joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406314
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x41d380]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x1c]
push eax
push dword [0x42cee8]
mov dword [0x42cef8], ebx
call dword [sym.imp.USER32.dll_GetWindowRect]
test eax, eax
je 0x406357
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push ebx
movsd dword es:[edi], dword [esi]
call fcn.004056f2
add esp, 0x14
mov byte [ebp - 0xc], 0
xor eax, eax
lea edi, [ebp - 0xb]
stosd dword es:[edi], eax
mov esi, 0x405
stosb byte es:[edi], al
mov edi, esi
mov dword [ebp + 8], 0x1a
push 6
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.0040bff0
add esp, 0xc
push 2
lea eax, [ebp - 0xc]
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
lea eax, [ebp - 0xc]
push eax
call fcn.0040dbbd
pop ecx
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
inc edi
dec dword [ebp + 8]
jne 0x406370
and dword [0x41d060], 0
push ebx
call fcn.00405d37
push 0xa
push 0x3fb
push ebx
call fcn.004058ba
push 0x1a
push esi
push ebx
call fcn.004058ba
add esp, 0x1c
call fcn.00405d79
push 0x406175
push 0x32
push 1
push ebx
call dword [sym.imp.USER32.dll_SetTimer]
call fcn.00405690
mov edi, 0xc8
push edi
push 0
mov esi, 0x42cd40
push esi
call fcn.0040bff0
add esp, 0xc
push edi
push esi
push dword [0x42cef0]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp - 4]
xor eax, eax
inc eax
call fcn.0040bfdc
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40646b
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x41d380]
and dword [ebp - 0x48], 0
push esi
push edi
mov dword [ebp - 4], eax
mov byte [ebp - 0x44], 0
push 0xf
xor eax, eax
pop ecx
lea edi, [ebp - 0x43]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00405de8
push dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
call esi
push dword [ebp + 0x10]
mov dword [0x42cef0], eax
mov eax, dword [ebp + 0x18]
push edi
mov dword [0x42cd38], eax
mov dword [0x42cef4], edi
call esi
push dword [ebp + 0x14]
mov dword [0x42cef0], eax
push edi
call esi
push 0x40
mov dword [0x42ceec], eax
lea eax, [ebp - 0x44]
push eax
push dword [ebp + 0x10]
push edi
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x44]
push eax
push 0x42cd40
call fcn.0040be20
cmp dword [0x42cef8], 0
pop ecx
pop ecx
jne 0x40652f
call fcn.00405a80
push 0
push 0x40641b
push edi
push 0x84
push dword [ebp + 8]
mov dword [0x42cee8], edi
call dword [sym.imp.USER32.dll_CreateDialogParamA]
push 5
push eax
mov dword [0x42cef8], eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [ebp - 0x48], 1
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x48]
pop edi
pop esi
call fcn.0040bfdc
leave
ret
Function at 0x407bcb
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x41d380]
mov dword [ebp + 0x74], eax
push esi
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x1c], 6
jb 0x407bfc
push 6
jmp 0x407c1e
cmp dword [ebp - 0x1c], 5
jne 0x407c1f
cmp dword [ebp - 0x18], 2
jne 0x407c0c
push 5
jmp 0x407c14
cmp dword [ebp - 0x18], 1
jne 0x407c17
push 4
pop esi
jmp 0x407c28
cmp dword [ebp - 0x18], esi
jne 0x407c28
push 3
pop esi
cmp dword [ebp - 0x1c], 4
ja 0x407c28
xor esi, esi
inc esi
mov ecx, dword [ebp + 0x74]
mov eax, esi
pop esi
call fcn.0040bfdc
add ebp, 0x78
leave
ret

Function at 0x4084c1
Capabilities:
Switch active desktop

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x104
mov eax, dword [0x41d380]
push ebx
push esi
push edi
push 0xd9
mov dword [ebp + 0x70], eax
