joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005ae4
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov esi, eax
mov al, byte [esi]
cmp al, 0x22
jne 0x1005b0b
inc esi
mov al, byte [esi]
test al, al
je 0x1005b04
cmp al, 0x22
jne 0x1005af9
cmp byte [esi], 0x22
jne 0x1005b1c
jmp 0x1005b1b
cmp al, 0x20
jle 0x1005b1c
inc esi
cmp byte [esi], 0x20
jg 0x1005b0f
jmp 0x1005b1c
cmp al, 0x20
jg 0x1005b22
inc esi
mov al, byte [esi]
test al, al
jne 0x1005b17
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.kernel32.dll_GetStartupInfoA]
test byte [ebp - 0x18], 1
je 0x1005b3c
movzx eax, word [ebp - 0x14]
jmp 0x1005b3f
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.kernel32.dll_ExitProcess]

Function at 0x1005c50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1005c63
xor eax, eax
jmp 0x1005c6b
shr eax, 4
not eax
and eax, 1
ret 4

Function at 0x1005da8
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xb0
and dword [ebp + 0x74], 0
cmp dword [0x100a2cc], 0xfffffffe
mov dword [ebp + 0x6c], 0xc
jne 0x1005e8f
and dword [0x100a2cc], 0
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x38], 0x94
call dword [sym.imp.kernel32.dll_GetVersionExA]
test eax, eax
je 0x1005e8f
cmp dword [ebp - 0x28], 1
jne 0x1005e8f
cmp dword [ebp - 0x34], 4
jne 0x1005e8f
cmp dword [ebp - 0x30], 0xa
jae 0x1005e8f
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x1005e8f
lea eax, [ebp + 0x70]
push eax
push 0x20019
push 0
push 0x1001498
push 0x80000001
call dword [sym.imp.advapi32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1005e8f
push edi
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x68]
push eax
push 0
push 0x1001251
push dword [ebp + 0x70]
call dword [sym.imp.advapi32.dll_RegQueryValueExA]
push dword [ebp + 0x70]
mov edi, eax
call dword [sym.imp.advapi32.dll_RegCloseKey]
test edi, edi
pop edi
jne 0x1005e8f
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x5c]
push eax
call fcn.01005ca2
test eax, eax
je 0x1005e8f
and dword [ebp + 0x74], 0x3ff
cmp dword [ebp + 0x74], 1
je 0x1005e85
cmp dword [ebp + 0x74], 0xd
jne 0x1005e8f
mov dword [0x100a2cc], 1
mov eax, dword [0x100a2cc]
add ebp, 0x78
leave
ret
Function at 0x1007115
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007150
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x100712d
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x100716c
dec esi
je 0x1007165
dec esi
jne 0x1007171
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403203
pop dword [ebp - 0x48]
mov eax, 0xf43bc593
add eax, 0xc046c70
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xfc0207e0
sub dword [ebp - 0x58], 0xadafc295
mov dword [ebp - 0x54], 0xc1c7d405
sub dword [ebp - 0x54], 0x8f9487c0
mov dword [ebp - 0x50], 0x110cc215
add dword [ebp - 0x50], 0x3b3f8219
mov dword [ebp - 0x4c], 0xb1e57e18
sub dword [ebp - 0x4c], 0xb1e57e18
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x552dc260
sub dword [ebp - 0x58], 0xe0bb590a
mov dword [ebp - 0x54], 0xc6e4a376
add dword [ebp - 0x54], 0x7a87bdff
mov dword [ebp - 0x50], 0x46fd9ce3
sub dword [ebp - 0x50], 0xe38e3077
mov dword [ebp - 0x4c], 0xeeabb775
add dword [ebp - 0x4c], 0x1154488b
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x36c79
push 0
call eax
mov ecx, 0x72fa2494
add ecx, 0x8d06242a
xor esi, esi
add esi, eax
mov edi, 0x702fd633
add edi, 0x901129cd
