joyce8/EMBER2024-capa huggingface dataset:
Function at 0x23a26030
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x23a477f9
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
lea edi, [esi + 0x2bc]
push edi
lea ecx, [esi + 0x118]
call sub.mfc90u.dll_CWnd::GetWindowTextW
mov ecx, edi
call dword [sym.imp.mfc90u.dll_]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
je 0x23a260e5
lea ecx, [esp + 0x10]
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_class]
mov eax, dword [edi]
push eax
lea ecx, [esp + 0x14]
push 0x324
push ecx
mov dword [esp + 0x28], ebx
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::Format]
add esp, 0xc
push ebx
push 0x24
lea ecx, [esp + 0x18]
call dword [sym.imp.mfc90u.dll_]
push eax
call sub.mfc90u.dll_AfxMessageBox
lea ecx, [esp + 0x10]
cmp eax, 6
je 0x23a260d7
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
mov dword [esp + 0x1c], 0xffffffff
call dword [sym.imp.mfc90u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
lea edx, [esi + 0x2c0]
push edx
push 0x3fd
mov ecx, esi
call sub.mfc90u.dll_CWnd::GetDlgItemTextW
mov ecx, edi
call dword [sym.imp.mfc90u.dll_]
push eax
push str.SaveAsPath
push SysReAllocString
mov ecx, 0x23a7cd30
call dword [sym.imp.actBasic.dll_public:_unsigned_long_int___thiscall_CApp::StoreString_struct_HKEY_____wchar_t_const___wchar_t_const__const]
push ebx
push ebx
push 0xf0
push 0x40e
mov ecx, esi
call sub.mfc90u.dll_CWnd::SendDlgItemMessageW
push ebx
push ebx
cmp eax, 1
push 0xf0
sete al
push 0x40d
mov ecx, esi
mov byte [esi + 0x2c4], al
call sub.mfc90u.dll_CWnd::SendDlgItemMessageW
push ebx
cmp eax, 1
push ebx
sete cl
push 0xf0
mov byte [esi + 0x2c5], cl
push 0x408
mov ecx, esi
call sub.mfc90u.dll_CWnd::SendDlgItemMessageW
cmp eax, 1
jne 0x23a26184
mov dword [esi + 0x2c8], ebx
mov dword [esi + 0x2cc], ebx
mov dword [esi + 0x2d0], ebx
mov dword [esi + 0x2d4], ebx
mov ecx, esi
call sub.mfc90u.dll_CDialog::OnOK
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x23a27310
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x23a478d9
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x23a7ca94]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, dword [esp + 0x24]
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x30]
mov dword [esi], eax
mov eax, dword [esp + 0x34]
mov dword [esi + 4], ecx
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0x10], esi
mov dword [esi + 0x10], eax
test eax, eax
je 0x23a27379
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov eax, dword [esp + 0x38]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 1
test eax, eax
je 0x23a273ab
mov edi, eax
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x23a273ab
test edi, edi
je 0x23a273ab
mov edx, dword [edi]
mov eax, dword [edx]
push 1
mov ecx, edi
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret
Function at 0x23a2a570
Capabilities:
Resume thread

Disassembly:
push esi
push 0
push 4
push 0
push 0
mov esi, ecx
push esi
push 0x23a298e0
call sub.mfc90u.dll_AfxBeginThread
mov dword [esi + 0xc], eax
test eax, eax
je 0x23a2a5a5
mov dword [eax + 0x28], 0
mov eax, dword [esi + 0xc]
mov ecx, dword [eax + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
pop esi
ret
mov edx, dword [esi + 8]
mov eax, dword [esi + 4]
push edx
push eax
push str._s:_Unable_launch___s__thread
call dword [sym.imp.actLogger32.dll_void___cdecl_logError_wchar_t_const__]
add esp, 0xc
mov eax, 0x9b
pop esi
ret

Function at 0x23a2b1f0
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
mov eax, dword [esi + 0xc]
test eax, eax
jne 0x23a2b1fe
pop esi
ret 4
mov ecx, dword [esp + 8]
mov eax, dword [eax + 0x2c]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
push eax
call edi
cmp eax, 0x102
jne 0x23a2b259
mov edx, dword [esi + 0xc]
mov eax, dword [edx + 0x30]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 4]
push eax
push ecx
push edx
push str._s:_Thread___s____u_id__has_been_terminated
call dword [sym.imp.actLogger32.dll_void___cdecl_logWarning_wchar_t_const__]
mov eax, dword [esi + 0xc]
add esp, 0x10
test eax, eax
je 0x23a2b23e
mov eax, dword [eax + 0x2c]
push 0x5b4
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov eax, dword [esi + 0xc]
test eax, eax
je 0x23a2b254
mov eax, dword [eax + 0x2c]
push 0xffffffffffffffff
push eax
call edi
mov eax, dword [esi + 0xc]
pop edi
test eax, eax
je 0x23a2b264
mov eax, dword [eax + 0x2c]
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
jne 0x23a2b28d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.GetExitCodeThread___failed_with_0x_08X_error
mov dword [esp + 0x10], eax
call dword [sym.imp.actLogger32.dll_void___cdecl_logError_char_const__]
add esp, 8
mov ecx, dword [esi + 0xc]
test ecx, ecx
je 0x23a2b29d
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push 1
call eax
mov eax, dword [esp + 8]
mov dword [esi + 0xc], 0
pop esi
ret 4
Function at 0x23a33330
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x23a3333a
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCR90.dll_fread]
add esp, 0x10
ret 0xc

