joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4895f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x48961b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x48963f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x48965a
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20

Function at 0x48d8e0
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48d918
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048c8aa
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048c882
jmp 0x48d924
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4
Function at 0x48f153
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48f195
call fcn.0049668d
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48f195
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x48f18c
xor eax, eax
jmp 0x48f19d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048f1a3
pop edi
pop esi
pop ebx
ret 4

Function at 0x490884
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4908a6
cmp dword [edi + 0x3c], 0
jne 0x4908a6
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0049668d
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004908d3
pop edi
pop esi
pop ebx
ret 8
Function at 0x4915e1
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x491611
push edi
call ebx
push eax
call fcn.00492255
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x49163b
test byte [ebp - 4], 1
je 0x49163b
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x49163b
push edi
call ebx
push eax
call fcn.00492255
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x4916e1
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.0049152e
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x49166d
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.0049152e
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x491683
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.0049152e
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4916ad
push 0
call ebx
push eax
call fcn.00492255
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x4916cb
push eax
call ebx
push eax
call fcn.00492255
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4916df
push eax
call ebx
push eax
call fcn.00492255
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x491708
test byte [ebp - 4], 1
jne 0x491708
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x491708
push edi
call ebx
push eax
call fcn.00492255
pop edi
pop ebx
leave
ret 8

Function at 0x497783
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4977b1
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4977cf
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004976e9
jmp 0x4977cf
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4977cf
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004976e9
test edi, edi
mov eax, edi
jne 0x4977b9
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x40c30d
Capabilities:
Parse pe header

Disassembly:
push 0x74
push 0x40e120
call fcn.0040c210
xor edi, edi
mov dword [ebp - 0x20], edi
push edi
mov ebx, dword [0x40d0ec]
call ebx
cmp word [eax], 0x5a4d
jne 0x40c34d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40c34d
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x40c365
cmp eax, 0x20b
je 0x40c352
mov dword [ebp - 0x1c], edi
jmp 0x40c379
cmp dword [ecx + 0x84], 0xe
jbe 0x40c34d
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x40c373
cmp dword [ecx + 0x74], 0xe
jbe 0x40c34d
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 2
call dword [0x40d1b8]
pop ecx
or dword [0x4102f8], 0xffffffff