add edi, dword [ebp - 0x48]
mov ebx, 0xc68be600
add ebx, 0x3fa9d690
xor dword [ebp - 0x30], eax
mov edx, dword [edi]
add dword [ebp - 0x20], esi
add edx, ebx
add dword [ebp - 0x44], 0xe97ea993
mov dword [esi], edx
mov dword [ebp - 0x40], 0x60cb5d02
add esi, 0xe74498d5
add esi, 0x18bb672f
add edi, 0x478d2a70
sub edi, 0x478d2a6c
loop 0x40331d
add eax, 0xa79969d2
add eax, 0x5867abf9
xor ebx, ebx
add ebx, eax
add eax, 0xf86e9f29
sub eax, 0xf86e9f24
mov ecx, 0x8f0c14af
sub ecx, 0x8ecc14af
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x40d08b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40d09a
pop dword [ebp - 0x40]
mov eax, 0xd1cea2f9
add eax, 0x2e722da1
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3aeaa
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4eb9
mov edi, eax
mov ebx, 0xfd3f52d8
add ebx, 0x301e8ec
add ebx, dword [ebp - 0x40]
mov edx, 0xc4fecb29
sub edx, 0x511e823
mov dword [ebp - 0x3c], 0x370db641
mov esi, dword [ebx]
sub dword [ebp - 0x2c], esi
add esi, edx
xor dword [ebp - 0x20], ebx
mov dword [edi], esi
add dword [ebp - 0x1c], 0xe6b9fd1
add edi, 0xeaede5a2
add edi, 0x15121a62
add ebx, 0x186afa3d
sub ebx, 0x186afa39
loop 0x40d0ee
add eax, 0x12db7
mov ebx, eax
add eax, 0xbab9f801
add eax, 0x45460804
mov ecx, 0x73ebf456
add ecx, 0x8c540baa
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x2e01416e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x2e0306d8
call fcn.2e001511
mov edi, ecx
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [edi + 0x14], 0xf
mov dword [edi + 0x10], ebx
mov byte [edi], bl
mov dword [ebp - 4], ebx
call fcn.2e014eb5
test ax, ax
je 0x2e014216
lea eax, [ebp - 0x10]
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014216
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01420d
mov eax, dword [ebp - 0x14]
inc eax
push eax
call fcn.2e01f637
mov esi, eax
pop ecx
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 1
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014200
push esi
mov ecx, edi
call fcn.2e010e6c
push 1
push esi
mov byte [ebp - 4], bl
call fcn.2e01f637
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
call fcn.2e00155b
ret

Function at 0x2e014ca3
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x28
mov eax, 0x2e030759
call fcn.2e02e6de
mov esi, dword [ebp + 8]
xor eax, eax
mov bl, al
mov edi, dword [ebp + 0xc]
cmp dword [ecx + 0x10], eax
jbe 0x2e014da7
push ecx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
call fcn.2e014b8d
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
push esi
call fcn.2e010d8f
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x30]
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push ecx
push eax
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014d65
lea eax, [ebp - 0x2c]
push eax
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014d5c
mov eax, dword [ebp - 0x2c]
inc eax
push eax
call fcn.2e01f637
mov esi, eax
pop ecx
mov dword [ebp - 0x34], esi
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
push esi
push 0
push 0
push 0x2e033941
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014d4e
push esi
mov ecx, edi
call fcn.2e010e6c
mov bl, 1
push 1
push esi
mov byte [ebp - 4], 0
call fcn.2e01f637
pop ecx
pop ecx
push dword [ebp - 0x30]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e014da7