xor ebx, ebx
lea eax, [ebp - 0x8c]
push ebx
push eax
call fcn.0040bff0
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov esi, dword [ebp + 0x7c]
mov dword [0x42cf34], eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 7
xor eax, eax
pop ecx
mov byte [ebp + 0x50], bl
lea edi, [ebp + 0x51]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp + 0x50]
push eax
push ebx
mov dword [ebp - 0x90], 0x20
call fcn.004044e6
add esp, 0xc
test eax, eax
jl 0x4085f8
push dword [ebp - 0x90]
lea eax, [ebp + 0x50]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.0040c0b0
mov al, byte [ebp - 0x90]
add esp, 0xc
push 0x11
mov byte [ebp - 0x4c], al
lea eax, [ebp - 0x4b]
push eax
mov edi, 0x42e
push edi
push esi
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
push ebx
push ebx
push 0xb0
push edi
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
movzx ecx, ax
shr eax, 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
push 0x42b2bc
push eax
mov dword [ebp - 0x14], ecx
call fcn.0040be20
lea eax, [ebp - 0x8c]
push eax
mov dword [ebp - 8], ebx
call fcn.00408941
add esp, 0xc
push 0x4083a3
push 0x64
push 1
push esi
call dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x10000000
push ebx
push ebx
push ebx
push str.mydesk1
call dword [sym.imp.USER32.dll_CreateDesktopA]
push str.__vp
mov dword [0x42cf38], eax
call fcn.00408a44
pop ecx
push dword [0x42cf38]
call dword [sym.imp.USER32.dll_SwitchDesktop]
mov ecx, dword [ebp + 0x70]
pop edi
pop esi
pop ebx
call fcn.0040bfdc
add ebp, 0x74
leave
ret
Function at 0x408878
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 1]
push 1
push eax
mov byte [ebp - 1], 0
call fcn.00408839
mov al, byte [ebp - 1]
pop ecx
pop ecx
mov ecx, dword [ebp + 8]
push 0x36
lea esi, [ecx + 1]
pop edi
mov byte [ecx], al
mov byte [ecx + 0xd9], al
mov edx, esi
push ebx
mov ecx, dword [edx]
mov ebx, ecx
shr ebx, 0x15
shl ecx, 0xb
or ebx, ecx
mov dword [edx], ebx
add edx, 4
dec edi
jne 0x4088a6
mov ecx, esi
mov esi, 0xd9
pop ebx
xor al, byte [ecx]
mov dl, al
shr dl, 5
shl al, 3
or dl, al
add dl, 5
mov al, dl
mov byte [ecx], al
inc ecx
dec esi
jne 0x4088c2
pop edi
pop esi
leave
ret

Function at 0x4088dd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov al, byte [esi]
push edi
lea edi, [esi + 1]
mov byte [ebp + 0xb], al
mov ecx, edi
mov dword [ebp - 4], 0xd9
push ebx
mov dl, byte [ecx]
mov al, dl
sub al, 5
mov bl, al
shr bl, 3
shl al, 5
or bl, al
xor bl, byte [ebp + 0xb]
mov byte [ebp + 0xb], dl
mov byte [ecx], bl
inc ecx
dec dword [ebp - 4]
jne 0x4088f8
push 0x36
pop edx
mov ecx, edi
pop ebx
mov eax, dword [ecx]
mov edi, eax
shl edi, 0x15
shr eax, 0xb
or edi, eax
mov dword [ecx], edi
add ecx, 4
dec edx
jne 0x40891c
mov al, byte [esi]
sub al, byte [esi + 0xd9]
pop edi
neg al
pop esi
sbb eax, eax
inc eax
leave
ret

Function at 0x408a44
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0xc8]
sub esp, 0x148
mov eax, dword [0x41d380]
push ebx
push esi
push edi
push 0x44
pop esi
push esi
mov dword [ebp + 0xc4], eax
xor ebx, ebx
lea eax, [ebp - 0x80]
push ebx
push eax
call fcn.0040bff0
push 0x10
mov dword [ebp - 0x80], esi
push ebx
mov esi, 0x42cf58
push esi
mov dword [ebp - 0x78], str.mydesk1
mov word [ebp - 0x50], 5
mov dword [ebp - 0x54], 1
call fcn.0040bff0
mov byte [ebp - 0x3c], bl
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x3b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00408a08
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.0040be20
