joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402990
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push edi
push 0x2af
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
xor ebx, ebx
cmp eax, ebx
je 0x4029e6
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [eax], 0x20494e49
jne 0x4029e6
push 1
add eax, 4
push eax
call fcn.00402586
mov edi, eax
cmp edi, ebx
jne 0x402a0b
push str.Could_not_load_embedded_INI_file
call fcn.00403518
pop ecx
push ebx
push dword [ebp + 0xc]
call fcn.00402586
mov edi, eax
cmp edi, ebx
jne 0x402a39
push dword [ebp + 0xc]
push str.Could_not_load_INI_file:__s
call fcn.00403537
pop ecx
pop ecx
xor eax, eax
jmp 0x402b2a
push esi
push ebx
push dword [ebp + 0xc]
call fcn.00402586
mov esi, eax
cmp esi, ebx
je 0x402a38
cmp dword [esi + 4], ebx
jle 0x402a38
mov eax, dword [esi + 8]
push dword [eax + ebx*4]
mov eax, dword [esi + 0xc]
push dword [eax + ebx*4]
push edi
call fcn.004023d7
inc ebx
cmp ebx, dword [esi + 4]
jl 0x402a20
pop esi
push edi
call fcn.004027d9
push dword [ebp + 0xc]
push str.WinRun4J:ModuleIni
push edi
call fcn.004023d7
push 0x104
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x208]
push eax
push str.WinRun4J:ModuleName
push edi
call fcn.004023d7
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push eax
call fcn.00404535
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
push str.WinRun4J:ModuleDir
push edi
call fcn.004023d7
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call fcn.00404535
pop ecx
pop ecx
lea eax, [ebp - 0x104]
push eax
push str.WinRun4J:IniDir
push edi
call fcn.004023d7
push edi
push str.:log.level
push edi
call fcn.0040265b
push eax
push str.:log
push edi
call fcn.0040265b
push eax
push dword [ebp + 8]
call fcn.00403633
lea eax, [ebp - 0x208]
push eax
push str.Module_Name:__s
call fcn.0040324d
push dword [ebp + 0xc]
push str.Module_INI:__s
call fcn.0040324d
lea eax, [ebp - 0x104]
push eax
push str.Module_Dir:__s
call fcn.0040324d
lea eax, [ebp - 0x104]
push eax
push str.INI_Dir:__s
call fcn.0040324d
add esp, 0x20
mov dword [0x40cd4c], edi
mov eax, edi
pop edi
pop ebx
leave
ret 8
Function at 0x4032ab
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [0x40ce94]
movzx eax, word [ebp - 4]
push eax
movzx eax, word [ebp - 6]
push eax
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x10]
push eax
push dword [0x40ce90]
lea eax, [ebp - 0x114]
push str._s__4d_02d_02d__02d_02d_02d_s
push eax
call fcn.00406c27
add esp, 0x28
push dword [0x40ce78]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x114]
push eax
push dword [0x40ce84]
call dword [sym.imp.KERNEL32.dll_MoveFileA]
xor ebx, ebx
xor eax, eax
cmp byte [0x40ce82], bl
push ebx
sete al
push 0x80
lea eax, [eax + eax + 2]
push eax
push ebx
push 1
push 0xc0000000
push dword [0x40ce84]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [0x40ce78], eax
je 0x40336b
mov cl, byte [0x40ce82]
neg cl
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
inc ecx
push ecx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [ebp - 0x114]
push eax
push str.Rolled_log_name:__s
call fcn.0040324d
pop ecx
pop ecx
pop ebx
leave
ret
Function at 0x403381
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1000
call fcn.00406e48
mov eax, dword [0x40c3ec]
cmp eax, dword [ebp + 8]
jg 0x403514
push ebx
xor ebx, ebx
cmp dword [ebp + 0x10], ebx
je 0x403513
push esi
push edi