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 4], 2
cmp eax, 0x1000
jb 0x2e014d9e
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.2e01f637
mov eax, dword [ebp - 0x2c]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x34]
push eax
push ecx
call fcn.2e01f637
pop ecx
pop ecx
mov al, bl
call fcn.2e02e6bc
ret 8
Function at 0x2e014de1
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xc
mov eax, 0x2e03078d
call fcn.2e001511
lea eax, [ebp - 0x10]
xor ebx, ebx
push eax
push dword [ebp + 8]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x2e014e1b
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e014e81
lea eax, [ebp - 0x14]
mov edi, 0x2e033941
push eax
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
jne 0x2e014e78
mov eax, dword [ebp - 0x14]
test eax, eax
js 0x2e014e78
inc eax
push eax
call fcn.2e01f637
mov esi, eax
pop ecx
mov dword [ebp - 0x18], esi
lea eax, [ebp - 0x14]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e014e6a
mov ecx, dword [ebp + 0xc]
push esi
call fcn.2e010e6c
mov bl, 1
or dword [ebp - 4], 0xffffffff
push 1
push esi
call fcn.2e01f637
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.2e00155b
ret 8
Function at 0x2e01e565
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x2e030a97
call fcn.2e02e6de
lea eax, [ebp - 0x2c]
xor ebx, ebx
push eax
push str.softwaremicrosoftwindows_shell_associationsurlassociationshttpuserchoice
push 0x80000001
mov edi, ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x2e01e683
lea eax, [ebp - 0x30]
push eax
push ebx
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x2e01e67a
mov eax, dword [ebp - 0x30]
inc eax
push eax
call fcn.2e01f637
mov esi, eax
pop ecx
mov dword [ebp - 0x3c], esi
lea eax, [ebp - 0x30]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
push ebx
push str.progid
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
xor ecx, ecx
inc ecx
test eax, eax
jne 0x2e01e66d
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], bl
call fcn.2e010e6c
push str.IE.HTTP
lea ecx, [ebp - 0x28]
call fcn.2e01f637
test al, al
jne 0x2e01e620
push ebx
push str.AppX
lea ecx, [ebp - 0x28]
call fcn.2e01f637
push 1
test eax, eax
pop edx
cmove edi, edx
jmp 0x2e01e623
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x2e01e65d
mov ecx, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], ecx
mov byte [ebp - 4], dl
cmp eax, 0x1000
jb 0x2e01e654
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call fcn.2e01f637
mov eax, dword [ebp - 0x34]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x38]
push eax
push ecx
call fcn.2e01f637
pop ecx
pop ecx
xor ecx, ecx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0xf
inc ecx
mov byte [ebp - 0x28], bl
or dword [ebp - 4], 0xffffffff
push ecx
push esi
call fcn.2e01f637
pop ecx
pop ecx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, di
call fcn.2e02e6bc
ret
Function at 0x2e01f637
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x2e01f646
pop dword [ebp - 0x18]
mov eax, 0xdceaa00e
sub eax, 0xaee8a9c8
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xa717c4fe
sub dword [ebp - 0x28], 0x58c57fb3
mov dword [ebp - 0x24], 0xb44675c5
sub dword [ebp - 0x24], 0x82132980
mov dword [ebp - 0x20], 0x2b17f906
add dword [ebp - 0x20], 0x21344b28
mov dword [ebp - 0x1c], 0x9acc8aad
add dword [ebp - 0x1c], 0x65337553
lea eax, [ebp - 0x28]