or dword [0x4102fc], 0xffffffff
call dword [0x40d1bc]
mov ecx, dword [0x4102f0]
mov dword [eax], ecx
call dword [0x40d1c0]
mov ecx, dword [0x4102ec]
mov dword [eax], ecx
mov eax, dword [0x40d1c4]
mov eax, dword [eax]
mov dword [0x4102f4], eax
call fcn.0040c596
call fcn.0040c636
cmp dword [0x410180], edi
jne 0x40c3d9
push fcn.0040c636
call dword [0x40d1c8]
pop ecx
call fcn.0040c624
push 0x410028
push 0x410024
call fcn.0040c61e
push 0x40c5da
call fcn.0040c2a6
mov eax, dword [0x4102e8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x4102e4]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [0x40d1d0]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, edi
jge 0x40c42d
push 8
call fcn.0040c590
pop ecx
push 0x410020
push 0x410000
call fcn.0040c61e
pop ecx
pop ecx
mov eax, dword [0x40d1d8]
mov esi, dword [eax]
cmp esi, edi
jne 0x40c457
or dword [ebp - 4], 0xffffffff
mov eax, 0xff
jmp 0x40c511
mov dword [ebp - 0x24], esi
mov ax, word [esi]
cmp ax, 0x20
ja 0x40c4c6
cmp ax, di
je 0x40c46d
cmp dword [ebp - 0x20], edi
jne 0x40c4c6
mov ax, word [esi]
cmp ax, di
je 0x40c482
cmp ax, 0x20
ja 0x40c482
inc esi
inc esi
mov dword [ebp - 0x24], esi
jmp 0x40c46d
mov dword [ebp - 0x58], edi
lea eax, [ebp - 0x84]
push eax
call dword [0x40d0f0]
test byte [ebp - 0x58], 1
je 0x40c49e
movzx eax, word [ebp - 0x54]
jmp 0x40c4a1
push 0xa
pop eax
push eax
push esi
push edi
push edi
call ebx
push eax
call fcn.00403dff
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], edi
jne 0x40c4be
push esi
call dword [0x40d1dc]
call dword [0x40d1e0]
jmp 0x40c50b
cmp ax, 0x22
jne 0x40c4d7
xor eax, eax
cmp dword [ebp - 0x20], edi
sete al
mov dword [ebp - 0x20], eax
inc esi
inc esi
jmp 0x40c457
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0040c24b
ret
Function at 0x406148
Capabilities:
Encode data using xor

Disassembly:
dec dword [ebx + 0x5f5b5e16]
add byte [eax], al
add al, bh
push ebx
salc
mov esi, edi
add al, 0x8a
push ebx
or byte [esp + esi + 0x508b2f74], al
or al, 0x29
leave
test edx, edx
jbe 0x40617c
lea esi, [eax + 0x10]
cmp dword [esi], edi
je 0x4060a7
inc ecx
or eax, 0xca3b04c6
jb 0x40615d
cmp ecx, edx
jne 0x406143
invalid
pop dword [ebx + 8]
add al, 0x74
mov edx, dword ds:[eax + 0x1010]
psrlq mm6, mm1
sal byte [esi - 0x53], cl
lea esi, [eax - 0x5bffefec]
cmp dword [esi], edi
push 0xc68f4108
add al, 0x3b
sal byte [edx - 0xc], 1
cmp ecx, edx
jne 0x406187
mov al, byte [eax]
add al, 0
add byte [ebx + 0x14], dh
mov dword [eax + ecx*4 + 0x131014], edi
jb 0x406104
adc byte [eax], dl
add byte [eax], al
inc ecx
mov dword [eax + 0x1004], ecx
not byte [edx + 8]
jb 0x406200
mov edx, dword ds:[eax + 0x20b1]
ret
push ebp
mov edx, dword [edx]
sub esp, 8
mov eax, dword [ebp + 0xc]
push ebx
push ds
lahf
cmp dword [eax - 0x69], 1
jne 0xae40638d
mov ebx, dword [eax + 0xc]
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [eax + 4]
mov edi, dword [ebx + 4]
sbb edx, edx
mov dword [ebp - 8], edi
jbe 0x406240
mov esi, dword [eax - 0x62ffcfe4]
adc eax, 0x1e3b0cc6
je 0x40624e
inc ecx
add esi, 0x14
cmp ecx, edx
sbb dh, ah
mov ebp, 0x117fb808
aad 0
pop ebx
mov esp, ebp
mov dl, al
aam 0
out 0xd9, eax
inc ecx
lea esi, [edx - 1]
cmp ecx, edx
add esi, dword [eax + 4]
jae 0x4062aa
lea ebx, [ebx + ebx*4]
lea ebp, [ecx + ecx*4 - 0x3efd1c3f]
out 2, eax
sub edx, ecx
mov dword [ebp - 0x52], edi
mov dword [ebp - 4], edx
mov ecx, dword [eax + 0x301c]
sub dl, byte [ebp + 0xc]
salc
push edx
or al, 0x8d
xor al, 0xf
cmp edx, dword [esi + 0xc]
jne 0x406288
lea ecx, [eax + 0x6f]
jmp 0x406298
