x10]
jmp 0x41c085
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
leave
ret 0xc
Function at 0x421222
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x42125d
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x421244
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x421255
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x42125f
inc edi
add eax, 0x28
cmp edi, esi
jb 0x42123a
xor eax, eax
pop edi
pop esi
ret
Function at 0x43de2b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043dadc

Function at 0x43de36
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0043dc66
Function at 0x401473
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x114
mov edi, eax
lea eax, [ebp - 0x120]
mov esi, edx
push eax
mov eax, dword [0x424c70]
or eax, 8
push eax
push 0
push edx
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov ebx, eax
test eax, eax
jne 0x401531
jmp 0x4014c1
cmp dword [ebp + 8], 0
jne 0x401504
mov eax, dword [ebp - 0x120]
mov edx, ebx
push 0
call fcn.00401473
test eax, eax
jne 0x4014de
lea ebx, [ebp - 0x11c]
push 0x105
push ebx
push 0
push dword [ebp - 0x120]
call sub.ADVAPI32.DLL_RegEnumKeyA
test eax, eax
je 0x4014a8
push dword [ebp - 0x120]
call sub.ADVAPI32.DLL_RegCloseKey
push 2
call fcn.00406304
test eax, eax
je 0x401516
push 0
push dword [0x424c70]
push esi
push edi
call eax
mov ebx, eax
jmp 0x401531
push dword [ebp - 0x120]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, 1
jmp 0x401533
xor ebx, ebx
cmp dword [0x424c70], 0
jne 0x40152c
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
je 0x401531
mov ebx, 1
mov eax, ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4
Function at 0x403116
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, eax
mov dword [ebp - 0x14], 0
call sub.KERNEL32.dll_GetTickCount
add eax, 0x1f4
mov ebx, edi
mov dword [ebp - 0x18], eax
mov eax, dword [0x414cb0]
sub eax, dword [0x414cc0]
sub ebx, eax
test ebx, ebx
jle 0x40330c
push dword [0x414cd0]
call fcn.004030c5
push 0
push 0
push dword [0x414cb0]
push dword [0x408010]
call sub.KERNEL32.dll_SetFilePointer
mov dword [0x414cf0], ebx
mov dword [0x414d00], 0
mov esi, dword [0x414ce0]
sub esi, dword [0x414cd0]
cmp esi, 0x4000
jle 0x403195
mov esi, 0x4000
push esi
push 0x414da0
call fcn.004030de
test eax, eax
jne 0x4031ac
or eax, 0xffffffff
jmp 0x40330e
add dword [0x414cd0], esi
mov dword [0x414d28], 0x414da0
mov dword [0x414d2c], esi
cmp dword [0x424ca0], 0
je 0x403230
cmp dword [0x424c60], 0
jne 0x403230
cmp dword [ebp - 0x14], 0
je 0x4031fe
mov eax, dword [0x414cb0]
mov edx, edi
sub eax, dword [0x414cc0]
push 0
sub edx, eax
mov eax, dword [0x414cf0]
sub eax, edx
mov dword [0x414d00], eax
call fcn.00406706
jmp 0x403230
call sub.KERNEL32.dll_GetTickCount
cmp eax, dword [ebp - 0x18]
jbe 0x403230
mov eax, str.unpacking_data:__d__
cmp dword [0x424d20], 0
je 0x403218
xor eax, eax
push eax
push 0x403000
push 0
push 0x6f
push dword [0x424d30]
call sub.USER32.dll_CreateDialogParamA
mov dword [ebp - 0x14], eax
mov ecx, 0x414d10
mov dword [0x414d30], 0x418da0
mov dword [0x414d34], 0x8000
call fcn.004067f7
test eax, eax
js 0x4032a0
mov eax, dword [0x414d30]
mov ebx, eax
sub ebx, 0x418da0
je 0x40328b
lea eax, [ebp - 0x10]
push 0
push eax
push ebx
push 0x418da0
push dword [0x408010]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x403281
cmp ebx, dword [ebp - 0x10]
je 0x4032a7
mov eax, 0xfffffffe
jmp 0x40330e
cmp dword [0x414d2c], 0
setne dl
test esi, esi
sete al
or eax, edx
test al, 1
je 0x4032ba
mov eax, 0xfffffffd
jmp 0x40330e
add dword [0x414cb0], ebx
cmp dword [0x414d2c], 0
jne 0x4031c2
mov eax, dword [0x414cb0]
mov edx, dword [0x414cc0]
sub eax, edx
mov ecx, edi
sub ecx, eax
test ecx, ecx
jg 0x40317c
push 0
push 0
push edx
push dword [0x408010]
call sub.KERNEL32.dll_SetFilePointer
cmp dword [ebp - 0x14], 0
je 0x40330c
push 0
push 0
push 0x113
mov eax, dword [0x414cf0]
push dword [ebp - 0x14]
mov dword [0x414d00], eax
call sub.USER32.dll_SendMessageA
push dword [ebp - 0x14]
call sub.USER32.dll_DestroyWindow
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403316
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov eax, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