push eax
mov eax, 0x2bec9716
add eax, 0x21699b2
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x2adc0041
sub dword [ebp - 0x28], 0xb66996eb
mov dword [ebp - 0x24], 0xc3422242
add dword [ebp - 0x24], 0x7e2a3f33
mov dword [ebp - 0x20], 0x8a2543fb
sub dword [ebp - 0x20], 0x26b5d78f
mov dword [ebp - 0x1c], 0x4ba4d0ef
add dword [ebp - 0x1c], 0xb45b2f11
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, 0xf8b1d307
sub eax, 0xcaaea24b
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x3e94f
push 0
call eax
mov ecx, 0x6deb7cc
add ecx, 0xf9218624
mov edx, eax
mov esi, 0x2272cc76
add esi, 0xb92b18a
add esi, dword [ebp - 0x18]
mov ebx, 0xa35f16b
sub ebx, 0xacb7cefc
mov edi, dword [esi]
add dword [ebp - 4], 0x12ea40a1
sub edi, ebx
xor dword [ebp - 0x10], 0x9c221b4f
mov dword [edx], edi
xor dword [ebp - 0xc], 0x20858745
add edx, 0x30cf0632
add edx, 0xcf30f9d2
add esi, 0x9a766e8c
add esi, 0x65899178
loop 0x2e01f768
add eax, 0x49c773d
sub eax, 0x49b8caa
xor ebx, ebx
add ebx, eax
add eax, 0x79199ea3
add eax, 0x86e66162
mov ecx, 0x8fe32a28
sub ecx, 0x61e32a28
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x4013f0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, 0x4795e8
cmp dword [esi], 0
jne 0x401436
push 0x644
push 0
call sub.KERNEL32.DLL_TerminateProcess
mov ecx, eax
test ecx, ecx
jne 0x401413
xor eax, eax
pop esi
pop ebx
ret
mov eax, dword [0x4795e4]
mov dword [ecx], eax
mov dword [0x4795e4], ecx
xor edx, edx
mov eax, edx
add eax, eax
lea eax, [ecx + eax*8 + 4]
mov ebx, dword [esi]
mov dword [eax], ebx
mov dword [esi], eax
inc edx
cmp edx, 0x64
jne 0x401422
mov eax, dword [esi]
mov edx, dword [eax]
mov dword [esi], edx
pop esi
pop ebx
ret

Function at 0x401a7c
Capabilities:
Create process on windows
Terminate process
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push ebp
push 0x401b32
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x4795cc
call sub.KERNEL32.DLL_WinExec
cmp byte [0x47904d], 0
je 0x401aaa
push 0x4795cc
call sub.KERNEL32.DLL_WriteFile
mov eax, 0x4795ec
call fcn.00401440
mov eax, 0x4795fc
call fcn.00401440
mov eax, 0x479628
call fcn.00401440
push 0xff8
push 0
call sub.KERNEL32.DLL_TerminateProcess
mov dword [0x479624], eax
cmp dword [0x479624], 0
je 0x401b11
mov eax, 3
mov edx, dword [0x479624]
xor ecx, ecx
mov dword [edx + eax*4 - 0xc], ecx
inc eax
cmp eax, 0x401
jne 0x401ae7
mov eax, 0x47960c
mov dword [eax + 4], eax
mov dword [eax], eax
mov dword [0x479618], eax
mov byte [0x4795c4], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401b39
cmp byte [0x47904d], 0
je 0x401b31
push 0x4795cc
call sub.KERNEL32.DLL_WritePrivateProfileStringA
ret

Function at 0x401b40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
cmp byte [0x4795c4], 0
je 0x401c1d
xor edx, edx
push ebp
push 0x401c16
push dword fs:[edx]
mov dword fs:[edx], esp
cmp byte [0x47904d], 0
je 0x401b72
push 0x4795cc
call sub.KERNEL32.DLL_WriteFile
mov byte [0x4795c4], 0
mov eax, dword [0x479624]
push eax
call sub.KERNEL32.DLL_VirtualAlloc
xor eax, eax
mov dword [0x479624], eax
mov ebx, dword [0x4795ec]
jmp 0x401ba5
push 0x8000
push 0
mov eax, dword [ebx + 8]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
mov ebx, dword [ebx]
cmp ebx, 0x4795ec
jne 0x401b93
mov eax, 0x4795ec
call fcn.00401440
mov eax, 0x4795fc
call fcn.00401440
mov eax, 0x479628