lea edi, [ebx + ecx]
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp + 8]
add ebx, 0x14
mov ecx, dword [ebp - 4]
sub dword [ebp + 0x7d899714], 8
mov dword [ebp - 4], ecx
jne 0x40626f
mov edi, dword [ebp - 8]
mov edx, dword [eax + 0xd]
xor ecx, ecx
test edx, edx
push eax
or eax, 0xd285c933
jbe 0x4062e1
lea esi, [eax + 0x10]
cmp dword [esi], edi
je 0x406307
inc ecx
add esi, 4
cmp ecx, edx
or ah, dh
jmp 0x4062e1
inc ecx
mov dword [edx], esi
salc
xchg dword [edi + ebp], ecx
ret 0x4e4c
fcom qword [eax + 0x1010]
xor ecx, ecx
test edx, edx
jbe 0x406327
stosb byte es:[edi], al
adc al, 0x10
add byte [eax], al
cmp dword [esi], edi
je 0x406301
inc ecx
add esi, 0xffffffe4
cmp ecx, edx
adc ch, byte [ebx + ebp*8]
dec edx
dec edx
cmp ecx, edx
jae 0x4062d0
lea edx, [edi + edx*2 + 0x4814]
xchg esp, eax
push edi
adc al, 0x48
add byte [eax], al
mov esi, dword [edx + 4]
inc ecx
mov dword [edx], esi
xor byte [eax + 0x71ac4210], 0x83
nop
add al, 0x4e
cmp ecx, esi
jb 0x40630d
ja 0x4062ab
cmp dl, byte [eax]
add dh, bl
mov esp, ecx
cmp ah, byte [eax]
add byte [eax], al
xor ecx, ecx
test edx, edx
mov bl, 0x3a
lea esi, [eax + 0x2018]
cmp dword [esi], edi
hlt
Function at 0x408bdc
Capabilities:
Send data
Send data on socket

Disassembly:
jle 0x408c44
add al, 0x80
push ecx
popal
inc ebp
cld
add byte [eax], al
add byte [eax], al
call dword [sym.imp.WS2_32.dll_WSASend]
adc dword [edi + 0x561e0cff], 0x76
xor eax, 0x408dd8
mov esp, 0x61c085d6
add eax, 0x5de5975e
fdivp st(7)
salc
add eax, 0xa9b80
popfd
mov edi, edi
pop ebp
ret
mov esi, dword [sym.imp.WSOCK32.dll_WSAGetLastError]
pushal
salc
test eax, eax
jne 0x408c55
pop esi
mov esp, ebp
pop ebp
ret
call esi
add eax, 0xb20afc80
pop esi
cmp ah, ch
pop ebp
ret
Function at 0x402b80
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x40c4a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
mov eax, dword [ecx + 0x1c]
cmp eax, 0x10
push ebx
push ebp
push esi
lea esi, [ecx + 4]
push edi
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], esi
jb 0x402bb4
mov esi, dword [esi + 4]
jmp 0x402bb7
add esi, 4
mov ebx, dword [ecx + 0x18]
xor ebp, ebp
xor edi, edi
xor eax, eax
test ebx, ebx
mov dword [esp + 0x18], 1
jg 0x402c00
mov ecx, dword [esp + 0x70]
push 0
mov byte [ecx], 0
mov ecx, dword [esp + 0x78]
push 0x40d1ce
call fcn.00401650
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
mov ecx, dword [esp + 0x20]
nop
mov edx, dword [esp + 0x18]
test edx, edx
je 0x402c4f
cmp byte [eax + esi], 0x2f
jne 0x402c4f
mov dl, byte [eax + esi + 1]
inc eax
inc eax
mov byte [esp + 0x13], dl
lea edx, [esp + 0x14]
mov dword [esp + 0x14], eax
push edx
add eax, esi
push eax
call fcn.00402a40
mov edi, eax
cmp ebp, dword [esp + 0x6c]
mov eax, dword [esp + 0x14]
je 0x402c72
inc ebp
test edi, edi
je 0x402c53
cmp eax, ebx
jge 0x402c4b
mov edi, edi
cmp byte [eax + esi], 0x20
jne 0x402c4b
inc eax
cmp eax, ebx
jl 0x402c40
lea eax, [eax + edi + 2]
test edi, edi
jne 0x402c68
cmp byte [eax + esi], 0x22
jne 0x402c68
mov edx, dword [esp + 0x18]
xor ecx, ecx
test edx, edx
sete cl
mov dword [esp + 0x18], ecx
inc eax
cmp eax, ebx
jl 0x402bfb
jmp 0x402bcc
test edi, edi
je 0x402cdc
lea edx, [eax + edi + 2]
cmp edx, ebx
jge 0x402d7c
cmp eax, ebx
jge 0x402bcc
lea ebx, [ebx]
mov cl, byte [eax + esi]
inc eax
cmp cl, 0x22
je 0x402ca2
cmp eax, ebx
jl 0x402c90
jmp 0x402bcc
mov ecx, dword [esp + 0x1c]
push edi
push eax
lea eax, [esp + 0x2c]
push eax
call fcn.00402b40
mov ecx, dword [esp + 0x74]
push 0xffffffffffffffff
push 0
push eax
mov dword [esp + 0x70], 0
call fcn.00401470