push dword [ebp + 0x14]
lea eax, [ebp - 0x1000]
push dword [ebp + 0x10]
push eax
call fcn.00406ecd
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
add esp, 0xc
cmp dword [ebp + 0xc], ebx
je 0x4033f8
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.00406c18
pop ecx
push eax
push dword [ebp + 0xc]
push dword [0x40ce78]
call esi
push ebx
lea eax, [ebp + 0x10]
push eax
push 1
push 0x408fe4
push dword [0x40ce78]
call esi
push ebx
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00406c18
pop ecx
push eax
lea eax, [ebp - 0x1000]
push eax
push dword [0x40ce78]
call esi
push ebx
lea eax, [ebp + 0x10]
push eax
push 2
push 0x408fe0
push dword [0x40ce78]
call esi
push dword [0x40ce78]
mov edi, dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call edi
cmp byte [0x40ce80], bl
je 0x4034bd
cmp byte [0x40ce81], bl
je 0x4034bd
cmp dword [ebp + 0xc], ebx
je 0x40347f
push ebx
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
call fcn.00406c18
pop ecx
push eax
push dword [ebp + 0xc]
push dword [0x40ce7c]
call esi
push ebx
lea eax, [ebp + 0x10]
push eax
push 1
push 0x408fe4
push dword [0x40ce7c]
call esi
push ebx
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x1000]
push eax
call fcn.00406c18
pop ecx
push eax
lea eax, [ebp - 0x1000]
push eax
push dword [0x40ce7c]
call esi
push ebx
lea eax, [ebp + 0x10]
push eax
push 2
push 0x408fe0
push dword [0x40ce7c]
call esi
push dword [0x40ce7c]
call edi
fldz
pop edi
fcomp qword [0x40ce88]
pop esi
fnstsw ax
test ah, 5
jp 0x403513
mov al, byte [0x40ce83]
test al, al
jne 0x403513
push ebx
push dword [0x40ce78]
mov byte [0x40ce83], 1
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
mov dword [ebp + 0xc], eax
fild dword [ebp + 0xc]
jge 0x4034fb
fadd qword [0x408fd0]
fcomp qword [0x40ce88]
fnstsw ax
test ah, 0x41
jne 0x40350d
call fcn.004032ab
mov byte [0x40ce83], bl
pop ebx
leave
ret 0x10
Function at 0x404dd1
Capabilities:
Delete service

Disassembly:
push esi
push str.Unregistering_Service...
call fcn.0040324d
mov dword [esp], str.:service.id
push dword [esp + 0xc]
call fcn.0040265b
mov esi, eax
test esi, esi
jne 0x404e02
push str.Service_ID_not_specified
call fcn.00403537
xor eax, eax
pop ecx
inc eax
jmp 0x404e53
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
test eax, eax
jne 0x404e2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.Could_not_access_service_manager:__d
call fcn.00403537
pop ecx
pop ecx
mov eax, esi
jmp 0x404e53
push 0xf003f
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
test eax, eax
jne 0x404e4c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push esi
push str.Could_not_open_service:__d
jmp 0x404e20
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
pop esi
ret 4
Function at 0x40516e
Capabilities:
Enumerate gui resources
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x340
push esi
push edi
push str.:single.instance
push dword [ebp + 0x7c]
call fcn.0040265b
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x405197
xor eax, eax
jmp 0x4052fa
push str.window
push esi
mov byte [ebp + 0x73], 1
mov byte [ebp + 0x72], 0
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
jne 0x40522d
mov byte [ebp + 0x73], al
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp + 0x68], eax
mov esi, 0x104
push esi
lea eax, [ebp - 0x2cc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea ecx, [ebp - 0xc4]