call fcn.00401440
mov eax, dword [0x4795e4]
test eax, eax
je 0x401beb
mov edx, dword [eax]
mov dword [0x4795e4], edx
push eax
call sub.KERNEL32.DLL_VirtualAlloc
mov eax, dword [0x4795e4]
test eax, eax
jne 0x401bd4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x401c1d
cmp byte [0x47904d], 0
je 0x401c0b
push 0x4795cc
call sub.KERNEL32.DLL_WritePrivateProfileStringA
push 0x4795cc
call sub.KERNEL32.DLL_lstrcpyA
ret
pop ebx
pop ebp
ret
Function at 0x402168
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
cmp byte [0x4795c4], 0
jne 0x402185
call fcn.00401a7c
test al, al
je 0x40218d
cmp ebx, 0x7ffffff8
jle 0x402197
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x4022eb
xor ecx, ecx
push ebp
push 0x4022e4
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x47904d], 0
je 0x4021b8
push 0x4795cc
call sub.KERNEL32.DLL_WriteFile
add ebx, 7
and ebx, 0xfffffffc
cmp ebx, 0xc
jge 0x4021c8
mov ebx, 0xc
cmp ebx, 0x1000
jg 0x402267
mov eax, ebx
test eax, eax
jns 0x4021dd
add eax, 3
sar eax, 2
mov edx, dword [0x479624]
mov edx, dword [edx + eax*4 - 0xc]
test edx, edx
je 0x402267
mov esi, edx
mov eax, esi
add eax, ebx
and dword [eax], 0xfffffffe
mov eax, dword [edx + 4]
cmp edx, eax
jne 0x402218
mov eax, ebx
test eax, eax
jns 0x402207
add eax, 3
sar eax, 2
mov ecx, dword [0x479624]
xor edi, edi
mov dword [ecx + eax*4 - 0xc], edi
jmp 0x40223e
mov ecx, ebx
test ecx, ecx
jns 0x402221
add ecx, 3
sar ecx, 2
mov edi, dword [0x479624]
mov dword [edi + ecx*4 - 0xc], eax
mov ecx, dword [edx]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov dword [ecx + 4], eax
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, esi
mov edx, dword [edx + 8]
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4795b4]
sub ebx, 4
add dword [0x4795b8], ebx
call fcn.00404198
jmp 0x4022eb
cmp ebx, dword [0x47961c]
jg 0x4022b9
sub dword [0x47961c], ebx
cmp dword [0x47961c], 0xc
jge 0x40228b
add ebx, dword [0x47961c]
xor eax, eax
mov dword [0x47961c], eax
mov eax, dword [0x479620]
add dword [0x479620], ebx
mov edx, ebx
or edx, 2
mov dword [eax], edx
add eax, 4
mov dword [ebp - 4], eax
inc dword [0x4795b4]
sub ebx, 4
add dword [0x4795b8], ebx
call fcn.00404198
jmp 0x4022eb
mov eax, ebx
call fcn.00402074
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4022eb
cmp byte [0x47904d], 0
je 0x4022e3
push 0x4795cc
call sub.KERNEL32.DLL_WritePrivateProfileStringA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4022f8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
mov dword [0x4795c8], eax
cmp byte [0x4795c4], 0
jne 0x402330
call fcn.00401a7c
test al, al
jne 0x402330
mov dword [0x4795c8], 8
mov dword [ebp - 4], 8
jmp 0x402491
xor ecx, ecx
push ebp
push 0x40248a
push dword fs:[ecx]
mov dword fs:[ecx], esp
cmp byte [0x47904d], 0
je 0x402351
push 0x4795cc
call sub.KERNEL32.DLL_WriteFile
mov esi, ebx
sub esi, 4
mov ebx, dword [esi]
test bl, 2
jne 0x40236c
mov dword [0x4795c8], 9
jmp 0x402461
dec dword [0x4795b4]
mov eax, ebx
and eax, 0x7ffffffc
sub eax, 4
sub dword [0x4795b8], eax
test bl, 1
je 0x4023cc
mov eax, esi
sub eax, 0xc
mov edx, dword [eax + 8]
cmp edx, 0xc
jl 0x40239c
test edx, 0x80000003
je 0x4023ab
mov dword [0x4795c8], 0xa
jmp 0x402461
mov eax, esi
sub eax, edx
cmp edx, dword [eax + 8]
je 0x4023c3
mov dword [0x4795c8], 0xa
jmp 0x402461
add ebx, edx
mov esi, eax
call fcn.00401c20
