joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4080c4
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
mov eax, 0x4219dc
call fcn.004175a4
sub esp, 0x108
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
pop esi
cmp ebx, 0x2000
mov dword [ebp - 0x10], ecx
mov dword [eax], esi
mov edi, 0xbc2
je 0x408136
cmp ebx, edi
je 0x408136
cmp ebx, 0x800704c7
jne 0x40810c
xor ebx, ebx
cmp dword [ebp + 0x18], ebx
je 0x408120
mov dword [eax], ebx
jmp 0x4081d8
test ebx, ebx
je 0x4081d8
cmp ebx, 0x1008
je 0x4081d8
mov dword [0x42ea5c], 0x66d
call fcn.00406464
xor eax, eax
jmp 0x4081da
call fcn.004124ab
test eax, eax
jne 0x40814e
cmp ebx, edi
je 0x40814e
mov eax, dword [ebp + 0xc]
mov dword [eax], 2
jmp 0x408158
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp - 0x10]
xor ebx, ebx
mov dword [ebp + 0x14], ebx
mov dword [eax + 0x38], esi
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push 0x80000002
lea ecx, [ebp + 0x14]
mov dword [ebp - 4], ebx
call fcn.0040637b
test eax, eax
jne 0x4081ca
push 0x40
lea edi, [ebp - 0x113]
pop ecx
mov byte [ebp - 0x114], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x104
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp + 8]
push eax
push ebx
push str.InstallerLocation
mov dword [ebp + 8], ebx
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [ebp + 0x14], ebx
je 0x4081d8
push dword [ebp + 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x14
Function at 0x4081eb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 4], ecx
mov dword [eax], ebx
call fcn.00401046
push 0x3f
mov esi, eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
mov byte [ebp - 0x118], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x409
stosb byte es:[edi], al
cmp byte [esi + 0x2e11], bl
jne 0x408257
push 0x42db88
lea eax, [ebp - 0x118]
push 0x100
push eax
push 0x42bab0
push str.DotNetLangPacks
push dword [0x4235b8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x118]
mov ecx, dword [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040b46f
push 1
cmp eax, ebx
pop edi
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edi
je 0x408299
push dword [0x423608]
mov ecx, dword [ebp - 4]
push dword [0x423604]
call fcn.00407afc
cmp eax, edi
mov dword [ebp - 0xc], eax
jne 0x408299
mov dword [ebp - 8], ebx
xor edi, edi
cmp byte [esi + 0x2e11], bl
jne 0x4082fd
mov ecx, dword [ebp - 4]
call fcn.0040bd9a
mov edi, eax
cmp edi, ebx
je 0x4082fd
mov ecx, dword [ebp - 4]
push str.JInstallOptionIfSilent
push str.JOptional
call fcn.00407afc
cmp eax, 1
jne 0x4082ca
xor edi, edi
cmp edi, ebx
je 0x4082fd
cmp eax, 2
jne 0x4082fd
cmp dword [esi + 0x14b4], ebx
jne 0x4082fd
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
and eax, 0x673
dec eax
push eax
push 0x4279a0
push 0x671
call fcn.004079c1
mov edi, eax
cmp dword [ebp - 8], ebx
je 0x40833f
cmp edi, ebx
jne 0x40833a
cmp dword [ebp - 0xc], 2
jne 0x40833a
cmp dword [esi + 0x14b4], ebx
jne 0x40833a
cmp byte [esi + 0x2e11], bl
push 0xffffffffffffffff
je 0x408325
push 0x42799c
jmp 0x40832a
push 0x4279a0
mov ecx, dword [ebp - 4]
push 0x66e
call fcn.004079c1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], ebx
jne 0x408343
cmp edi, ebx
je 0x408399
lea eax, [ebp - 0x14]
mov ecx, dword [ebp - 4]
push eax
push edi
push dword [ebp - 8]
lea eax, [ebp - 0x118]
mov dword [ebp - 0x14], ebx
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x18]
call fcn.00407d48
test eax, eax
jne 0x40836e
call fcn.00406464
jmp 0x408395
cmp dword [ebp - 0xc], ebx
je 0x408379
cmp dword [ebp - 0xc], 2
jne 0x40837c
push 1
pop ebx
push ebx
mov ecx, dword [ebp - 4]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0x14]
call fcn.004080c4
test eax, eax
jne 0x408399
xor eax, eax
jmp 0x40839c
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x409f3a
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe20
and byte [ebp - 0x20], 0
push ebx
push esi
push edi
mov ebx, ecx
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1f]
and byte [ebp - 0x620], 0
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push 0x7f
xor eax, eax
pop ecx
lea edi, [ebp - 0x61f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0x20]
push eax
push str.Msi.DLL
