joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40672b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x41c380]
push ebx
mov dword [ebp - 4], eax
push edi
xor ebx, ebx
xor eax, eax
mov byte [ebp - 0xc], bl
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
stosb byte es:[edi], al
movzx eax, word [ebp + 0xc]
cmp eax, ebx
jle 0x4068af
cmp eax, 2
jle 0x4068aa
cmp eax, 0x3fa
jle 0x4068af
cmp eax, 0x41e
jle 0x406882
cmp eax, 0x41f
je 0x406842
cmp eax, 0x420
je 0x40679d
cmp eax, 0x421
jne 0x4068af
push dword [ebp + 8]
call fcn.00405c79
pop ecx
jmp 0x4068b1
cmp dword [0x41c060], ebx
push esi
push 0x1a
mov esi, 0x405
pop edi
jne 0x4067f2
push 6
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0040c880
add esp, 0xc
push 2
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
lea eax, [ebp - 0xc]
push eax
call fcn.0040e4f9
pop ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
inc esi
dec edi
jne 0x4067ae
mov dword [0x41c060], 1
jmp 0x406830
push 6
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0040c880
add esp, 0xc
push 2
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
lea eax, [ebp - 0xc]
push eax
call fcn.0040e3e5
pop ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
inc esi
dec edi
jne 0x4067f2
mov dword [0x41c060], ebx
push dword [0x42cc58]
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
inc eax
pop esi
jmp 0x4068b1
push ebx
push 8
push 0x102
push dword [0x42cc58]
call dword [sym.imp.USER32.dll_SendMessageA]
push 0xc8
push 0x42caa8
push dword [0x42cc58]
call dword [sym.imp.USER32.dll_GetWindowTextA]
call fcn.00406322
push dword [0x42cc58]
call dword [sym.imp.USER32.dll_SetFocus]
xor eax, eax
inc eax
jmp 0x4068b1
add eax, 0xfffffc05
cmp word [ebp + 0xc], 0x405
jb 0x40689a
cmp dword [0x41c060], ebx
je 0x40689a
add eax, 0x1a
mov al, byte [eax + str.1234567890qwertyuiopasdfghjklzxcvbnmQWERTYUIOPASDFGHJKLZXCVBNM]
mov byte [ebp - 0xc], al
movsx eax, al
push ebx
push eax
jmp 0x406845
call fcn.004066f1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop ebx
call fcn.0040c86c
leave
ret
Function at 0x4068bd
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x41c380]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [0x42cc50]
mov dword [0x42cc60], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x406900
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.00405c9b
add esp, 0x14
mov byte [ebp - 0xc], 0
xor eax, eax
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
mov esi, 0x405
stosb byte es:[edi], al
mov edi, esi
mov dword [ebp + 8], 0x1a
push 6
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.0040c880
add esp, 0xc
push 2
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
lea eax, [ebp - 0xc]
push eax
call fcn.0040e3e5
pop ecx
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
inc edi
dec dword [ebp + 8]
jne 0x406919
and dword [0x41c060], 0
push ebx
call fcn.004062e0
push 0xa
push 0x3fb
push ebx
call fcn.00405e63
push 0x1a
push esi
push ebx
call fcn.00405e63
add esp, 0x1c
call fcn.00406322
push 0x40671e
push 0x32
push 1
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00405c39
mov edi, 0xc8
push edi
push 0
mov esi, 0x42caa8
push esi
call fcn.0040c880
add esp, 0xc
push edi
push esi
push dword [0x42cc58]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp - 4]
xor eax, eax
inc eax
call fcn.0040c86c
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406a14
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x41c380]
and dword [ebp - 0x48], 0
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 0x44], 0
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00406391
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
call esi
push dword [ebp + 0x10]
mov dword [0x42cc58], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [0x42caa0], eax
mov dword [0x42cc5c], edi
call esi
push dword [ebp + 0x14]
mov dword [0x42cc58], eax
push edi
call esi
push 0x40
mov dword [0x42cc54], eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x10]
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x44]
push eax
push 0x42caa8
call fcn.0040c6b0
cmp dword [0x42cc60], 0
pop ecx
pop ecx
jne 0x406ad8
call fcn.00406029
push 0
push 0x4069c4
push edi
push 0x84
push dword [ebp + 8]
mov dword [0x42cc50], edi
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x42cc60], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x48], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
pop edi
pop esi
call fcn.0040c86c
leave
ret
Function at 0x408308
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x41c380]
mov dword [ebp + 0x74], eax
push esi
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x1c]
cmp eax, 6
jbe 0x40833b
push 7
jmp 0x408372
jne 0x408352
cmp dword [ebp - 0x18], 1
jbe 0x408347
push 7
jmp 0x408368
je 0x408343
cmp dword [ebp - 0x18], esi
jne 0x40837b
push 6
jmp 0x408368
cmp eax, 5
jne 0x408373
cmp dword [ebp - 0x18], 2
jne 0x408360
push eax
jmp 0x408368
cmp dword [ebp - 0x18], 1
jne 0x40836b
push 4
pop esi
jmp 0x40837b
cmp dword [ebp - 0x18], esi
jne 0x40837b
push 3
pop esi
cmp eax, 4
ja 0x40837b
xor esi, esi
inc esi
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.0040c86c
add ebp, 0x78
leave
ret