push ecx
push eax
mov dword [ebp + 0x6c], eax
mov dword [ebp - 0xc4], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4052f7
push dword [ebp - 0xbc]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0x410
call edi
mov ebx, eax
push esi
lea eax, [ebp - 0x1c8]
push eax
push 0
push ebx
call sub.PSAPI.DLL_GetModuleFileNameExA
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4052be
push 0x409954
push esi
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
jne 0x40524a
mov byte [ebp + 0x73], al
mov byte [ebp + 0x72], 1
jmp 0x4051b3
push str.process
push esi
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
je 0x4051b3
push esi
push str.Invalid_single_instance_mode:__s
call fcn.00403518
pop ecx
pop ecx
jmp 0x405190
cmp byte [ebp + 0x72], 0
je 0x405283
push dword [ebp + 0x7c]
call fcn.00401e62
test al, al
jne 0x405289
cmp byte [ebp + 0x73], 0
je 0x405303
push str.Single_Instance_Shutdown
call fcn.00403518
xor eax, eax
pop ecx
inc eax
jmp 0x4052f9
push dword [ebp - 0xbc]
push 0
push 0x410
call edi
push esi
lea ecx, [ebp - 0x1c8]
push ecx
push 0
push eax
mov dword [ebp + 0x64], eax
call sub.PSAPI.DLL_GetModuleFileNameExA
push dword [ebp + 0x64]
call ebx
mov eax, dword [ebp + 0x68]
cmp eax, dword [ebp - 0xbc]
je 0x4052e4
lea eax, [ebp - 0x1c8]
push eax
lea eax, [ebp - 0x2cc]
push eax
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
je 0x405271
lea eax, [ebp - 0xc4]
push eax
push dword [ebp + 0x6c]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x405299
xor eax, eax
pop ebx
pop edi
pop esi
add ebp, 0x74
leave
ret 4
push dword [ebp - 0xbc]
push 0x405113
call dword [sym.imp.USER32.dll_EnumWindows]
neg eax
sbb eax, eax
inc eax
jmp 0x4052f9
Function at 0x405890
Capabilities:
Get common file path
Get file size
Read file on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push edi
push str.:working.directory
push dword [ebp + 8]
call fcn.0040265b
xor edi, edi
cmp eax, edi
mov dword [ebp - 8], eax
jne 0x4058d6
lea eax, [ebp - 0x10c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.WinRun4J:IniDir
push dword [ebp + 8]
call fcn.0040265b
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push edi
push edi
push 3
push edi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x405944
push ebx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
mov ebx, eax
lea eax, [ebp + 8]
push eax
push esi
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 8], edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405932
cmp dword [ebp + 8], esi
jne 0x405932
push esi
push ebx
call fcn.004054af
mov dword [ebp - 4], eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
cmp dword [ebp - 8], edi
pop edi
jne 0x405957
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 4]
leave
ret 8
Function at 0x4059f4
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push str.:splash.image
push dword [ebp + 0xc]
call fcn.0040265b
xor edi, edi
cmp eax, edi
mov dword [ebp - 4], eax
jne 0x405b05
push 0x2b1
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, edi
je 0x405a98
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push edi
push 2
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push edi
mov esi, eax
push ebx
push esi
call fcn.00406c3b
add esp, 0xc
push edi
push esi
call fcn.004054af
push esi
mov dword [0x40d000], eax
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
cmp dword [0x40d000], 0
