joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012026
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov esi, edx
push ecx
push ecx
push 0x10000026
push esi
push ecx
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1001208b
mov eax, dword [ebp - 4]
lea ecx, [ebp - 4]
add eax, 2
push ecx
mov ecx, dword [ebp + 8]
shr eax, 1
push eax
call fcn.10010b77
push eax
push 0
push 0x10000026
push esi
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1001208b
mov eax, dword [ebp - 4]
shr eax, 1
je 0x10012080
dec eax
mov ecx, dword [ebp + 8]
push eax
call fcn.10010bfd
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x10012108
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
lea eax, [ebp - 4]
push esi
push eax
push esi
push 0x20006
push 4
push esi
push esi
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1001214d
push 4
push dword [ebp + 0x10]
push 4
push esi
push str.CurrentState
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x1001219a
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
call fcn.10010fce
push eax
lea ecx, [ebp - 0x14]
call fcn.10010df9
push 0x4000
lea ecx, [ebp - 0x14]
call fcn.10010b77
xor ecx, ecx
mov esi, eax
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 0x10], esi
push eax
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push ecx
push ecx
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
mov ebx, eax
test ebx, ebx
jne 0x10012284
jmp 0x1001223c
push 0x4000
dec ecx
push esi
push ecx
push edi
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
test esi, esi
jne 0x10012237
and dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0x3001f
push 4
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x1001222b
mov ecx, dword [ebp - 0xc]
call fcn.10012296
mov esi, eax
lea ecx, [ebp - 0xc]
call fcn.100108d9
test esi, esi
je 0x10012239
mov ebx, esi
mov esi, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
test ecx, ecx
jne 0x100121eb
dec ecx
mov dword [ebp - 4], ecx
jmp 0x10012279
xor ecx, ecx
mov dword [ebp - 0x18], 0x4000
push ecx
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x18]
dec eax
push ecx
push esi
push eax
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x10012277
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x10012279
mov ebx, eax
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10012249
dec eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.100110af
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x1001243c
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
lea eax, [ebp - 8]
mov esi, edx
push eax
push 0xf003f
push 0xc
mov ecx, 0x80000002
push esi
push ecx
mov dword [ebp - 4], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1001248f
push 0x1001d0e4
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 8]
call dword [sym.imp.ntdll.dll_NtDeleteKey]
test eax, eax
je 0x10012486
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ebx, ebx
lea eax, [ebp - 4]
push ebx
push eax
push ebx
push 0xf003f
push 7
push ebx
push ebx
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x100124dc
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
add eax, eax
push eax
push dword [ebp + 8]
push 6
push ebx
push 0x1001d0e4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x1001250e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push esi
push edi
push 0x800
xor edi, edi
mov esi, ecx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
test eax, eax
jne 0x100125b8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100125b6
push 0x5c
pop eax
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
pop ecx
test eax, eax
jne 0x100125aa
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x100125b6
cmp ecx, edi
jae 0x100125b6
push 0x5c
pop eax
mov word [ebp + ecx*2 - 0x20c], ax
inc ecx
movzx eax, word [esi]
test ax, ax
je 0x10012597
mov edx, eax
lea esi, [esi + 2]
mov word [ebp + ecx*2 - 0x20c], dx
movzx eax, word [esi]
inc ecx
mov edx, eax
test ax, ax
jne 0x10012581
xor eax, eax
lea esi, [ebp - 0x20c]
push 8
mov word [ebp + ecx*2 - 0x20c], ax
pop edi
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x100125b8
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x10013880
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
lea ecx, [ecx + ecx*4]
lea edi, [eax + ecx*8]
cmp eax, edi
je 0x100138be
mov esi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
cmp esi, edx
jb 0x100138b7
mov ecx, dword [eax + 8]
add ecx, edx
cmp esi, ecx
jb 0x100138c0
add eax, 0x28
cmp eax, edi
jne 0x100138a7
xor eax, eax
pop edi
pop esi
pop ebp
ret
Function at 0x10014ec0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x10020008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x10014ee7
mov ecx, 5
int 0x29
push 2
call fcn.100144c0
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x10014ff2
test esi, esi
jne 0x10014ff2
push 2
call fcn.100144c0
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10014c7b
mov esp, ebp
pop ebp
ret