Function at 0x40843f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40845d
xor eax, eax
leave
ret
push esi
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret

Function at 0x408489
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push 4
pop esi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4084b0
xor eax, eax
jmp 0x4084de
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp - 8], esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
sete al
pop esi
leave
ret
Function at 0x408d17
Capabilities:
Switch active desktop

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x104
mov eax, dword [0x41c380]
push ebx
push esi
push edi
push 0xd9
mov dword [ebp + 0x70], eax
xor ebx, ebx
lea eax, [ebp - 0x8c]
push ebx
push eax
call fcn.0040c880
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov esi, dword [ebp + 0x7c]
mov dword [0x42cc9c], eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 7
xor eax, eax
pop ecx
mov byte [ebp + 0x50], bl
lea edi, [ebp + 0x51]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp + 0x50]
push eax
push ebx
mov dword [ebp - 0x90], 0x20
call fcn.00404562
add esp, 0xc
test eax, eax
jl 0x408e4e
push dword [ebp - 0x90]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.0040c940
mov al, byte [ebp - 0x90]
add esp, 0xc
push 0x11
mov byte [ebp - 0x4c], al
lea eax, [ebp - 0x4b]
push eax
mov edi, 0x42e
push edi
push esi
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push ebx
push ebx
push 0xb0
push edi
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
movzx ecx, ax
shr eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
push 0x42b01c
push eax
mov dword [ebp - 0x14], ecx
call fcn.0040c6b0
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 8], ebx
call fcn.004091d1
add esp, 0xc
push 0x408bf2
push 0x64
push 1
push esi
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x10000000
push ebx
push ebx
push ebx
push str.mydesk1
call dword [sym.imp.USER32.dll_CreateDesktopA]
push str.__vp
mov dword [0x42cccc], eax
call fcn.004092d4
pop ecx
push dword [0x42cccc]
call dword [sym.imp.USER32.dll_SwitchDesktop]
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
pop ebx
call fcn.0040c86c
add ebp, 0x74
leave
ret

Function at 0x409108
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 1]
push 1
push eax
mov byte [ebp - 1], 0
call fcn.004090c9
mov al, byte [ebp - 1]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0x36
lea esi, [ecx + 1]
pop edi
mov byte [ecx], al
mov byte [ecx + 0xd9], al
mov edx, esi
push ebx
mov ecx, dword [edx]
mov ebx, ecx
shr ebx, 0x15
shl ecx, 0xb
or ebx, ecx
mov dword [edx], ebx
add edx, 4
dec edi
jne 0x409136
mov ecx, esi
mov esi, 0xd9
pop ebx
xor al, byte [ecx]
mov dl, al
shr dl, 5
shl al, 3
or dl, al
add dl, 5
mov al, dl
mov byte [ecx], al
inc ecx
dec esi
jne 0x409152
pop edi
pop esi
leave
ret
Function at 0x40916d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
push edi
lea edi, [esi + 1]
mov byte [ebp + 0xb], al
mov ecx, edi
mov dword [ebp - 4], 0xd9
push ebx
mov dl, byte [ecx]
mov al, dl
sub al, 5
mov bl, al
shr bl, 3
shl al, 5
or bl, al
xor bl, byte [ebp + 0xb]
mov byte [ebp + 0xb], dl
mov byte [ecx], bl
inc ecx
dec dword [ebp - 4]
jne 0x409188
push 0x36
pop edx
mov ecx, edi
pop ebx
mov eax, dword [ecx]
mov edi, eax
shl edi, 0x15
shr eax, 0xb
or edi, eax
mov dword [ecx], edi
add ecx, 4
dec edx
jne 0x4091ac
mov al, byte [esi]
sub al, byte [esi + 0xd9]
pop edi
neg al
pop esi
sbb eax, eax
inc eax
leave
ret