call fcn.004119d3
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
call fcn.00412252
add esp, 0x14
test eax, eax
jge 0x40a127
mov ecx, ebx
call fcn.00401046
mov edi, eax
mov ecx, edi
call fcn.0040f3a4
mov ecx, ebx
mov esi, eax
call fcn.00409d00
test eax, eax
je 0x40a059
cmp dword [esi], 2
jne 0x40a052
call fcn.00412507
test eax, eax
jne 0x409fe5
mov eax, 0x4b2
push eax
mov dword [0x42ea5c], eax
call fcn.0041180a
pop ecx
push 1
jmp 0x40a129
and byte [ebp - 0x420], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x41f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x420]
mov esi, 0x400
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40a027
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.00409a0e
test eax, eax
je 0x40a04b
lea eax, [ebp - 0x420]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x40a052
lea eax, [ebp - 0x420]
mov ecx, ebx
push eax
call fcn.00409a0e
test eax, eax
jne 0x40a052
push 2
jmp 0x40a129
xor eax, eax
jmp 0x40a12a
cmp dword [esi + 0x14], 2
jne 0x40a073
cmp dword [esi + 8], 4
jne 0x40a073
mov ecx, edi
call fcn.0041088f
push 3
jmp 0x40a129
mov esi, 0x400
push 0x42db88
lea eax, [ebp - 0xe20]
push esi
push eax
push 0x42bab0
push dword [0x4235c0]
push dword [0x4235b8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0xe20], 0x79
je 0x40a122
cmp byte [ebp - 0xe20], 0x59
je 0x40a122
and byte [ebp - 0x420], 0
mov ebx, 0xff
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x41f]
mov edx, 0x4b7
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x420]
push esi
push eax
push edx
mov dword [0x42ea5c], edx
call fcn.004118ea
and byte [ebp - 0xa20], 0
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0xa1f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
add esp, 0xc
stosb byte es:[edi], al
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 0xa20]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0xa20]
push eax
call fcn.004116b2
add esp, 0x10
or eax, 0xffffffff
jmp 0x40a12a
push 0xfffffffffffffffe
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x40a131
Capabilities:
Query or enumerate registry value
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov edx, ecx
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x107]
mov byte [ebp - 0x108], bl
mov esi, dword [ebp + 0xc]
mov byte [ebp + 0xf], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, edx
mov dword [esi], ebx
stosb byte es:[edi], al
call fcn.00401046
add eax, 0xac
push eax
push str.2.0.2600.0
call fcn.00412252
pop ecx
test eax, eax
pop ecx
jge 0x40a186
push dword [ebp + 8]
push str.__s___q
jmp 0x40a192
push dword [ebp + 8]
mov byte [ebp + 0xf], 1
push str.__s___c:_msiinst__delayrebootq_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x108]
push 1
push eax
call fcn.004122e2
mov edi, eax
cmp edi, ebx
je 0x40a264
cmp edi, 0xbc2
je 0x40a1dc
push ebx
push edi
mov dword [0x42ea5c], 0x484
call fcn.00411724
pop ecx
mov eax, edi
pop ecx
jmp 0x40a266
cmp byte [ebp + 0xf], bl
je 0x40a25e
push 0x20019
push str.SoftwareMicrosoftWindowsCurrentVersionInstaller
push 0x80000002
lea ecx, [ebp + 8]
mov dword [esi], 2
mov dword [ebp + 8], ebx
call fcn.0040637b
test eax, eax
jne 0x40a24e
push 0x40
lea edi, [ebp - 0x20b]
pop ecx
mov byte [ebp - 0x20c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push str.InstallerLocation
mov dword [ebp - 4], ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
cmp dword [ebp + 8], ebx
je 0x40a264
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40a264
mov dword [esi], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40a26d
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x421b30
call fcn.004175a4
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], ecx
call fcn.00401046
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov esi, 0x42db88
xor ebx, ebx
push esi
push ebx
push str.ScriptDriven
push dword [0x4235b8]
call edi
sub eax, ebx
je 0x40a2ab
dec eax
je 0x40a2c1
dec eax
je 0x40a2cb
xor eax, eax
mov ecx, dword [ebp - 0xc]
lea esp, [ebp - 0x38]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 4
mov eax, dword [ebp - 0x18]
mov dword [eax + 0x10], 1
cmp byte [ebp + 8], bl
je 0x40a2f1
push esi
push ebx
push dword [0x4235e8]
push dword [0x4235f8]