push dword [ebp + 0xd0]
lea eax, [ebp - 0x3c]
push eax
call fcn.0040be30
add esp, 0x28
push esi
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x90
push ebx
push ebx
push ebx
lea eax, [ebp - 0x3c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x408afe
push ebx
push str.Error
push 0x418af4
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov ecx, dword [ebp + 0xc4]
pop edi
pop esi
pop ebx
call fcn.0040bfdc
add ebp, 0xc8
leave
ret
Function at 0x408b30
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0xb4]
sub esp, 0x134
mov eax, dword [0x41d380]
push ebx
push esi
push edi
mov dword [ebp + 0xb0], eax
mov ebx, ecx
push 0x3f
xor eax, eax
pop ecx
mov byte [ebp - 0x80], 0
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, str.WTSAPI32.dll
lea edi, [ebp + 0x80]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 8
xor eax, eax
cmp dword [ebx + 8], 0
pop ecx
lea edi, [ebp + 0x8d]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
jne 0x408c13
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp + 0x80]
push eax
call esi
test eax, eax
mov dword [ebx + 8], eax
jne 0x408bef
push 0xff
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x408bd4
lea eax, [ebp - 0x80]
push eax
call fcn.0040bf20
cmp byte [ebp + eax - 0x81], 0x5c
pop ecx
je 0x408bd4
lea eax, [ebp - 0x80]
push 0x41835c
push eax
call fcn.0040be30
pop ecx
pop ecx
lea eax, [ebp + 0x80]
push eax
lea eax, [ebp - 0x80]
push eax
call fcn.0040be30
pop ecx
pop ecx
lea eax, [ebp - 0x80]
push eax
call esi
mov dword [ebx + 8], eax
mov eax, dword [ebx + 8]
test eax, eax
je 0x408c13
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WTSRegisterSessionNotification
push eax
call esi
push str.WTSUnRegisterSessionNotification
push dword [ebx + 8]
mov dword [ebx], eax
call esi
mov dword [ebx + 4], eax
mov ecx, dword [ebp + 0xb0]
xor eax, eax
cmp dword [ebx], eax
pop edi
pop esi
setne al
pop ebx
call fcn.0040bfdc
add ebp, 0xb4
leave
ret
Function at 0x408ee0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x41d380]
mov dword [esp + 0x10c], eax
push esi
push edi
xor eax, eax
mov byte [esp + 0x10], 0
mov ecx, 0x3f
lea edi, [esp + 0x11]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
lea edx, [esp + 0x10]
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x408f18
mov eax, dword [ebp + 0xc]
mov ecx, eax
lea esi, [ecx + 1]
lea ebx, [ebx]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x408f30
sub ecx, esi
mov dword [esp + 0xc], ecx
je 0x408f68
mov edx, eax
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x408f41
lea edi, [esp + 0x10]
sub eax, edx
dec edi
nop
mov cl, byte [edi + 1]
inc edi
test cl, cl
jne 0x408f50
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x408f95
xor eax, eax
mov ecx, dword [esp + 0x114]
call fcn.0040bfdc
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
mov ecx, dword [esp + 0xc]
push 4
lea edx, [ebp + 0x14]
push edx
push 4
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 0xc]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
xor eax, eax
test esi, esi
sete al
call fcn.0040bfdc
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x408fe0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
mov eax, dword [0x41d380]
mov ecx, dword [esp + 0xc]
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x409013
xor eax, eax
mov ecx, dword [esp + 4]
call fcn.0040bfdc
add esp, 8
ret
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push esi
push edx