Function at 0x4092d4
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0x148
mov eax, dword [0x41c380]
push ebx
push esi
push edi
push 0x44
pop esi
push esi
mov dword [ebp + 0xc4], eax
xor ebx, ebx
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0040c880
push 0x10
mov dword [ebp - 0x80], esi
push ebx
mov esi, 0x42ccd8
push esi
mov dword [ebp - 0x78], str.mydesk1
mov word [ebp - 0x50], 5
mov dword [ebp - 0x54], 1
call fcn.0040c880
mov byte [ebp - 0x3c], bl
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x3b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00409298
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040c6b0
push dword [ebp + 0xd0]
lea eax, [ebp - 0x3c]
push eax
call fcn.0040c6c0
add esp, 0x28
push esi
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x90
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40938e
push ebx
push str.Error
push 0x418054
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp + 0xc4]
pop edi
pop esi
pop ebx
call fcn.0040c86c
add ebp, 0xc8
leave
ret
Function at 0x4093c0
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0x134
mov eax, dword [0x41c380]
push ebx
push esi
push edi
mov dword [ebp + 0xb0], eax
mov ebx, ecx
push 0x3f
xor eax, eax
pop ecx
mov byte [ebp - 0x80], 0
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, str.WTSAPI32.dll
lea edi, [ebp + 0x80]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 8
xor eax, eax
cmp dword [ebx + 8], 0
pop ecx
lea edi, [ebp + 0x8d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x4094a3
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp + 0x80]
push eax
call esi
test eax, eax
mov dword [ebx + 8], eax
jne 0x40947f
push 0xff
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x409464
lea eax, [ebp - 0x80]
push eax
call fcn.0040c7b0
cmp byte [ebp + eax - 0x81], 0x5c
pop ecx
je 0x409464
lea eax, [ebp - 0x80]
push 0x417354
push eax
call fcn.0040c6c0
pop ecx
pop ecx
lea eax, [ebp + 0x80]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040c6c0
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
call esi
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x4094a3
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSRegisterSessionNotification
push eax
call esi
push str.WTSUnRegisterSessionNotification
push dword [ebx + 8]
mov dword [ebx], eax
call esi
mov dword [ebx + 4], eax
mov ecx, dword [ebp + 0xb0]
xor eax, eax
cmp dword [ebx], eax
pop edi
pop esi
setne al
pop ebx
call fcn.0040c86c
add ebp, 0xb4
leave
ret
Function at 0x409770
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x41c380]
mov dword [esp + 0x10c], eax
push esi
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4097a8
mov eax, dword [ebp + 0xc]
mov ecx, eax
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x4097c0
sub ecx, esi
mov dword [esp + 0xc], ecx
je 0x4097f8
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4097d1
lea edi, [esp + 0x10]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x4097e0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x409825
xor eax, eax
mov ecx, dword [esp + 0x114]
call fcn.0040c86c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0xc]
push 4
lea edx, [ebp + 0x14]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
xor eax, eax
test esi, esi
sete al
call fcn.0040c86c
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x409870
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov eax, dword [0x41c380]
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x4098a3
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040c86c
add esp, 8
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push esi
push edx
mov edx, dword [esp + 8]
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 8]
xor eax, eax
test esi, esi
sete al
pop esi
call fcn.0040c86c
add esp, 8
ret
Function at 0x409a54
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41c380]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebx + ebx]
lea eax, [edi + 1]
push eax
call fcn.0040ce50
pop ecx
xor ecx, ecx
test ebx, ebx
mov esi, eax
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x43
mov byte [ebp - 7], 0x44
mov byte [ebp - 6], 0x45
mov byte [ebp - 5], 0x46
jbe 0x409ad7
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [eax]
shr dl, 4
mov byte [esi + ecx*2], dl
mov al, byte [eax]
and al, 0xf
mov byte [esi + ecx*2 + 1], al
inc ecx
cmp ecx, ebx
jb 0x409abd
xor eax, eax
test edi, edi
jbe 0x409aed
movzx ecx, byte [eax + esi]
mov cl, byte [ebp + ecx - 0x14]
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x409add
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x409afc
mov eax, dword [eax]
cmp eax, edi
jae 0x409afc
mov edi, eax
push edi
push esi
push dword [ebp + 0x10]
call fcn.0040c940
push esi
call fcn.0040cd38
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
pop ebx
call fcn.0040c86c
leave
ret