call edi
cmp eax, 2
je 0x40a2f6
mov ecx, dword [ebp - 0x18]
call fcn.0040b3e9
test al, al
je 0x40a2f6
push 1
pop eax
jmp 0x40a2ad
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ebx
push ebx
push ebx
lea eax, [ebp + 8]
push ebx
push eax
push 0x427a18
push 0x423a58
call fcn.00404ede
test eax, eax
jge 0x40a335
mov eax, dword [ebp + 8]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x40a32d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push 1
pop ebx
jmp 0x40a434
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
lea edx, [ebp - 0x10]
push edx
push 0x427ca8
mov ecx, dword [eax]
push eax
mov byte [ebp - 4], 2
call dword [ecx]
cmp eax, ebx
jl 0x40a3f3
mov dword [ebp - 0x14], ebx
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 3
call dword [ecx + 0x1c]
test eax, eax
jge 0x40a372
push dword [ebp - 0x14]
jmp 0x40a3ed
xor eax, eax
lea edi, [ebp - 0x2b]
mov byte [ebp - 0x2c], bl
push esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x2c]
push 0x14
push eax
push 0x42bab0
push dword [0x4235e4]
push dword [0x4235b8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov dword [ebp - 0x18], eax
jne 0x40a3ad
xor edi, edi
jmp 0x40a3d9
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [eax + eax + 2]
mov eax, esi
add eax, 3
and al, 0xfc
call fcn.004176a0
mov edi, esp
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp - 0x18]
mov byte [edi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea eax, [ebp - 0x2c]
push eax
push edi
call fcn.00412252
pop ecx
cmp eax, 1
pop ecx
push dword [ebp - 0x14]
jne 0x40a40d
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x40a31d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x40a31d
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp eax, ebx
je 0x40a424
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp + 8]
mov byte [ebp - 4], bl
cmp eax, ebx
je 0x40a434
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, ebx
jmp 0x40a2ad
Function at 0x40a516
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.00401046
mov dword [ebp - 8], eax
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x407]
mov byte [ebp - 0x408], bl
rep stosd dword es:[edi], eax
mov esi, dword [ebp + 0x18]
cmp dword [ebp + 0x14], ebx
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esi], 2
je 0x40a569
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x408]
push edi
push eax
call fcn.00417020
pop ecx
pop ecx
jmp 0x40a5a3
mov edi, 0x42db88
push edi
push ebx
push dword [0x4235e8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov dword [esi], eax
push edi
lea eax, [ebp - 0x408]
push 0x400
push eax
push dword [ebp + 8]
push dword [0x4235ec]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov edi, dword [ebp + 0x10]
mov esi, dword [esi]
sub esi, ebx
je 0x40a679
dec esi
je 0x40a660
dec esi
je 0x40a648
dec esi
je 0x40a5f0
dec esi
jne 0x40a62e
push dword [ebp + 8]
push 0x42bab4
push edi
call fcn.0041200c
push edi
call fcn.00412144
test eax, eax
jne 0x40a62e
mov eax, 0x483
push edi
push eax
mov dword [0x42ea5c], eax
call fcn.0041180a
pop ecx
pop ecx
xor eax, eax
jmp 0x40a631
mov esi, dword [ebp - 4]
push ebx
mov ecx, esi
call fcn.0040a26d
cmp dword [esi + 0x10], ebx
je 0x40a638
push 1
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x408]
mov ecx, esi
push eax
call fcn.0040a6e0
test eax, eax
je 0x40a5ec
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x408]
push 1
push eax
push str._URL
call fcn.004102a0
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x18
lea eax, [ebp - 0x408]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x40a62e
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x408]
push edi
push dword [ebp + 8]
push eax
call fcn.0040a6e0
jmp 0x40a670
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x408]
push edi
push eax
call fcn.0040a68a
test eax, eax
jne 0x40a62e
jmp 0x40a5ec
lea eax, [ebp - 0x408]
push eax
push 0x42e65c
jmp 0x40a5c9
Function at 0x40b3e9
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
push ebx
push esi
push edi
push str.31EE4FE8_7F9C_11D5_ABB8_00B0D02332EB
lea eax, [ebp - 0x80c]
push str.SoftwareMicrosoftWindowsCurrentVersionUninstall_s
push eax
xor ebx, ebx
