joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403257
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, eax
sub ebx, dword [0x43b870]
mov edi, eax
add ebx, dword [0x43b880]
call sub.KERNEL32.dll_GetTickCount
add eax, 0x1f4
test ebx, ebx
mov dword [0x4a0cf8], eax
jle 0x4033e4
sub esp, 0xc
push dword [0x43b890]
call fcn.00403124
add esp, 0xc
push 0
push 0
push dword [0x43b870]
push dword [0x409014]
call sub.KERNEL32.dll_SetFilePointer
mov dword [0x43b8b0], ebx
mov dword [0x43b8c0], 0
mov esi, dword [0x43b8a0]
sub esi, dword [0x43b890]
cmp esi, 0x4000
jle 0x4032d6
mov esi, 0x4000
push eax
push eax
push esi
push 0x43b960
call fcn.00403140
pop ecx
test eax, eax
pop ebx
jne 0x4032f1
or eax, 0xffffffff
jmp 0x403401
add dword [0x43b890], esi
mov dword [0x43b8e8], 0x43b960
mov dword [0x43b8ec], esi
cmp dword [0x4a0ca8], 0
je 0x403340
cmp dword [0x4a0c68], 0
jne 0x403340
mov edx, edi
sub esp, 0xc
sub edx, dword [0x43b870]
mov eax, dword [0x43b8b0]
add edx, dword [0x43b880]
push 0
sub eax, edx
mov dword [0x43b8c0], eax
call fcn.0040319b
add esp, 0x10
mov ecx, 0x43b8d0
mov dword [0x43b8f0], 0x43f960
mov dword [0x43b8f4], 0x8000
call fcn.00406ff1
test eax, eax
js 0x4033f5
mov eax, dword [0x43b8f0]
mov ebx, eax
sub ebx, 0x43f960
je 0x4033af
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push ebx
push 0x43f960
push dword [0x409014]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x4033fc
cmp ebx, dword [ebp - 0x10]
jne 0x4033fc
add dword [0x43b870], ebx
cmp dword [0x43b8ec], 0
je 0x4033bc
jmp 0x403307
cmp dword [0x43b8ec], 0
jne 0x4033f5
test esi, esi
je 0x4033f5
mov edx, dword [0x43b880]
mov eax, edx
sub eax, dword [0x43b870]
add eax, edi
test eax, eax
jg 0x4032bd
push 0
push 0
push edx
push dword [0x409014]
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0xc
push 1
call fcn.0040319b
xor eax, eax
add esp, 0x10
jmp 0x403401
mov eax, 0xfffffffd
jmp 0x403401
mov eax, 0xfffffffe
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403409
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
test eax, eax
js 0x403437
add eax, dword [0x4a0cf0]
push 0
push 0
push eax
push dword [0x409014]
mov dword [0x43b880], eax
call sub.KERNEL32.dll_SetFilePointer
mov eax, 4
call fcn.00403257
mov ebx, eax
test eax, eax
js 0x403549
sub esp, 0xc
lea eax, [ebp - 0x14]
lea esi, [ebp - 0x10]
push 0
push esi
push 4
push eax
push dword [0x409014]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40353d
cmp dword [ebp - 0x10], 4
jne 0x40353d
mov eax, dword [ebp - 0x14]
add dword [0x43b880], 4
call fcn.00403257
mov ebx, eax
test eax, eax
js 0x403549
test edi, edi
je 0x4034fd
jmp 0x403509
mov esi, eax
cmp eax, 0x4000
jle 0x4034a7
mov esi, 0x4000
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push esi
push 0x43b960
push dword [0x409014]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40353d
cmp esi, dword [ebp - 0x10]
jne 0x40353d
sub esp, 0xc
push 0
push edi
push esi
push 0x43b960
push dword [ebp + 0xc]
call sub.KERNEL32.dll_WriteFile
add esp, 0xc
test eax, eax
je 0x403544
cmp dword [ebp - 0x18], esi
jne 0x403544
mov eax, dword [ebp - 0x10]
sub dword [ebp - 0x14], eax
add ebx, eax
add dword [0x43b880], eax
jmp 0x403500
lea edi, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
test eax, eax
jg 0x403499
jmp 0x403549
sub esp, 0xc
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0x14]
push 0
push eax