cmp dword [esp + 0x3c], 0x10
jb 0x402d7c
mov ecx, dword [esp + 0x28]
jmp 0x402d73
xor ebp, ebp
xor edi, edi
cmp eax, ebx
mov edx, eax
jge 0x402d7c
lea ebx, [ebx]
test ebp, ebp
jne 0x402cfa
cmp byte [edx + esi], 0x2f
je 0x402d20
mov cl, byte [edx + esi]
cmp cl, 0xa
je 0x402d20
test cl, cl
je 0x402d20
cmp cl, 0x22
jne 0x402d16
test ebp, ebp
jne 0x402d20
mov ebp, 1
jmp 0x402d1b
test ebp, ebp
je 0x402d1b
inc edi
inc edx
cmp edx, ebx
jl 0x402cf0
test edi, edi
je 0x402d7c
lea edx, [eax + edi + 2]
cmp edx, ebx
jge 0x402d7c
lea esp, [esp]
mov cl, byte [eax + esi]
inc eax
cmp cl, 0x22
je 0x402d42
cmp eax, ebx
jl 0x402d30
jmp 0x402bcc
mov ecx, dword [esp + 0x1c]
push edi
push eax
lea eax, [esp + 0x48]
push eax
call fcn.00402b40
mov ecx, dword [esp + 0x74]
push 0xffffffffffffffff
push 0
push eax
mov dword [esp + 0x70], 1
call fcn.00401470
cmp dword [esp + 0x58], 0x10
jb 0x402d7c
mov ecx, dword [esp + 0x44]
push ecx
call fcn.0040582d
add esp, 4
mov al, byte [esp + 0x13]
mov edx, dword [esp + 0x70]
mov ecx, dword [esp + 0x5c]
mov byte [edx], al
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x58
ret 0xc
Function at 0x403d30
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x40c580
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
xor ebx, ebx
mov eax, 0xf
push edi
mov edi, ecx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ebx
mov byte [esp + 0x10], bl
mov dword [esp + 0x68], ebx
mov dword [esp + 0x40], eax
mov dword [esp + 0x3c], ebx
mov byte [esp + 0x2c], bl
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], bl
mov edx, dword [esp + 0x70]
cmp edx, ebx
mov byte [esp + 0x68], 1
je 0x403da3
mov eax, edx
lea esi, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x403d90
sub eax, esi
push eax
push edx
lea ecx, [edi + 4]
call fcn.00401650
push ebp
lea ebp, [edi + 0x20]
mov ecx, ebp
call fcn.00403520
xor esi, esi
push ebx
push 0x40d1ce
lea ecx, [esp + 0x18]
call fcn.00401650
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x78]
push ecx
push esi
mov ecx, edi
call fcn.00402b80
cmp eax, 0xffffffff
je 0x403e4d
cmp dword [esp + 0x44], 1
mov bl, byte [esp + 0x74]
jae 0x403df1
mov edx, dword [esp + 0x40]
push edx
push 1
lea ecx, [esp + 0x34]
call fcn.00401240
mov eax, dword [esp + 0x44]
mov ecx, 0x10
cmp eax, ecx
mov eax, dword [esp + 0x30]
jae 0x403e06
lea eax, [esp + 0x30]
movsx edx, bl
mov byte [eax], dl
cmp dword [esp + 0x44], ecx
mov eax, dword [esp + 0x30]
mov dh, dl
mov dword [esp + 0x40], 1
jae 0x403e23
lea eax, [esp + 0x30]
push 0xffffffffffffffff
mov byte [eax + 1], 0
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esp + 0x54]
call fcn.00401470
lea ecx, [esp + 0x2c]
push ecx
mov ecx, ebp
call fcn.00403c60
inc esi
xor ebx, ebx
jmp 0x403db0
mov eax, dword [esp + 0x60]
mov esi, 0x10
cmp eax, esi
pop ebp
jb 0x403e68
mov edx, dword [esp + 0x48]
push edx
call fcn.0040582d
add esp, 4
cmp dword [esp + 0x40], esi
mov edi, 0xf
mov dword [esp + 0x5c], edi
mov dword [esp + 0x58], ebx
mov byte [esp + 0x48], 0
jb 0x403e8d
mov eax, dword [esp + 0x2c]
push eax
call fcn.0040582d
add esp, 4
mov eax, dword [esp + 0x24]
mov dword [esp + 0x40], edi
pop edi
cmp eax, esi
pop esi
mov dword [esp + 0x34], ebx
mov byte [esp + 0x24], 0
pop ebx
jb 0x403eb2
mov ecx, dword [esp + 4]
push ecx
call fcn.0040582d
add esp, 4
mov ecx, dword [esp + 0x54]
mov dword fs:[0], ecx
add esp, 0x60
ret 4
Function at 0x404030
Capabilities:
Check os version
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x98
push ebx
push ebp
push esi
push edi
mov ebp, ecx
xor eax, eax