xor edi, edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 8]
mov esi, 0x80000002
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push 0xf003f
push ebx
push ebx
lea eax, [ebp - 0x80c]
push ebx
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x40b455
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x80c]
push eax
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp dword [ebp - 8], ebx
sete byte [ebp - 1]
cmp edi, ebx
je 0x40b467
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b76c
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x421c16
call fcn.004175a4
sub esp, 0x18c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x12]
mov ebx, 0x423650
mov esi, 0x423648
push edi
push eax
lea ecx, [ebp - 0x6c]
mov dword [ebp - 4], 1
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x4c], esi
call fcn.0040c3e8
push dword [ebp + 0xc]
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 2
push eax
call fcn.0040b973
pop ecx
pop ecx
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0040cb3a
lea ecx, [ebp + 0xc]
mov dword [ebp + 0xc], edi
push ecx
push 0x20019
push edi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, edi
jne 0x40b7f5
lea ecx, [ebp - 0x10]
call fcn.004052a9
mov ecx, dword [ebp + 0xc]
cmp eax, edi
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
sete byte [ebp + 0xf]
call fcn.00407cce
cmp byte [ebp + 0xf], 0
je 0x40b92b
and byte [ebp - 0x198], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x197]
and dword [ebp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x104
push eax
lea eax, [ebp - 0x198]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push str.Version
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40b875
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xf]
push 0
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.0040c3e8
mov dword [ebp - 0x18], 1
jmp 0x40b947
lea eax, [ebp + 0xf]
push 1
push eax
lea eax, [ebp - 0x198]
push eax
lea ecx, [ebp - 0x44]
call fcn.0040c0e8
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x6c]
push eax
mov byte [ebp - 4], 4
call fcn.0040bbdf
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00407cce
mov eax, 0x427e54
mov dword [ebp - 0x44], ebx
mov ecx, eax
mov dword [ebp - 0x24], esi
test ecx, ecx
mov edi, 0x42e5c4
jne 0x40b8be
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x44]
call fcn.0040c4f0
mov eax, 0x427e50
mov byte [ebp - 4], 5
mov ecx, eax
mov dword [ebp - 0x94], ebx
test ecx, ecx
mov dword [ebp - 0x74], esi
jne 0x40b8e7
mov eax, edi
lea ecx, [ebp - 0x11]
push 0
push ecx
push eax
lea ecx, [ebp - 0x94]
call fcn.0040c4f0
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 6
call fcn.0040c26f
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 5
call fcn.00407cce
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 2
call fcn.00407cce
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x6c]
push 0
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.0040c45d
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 1
call fcn.00407cce
cmp dword [ebp - 0x10], 0
je 0x40b962
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40bd9a
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x421ca0
call fcn.004175a4
sub esp, 0x444
push ebx
push edi
xor ebx, ebx
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x44f]
mov byte [ebp - 0x450], bl
push 0x42db88
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x450]
push 0x400
push eax
push 0x42bab0
push str.JVersion
push dword [0x4235b8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x450], bl
jne 0x40bdf9
xor eax, eax
jmp 0x40be6a
mov al, byte [ebp - 0xd]
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x28], al
mov al, byte [ebp - 0xd]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
mov byte [ebp - 0x27], al
mov byte [ebp - 0x20], bl
call fcn.0040d2a1
lea eax, [ebp - 0xd]
push 1
push eax
lea eax, [ebp - 0x450]
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0040c0e8
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
push ecx
lea ecx, [ebp - 0x18]
push ecx
push eax
push str.SOFTWAREMicrosoftVisual_JSharp_SetupRedist
call fcn.0040bc43
add esp, 0x10
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], bl
call fcn.00407cce