Function at 0x23a33360
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [ecx + 4]
test eax, eax
jne 0x23a3336a
ret 0xc
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
push eax
mov eax, dword [esp + 0x10]
push eax
push ecx
push edx
call dword [sym.imp.MSVCR90.dll_fwrite]
add esp, 0x10
ret 0xc
Function at 0x23a41d28
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x23a7ca94]
jne 0x23a41d32
repz ret
jmp fcn.23a42646
Function at 0x401320
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor ebx, ebx
cmp byte [ebp + 0x10], bl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
je 0x4013c4
lea eax, [ebp + 0x10]
push eax
mov dword [ebp + 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [ebp + 0x10], 3
mov esi, eax
jl 0x4013a8
push dword [esi + 4]
push str._stdio
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
jne 0x4013a8
push ebx
push ebx
push 4
push ebx
push ebx
push 0xc0000000
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x40138c
push 5
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [sym.imp.KERNEL32.dll_SetStdHandle]
push eax
push 0xfffffffffffffff6
call esi
test eax, eax
je 0x401384
push dword [ebp - 4]
push 0xfffffffffffffff5
call esi
test eax, eax
jne 0x4013c4
jmp 0x401384
push str.AttachConsole
push str.kernel32.dll
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4013c4
push 0xffffffffffffffff
call eax
pop ecx
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
push dword [ebp + 8]
mov dword [ebp + 0x10], ebx
call fcn.00553000
add esp, 0x10
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x401464
mov eax, dword [section..data]
mov esi, dword [sym.imp.SHLWAPI.dll_AssocQueryStringW]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
push eax
push ebx
push ebx
mov edi, str..air
push edi
push 2
push ebx
mov dword [ebp + 0x10], ebx
call esi
cmp eax, 1
jne 0x40144e
mov eax, dword [ebp + 0x10]
add eax, eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp + 0x10]
push ecx
push eax
push ebx
push edi
push 2
push ebx
mov dword [ebp - 8], eax
call esi
test eax, eax
jne 0x40143d
mov eax, dword [str.This_application_requires_a_version_of_nAdobe_AIR_which_is_no_longer_supported._nPlease_contact_the_application_nauthor_for_an_updated_version.]
mov dword [ebp - 4], eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0x30
push str.Adobe_AIR
push dword [ebp - 4]
push ebx
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0xc]
jmp 0x40146e
push dword [ebp + 0x10]
push ebx
call edi
push eax
call dword [ebp - 4]
push eax
jmp 0x401386
Function at 0x4015a0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ecx
mov eax, dword [esp + 0x10]
push esi
push edi
xor edi, edi
xor esi, esi
cmp eax, edi
mov dword [esp + 8], edi
jbe 0x401694
mov ecx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [0x46585c]
lea eax, [esi + 1]
xor edx, edx
div ebp
mov esi, edx
xor edx, edx
mov bl, byte [esi + ecx]
mov eax, ebx
and eax, 0xff
add eax, edi
div ebp
mov edi, edx
mov al, byte [edi + ecx]
mov byte [esi + ecx], al
mov edx, dword [0x46586c]
sub edx, dword [0x465878]
imul edx, dword [0x465870]
add edx, edi
mov byte [edx + ecx], bl
mov eax, dword [0x465874]
mov ebp, dword [0x465878]
mov ebx, 1
lea edx, [eax + 1]
mov eax, dword [0x465870]
imul edx, eax
sub ebx, edx
mov edx, 2
imul ebx, ebp
add ebx, 3
imul ebx, eax
mov eax, dword [0x46586c]
sub edx, eax
imul edx, eax
mov eax, dword [0x465868]
add ebx, edx
dec eax
mov edx, dword [0x465868]
imul eax, dword [0x465874]
add ebx, eax
xor eax, eax
sub ebx, edx
xor edx, edx
mov dl, byte [esi + ecx]
add ebx, edi
mov al, byte [ebx + ecx]
add eax, edx
xor edx, edx
div dword [0x46585c]