and ebx, 0x7ffffffc
mov eax, esi
add eax, ebx
mov edi, eax
cmp edi, dword [0x479620]
jne 0x40240c
sub dword [0x479620], ebx
add dword [0x47961c], ebx
cmp dword [0x47961c], 0x3c00
jle 0x4023fd
call fcn.00401f10
xor eax, eax
mov dword [ebp - 4], eax
call fcn.00404198
jmp 0x402491
mov edx, dword [eax]
test dl, 2
je 0x40242f
and edx, 0x7ffffffc
cmp edx, 4
jge 0x40242a
mov dword [0x4795c8], 0xb
jmp 0x402461
or dword [eax], 1
jmp 0x402458
mov eax, edi
cmp dword [eax + 4], 0
je 0x402442
cmp dword [eax], 0
je 0x402442
cmp dword [eax + 8], 0xc
jge 0x40244e
mov dword [0x4795c8], 0xb
jmp 0x402461
mov edx, dword [eax + 8]
add ebx, edx
call fcn.00401c20
mov edx, ebx
mov eax, esi
call fcn.00401e88
mov eax, dword [0x4795c8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402491
cmp byte [0x47904d], 0
je 0x402489
push 0x4795cc
call sub.KERNEL32.DLL_WritePrivateProfileStringA
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x402a70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404734
test esi, esi
jne 0x402aa6
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_LoadResource
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404824
jmp 0x402ac4
call sub.KERNEL32.DLL_InitializeCriticalSection
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402984
mov edi, eax
test esi, esi
je 0x402ac4
cmp dword [ebx], 0
je 0x402ac4
dec esi
jmp 0x402aad
add esp, 0x108
pop edi
pop esi
pop ebx
ret
Function at 0x403140
Capabilities:
Get system information on windows

Disassembly:
push ebx
push esi
push edi
mov esi, edx
mov edi, ecx
xor edx, edx
mov ebx, eax
mov dx, word [eax + 4]
sub edx, 0xd7b0
je 0x40316c
cmp edx, 3
ja 0x403202
call dword [ebx + 0x24]
test eax, eax
je 0x40316c
call fcn.004028c4
mov word [ebx + 4], 0xd7b3
mov dword [ebx + 8], esi
mov dword [ebx + 0x24], 0x403118
mov dword [ebx + 0x1c], 0x402bf8
cmp byte [ebx + 0x48], 0
je 0x4031e9
mov eax, 0xc0000000
mov dl, byte [0x477008]
and edx, 0x70
shr edx, 2
mov edx, dword [edx + 0x477068]
mov ecx, 2
sub edi, 3
je 0x4031cb
mov ecx, 3
inc edi
je 0x4031cb
mov eax, 0x40000000
inc edi
mov word [ebx + 4], 0xd7b2
je 0x4031cb
mov eax, 0x80000000
mov word [ebx + 4], 0xd7b1
push 0
push 0x80
push ecx
push 0
push edx
push eax
lea eax, [ebx + 0x48]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
cmp eax, 0xffffffff
je 0x403209
mov dword [ebx], eax
jmp 0x403219
mov dword [ebx + 0x24], 0x402bf8
cmp edi, 3
je 0x4031f9
push 0xfffffffffffffff6
jmp 0x4031fb
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetTickCount
jmp 0x4031e0
mov eax, 0x66
jmp 0x403214
mov word [ebx + 4], 0xd7b0
call sub.KERNEL32.DLL_LeaveCriticalSection
call fcn.004028c4
pop edi
pop esi
pop ebx
ret

Function at 0x404e40
Capabilities:
Hide graphical window

Disassembly:
test eax, eax
je 0x404e54
push eax
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x404e38
ret

Function at 0x405b94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
add esp, 0xfffffef8
mov ebx, eax
cmp dword [ebx + 0x10], 0
jne 0x405bcf
push 0x105
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 4]
push eax
call sub.KERNEL32.DLL_LoadResource
mov eax, esp
mov dl, 1
call fcn.00405dd0
mov esi, eax
mov dword [ebx + 0x10], esi
test esi, esi
jne 0x405bcf
mov eax, dword [ebx + 4]
mov dword [ebx + 0x10], eax
mov eax, dword [ebx + 0x10]
add esp, 0x108
pop esi
pop ebx
ret