Function at 0x431000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43101e
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp fcn.00401219
Function at 0x2e001676
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x2e001d78
call fcn.2e001a26
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x2e00338c
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x2e001467
cmp eax, esi
jne 0x2e00145a
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x2e00146a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x2e001441
xor esi, esi
inc esi
mov eax, dword [0x2e003388]
cmp eax, esi
jne 0x2e00147d
push 0x1f
call sub.MSVCR90.dll__amsg_exit
pop ecx
jmp 0x2e0014b8
mov eax, dword [0x2e003388]
test eax, eax
jne 0x2e0014b2
mov dword [0x2e003388], esi
push 0x2e0010ec
push 0x2e0010e0
call sub.MSVCR90.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x2e0014b8
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x2e00158f
mov dword [0x2e003038], esi
mov eax, dword [0x2e003388]
cmp eax, esi
jne 0x2e0014dc
push 0x2e0010dc
push 0x2e0010d4
call sub.MSVCR90.dll__initterm
pop ecx
pop ecx
mov dword [0x2e003388], 2
cmp dword [ebp - 0x1c], ebx
jne 0x2e0014e9
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x2e003398], ebx
je 0x2e00150a
push 0x2e003398
call fcn.2e00195d
pop ecx
test eax, eax
je 0x2e00150a
push ebx
push 2
push ebx
call dword [0x2e003398]
mov eax, dword [0x2e003020]
mov ecx, dword [sym.imp.MSVCR90.dll___initenv]
mov dword [ecx], eax
push dword [0x2e003020]
push dword [0x2e003024]
push dword [0x2e00301c]
call fcn.2e00127c
add esp, 0xc
mov dword [0x2e003034], eax
cmp dword [0x2e003028], ebx
jne 0x2e001575
push eax
call dword [sym.imp.MSVCR90.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.MSVCR90.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x2e003038], ebx
jne 0x2e001583
call dword [sym.imp.MSVCR90.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x2e003034]
call fcn.2e001a6b
ret
call fcn.2e001313
jmp 0x2e00141f
Function at 0x42e60a
Capabilities:
Encode data using xor

Disassembly:
push es
imul ecx, ebp, 0xffffff95
xchg ebp, eax
pop eax
or al, 0x63
pop eax
add ah, bh
or eax, 0x989f4f1e
push ds
dec edi
lahf
cwde
add dword [ebp + 0x5a], edi
fadd dword [ebp + ecx*4 - 0x7f]
inc esp
lea eax, [ecx - 0x2ca2fd5d]
dec ebp
loop 0x42e58e
and al, 0x4b
cmpsb byte [esi], byte es:[edi]
popfd
out 0x8a, al

Function at 0x44502a
Capabilities:
Encode data using xor

Disassembly:
invalid
cli
ja 0x445005
mov ebp, 0xa9291192
mov byte [ebx], bl
sar dword [ecx], 1
invalid
invalid
stosb byte es:[edi], al
invalid