mov eax, dword [ebp + 0x14]
cmp eax, edx
jle 0x40351e
mov eax, edx
push eax
push edi
push dword [0x409014]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40353d
mov ebx, dword [ebp - 0x10]
add dword [0x43b880], ebx
jmp 0x403549
mov ebx, 0xfffffffd
jmp 0x403549
mov ebx, 0xfffffffe
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x403959
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x58b000
call fcn.0040636a
push 0x58b000
call fcn.00406120
xor edx, edx
add esp, 0xc
test eax, eax
je 0x4039ac
sub esp, 0xc
push 0x58b000
call fcn.00406467
sub esp, 0xc
push 0
push 0x58b000
call sub.KERNEL32.dll_CreateDirectoryA
push 0x58b000
push 0x583000
call fcn.00406816
mov edx, eax
add esp, 0x18
mov eax, edx
leave
ret
Function at 0x4064db
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 0x14]
lea edx, [ebp - 8]
mov byte [ebx], 0
push edx
cmp dword [ebp + 0x18], 1
sbb eax, eax
xor al, al
add eax, 0x20119
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x406554
push eax
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x8000
push eax
lea eax, [ebp - 0x10]
push ebx
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegQueryValueExA
pop edx
test eax, eax
pop ecx
jne 0x40653c
mov eax, dword [ebp - 0x10]
dec eax
cmp eax, 1
jbe 0x40653f
mov byte [ebx], 0
mov byte [ebx + 0x7fff], 0
sub esp, 0xc
push dword [ebp - 8]
call sub.ADVAPI32.DLL_RegCloseKey
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret 0x14
Function at 0x406816
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov edi, 0x64
mov esi, dword [ebp + 8]
jmp 0x40685b
mov dword [ebp - 0x10], 0x61736e
mov bl, byte [ebp - 0xe]
call sub.KERNEL32.dll_GetTickCount
mov edx, 0x1a
push esi
mov ecx, edx
xor edx, edx
div ecx
lea eax, [ebp - 0x10]
push 0
push eax
add ebx, edx
push dword [ebp + 0xc]
mov byte [ebp - 0xe], bl
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x406866
dec edi
cmp edi, 0xffffffff
jne 0x406829
mov byte [esi], 0
xor esi, esi
lea esp, [ebp - 0xc]
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x406872
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xc
push dword [ebp + 8]
push 0x4907b8
call fcn.004064a4
push ecx
push 0x4907b8
call fcn.00406301
add esp, 0xc
mov ebx, eax
test eax, eax
je 0x406927
sub esp, 0xc
push eax
call fcn.0040636a
add esp, 0xc
cmp byte [0x4a0d08], 0
jns 0x4068ea
mov al, byte [ebx]
test al, al
je 0x406927
cmp al, 0x5c
jne 0x4068ea
jmp 0x406927
sub esp, 0xc
push 0x4907b8
call fcn.004062a2
add esp, 0xc
test eax, eax
je 0x4068d8
test byte [eax], 0x10
je 0x406927
sub esp, 0xc
push 0x4907b8
call fcn.00406432
add esp, 0xc
jmp 0x4068f0
sub ebx, 0x4907b8
sub esp, 0xc
push 0x4907b8
call fcn.00406429
add esp, 0xc
cmp eax, ebx
jg 0x4068bf
sub esp, 0xc
push 0x4907b8
call fcn.00406467
push 0x4907b8
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
inc eax
setne al
movzx eax, al
jmp 0x406929
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x406930
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
pop edx
xor edx, edx
cmp eax, 0xffffffff
pop ecx
setne dl
neg edx
and edx, eax
push 0
push edx
push dword [ebp + 0x10]
push 0
push 1
push dword [ebp + 0xc]
push ebx
call sub.KERNEL32.dll_CreateFileA
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x406968
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
add esp, 0xc
cmp eax, 0xffffffff
je 0x40698e
and eax, 0xfffffffe
push edx
push edx