mov edx, dword [esp + 8]
push eax
push 3
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 8]
xor eax, eax
test esi, esi
sete al
pop esi
call fcn.0040bfdc
add esp, 8
ret
Function at 0x4091c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x41d380]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 4], eax
lea edi, [ebx + ebx]
lea eax, [edi + 1]
push eax
call fcn.0040c9f0
pop ecx
xor ecx, ecx
test ebx, ebx
mov esi, eax
mov byte [ebp - 0x14], 0x30
mov byte [ebp - 0x13], 0x31
mov byte [ebp - 0x12], 0x32
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x34
mov byte [ebp - 0xf], 0x35
mov byte [ebp - 0xe], 0x36
mov byte [ebp - 0xd], 0x37
mov byte [ebp - 0xc], 0x38
mov byte [ebp - 0xb], 0x39
mov byte [ebp - 0xa], 0x41
mov byte [ebp - 9], 0x42
mov byte [ebp - 8], 0x43
mov byte [ebp - 7], 0x44
mov byte [ebp - 6], 0x45
mov byte [ebp - 5], 0x46
jbe 0x409247
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [eax]
shr dl, 4
mov byte [esi + ecx*2], dl
mov al, byte [eax]
and al, 0xf
mov byte [esi + ecx*2 + 1], al
inc ecx
cmp ecx, ebx
jb 0x40922d
xor eax, eax
test edi, edi
jbe 0x40925d
movzx ecx, byte [eax + esi]
mov cl, byte [ebp + ecx - 0x14]
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x40924d
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40926c
mov eax, dword [eax]
cmp eax, edi
jae 0x40926c
mov edi, eax
push edi
push esi
push dword [ebp + 0x10]
call fcn.0040c0b0
push esi
call fcn.0040c8d8
mov ecx, dword [ebp - 4]
add esp, 0x10
pop edi
pop esi
pop ebx
call fcn.0040bfdc
leave
ret

Function at 0x409340
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0xd8]
sub esp, 0x158
mov eax, dword [0x41d380]
push esi
push edi
push 0xff
mov dword [ebp + 0xd4], eax
xor esi, esi
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0040bff0
push dword [ebp + 0xe0]
call fcn.0040bf20
push eax
push dword [ebp + 0xe0]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040c0b0
push 0x44
pop edi
push edi
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.0040bff0
add esp, 0x28
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push 0x8000020
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
push esi
mov dword [ebp - 0x80], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edi, eax
cmp edi, 1
jne 0x4093e0
mov eax, dword [ebp + 0xe4]
cmp eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
jne 0x4093d6
push dword [ebp - 0x3c]
call esi
jmp 0x4093db
mov ecx, dword [ebp - 0x3c]
mov dword [eax], ecx
push dword [ebp - 0x38]
call esi
mov ecx, dword [ebp + 0xd4]
mov eax, edi
pop edi
pop esi
call fcn.0040bfdc
add ebp, 0xd8
leave
ret
Function at 0x409434
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x41d380]
mov dword [ebp - 4], eax
call fcn.004093f7
test eax, eax
mov eax, str.SOFTWAREWow6432NodeMicrosoftCryptographyDefaultsProviderComyiSafe_CSP_V3.0_
jne 0x409455
mov eax, str.SOFTWAREMicrosoftCryptographyDefaultsProviderComyiSafe_CSP_V3.0_
lea ecx, [ebp - 0x48]
push ecx
push 1
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4094b3
push esi
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x50]
push eax
push 0
push str.version
push dword [ebp - 0x48]
mov dword [ebp - 0x4c], 0x40
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x48]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp + 8]
test esi, esi
mov byte [eax], 0
pop esi
jne 0x4094b3
lea ecx, [ebp - 0x44]
push ecx
push eax
call fcn.0040be20
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0040bfdc
leave