pop ebx
jne 0x405aa5
push str.Could_not_load_embedded_splash_image
call fcn.00403518
pop ecx
cmp dword [0x40d000], 0
je 0x405b25
push str.Displaying_embedded_splash_image
call fcn.0040324d
xor edi, edi
pop ecx
push str.:splash.autohide
push dword [ebp + 0xc]
call fcn.0040265b
cmp eax, edi
je 0x405adb
push str.false
push eax
call fcn.00406bf5
test eax, eax
pop ecx
pop ecx
jne 0x405adb
mov byte [0x40d00d], 1
cmp dword [ebp - 4], edi
je 0x405b13
push dword [ebp - 4]
push dword [ebp + 0xc]
call fcn.00405890
cmp eax, edi
mov dword [0x40d000], eax
jne 0x405b13
push dword [ebp - 4]
push str.Could_not_load_splash_screen:__s
call fcn.00403518
pop ecx
pop ecx
jmp 0x405b25
push eax
push str.Displaying_splash:__s
call fcn.0040324d
pop ecx
jmp 0x405ab1
push edi
push edi
push dword [ebp + 8]
push 0x40595e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
leave
ret 8
Function at 0x405c27
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push esi
push edi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov edi, dword [ebp - 0x24]
push str.:vm.heapsize.preferred
push dword [ebp + 8]
shr edi, 0x14
sub edi, 0x50
mov dword [ebp - 0xc], edi
call fcn.0040265b
test eax, eax
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
je 0x405c98
push eax
call fcn.00406c76
cmp eax, edi
pop ecx
jle 0x405c6d
mov eax, edi
push eax
lea eax, [ebp - 0x130]
push str._Xmx_um
push eax
call fcn.00406c27
lea eax, [ebp - 0x130]
push eax
call fcn.00404676
mov ecx, dword [esi]
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [edx + ecx*4], eax
inc dword [esi]
push 0x409c28
push dword [ebp + 8]
call fcn.0040265b
test eax, eax
mov ebx, 0x5fa
je 0x405d4e
cmp dword [ebp - 4], 0
jne 0x405d4e
push eax
call fcn.00406c87
fst qword [ebp - 8]
fldz
pop ecx
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x405d41
fld qword [0x409c20]
fcomp st(1)
fnstsw ax
test ah, 5
jnp 0x405d41
push ecx
push ecx
fstp qword [esp]
push str.Percent_is:__f
call fcn.0040324d
push edi
push str.Avail_Phys:__dm
call fcn.0040324d
fld qword [ebp - 8]
fdiv qword [0x409c20]
add esp, 0x14
fimul dword [ebp - 0xc]
call fcn.00404658
cmp eax, ebx
jle 0x405d14
mov eax, ebx
push eax
lea eax, [ebp - 0x130]
push str._Xmx_um
push eax
call fcn.00406c27
lea eax, [ebp - 0x130]
push eax
call fcn.00404676
mov ecx, dword [esi]
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [edx + ecx*4], eax
inc dword [esi]
jmp 0x405d4e
push str.Error_with_heap_size_percent._Should_be_between_0_and_100.
fstp st(0)
call fcn.00403537
pop ecx
push str.:vm.heapsize.min.percent
push dword [ebp + 8]
call fcn.0040265b
test eax, eax
je 0x405df5
push eax
call fcn.00406c87
fst qword [ebp - 8]
fldz
pop ecx
fcomp st(1)
fnstsw ax
test ah, 0x41
je 0x405de8
fld qword [0x409c20]
fcomp st(1)
fnstsw ax
test ah, 5
jnp 0x405de8
push ecx
push ecx
fstp qword [esp]
push str.Percent_is:__f
call fcn.0040324d
push edi
push str.Avail_Phys:__dm
call fcn.0040324d
fld qword [ebp - 8]
fdiv qword [0x409c20]
add esp, 0x14
fimul dword [ebp - 0xc]
call fcn.00404658
cmp eax, ebx
jle 0x405dbb
mov eax, ebx
push eax
lea eax, [ebp - 0x130]
push str._Xms_um
push eax
call fcn.00406c27
lea eax, [ebp - 0x130]
push eax
call fcn.00404676
mov ecx, dword [esi]
mov edx, dword [ebp + 0xc]
add esp, 0x10
mov dword [edx + ecx*4], eax
inc dword [esi]
jmp 0x405df5
push str.Error_with_heap_size_percent._Should_be_between_0_and_100.