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
pop ebx
pop eax
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x4069fb
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
push 1
call fcn.00406253
add esp, 0xc
test eax, eax
je 0x406a28
push edx
push 5
push ebx
push esi
call eax
pop edi
test eax, eax
jne 0x406bee
mov dword [0x48fbb8], 0x4c554e
test ebx, ebx
je 0x406a71
push ecx
push 1
push 0
push ebx
call fcn.00406930
push edx
push edx
push eax
call sub.KERNEL32.dll_CloseHandle
push eax
push eax
push 0x400
push 0x48fbb8
push ebx
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0x14
test eax, eax
je 0x406bf4
cmp eax, 0x400
jg 0x406bf4
push eax
push 0x400
push 0x48ffb8
push esi
call sub.KERNEL32.dll_GetShortPathNameA
pop edi
test eax, eax
je 0x406bf4
cmp eax, 0x400
jg 0x406bf4
push 0x48ffb8
push 0x48fbb8
push str._s_s_r_n
push 0x4903b8
call sub.USER32.dll_wsprintfA
pop ebx
mov dword [ebp - 0x24], eax
mov eax, dword [0x4a0ca8]
pop esi
push dword [eax + 0x128]
push 0x48ffb8
call fcn.0040655b
sub esp, 0xc
push 4
push 0xc0000000
push 0x48ffb8
call fcn.00406930
add esp, 0x14
mov dword [ebp - 0x20], eax
cmp eax, 0xffffffff
je 0x406bee
push ecx
push ecx
push 0
push eax
call sub.KERNEL32.dll_GetFileSize
mov edx, dword [ebp - 0x24]
mov ebx, eax
lea eax, [eax + edx + 0xa]
push eax
push 0x40
call sub.KERNEL32.dll_GlobalAlloc
mov esi, eax
pop eax
test esi, esi
pop edx
je 0x406be0
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
push ebx
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x406be0
cmp ebx, dword [ebp - 0x10]
jne 0x406be0
push edi
push edi
push str._Rename__r_n
push esi
call fcn.00406995
pop edx
test eax, eax
pop ecx
jne 0x406b66
push eax
push eax
lea eax, [esi + ebx]
push str._Rename__r_n
push eax
call fcn.004064a4
add ebx, 0xa
pop ecx
mov eax, ebx
pop edi
jmp 0x406b9f
add eax, 0xa
push edx
push edx
push 0x40a3ef
push eax
call fcn.00406995
mov edx, eax
pop edi
test edx, edx
pop eax
mov eax, ebx
je 0x406b9f
lea ecx, [edx + 1]
lea edi, [esi + ebx]
mov edx, ecx
mov dword [ebp - 0x28], edi
jmp 0x406b96
mov edi, dword [ebp - 0x24]
mov al, byte [edx]
mov byte [edi + edx], al
inc edx
cmp edx, dword [ebp - 0x28]
jb 0x406b8d
mov eax, ecx
sub eax, esi
push dword [ebp - 0x24]
lea eax, [esi + eax]
push 0x4903b8
push eax
call fcn.0040614f
push 0
push 0
push 0
push dword [ebp - 0x20]
call sub.KERNEL32.dll_SetFilePointer
mov edx, dword [ebp - 0x24]
sub esp, 0xc
lea eax, [ebp - 0x10]
push 0
push eax
lea eax, [ebx + edx]
push eax
push esi
push dword [ebp - 0x20]
call sub.KERNEL32.dll_WriteFile
push esi
call sub.KERNEL32.dll_GlobalFree
add esp, 0xc
sub esp, 0xc
push dword [ebp - 0x20]
call sub.KERNEL32.dll_CloseHandle
add esp, 0xc
inc dword [0x4a0c58]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x406efe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [0x4a07b8], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x4a07b8
push 0
push 0
push 0
push 0
push 0
push 0
push dword [ebp + 8]
push 0
call sub.KERNEL32.dll_CreateProcessA
pop edx
xor edx, edx
pop ecx
test eax, eax
je 0x406f46
sub esp, 0xc
push dword [ebp - 0xc]
call sub.KERNEL32.dll_CloseHandle
mov edx, dword [ebp - 0x10]
add esp, 0xc
mov eax, edx
leave
ret 4

Function at 0x406f4c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
cmp dword [0x4a080c], 0
push ebx
mov esi, dword [ebp + 0x10]
jne 0x406f89
xor ebx, ebx
mov edx, ebx
xor ecx, ecx