ret

Function at 0x4094bd
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
push dword [0x42e758]
mov edi, dword [esp + 0x18]
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
push dword [0x42e754]
mov esi, dword [sym.imp.USER32.dll_SetDlgItemTextA]
push 0x17d5
push edi
call esi
push 0x42e5ac
xor ebx, ebx
inc ebx
push ebx
push edi
call esi
push 0x42e5b6
push 0x17d6
push edi
call esi
push 0x42e5c0
mov ebp, 0x17d7
push ebp
push edi
call esi
test byte [0x42e750], 4
jle 0x409557
push 0
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 1
push 0x17d6
push edi
call ebx
push eax
call esi
push 1
push ebp
push edi
call ebx
push eax
call esi
test dword [0x42e750], 0x100
jle 0x409550
push ebp
jmp 0x409583
push 0x17d6
jmp 0x409583
push ebx
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetDlgItem]
push edi
call ebx
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push eax
call esi
push 0
push 0x17d6
push edi
call ebx
push eax
call esi
push 0
push ebp
push edi
call ebx
push eax
call esi
push 1
push edi
call ebx
push eax
call dword [sym.imp.USER32.dll_SetFocus]
xor ebx, ebx
cmp dword [0x42e75c], ebx
jne 0x4095c1
push 6
push edi
mov dword [0x42e75c], 1
call esi
push 9
push edi
call esi
push 3
push ebx
push ebx
push ebx
push ebx
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push edi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret
Function at 0x409de3
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
lea ebp, [esp - 0x88]
sub esp, 0x108
mov eax, dword [0x41d380]
push esi
push edi
mov dword [ebp + 0x84], eax
push 0x40
xor eax, eax
mov byte [ebp - 0x80], 0
pop ecx
push dword [ebp + 0x90]
lea edi, [ebp - 0x7f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x80]
push eax
call fcn.0040be20
lea eax, [ebp - 0x80]
push str.XJABCVer.ini
push eax
call fcn.0040be30
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call esi
push dword [ebp + 0x90]
lea eax, [ebp - 0x80]
push eax
call fcn.0040be20
lea eax, [ebp - 0x80]
push str.XJABCSetup.exe
push eax
call fcn.0040be30
add esp, 0x10
lea eax, [ebp - 0x80]
push eax
call esi
push 0x32
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp + 0x90]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov ecx, dword [ebp + 0x84]
pop edi
pop esi
call fcn.0040bfdc
add ebp, 0x88
leave
ret

Function at 0x409e8a
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41d380]
push ebx
push esi
push edi
mov dword [ebp - 4], eax
push 0x40
xor eax, eax
pop ecx
mov byte [ebp - 0x20c], 0
lea edi, [ebp - 0x20b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
pop ecx
xor eax, eax
mov byte [ebp - 0x108], 0
lea edi, [ebp - 0x107]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
xor ebx, ebx
mov edi, str._sAbcCyInstUpdate_d_
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0040c050
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x409f26
lea eax, [ebp - 0x108]
push eax
call fcn.00409de3
inc ebx
cmp ebx, 0x7d0
pop ecx
jl 0x409eeb
xor ebx, ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.0040c050
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
call esi
test eax, eax
je 0x409f63
lea eax, [ebp - 0x108]
push eax
call fcn.00409de3
inc ebx
cmp ebx, 0x7d0
pop ecx
jl 0x409f28
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp dword [ebp + 8], 0
pop edi
pop esi
pop ebx
je 0x409f8c
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 8]
call fcn.0040be20
pop ecx
pop ecx
mov ecx, dword [ebp - 4]
call fcn.0040bfdc