Function at 0x409b7e
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xd8]
sub esp, 0x158
mov eax, dword [0x41c380]
push esi
push edi
push 0xff
mov dword [ebp + 0xd4], eax
xor esi, esi
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0040c880
push dword [ebp + 0xe0]
call fcn.0040c7b0
push eax
push dword [ebp + 0xe0]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c940
push 0x44
pop edi
push edi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0040c880
add esp, 0x28
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x8000020
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 0x80], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, 1
jne 0x409c1e
mov eax, dword [ebp + 0xe4]
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x409c14
push dword [ebp - 0x3c]
call esi
jmp 0x409c19
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0xd4]
mov eax, edi
pop edi
pop esi
call fcn.0040c86c
add ebp, 0xd8
leave
ret
Function at 0x409cc4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x41c380]
mov dword [ebp - 4], eax
call fcn.00409c35
test eax, eax
mov eax, str.SOFTWAREWow6432NodeMicrosoftCryptographyDefaultsProviderComyiSafe_CSP_V3.0_
jne 0x409ce5
mov eax, str.SOFTWAREMicrosoftCryptographyDefaultsProviderComyiSafe_CSP_V3.0_
lea ecx, [ebp - 0x48]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409d43
push esi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push str.version
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x48]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
test esi, esi
mov byte [eax], 0
pop esi
jne 0x409d43
lea ecx, [ebp - 0x44]
push ecx
push eax
call fcn.0040c6b0
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0040c86c
leave
ret

Function at 0x409d4d
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x42e4d8]
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [0x42e4d4]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x17d5
push edi
call esi
push 0x42e32c
xor ebx, ebx
inc ebx
push ebx
push edi
call esi
push 0x42e336
push 0x17d6
push edi
call esi
push 0x42e340
mov ebp, 0x17d7
push ebp
push edi
call esi
test byte [0x42e4d0], 4
jle 0x409de7
push 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x17d6
push edi
call ebx
push eax
call esi
push 1
push ebp
push edi
call ebx
push eax
call esi
test dword [0x42e4d0], 0x100
jle 0x409de0
push ebp
jmp 0x409e13
push 0x17d6
jmp 0x409e13
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 0
push 0x17d6
push edi
call ebx
push eax
call esi
push 0
push ebp
push edi
call ebx
push eax
call esi
push 1
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
cmp dword [0x42e4dc], ebx
jne 0x409e51
push 6
push edi
mov dword [0x42e4dc], 1
call esi
push 9
push edi
call esi
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret
Function at 0x40a673
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x41c380]
push esi
push edi
mov dword [ebp + 0x84], eax
push 0x40
xor eax, eax
mov byte [ebp - 0x80], 0
pop ecx
push dword [ebp + 0x90]
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push eax
call fcn.0040c6b0
lea eax, [ebp - 0x80]
push str.XJABCVer.ini
push eax
call fcn.0040c6c0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call esi
push dword [ebp + 0x90]
lea eax, [ebp - 0x80]
push eax
call fcn.0040c6b0
lea eax, [ebp - 0x80]
push str.XJABCSetup.exe
push eax
call fcn.0040c6c0
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call esi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x90]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp + 0x84]
pop edi
pop esi
call fcn.0040c86c
add ebp, 0x88
leave
ret

Function at 0x40a71a
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41c380]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x20c], 0
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor ebx, ebx
mov edi, str._sAbcCyInstUpdate_d_
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0040c8e0
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x40a7b6
lea eax, [ebp - 0x108]
push eax
call fcn.0040a673
inc ebx
cmp ebx, 0x7d0
pop ecx
jl 0x40a77b
xor ebx, ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0040c8e0
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x40a7f3
lea eax, [ebp - 0x108]
push eax
call fcn.0040a673
inc ebx
cmp ebx, 0x7d0
pop ecx
jl 0x40a7b8
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x40a81c
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call fcn.0040c6b0
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0040c86c
leave
ret