Function at 0x45bc56
Capabilities:
Encode data using xor

Disassembly:
aaa
shl byte [ebp - 0x5550bdc8], 0xe0
cwde
push esp
wait
jb 0x45bbeb
lea ebp, [eax]
xor dword [ecx - 0x71566082], ebp
sub al, cl
jl 0x45bcbf
loopne 0x45bc8d
pop eax
cld
push 0x3c
rol dword [eax + 0x2f], cl
mov eax, 0xc7fc464c
push 0x8d6920e6
sti
xchg ecx, eax
and ch, byte [edx - 0x345f57df]
sub al, 0x90
invalid
invalid
out 0x50, eax
push 0xfffffffffffffff3
sbb byte [edi - 0x30], ch
outsd dx, dword [esi]
mov al, 0x13
cmc
xchg edx, eax
in eax, dx
pop ds
clc
das
xor eax, 0x14005190
inc edx
jl 0x45bcee
jl 0x45bcae
leave
xchg ecx, eax
jne 0x45bce6
pop esi
jo 0x45bcb0
push ds
mov dl, 0xab
nop
pop ebp
xchg esp, eax
mov gs, ebp
pop eax
je 0x45bd37
invalid
sbb ch, 0xd1
mov bl, 0xa0
movsd dword es:[edi], dword [esi]
push eax
fcompi st(6)
fsubr qword [ecx + 0x64f0187f]
test byte [ecx - 0x1b], dl
jno 0x45bd63
adc esp, dword [eax - 0x100a7ffd]
cmp byte [edx*8 + 0x1fffd69c], dl
pushfd
salc
call [edi]
push edx
inc edx
nop
sub byte [ecx], bh
lodsd eax, dword [esi]
test byte [edi], bl
jg 0x45bd05
outsd dx, dword [esi]
movsd dword es:[edi], dword [esi]
xor eax, 0x3e7407d6
inc ebp
invalid
enter 0x3240, 0x3d
in al, dx
jae 0x45bd88
xor bh, byte [0x145373ec]
cmp byte [esi + 0x6df87418], bh
adc al, 0x38
mov esi, 0x6df87418
add esi, dword [ebx]
test dword [ecx], ebp
out 0x2f, al
push es
dec ebx
jnp 0x45bd2e
cmp eax, 0x70aa88ef
aam 0x1b
cmpsd dword [esi], dword es:[edi]
inc edx
inc edx
mov byte [ebx], dh
mov ah, 0xeb
enter 0x25d6, 0xfffffffffffffff4
imul ecx, ecx, 0xffffff9f
scasb al, byte es:[edi]
aaa
jge 0x45bd8a
and ah, byte [edx]
aam 0x22
dec ebx
xchg byte [edi + 0x3c], dl
rcl dword [esi + 0x48], 0x85
sbb eax, 0xd0c2bca9
push edi
cmp al, 0xc1
push esi
dec eax
test dword [0xd0c2bca9], ebx
adc edi, dword [esi + ebx*8 + 0xcfca0f8]
push 0x3af4ef3b
jp 0x45bd30
mov dh, 0xb
push es
mov byte [0xabd06f06], al
jns 0x45bd3c
inc ebx
stosd dword es:[edi], eax
mov byte [0x42f60675], al
lcall 0xeac6, 0x6f176755
cmp edi, dword es:[ecx + 0x5a]
sbb esi, ecx
xor ebx, ecx
test dword [ecx - 0x7766c71], esi
xchg byte [ebx - 0x35e98133], ah
push eax
or dword [ecx], ebx
or bl, bl
inc eax
xchg byte [esi], dl
les ebx, [edi]
xchg dl, dl
int3
Function at 0x4baa54
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c4498
cmp edx, dword [eax]
je 0x4baa76
add eax, 8
inc ecx
cmp eax, 0x4c4528
jl 0x4baa67
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c4498]
jne 0x4baba4
mov eax, dword [0x4c6d3c]
cmp eax, 1
je 0x4bab7e
test eax, eax
jne 0x4baaa7
cmp dword [0x4c22dc], 1
je 0x4bab7e
cmp edx, 0xfc
je 0x4baba4
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4baade
lea eax, [ebp - 0x1a4]
push 0x4beb40
push eax
call fcn.004bbbc0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004bbcb0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4bab21
lea eax, [ebp - 0x1a4]
push eax
call fcn.004bbcb0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4beb3c
push edi
call fcn.004bc670
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x4beb20
push eax
call fcn.004bbbc0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004bbbd0
lea eax, [ebp - 0xa0]
push 0x4beb1c
push eax
call fcn.004bbbd0
push dword [esi + 0x4c449c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004bbbd0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x4beaf4
push eax
call fcn.004bc5e2
add esp, 0x2c
pop edi
jmp 0x4baba4
lea eax, [ebp + 8]
lea esi, [esi + 0x4c449c]
push 0
push eax
push dword [esi]
call fcn.004bbcb0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
mov ebx, 0x408f6c
mov ecx, 0x75227536
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..pdata_1
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x4c5275a0
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0xf7672a
Capabilities:
Execute anti-debugging instructions