leave
ret
Function at 0x40a93d
Capabilities:
Enumerate gui resources
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c28
call fcn.0040ca10
mov eax, dword [0x41d380]
push edi
push 0x1c24
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c28]
push 0
push eax
call fcn.0040bff0
add esp, 0xc
lea eax, [ebp - 0x1c28]
push eax
push 0x40a8ae
call dword [sym.imp.USER32.dll_EnumWindows]
xor edi, edi
cmp dword [ebp - 8], edi
jle 0x40a9ab
push esi
lea esi, [ebp - 0x1c28]
push dword [esi]
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
inc edi
add esi, 0x48
cmp edi, dword [ebp - 8]
jl 0x40a989
pop esi
mov ecx, dword [ebp - 4]
xor eax, eax
inc eax
pop edi
call fcn.0040bfdc
leave
ret

Function at 0x40a9b9
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1c28
call fcn.0040ca10
mov eax, dword [0x41d380]
push esi
push 0x1c24
mov dword [ebp - 4], eax
xor esi, esi
lea eax, [ebp - 0x1c28]
push esi
push eax
call fcn.0040bff0
add esp, 0xc
lea eax, [ebp - 0x1c28]
push eax
push 0x40a8ae
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 8], esi
jle 0x40a9fe
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
call fcn.0040bfdc
leave
ret
Function at 0x40aa72
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov eax, 0x501c
lea ebp, [esp - 0x4f9c]
call fcn.0040ca10
mov eax, dword [0x41d380]
push ebx
push edi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push 0x419a00
mov dword [ebp + 0x4f98], eax
xor edi, edi
call dword [sym.imp.WININET.dll_InternetOpenA]
cmp eax, ebx
mov dword [ebp - 0x80], eax
je 0x40abd5
push esi
push ebx
push 0x84000002
push ebx
push ebx
push dword [ebp + 0x4fa4]
push eax
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov esi, eax
cmp esi, ebx
mov dword [ebp - 0x78], esi
je 0x40abcb
push ebx
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
push 5
push esi
mov dword [ebp - 0x6c], 0x5000
call dword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
je 0x40aafe
lea eax, [ebp - 0x68]
push eax
call fcn.0040db35
pop ecx
mov dword [ebp - 0x74], eax
jmp 0x40ab05
mov dword [ebp - 0x74], 0x64000
push 0x4184a4
push dword [ebp + 0x4fa8]
call fcn.0040c808
pop ecx
pop ecx
mov dword [ebp - 0x70], eax
lea eax, [ebp - 0x6c]
push eax
mov edi, 0x400
push edi
lea eax, [ebp - 0x68]
push eax
push esi
mov esi, dword [sym.imp.WININET.dll_InternetReadFile]
jmp 0x40aba1
cmp dword [ebp - 0x6c], 0
jbe 0x40aba7
cmp dword [ebp - 0x70], 0
je 0x40ab51
push dword [ebp - 0x70]
lea eax, [ebp - 0x68]
push dword [ebp - 0x6c]
push 1
push eax
call fcn.0040c760
add esp, 0x10
add ebx, dword [ebp - 0x6c]
push 0
test ebx, ebx
mov dword [ebp - 0x7c], ebx
fild dword [ebp - 0x7c]
jge 0x40ab66
fadd qword [0x4199f8]
mov eax, dword [ebp - 0x74]
fmul qword [0x4199f0]
test eax, eax
fild dword [ebp - 0x74]
jge 0x40ab7c
fadd qword [0x4199f8]
fdivp st(1)
call fcn.0040dac0
push eax
push 0x402
push dword [ebp + 0x4fac]
call dword [sym.imp.USER32.dll_SendMessageA]
lea eax, [ebp - 0x6c]
push eax
push edi
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x78]
call esi
test eax, eax
jne 0x40ab31
cmp dword [ebp - 0x70], 0
je 0x40abb6
push dword [ebp - 0x70]
call fcn.0040c44f
pop ecx
cmp ebx, dword [ebp - 0x74]
je 0x40abc8
cmp dword [ebp - 0x74], 0x64000
je 0x40abc8
xor edi, edi
jmp 0x40abcb
xor edi, edi
inc edi
push dword [ebp - 0x80]
call dword [sym.imp.WININET.dll_InternetCloseHandle]
pop esi
mov ecx, dword [ebp + 0x4f98]
mov eax, edi
pop edi
pop ebx
call fcn.0040bfdc
add ebp, 0x4f9c
leave
ret