mov ecx, 0x25
lea edi, [esp + 0x10]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x10]
push eax
mov ebx, 1
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp eax, ebx
jne 0x404087
mov eax, dword [esp + 0x20]
sub eax, 2
je 0x40407e
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esp + 0x14], 5
jb 0x404087
xor ebx, ebx
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x4040e9
cmp ebx, 1
je 0x4040bd
push 0
push 0x23
push esi
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
mov ecx, ebp
call fcn.00403fe0
test eax, eax
jne 0x4040e9
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
ja 0x4040e9
mov edi, dword [sym.imp.KERNEL32.dll_GlobalHandle]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x404bc0
Capabilities:
Copy file
Get common file path

Disassembly:
sub esp, 0x2d0
push ebp
push esi
push edi
lea ecx, [esp + 0x3c]
call fcn.004039a0
lea ecx, [esp + 0x28]
call fcn.00402160
push str.C:E_SPNF01.LOG
push str.E_SPNF01
push str.softwareEPSONSTM3Debug
push 0x80000002
lea ecx, [esp + 0x7c]
call fcn.00404390
mov esi, dword [esp + 0x2e8]
push esi
lea eax, [esp + 0x70]
push str.Input_CmdLine_:__s_n
push eax
call fcn.00404180
add esp, 0xc
push esi
lea ecx, [esp + 0x40]
call fcn.00403d30
push 1
lea ecx, [esp + 0x10]
push ecx
push 0x40d2e0
lea ecx, [esp + 0x48]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
xor edi, edi
call fcn.004032b0
test eax, eax
je 0x404c51
mov edi, 1
lea ecx, [esp + 0x28]
call fcn.00401040
mov ebp, eax
push ebp
lea edx, [esp + 0x70]
push str.Regist_Application_num_:__d_n
push edx
call fcn.00404180
add esp, 0xc
test ebp, ebp
jle 0x404d7e
lea ecx, [esp + 0x90]
call fcn.00401380
lea eax, [esp + 0x90]
push eax
push 0
lea ecx, [esp + 0x30]
call fcn.00401be0
push esi
push edi
lea ecx, [esp + 0x44]
push ecx
lea edx, [esp + 0x9c]
push edx
call fcn.00404450
add esp, 0x10
cmp ebp, 1
jle 0x404d72
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 1
lea eax, [esp + 0x94]
push eax
push esi
lea ecx, [esp + 0x34]
call fcn.00401be0
test edi, edi
je 0x404d4a
push 1
push 0x40d2e0
lea ecx, [esp + 0x48]
call fcn.00403a10
lea ecx, [esp + 0x1d8]
push ecx
push 0x104
call ebx
lea edx, [esp + 0xd0]
push edx
push 0
push 0x40d2bc
lea eax, [esp + 0x1e4]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
cmp dword [esp + 0x28], 0x10
mov eax, dword [esp + 0x14]
jae 0x404d23
lea eax, [esp + 0x14]
push 0
lea ecx, [esp + 0xd4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea edx, [esp + 0xd0]
push edx
push 0x40d2e0
lea ecx, [esp + 0x48]
call fcn.00403ed0
mov eax, dword [esp + 0x2ec]
push eax
push edi
lea ecx, [esp + 0x48]
push ecx
lea edx, [esp + 0xa0]
push edx
call fcn.00404450
add esp, 0x10
inc esi
cmp esi, ebp
jl 0x404cc2
pop ebx
lea ecx, [esp + 0x90]
call fcn.00402dd0
cmp dword [esp + 0x24], 0x10
pop edi
pop esi
pop ebp
jb 0x404d95
mov eax, dword [esp + 4]
push eax
call fcn.0040582d
add esp, 4
lea ecx, [esp + 0x60]
mov dword [esp + 0x18], 0xf
mov dword [esp + 0x14], 0
mov byte [esp + 4], 0
call fcn.004041f0
lea ecx, [esp + 0x1c]
call fcn.004020c0
lea ecx, [esp + 0x30]
call fcn.004039f0
xor eax, eax
add esp, 0x2d0
ret 0x10

Function at 0x404df0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [ecx + 8]
test eax, eax
je 0x404e38
mov edx, dword [esp + 8]
push 0
push 0
lea eax, [esp + 8]
push eax
mov eax, dword [ecx + 4]
push 0
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x404e38
mov eax, dword [esp]
test eax, eax
jbe 0x404e38
cmp eax, 2
jbe 0x404e2f
cmp eax, 7
jne 0x404e38
mov eax, 1
pop ecx
ret 4
xor eax, eax
pop ecx
ret 4