cmp dword [ebp - 0x18], 1
jae 0x40be5c
push 1
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040c34a
mov eax, ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40be95
Capabilities:
Read .ini file

Disassembly:
push esi
push edi
push 0x42db88
push 0
push dword [0x4235e8]
mov esi, ecx
push str.dotnetfx.exe
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, 2
mov edi, 0x409
je 0x40becb
push eax
mov ecx, esi
push dword [esp + 0x10]
call fcn.0040bed6
test eax, eax
je 0x40becf
mov edi, dword [esp + 0xc]
mov eax, edi
pop edi
pop esi
ret 4

Function at 0x40e2fd
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xd0
and dword [ebp - 0x14], 0
push esi
push edi
mov edi, ecx
call fcn.0040105f
push 1
lea eax, [ebp - 0xd0]
pop esi
mov dword [ebp - 0xd0], 0x94
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0xcc]
mov ecx, dword [ebp - 0xc4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc0]
mov dword [ebp - 4], eax
sub eax, 0
mov dword [ebp - 8], ecx
je 0x40e3ad
dec eax
je 0x40e3a2
dec eax
jne 0x40e3b4
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], 2
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x3c]
push 4
dec eax
pop ecx
je 0x40e392
dec eax
je 0x40e389
dec eax
jne 0x40e395
mov dword [ebp - 0x18], 5
jmp 0x40e395
mov dword [ebp - 0x18], 3
jmp 0x40e395
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0xcc], ecx
jb 0x40e3b4
mov dword [ebp - 0x14], esi
jmp 0x40e3b4
movzx eax, cx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jmp 0x40e3b4
mov dword [ebp - 0x18], 7
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.00401046
mov ecx, eax
call fcn.0040f3ab
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40e5a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
dec edx
test eax, eax
je 0x40e5dd
mov eax, dword [ecx + 0x6c]
push esi
lea esi, [edx + 1]
mov edx, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
movzx edi, byte [edx]
and ecx, 0xff
xor ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 8
mov ecx, dword [eax + ecx*4]
inc edx
xor edi, ecx
dec esi
mov dword [ebp + 0x10], edi
jne 0x40e5bb
pop edi
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x40febc
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4b8
push ebx
push esi
xor ebx, ebx
push edi
push ebx
push 1
push dword [0x4281dc]
mov dword [ebp - 8], ecx
call fcn.004100a5
test eax, eax
je 0x40ffb0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x4b7]
mov byte [ebp - 0x4b8], bl
rep stosd dword es:[edi], eax
push dword [0x4281dc]
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x4b8]
push 0x42bab4
push eax
call fcn.0041200c
lea eax, [ebp - 0x4b8]
mov edi, str.Languages
push eax
push ebx
push str.Count
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp eax, ebx
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ebx
jbe 0x40ffa8
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push dword [ebp - 4]
lea eax, [ebp - 0xb8]
push 0x4275e0
push str._s_d
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x4b8]
push eax
lea eax, [ebp - 0x20]
push 0x13
push eax
lea eax, [ebp - 0xb8]
push 0x42bab0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x40ffb0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x38]
push str.0x0_s.ini
push eax
call esi
mov ecx, dword [ebp - 8]
add esp, 0xc
lea eax, [ebp - 0x38]
push ebx
push 1
push eax
call fcn.004100a5
test eax, eax
je 0x40ffb0
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jb 0x40ff3b
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
xor eax, eax
jmp 0x40ffab

Function at 0x410181
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x410237
lea eax, [ebp - 0x118]
push 0xff
push eax
push dword [ebp + 0xc]
call fcn.004118ea
add esp, 0xc
cmp dword [ebp + 0xc], 0x452
jne 0x410227
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4101e3
lea eax, [ebp - 0x118]
push 0x4271e4
push eax
call fcn.004180a0
pop ecx
test eax, eax
pop ecx
jne 0x4101ff
mov eax, 0x486
push eax
mov dword [0x42ea5c], eax
call fcn.0041180a
pop ecx
push dword [0x42ea5c]
call fcn.00417f9e
lea eax, [ebp - 0x18]
push eax
push 0
call fcn.00412988
pop ecx
lea eax, [ebp - 0x18]
pop ecx
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextA]
leave
ret 8