mov eax, edx
inc ecx
shr edx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor edx, eax
cmp ecx, 8
jne 0x406f63
mov dword [ebx*4 + 0x4a0808], edx
inc ebx
cmp ebx, 0x100
jne 0x406f5f
mov edx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
not edx
jmp 0x406fa5
mov al, byte [ecx - 1]
xor eax, edx
movzx eax, al
shr edx, 8
xor edx, dword [eax*4 + 0x4a0808]
dec esi
inc ecx
cmp esi, 0xffffffff
jne 0x406f93
not edx
mov eax, edx
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x717f90
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x142000]
push edi
jmp 0x717faa
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x717fb1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x717fa0
mov eax, 1
add ebx, ebx
jne 0x717fc3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x717fd4
jne 0x717ff3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x717ff3
dec eax
add ebx, ebx
jne 0x717fe0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x717fb8
add ebx, ebx
jne 0x717fef
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x718045
xor ecx, ecx
sub eax, 3
jb 0x71800b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x71807a
sar eax, 1
mov ebp, eax
jmp 0x718016
add ebx, ebx
jne 0x718016
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x717fe4
inc ecx
add ebx, ebx
jne 0x718024
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x717fe4
add ebx, ebx
jne 0x718031
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x718026
jne 0x718042
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x718026
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x718064
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x718056
jmp 0x717fa6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x718064
add edi, ecx
jmp 0x717fa6
pop esi
mov edi, esi
mov ecx, 0xaf08
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x718082
cmp byte [edi], 0x20
jne 0x718082
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x718087
lea edi, [esi + 0x312000]
mov eax, dword [edi]
or eax, eax
je 0x7180ff
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x318000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3181e4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7180b4
mov ecx, edi
jns 0x7180e3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3181ec]
or eax, eax
je 0x7180f9
mov dword [ebx], eax
add ebx, 4
jmp 0x7180d1
call dword [esi + 0x3181e8]
mov ebp, dword [esi + 0x3181f0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x718133
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x56012e10
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x3db8784f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401509
Capabilities:
Read .ini file
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0xf8
mov eax, dword [0x42197c]
push ebx
push esi
push edi
xor eax, ebp
push 4
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
xor ebx, ebx
push ebx
push eax
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x74], eax
call fcn.004058a0
add esp, 0xc
mov esi, str..key.ini
push esi
push ebx
push 0x41a75c
mov edi, str.keys
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
push 2
mov dword [ebp - 0x84], eax
lea eax, [ebp - 0x70]
push ebx
push eax
call fcn.004058a0
push 0x64
lea eax, [ebp - 8]
push ebx
push eax
call fcn.004058a0
push 0x14
lea eax, [ebp + 0x5c]
push ebx
push eax
call fcn.004058a0
push ebx
call fcn.0040585f