test eax, eax
js 0x403344
add eax, dword [0x424ce8]
push 0
push 0
push eax
push dword [0x408010]
mov dword [0x414cc0], eax
call sub.KERNEL32.dll_SetFilePointer
mov eax, 4
call fcn.00403116
mov edx, eax
test eax, eax
js 0x40343b
lea eax, [ebp - 0x14]
lea edi, [ebp - 0x10]
push 0
push edi
push 4
push eax
push dword [0x408010]
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x4033ce
cmp dword [ebp - 0x10], 4
jne 0x4033ce
mov eax, dword [ebp - 0x14]
add dword [0x414cc0], 4
call fcn.00403116
mov ebx, eax
mov edx, eax
test eax, eax
js 0x40343b
test esi, esi
mov eax, dword [ebp - 0x14]
jne 0x40340e
test eax, eax
jle 0x403439
mov esi, eax
cmp eax, 0x4000
jle 0x4033b1
mov esi, 0x4000
push 0
push edi
push esi
push 0x414da0
push dword [0x408010]
call sub.KERNEL32.dll_ReadFile
test eax, eax
je 0x4033ce
cmp esi, dword [ebp - 0x10]
je 0x4033d5
mov edx, 0xfffffffd
jmp 0x40343b
lea eax, [ebp - 0x18]
push 0
push eax
push esi
push 0x414da0
push dword [ebp + 0xc]
call sub.KERNEL32.dll_WriteFile
test eax, eax
je 0x4033f2
cmp dword [ebp - 0x18], esi
je 0x4033f9
mov edx, 0xfffffffe
jmp 0x40343b
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
add dword [0x414cc0], edx
sub eax, edx
add ebx, edx
mov dword [ebp - 0x14], eax
jmp 0x40339b
mov edx, dword [ebp + 0x14]
push 0
cmp edx, eax
push edi
jle 0x40341a
mov edx, eax
push edx
push esi
push dword [0x408010]
call sub.KERNEL32.dll_ReadFile
mov edx, 0xfffffffd
test eax, eax
je 0x40343b
mov ebx, dword [ebp - 0x10]
add dword [0x414cc0], ebx
mov edx, ebx
lea esp, [ebp - 0xc]
mov eax, edx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x405b00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x4232b0], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x4232b0
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.dll_CreateProcessA
xor edx, edx
test eax, eax
je 0x405b40
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x10]
mov eax, edx
leave
ret 4

Function at 0x405d4f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x405d6b
and eax, 0xfffffffe
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x405d72
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
push 0
jne 0x405d88
xor eax, eax
push eax
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x405da0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov esi, 0x63
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], 0x61736e
call sub.KERNEL32.dll_GetTickCount
mov edx, 0x1a
push ebx
mov ecx, edx
xor edx, edx
div ecx
lea eax, [ebp - 0x10]
push 0
add byte [ebp - 0xe], dl
push eax
push edi
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
je 0x405de1
mov eax, ebx
jmp 0x405dec
dec esi
cmp esi, 0xffffffff
jne 0x405db2
mov byte [ebx], 0
xor eax, eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x405df6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
mov ebx, dword [ebp + 0x14]
lea eax, [ebp - 8]
mov byte [ebx], 0
push eax
cmp dword [ebp + 0x18], 1
sbb eax, eax
xor al, al
add eax, 0x20119
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x405e62
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x400
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
test eax, eax
jne 0x405e50
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
jbe 0x405e53
mov byte [ebx], 0
mov byte [ebx + 0x3ff], 0
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x40625c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push dword [ebp + 8]
push 0x423440
call fcn.00405f27
push 0x423440
call fcn.00405c20
xor edx, edx
mov ebx, eax
test eax, eax
je 0x4062fb
push eax
call fcn.00405ca4
cmp byte [0x424cf0], 0
jns 0x4062c1
mov al, byte [ebx]
test al, al
sete dl
cmp al, 0x5c
sete al
or eax, edx
xor edx, edx
test al, 1
jne 0x4062fb
jmp 0x4062c1
push 0x423440
call fcn.0040621f
test eax, eax
je 0x4062b7
test byte [eax], 0x10
je 0x4062f2
push 0x423440
call fcn.00405fa1
push 0x423440
call fcn.00405f3e
mov edx, ebx
sub edx, 0x423440
cmp eax, edx
jg 0x4062a4
push 0x423440
call fcn.00405fd5
push 0x423440
call sub.KERNEL32.dll_GetFileAttributesA
xor edx, edx
inc eax
je 0x4062fb
jmp 0x4062f6
xor edx, edx
jmp 0x4062fb
mov edx, 1
mov eax, edx
mov ebx, dword [ebp - 4]
leave
ret 4