lea eax, [ebp - 1]
imul eax, dword [0x46586c]
add ebp, edx
add eax, ebp
mov ebp, dword [esp + 0x1c]
mov dl, byte [eax + ecx]
mov eax, dword [esp + 0x10]
mov bl, byte [eax + ebp]
xor bl, dl
mov edx, dword [esp + 0x20]
mov byte [eax + ebp], bl
inc eax
cmp eax, edx
mov dword [esp + 0x10], eax
jb 0x4015bd
pop ebp
pop ebx
pop edi
pop esi
pop ecx
ret
Function at 0x4017c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ecx
mov eax, dword [0x465870]
mov edx, dword [0x465878]
mov ecx, dword [0x46586c]
push ebx
push ebp
push esi
mov esi, eax
mov ebx, dword [0x465874]
sub esi, edx
mov edx, dword [0x465868]
inc esi
mov ebp, eax
imul esi, ecx
imul ebp, ecx
sub esi, ebx
push edi
mov edi, dword [esp + 0x18]
sub esi, edx
add esi, eax
mov dword [esp + 0x10], 0
shl esi, 6
mov esi, dword [esi + edi + 0x3c]
mov esi, dword [esi + edi + 0x78]
add esi, edi
inc ebp
imul ebp, edx
inc ebp
imul ebp, ebx
mov ebx, eax
sub ebx, edx
mov edx, dword [0x465878]
add ebp, edx
lea edx, [ecx + 2]
imul edx, dword [0x465868]
sub ebx, ecx
lea ebx, [ebp + ebx*2]
add edx, ebx
mov ebx, dword [esi + 0x20]
add edx, ecx
lea edx, [ebx + edx*4]
mov ebx, dword [0x465874]
sub eax, ebx
mov ebx, dword [0x465878]
sub eax, ecx
add edx, edi
lea ebp, [ebx - 1]
inc eax
imul ebp, dword [0x465874]
imul eax, dword [0x465868]
add ebp, ebx
lea ebx, [ecx - 1]
imul ebx, ecx
add ebp, eax
mov eax, dword [esi + 0x1c]
add ebx, ebp
mov ebp, dword [esi + 0x24]
add ebp, edi
lea ebx, [eax + ebx*4]
mov eax, dword [esi + 0x18]
add ebx, edi
test eax, eax
jbe 0x4018b8
mov dword [esp + 0x18], edx
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx]
add eax, edi
push eax
call fcn.00401450
mov ecx, dword [esp + 0x20]
add esp, 4
cmp eax, ecx
je 0x4018c0
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x10], eax
mov dword [esp + 0x18], edx
jb 0x401884
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x10]
xor edx, edx
mov dx, word [ebp + eax*2]
mov eax, dword [ebx + edx*4]
add eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x40f0c5
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x466bf0
cmp edx, dword [eax]
je 0x40f0e7
add eax, 8
inc ecx
cmp eax, 0x466c80
jl 0x40f0d8
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x466bf0]
jne 0x40f215
mov eax, dword [0x46993c]
cmp eax, 1
je 0x40f1ef
test eax, eax
jne 0x40f118
cmp dword [0x4666fc], 1
je 0x40f1ef
cmp edx, 0xfc
je 0x40f215
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40f14f
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040f2b0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040f3a0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40f192
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040f3a0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x422fac
push edi
call fcn.004109b0
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040f2b0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040f2c0
lea eax, [ebp - 0xa0]
push 0x422f8c
push eax
call fcn.0040f2c0
push dword [esi + 0x466bf4]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040f2c0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00410927
add esp, 0x2c
pop edi
jmp 0x40f215
lea eax, [ebp + 8]
lea esi, [esi + 0x466bf4]
push 0
push eax
push dword [esi]
call fcn.0040f3a0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x4174af
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4174f1
call fcn.0041bdc2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x4174f1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4174e8
xor eax, eax
jmp 0x4174f9
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004174ff
pop edi
pop esi
pop ebx
ret 4