push eax
call fcn.00405830
call fcn.0040583d
movzx ecx, word [ebp - 0x84]
cdq
idiv ecx
movzx eax, dx
push eax
lea eax, [ebp + 0x5c]
push 0x41a750
push eax
call fcn.004057d8
add esp, 0x38
push esi
push 0x64
push dword [ebp - 0x74]
mov ebx, 0x41a74c
push ebx
lea eax, [ebp + 0x5c]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call edi
push esi
push 0x64
lea eax, [ebp - 8]
push eax
push ebx
push 0x41a748
push 0x41a710
call edi
push esi
push 3
lea eax, [ebp - 0x80]
push eax
push ebx
push str.root
push 0x41a710
call edi
push esi
push 2
lea eax, [ebp - 0x70]
push eax
push ebx
push str.debug
push 0x41a710
call edi
lea eax, [ebp - 0x70]
push eax
push 0x41a734
call fcn.00405750
test eax, eax
pop ecx
pop ecx
jne 0x401623
mov ecx, dword [ebp - 0x7c]
push eax
lea eax, [ebp + 0x5c]
push eax
push dword [ebp - 0x74]
call fcn.004120af
lea eax, [ebp - 0x80]
push eax
call fcn.00405743
cmp ax, 1
pop ecx
mov dword [ebp - 0x7c], eax
jne 0x401649
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 8]
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
cmp word [ebp - 0x7c], 2
jne 0x401663
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
push esi
push 0x64
lea eax, [ebp - 0x6c]
push eax
push ebx
push str.subkey
push 0x41a710
call edi
push dword [ebp - 0x74]
call fcn.00405630
pop ecx
inc eax
push eax
push dword [ebp - 0x74]
lea eax, [ebp - 0x6c]
push 1
push 0
push eax
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040526e
add ebp, 0x74
leave
ret 4
Function at 0x401e97
Capabilities:
Read .ini file
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0x224
mov eax, dword [0x42197c]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push edi
xor eax, ebp
push str.._name.ini
mov dword [ebp + 0x64], eax
mov eax, dword [ebp + 0x70]
push 0x64
mov dword [ebp - 0x1b8], ecx
lea ecx, [ebp - 0xdc]
push ecx
mov dword [ebp - 0x1bc], eax
mov eax, dword [ebp + 0x78]
mov esi, 0x41a74c
push esi
mov dword [ebp - 0x1b4], eax
mov eax, dword [ebp + 0x7c]
push str.compatibility
push eax
call ebx
xor eax, eax
mov byte [ebp - 0x1a8], 0
lea edi, [ebp - 0x1a7]
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x18
mov byte [ebp - 0x78], 0
xor eax, eax
pop ecx
lea edi, [ebp - 0x77]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x1ac], 1
mov edi, 0x80000001
push 0x64
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.004058a0
push 0xa
lea eax, [ebp - 0x1a8]
push eax
movzx eax, word [ebp - 0x1ac]
push eax
call fcn.0040dd6c
add esp, 0x18
push str..COMP.INI
push 0x64
lea eax, [ebp - 0x14]
push eax
push esi
push str.compexe
lea eax, [ebp - 0x1a8]
push eax
call ebx
lea eax, [ebp - 0x14]
push eax
push esi
call fcn.00405750
test eax, eax
pop ecx
pop ecx
je 0x402061
push str..COMP.INI
push 0x14
lea eax, [ebp + 0x50]
push eax
push esi
push str.comptype
lea eax, [ebp - 0x1a8]
push eax
call ebx
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xdc]
push eax
lea eax, [ebp - 0x78]
push str._s:_s_____s
push eax
call fcn.004057d8
mov ecx, dword [ebp - 0x1b8]
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
add ecx, 0xc4
call fcn.0041486c
push dword [ebp - 0x1bc]
push 0x41a734
call fcn.00405750
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x14]
push eax
jne 0x401fe7
movsx eax, byte [ebp + 0x74]
push eax
push str._c:_s
jmp 0x401ff2
push dword [ebp - 0x1b4]
push 0x41a8fc
lea eax, [ebp - 0x1a4]
push eax
call fcn.004057d8