Disassembly:
dec ecx
stc
test ecx, eax
xor ecx, 0x8c820f6
inc ecx
not ecx
jmp 0x18eae5a
pushfd
jmp 0xfca895
push esi
mov esi, esi
bswap esi
movsx esi, ax
push ecx
push edi
push eax
push ebx
setle cl
mov cx, cx
cbw
push edx
cdq
rdtsc
movzx eax, si
push ebp
rdtsc
mov edx, 0
dec bh
cwde
push edx
not eax
mov edi, dword [esp + 0x28]
inc edi
neg edi
btc ebx, ebp
bts si, di
btr ebp, 0x42
rol edi, 1
mov ebp, esi
inc edi
add edi, edx
inc bx
mov ebp, esp
bswap ebx
btr bx, 0xd7
xor ecx, 0x2895a95
lea esp, [esp - 0xc0]
xor ecx, ebp
and ah, 0x93
cmp bp, 0x1c98
mov ebx, edi
and esi, 0x7c42585
mov eax, 0
adc ecx, 0x4eec5baf
sub ebx, eax
lea esi, [0xfca90f]
mov ecx, dword [edi]
add edi, 4
xor ecx, ebx
ror ecx, 2
jmp 0xf1467f
xor ebx, ecx
test sp, 0x13c
add esi, ecx
jmp 0x18ff95a
jmp esi
Function at 0x406c00
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov dword [ebp - 0x144], 1
mov eax, 1
test eax, eax
je 0x406c88
mov ecx, dword [ebp - 0x144]
push ecx
push 0x417268
mov edx, dword [0x418a20]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x140]
push eax
push 0x418d40
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0xffffffff
je 0x406c75
lea ecx, [ebp - 0x114]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [ebp - 0x148]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x406c77
jmp 0x406c88
mov eax, dword [ebp - 0x144]
add eax, 1
mov dword [ebp - 0x144], eax
jmp 0x406c13
mov esp, ebp
pop ebp
ret

Function at 0x408286
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 5
mov eax, dword [ebp + 8]
and eax, 0xffff
push eax
mov ecx, dword [0x4189d8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4082d2
mov edx, dword [ebp - 8]
push edx
mov eax, dword [0x4189d8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4082d2
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x4082d4
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x408a42
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push 0x12c
lea eax, [ebp - 0x130]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea edx, [ebp - 0x130]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
cmp ecx, 0x22
jne 0x408a7e
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx + eax - 1]
cmp edx, 0x22
jne 0x408aa7
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 4]
mov byte [ecx + eax - 1], 0
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esp, ebp
pop ebp
ret
Function at 0x40ae0e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and al, 0xfb
add eax, 5
push eax
push 0x401
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
neg edx
sbb edx, edx
and edx, 0xfffffffb
add edx, 5
push edx
push 0x402
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffb
add ecx, 5
push ecx
push 0x409
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and al, 0xfb
add eax, 5
push eax
push 0x40a
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
neg edx
sbb edx, edx
and edx, 0xfffffffb
add edx, 5
push edx
push 0x403
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
and ecx, 0xfffffffb
add ecx, 5
push ecx
push 0x404
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push 0x405
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 8]
neg edx
sbb edx, edx
and edx, 5
push edx
push 0x408
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp + 8]
neg ecx
sbb ecx, ecx
and ecx, 5
push ecx
push 0x406
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp + 8]
neg eax
sbb eax, eax
and eax, 5
push eax
push 0x40b
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp dword [ebp + 8], 0
je 0x40afa4
xor edx, edx
mov dx, word [0x418ae8]
or edx, 1
mov word [0x418ae8], dx
jmp 0x40afc1
xor eax, eax
mov ax, word [0x418ae8]
and eax, 1
test eax, eax
je 0x40afc1
mov cx, word [0x418ae8]
mov word [0x418ae8], cx
lea edx, [ebp - 0x10]
push edx
push 0x400
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea eax, [ebp - 8]
push eax
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0
lea edx, [ebp - 0x10]
push edx
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esp, ebp
pop ebp
ret
Function at 0x40b022
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push 0
push 0x401
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x402
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x409
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x40a
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x403
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x404
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x405
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x408
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x406
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0x40b
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
lea ecx, [ebp - 0x10]
push ecx
push 0x400
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [0x418e44]
push ecx
call dword [sym.imp.USER32.dll_ScreenToClient]
lea edx, [ebp - 8]
push edx
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [0x418e44]
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [0x418e44]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov esp, ebp
pop ebp
ret