Function at 0x41c2b5
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x41c2e3
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x41c301
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0041c21b
jmp 0x41c301
mov eax, dword [esi + 0x14]
test eax, eax
je 0x41c301
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0041c21b
test edi, edi
mov eax, edi
jne 0x41c2eb
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 0
push 0
push 2
push 0
push 1
push 0x40000000
push eax
xor bl, bl
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x401025
lea ecx, [esp + 0xc]
push 0
push ecx
push 0xd000
push section..data
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401043
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop esi
pop ebx
ret

Function at 0x401120
Capabilities:
Create directory

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x401d58
push eax
mov dword fs:[0], esp
push esi
mov esi, dword [esp + 0x14]
push 0
mov eax, dword [esi]
push eax
call dword [sym.imp.MSVCRT.dll__access]
add esp, 8
cmp eax, 0xffffffff
jne 0x40119a
mov eax, dword [esi]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40119a
push 0x5c
mov ecx, esi
call sub.MFC42.DLL_CString::ReverseFind
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::Left
push eax
mov dword [esp + 0x10], 0
call fcn.00401120
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0xc], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov edx, dword [esi]
push edx
call dword [sym.imp.MSVCRT.dll__mkdir]
add esp, 4
mov ecx, dword [esp + 4]
pop esi
mov dword fs:[0], ecx
add esp, 0xc
ret

Function at 0x401210
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40122e
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x40122e
xor eax, eax
ret
mov eax, 1
ret

Function at 0x401540
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push esi
push edi
mov esi, ecx
push str.ADVAPI32.dll
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esi + 0x20], eax
test eax, eax
je 0x401586
push str.RegOpenKeyExA
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi + 0x20]
push str.RegQueryValueExA
push eax
call edi
mov ecx, dword [esi + 0x20]
push str.RegCloseKey
push ecx
mov dword [esi + 0xc], eax
call edi
mov dword [esi + 0x10], eax
push str.kernel32.dll
call ebx
test eax, eax
mov dword [esi + 0x24], eax
je 0x4015bb
push str.ReleaseMutex
push eax
call edi
mov edx, dword [esi + 0x24]
push str.CreateMutexA
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x24]
push str.GetVersionExA
push eax
call edi
mov dword [esi + 0x1c], eax
push str.shell32.dll
call ebx
test eax, eax
mov dword [esi + 0x28], eax
je 0x4015d4
push str.ShellExecuteA
push eax
call edi
mov dword [esi + 4], eax
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x401a30
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file
Query environment variable

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x401d7b
push eax
mov dword fs:[0], esp
sub esp, 0x304
push ebx
push esi
push edi
push 0x32c
mov edi, ecx
push 0x410000
call fcn.004019d0
add esp, 8
mov ecx, edi
call fcn.004015f0
test eax, eax
jne 0x401c59
mov eax, dword [0x410064]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push 0x410068
push eax
push 0x410000
lea ecx, [esp + 0x2b8]
push str._s:_d:_s
push ecx
call ebx
add esp, 0x14
lea edx, [esp + 0x2ac]
push edx
push 0
push 0
call dword [edi + 0x14]
mov esi, eax
test esi, esi
je 0x401abf
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x401c60
push esi
call dword [edi + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [esp + 0x10]
push 0x104
push eax
push 0x4101b0
call esi
lea ecx, [esp + 0x10]
push ecx
call fcn.00401210
add esp, 4
test eax, eax
jne 0x401b7b
lea edx, [esp + 0x114]
mov dword [esp + 0x114], 0x94
push edx
call dword [edi + 0x1c]
cmp dword [esp + 0x124], 2
jne 0x401b20
cmp dword [esp + 0x118], 6
jae 0x401b6a
lea eax, [esp + 0x10]
lea ecx, [esp + 0xc]
push eax
call fcn.00401d2e
lea ecx, [esp + 0xc]
mov dword [esp + 0x318], 0
push ecx
call fcn.00401120
add esp, 4
lea ecx, [esp + 0xc]
mov dword [esp + 0x318], 0xffffffff
call sub.MFC42.DLL_CString::CString
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x401b7b
lea eax, [esp + 0x10]
push 0x104
push eax
push str._Temp__
call esi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [esp + 0x10]
push eax
push ecx
lea edx, [esp + 0x1b0]
push str._s_d.txt
push edx
call ebx
lea eax, [esp + 0x1b8]
push eax
call fcn.00401340
add esp, 0x14
test al, al
je 0x401c59
lea ecx, [esp + 0x1a8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x401c50
mov eax, dword [0x4101ac]
test eax, eax
je 0x401bed
push str.MainThread
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
lea edx, [esp + 0x1a8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x401c49
push str.Install
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x401c49
lea ecx, [esp + 0x1a8]
push ecx
call eax
test eax, eax
jne 0x401c49
lea edx, [esp + 0x1a8]
lea eax, [esp + 0x10]
push edx
push str.___s__MainThread
push eax
call ebx
add esp, 0xc
lea ecx, [esp + 0x10]
push 0
push 0
push ecx
push str.rundll32.exe
push str.open
push 0
call dword [edi + 4]
push 4
lea edx, [esp + 0x14]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [0x4101a4]
test eax, eax
jne 0x401c60
mov ecx, edi
call fcn.004015e0
mov ecx, dword [esp + 0x310]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x310
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x100013a0
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x10012004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1001338c]
test eax, eax
je 0x100013ca
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1001338c], 0
push ecx
lea eax, [ebp - 0x44]
push eax
call fcn.10001990
add esp, 8
test eax, eax
je 0x10001441
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x10001440
push esi
push 0xf01ff
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
jne 0x1000141f
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001b10
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001b10
mov esp, ebp
pop ebp
ret