add esp, 0x10
lea eax, [ebp - 0x1b0]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 0x1b0]
push eax
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsLayers
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp + 0x50]
push eax
call fcn.00405630
pop ecx
push eax
lea eax, [ebp + 0x50]
push eax
push 1
push 0
lea eax, [ebp - 0x1a4]
push eax
push dword [ebp - 0x1b0]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
inc dword [ebp - 0x1ac]
cmp word [ebp - 0x1ac], 0xa
jb 0x401f1e
mov ecx, dword [ebp + 0x64]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040526e
add ebp, 0x68
leave
ret 0x10
Function at 0x4024d3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
mov dword [ebp - 0x10], ecx
add ebx, 0xd6
mov dword [ebp - 0xc], 0xf
mov edi, 0x41a74c
push 3
lea eax, [ebp + 8]
push 0
push eax
call fcn.004058a0
push 0xa
lea eax, [ebp + 8]
push eax
push dword [ebp - 8]
call fcn.0040dd6c
add esp, 0x18
push str.._name.ini
push 0xa
push ebx
push edi
lea eax, [ebp + 8]
push eax
push str.nickname
call esi
push str.._name.ini
push 0x64
lea eax, [ebx - 0xd6]
push eax
push edi
push ebx
push dword [ebp + 0xc]
call esi
push str..dllinst.ini
push 3
lea eax, [ebp - 4]
push eax
push edi
push ebx
push str.install
call esi
lea eax, [ebp - 4]
push eax
call fcn.00405743
inc dword [ebp - 8]
mov word [ebx - 0x72], ax
add ebx, 0x146
dec dword [ebp - 0xc]
pop ecx
jne 0x4024fe
mov esi, dword [ebp - 0x10]
push 5
lea ecx, [esi + 0x168]
mov word [esi + 0x164], 5
call fcn.00401935
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40283e
Capabilities:
Create process on windows
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x114]
sub esp, 0x194
mov eax, dword [0x42197c]
xor eax, ebp
push ebx
mov dword [ebp + 0x110], eax
mov eax, dword [ebp + 0x11c]
push esi
push edi
mov dword [ebp - 0x2c], eax
xor eax, eax
push 0x31
pop ecx
mov byte [ebp - 0x24], 0
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
push 0x18
mov byte [ebp + 0xa4], 0
pop ecx
lea edi, [ebp + 0xa5]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp + 0x108], 0
xor eax, eax
lea edi, [ebp + 0x109]
stosd dword es:[edi], eax
stosb byte es:[edi], al
mov dword [ebp - 0x28], 1
mov ebx, str.._regsvr32.ini
mov esi, 0x41a74c
mov edi, 0x41a710
push 0x44
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.004058a0
push 0xa
lea eax, [ebp + 0x108]
push eax
movzx eax, word [ebp - 0x28]
push eax
mov dword [ebp - 0x68], 0x44
mov dword [ebp - 0x54], 1
mov word [ebp - 0x50], 5
call fcn.0040dd6c
add esp, 0x18
push ebx
push 0x64
lea eax, [ebp + 0xa4]
push eax
push esi
lea eax, [ebp + 0x108]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp + 0xa4]
push esi
push eax
call fcn.00405750
test eax, eax
pop ecx
pop ecx
je 0x402983
push ebx
push 0
push str.debug
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
lea eax, [ebp + 0xa4]
push eax
push dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
je 0x40293e
push str.regsvr32___s_s_
jmp 0x402943
push str.regsvr32__s___s_s_
push eax
call fcn.004057d8
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x2c]
xor eax, eax
push eax
push 0x20
push eax
push eax
push eax
lea ecx, [ebp - 0x24]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
inc dword [ebp - 0x28]
cmp word [ebp - 0x28], 0x78
jbe 0x4028b4
mov ecx, dword [ebp + 0x110]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040526e
add ebp, 0x114
leave
ret 4