fstp st(0)
call fcn.00403518
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x406317
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x232e0
call fcn.00406e48
mov dword [ebp - 0xc], 0xff
lea eax, [ebp - 0x232e0]
mov ecx, 0xfe
mov byte [eax], 0
add eax, 0x234
dec ecx
jns 0x406336
push ebx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x232e0]
push eax
call fcn.004060da
push dword [ebp + 0x10]
lea eax, [ebp - 0x232e0]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 0xc]
push eax
call fcn.00405fe7
mov ebx, eax
test ebx, ebx
je 0x4063f6
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
lea eax, [ebp - 4]
push eax
mov edi, 0x20019
push edi
push 0
lea eax, [ebx + 0x130]
push eax
push 0x80000002
call esi
test eax, eax
jne 0x4063d3
lea eax, [ebp - 8]
push eax
push edi
xor edi, edi
push edi
inc ebx
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4063d3
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x114]
push eax
push edi
push edi
push str.RuntimeLib
push dword [ebp - 8]
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4063d7
xor eax, eax
jmp 0x4063f4
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x114]
push eax
call fcn.00404676
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4063fb
Capabilities:
Check if file exists
Get common file path
Get file attributes
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push str.:vm.location
push edi
call fcn.0040265b
test eax, eax
mov dword [ebp + 8], eax
je 0x406498
push str.:working.directory
push edi
call fcn.0040265b
test eax, eax
mov ebx, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [ebp - 4], eax
mov esi, 0x104
jne 0x406455
lea eax, [ebp - 0x108]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
push str.WinRun4J:IniDir
push edi
call fcn.0040265b
push eax
call ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x406467
xor eax, eax
jmp 0x4064c1
push 0
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
cmp dword [ebp - 4], 0
jne 0x406489
lea eax, [ebp - 0x108]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.00404676
pop ecx
jmp 0x4064c1
push str.:vm.version.max
push edi
call fcn.0040265b
push eax
push str.:vm.version.min
push edi
call fcn.0040265b
push eax
push str.:vm.version
push edi
call fcn.0040265b
push eax
call fcn.00406317
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4064c8
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
cmp byte [0x40d855], 0
jne 0x40653f
push edi
push str.:working.directory
push dword [ebp + 8]
call fcn.0040265b
mov edi, eax
test edi, edi
je 0x406537
push esi
push str.WinRun4J:IniDir
push dword [ebp + 8]
call fcn.0040265b
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push eax
call esi
push edi
call esi
call fcn.0040323b
test eax, eax
pop esi
jne 0x406537
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x104]
push eax
push str.Working_directory_set_to:__s
call fcn.0040324d
pop ecx
pop ecx
mov byte [0x40d855], 1
pop edi
leave
ret 4

Function at 0x406f8d
Capabilities:
Accept command line arguments
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x40c3f8]
test eax, eax
je 0x406fa6
call eax
test eax, eax
jne 0x406fa6
push 0xfffffffffffffffe
jmp 0x406fc0
push 1
push 0x40b014
push 0x40b008
call fcn.00407a62
add esp, 0xc
test eax, eax
je 0x406fc6
push 0xfffffffffffffffd
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push esi
push 0
push 0x40b004
push section..data
call fcn.00407a62
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
test esi, esi
jne 0x406fec
mov esi, 0x40828c
mov cl, 0x20
jmp 0x406ff5
cmp al, 0x20
ja 0x406fff
inc esi
mov al, byte [esi]
test al, al
jne 0x406ff0
cmp al, 0x20
jbe 0x407016
mov al, byte [esi]
cmp al, 0x22
jne 0x407008
xor cl, 0x20
inc esi
mov al, byte [esi]
cmp al, cl
ja 0x407001
jmp 0x407016
cmp al, cl
ja 0x40701c
inc esi
mov al, byte [esi]
test al, al
jne 0x407011
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test eax, 0xa0d0a0d
sub eax, 0x54524357
sub eax, 0xa0d0a0d
test byte [ebp - 0x18], 1
je 0x407045
movzx eax, word [ebp - 0x14]
jmp 0x407048
push 0xa
pop eax
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call fcn.00407a2d
pop ecx
pop esi
leave
ret
Function at 0x407a2d
Capabilities:
Terminate process

Disassembly:
call fcn.00407aa4
push 0
push 0x40b01c
push 0x40b018
call fcn.00407a62
push 0
push 0x40b024
push 0x40b020
call fcn.00407a62
add esp, 0x18
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40f310
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48cebb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047f4b1
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40f392
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047cb40
mov eax, dword [eax]
push 0x6ff224
push eax
call fcn.0046e5d4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047f73c
test bl, bl
je 0x40f392
push 0x6ff224
lea ecx, [esp + 0xc]
call fcn.0047fb18
push 0x702dac
lea ecx, [esp + 0xc]
call fcn.0047fb18
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40f3ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047f73c
jmp 0x40f499
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40f452
lea edx, [esp + 0x7c]
push 0x702da8
push edx
call fcn.0046e5d4
add esp, 8
test eax, eax
je 0x40f452
lea eax, [esp + 0x7c]
push 0x702da4
push eax
call fcn.0046e5d4
add esp, 8
test eax, eax
je 0x40f452
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40f3e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047f73c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x4106f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x410752
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc