joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45c460
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x45c4c0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x45c4c0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x45c4c0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x45c4c0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x45c4d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x45e3e0
Capabilities:
Capture webcam image

Disassembly:
mov eax, dword [esp + 8]
push ebx
push esi
mov esi, ecx
mov eax, dword [eax + 4]
cmp dword [esi + 0xec], 1
jne 0x45e483
test eax, eax
jbe 0x45e483
mov ecx, dword [esi + 0xbc]
test ecx, ecx
jle 0x45e483
mov ecx, dword [esi + 0x1c]
push edi
push 0
push eax
push 0x419
push ecx
call dword [sym.imp.USER32.dll_SendMessageA]
mov edi, eax
mov eax, dword [esi + 0xbc]
inc edi
test eax, eax
jne 0x45e42e
xor esi, esi
jmp 0x45e434
mov esi, dword [esi + 0xb4]
add esi, 4
xor ebx, ebx
test edi, edi
jbe 0x45e45f
push ebp
mov ebp, edi
add esi, 6
push esi
call fcn.00407130
add esi, eax
push esi
mov ebx, esi
call fcn.00407130
add esp, 8
add esi, eax
dec edi
dec ebp
jne 0x45e440
pop ebp
test edi, edi
pop edi
jne 0x45e483
test ebx, ebx
je 0x45e483
mov edx, dword [esp + 0x10]
push 0x4e
add edx, 0x10
push ebx
push edx
call fcn.00462940
add esp, 0xc
mov eax, 1
pop esi
pop ebx
ret 0xc
pop esi
xor eax, eax
pop ebx
ret 0xc

Function at 0x45e5c5
Capabilities:
Capture webcam image

Disassembly:
sub esp, 0x44
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x45e6dd
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45e6dd
mov eax, dword [esi + 0x3c]
push eax
call fcn.00473387
mov esi, eax
test esi, esi
je 0x45e6dd
mov ebx, dword [esp + 0x58]
mov ecx, dword [esi + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push ebx
push 0x419
push ecx
call ebp
mov edi, eax
test edi, edi
jl 0x45e6dd
mov ecx, esi
call fcn.0045e530
cmp edi, eax
jge 0x45e6dd
mov eax, dword [esi + 0xc4]
mov edx, dword [esi + 0xc0]
mov dword [esp + 0x2c], eax
mov eax, dword [esp + 0x5c]
xor ecx, ecx
mov dword [esp + 0x28], edx
cmp eax, ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x4c], ecx
mov dword [esp + 0x50], ecx
mov dword [esp + 0x38], edi
jne 0x45e663
mov dword [esp + 0x34], 1
jmp 0x45e6be
mov edx, dword [esi + 0x1c]
lea ecx, [esp + 0x18]
push ecx
push ebx
push 0x433
push edx
call ebp
test eax, eax
je 0x45e6dd
mov eax, dword [esp + 0x60]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x10], ecx
mov dword [eax], 0
mov ecx, dword [esi + 0x1c]
lea eax, [esp + 0x10]
add edx, 2
push eax
push ecx
mov dword [esp + 0x1c], edx
call dword [sym.imp.USER32.dll_ClientToScreen]
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov dword [esp + 0x34], 3
mov dword [esp + 0x3c], edx
mov dword [esp + 0x40], eax
xor ecx, ecx
push ecx
lea ecx, [esp + 0x2c]
push ecx
push 0x7d8
call fcn.0045db30
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x44
ret 0xc
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x44
ret 0xc
Function at 0x473d2b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x473d63
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00471de2
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00471dba
jmp 0x473d6f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x475420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x475462
call fcn.0047b160
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x475462
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x475459
xor eax, eax
jmp 0x47546a
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00475470
pop edi
pop esi
pop ebx
ret 4

Function at 0x47b690
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x47b6be
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x47b6dc
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0047b5f6
jmp 0x47b6dc
mov eax, dword [esi + 0x14]
test eax, eax
je 0x47b6dc
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0047b5f6
test edi, edi
mov eax, edi
jne 0x47b6c6
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x402371
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov esi, ecx
push str.INFOEXE
push 0x7c
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0x468
add esi, 0x18
push eax
push esi
call fcn.00407d60
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 1
pop eax
pop edi
pop esi
ret

Function at 0x40248a
Capabilities:
Get common file path

Disassembly:
mov eax, 0x41028e
call fcn.00407a20
sub esp, 0x230
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 0x18]
call fcn.00405a7c
push dword [esi + 0x470]
lea edi, [esi + 0x470]
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], ebx
call fcn.00405abe
push dword [ebp - 0x14]
mov ecx, esi
push dword [edi]
push dword [esi + 0x46c]
push dword [esi + 0x468]
call fcn.004023b7
test eax, eax
jne 0x4024e3
xor esi, esi
jmp 0x4025b1
lea eax, [ebp - 0x23c]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x134]
push eax
push ebx
lea eax, [ebp - 0x23c]
push 0x414464
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
lea ecx, [ebp - 0x24]
call fcn.0040624d
push ebx
push 0x10000000
push 2
push ebx
lea eax, [ebp - 0x134]
push 0x40000000
push eax
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 1
call fcn.004062d1
test eax, eax
jne 0x402540
xor esi, esi
jmp 0x4025a6
lea eax, [ebp - 0x2c]
lea ecx, [ebp - 0x24]
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.00406390
test eax, eax
je 0x40253c
lea ecx, [ebp - 0x24]
call fcn.0040631b
push 0x70
call fcn.00407ac3
pop ecx
mov ecx, eax
mov dword [ebp - 0x28], ecx
cmp ecx, ebx
mov byte [ebp - 4], 2
je 0x40258a
push dword [esi + 0x478]
lea eax, [ebp - 0x134]
push eax
push dword [esi + 8]
call fcn.0040103d
jmp 0x40258c
xor eax, eax
add esi, 0x484
mov ecx, eax
mov byte [ebp - 4], 1
mov dword [esi], eax
call fcn.004011ff
cmp dword [esi], ebx
je 0x40253c
push 1
pop esi
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], bl
call fcn.0040625e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00405aa9
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4026da
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4102d8
call fcn.00407a20
sub esp, 0x33c
push ebx
push esi
mov esi, ecx
xor eax, eax
push edi
mov dword [ebp - 0x14], eax
cmp dword [esi + 0x348], eax
mov ebx, dword [esi + 0x340]
mov edi, dword [esi + 0x344]
mov dword [ebp - 0x18], eax
jle 0x40276e
cmp dword [ebp - 0x14], 0
jne 0x40278c
lea eax, [ebp - 0x348]
mov ecx, esi
push eax
push 0x208
push edi
push ebx
call fcn.004023b7
test eax, eax
je 0x402785
lea eax, [ebp - 0x247]
push str.WD80IMG.DLL
push eax
call fcn.00408170
pop ecx
test eax, eax
pop ecx
jne 0x40274a
mov dword [ebp - 0x14], 1
jmp 0x40275a
mov eax, dword [ebp - 0x144]
add eax, 0x208
add ebx, eax
adc edi, 0
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
cmp eax, dword [esi + 0x348]
jl 0x40270b
cmp dword [ebp - 0x14], 0
jne 0x40278c
mov ecx, dword [ebp + 8]
add esi, 0x125
push esi
call fcn.00405ccf
push 1
pop eax
jmp 0x4028e1
xor eax, eax
jmp 0x4028e1
lea eax, [ebp - 0x140]
push 0
push eax
lea ecx, [esi + 0x480]
call fcn.00405c30
push eax
call fcn.00404b1b
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.00405a7c
lea eax, [ebp - 0x1c]
and dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x348]
push eax
push edi
push ebx
mov ecx, esi
call fcn.004028f2
test eax, eax
jne 0x4027d8
xor edi, edi
jmp 0x4028d3
lea ecx, [ebp - 0x10]
call fcn.00405bc9
lea eax, [ebp - 0x348]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.00406053
add esp, 0x10
lea ecx, [ebp - 0x28]
call fcn.0040624d
mov ebx, 0x10000000
push 0
push ebx
push 2
mov edi, 0x40000000
push 0
push edi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00405c30
push eax
lea ecx, [ebp - 0x28]
call fcn.004062d1
test eax, eax
jne 0x402888
lea eax, [ebp - 0x140]
push eax
push 0x105
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x348]
push eax
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.00406053
add esp, 0x10
lea ecx, [ebp - 0x10]
push 0
push ebx
push 2
push 0
push edi
call fcn.00405c30
push eax
lea ecx, [ebp - 0x28]
call fcn.004062d1
test eax, eax
jne 0x402888
xor edi, edi
jmp 0x4028bb
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x30]
call fcn.00406390
test eax, eax
je 0x402884
lea ecx, [ebp - 0x28]
call fcn.0040631b
mov ecx, dword [ebp + 8]
push 1
pop edi
lea eax, [ebp - 0x10]
push eax
mov dword [esi + 0x488], edi
call fcn.00405cb7
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.0040625e
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.00405bfb
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.00405aa9
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x402b06
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x410328
call fcn.00407a20
sub esp, 0x110
push esi
mov esi, ecx
push edi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00408310
lea eax, [ebp - 0x11c]
push str.WDUPDATE.NET
push eax
call fcn.00408320
add esp, 0x10
lea eax, [ebp - 0x11c]
lea edi, [esi + 0x212]
push eax
push 0
push str.RESEAU
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [esi + 0x41c], 0
mov dword [ebp - 0x10], eax
je 0x402b9e
push eax
lea eax, [ebp - 0x11c]
push eax
push edi
lea eax, [ebp - 0x14]
push str.100___Lecture_de_la_cl
push eax
call fcn.00406066
add esp, 0x14
and dword [ebp - 4], 0
mov ecx, eax
call fcn.00405c30
push eax
mov ecx, esi
call fcn.00402a1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405bfb
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x402baf
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x410344
call fcn.00407a20
sub esp, 0x42c
push esi
mov esi, ecx
push str.bWL_MultiRemoteControl
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [ebp - 0x14], eax
je 0x402d5c
push ebx
lea eax, [esi + 8]
push edi
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00408310
mov edi, str.WDUPDATE.NET
lea eax, [ebp - 0x120]
push edi
push eax
call fcn.00408320
add esp, 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x120]
lea eax, [esi + 0x10d]
push edx
push 0x104
push eax
lea ecx, [esi + 0x212]
push 0x418090
push str.SERVEUR
push ecx
call ebx
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x438]
push 0x104
push eax
push 0x418090
lea eax, [esi + 0x212]
push str.CHEMIN
push eax
call ebx
lea eax, [ebp - 0x438]
lea ebx, [esi + 0x10d]
push eax
push ebx
call fcn.00408320
push ebx
call fcn.004048f1
lea eax, [ebp - 0x330]
push ebx
push eax
call fcn.00408310
lea eax, [ebp - 0x330]
push edi
push eax
call fcn.00408320
xor ebx, ebx
add esp, 0x1c
cmp dword [esi + 0x41c], ebx
je 0x402cca
lea eax, [ebp - 0x330]
push eax
lea eax, [ebp - 0x10]
push str.113___V
push eax
call fcn.00406066
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00405c30
push eax
mov ecx, esi
call fcn.00402a1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405bfb
lea eax, [ebp - 0x330]
push ebx
push eax
call dword [ebp - 0x14]
mov dword [ebp - 0x10], eax
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x228]
push eax
call fcn.00408310
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.00408320
add esp, 0x18
cmp dword [esi + 0x41c], ebx
push 1
pop edi
je 0x402d39
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x18]
push str.124___V
push eax
call fcn.00406066
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00405c30
push eax
mov ecx, esi
call fcn.00402a1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00405bfb
cmp dword [ebp - 0x10], ebx
je 0x402d4f
lea eax, [ebp - 0x228]
push edi
push eax
call dword [ebp - 0x14]
pop ecx
test eax, eax
pop ecx
jne 0x402d51
xor edi, edi
xor eax, eax
cmp edi, ebx
pop edi
pop ebx
sete al
jmp 0x402d5e
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
leave
ret
Function at 0x403343
Capabilities:
Get hostname
Query environment variable
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
mov esi, ecx
push edi
push 0x414a58
lea eax, [esi + 0x462]
push eax
call fcn.00408310
pop ecx
lea eax, [esi + 0x420]
pop ecx
mov dword [ebp - 8], 0x41
lea ecx, [ebp - 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x12]
push ecx
lea eax, [esi + 0x47b]
movzx ecx, word [ebp - 0x16]
push ecx
movzx ecx, word [ebp - 0x18]
push ecx
push str._04i_02i_02i
push eax
call fcn.004084af
movzx ecx, word [ebp - 0xe]
add esp, 0x14
lea eax, [esi + 0x484]
push ecx
movzx ecx, word [ebp - 0x10]
push ecx
push str._02i_02i
push eax
call fcn.004084af
add esp, 0x10
cmp dword [esi + 0x41c], 0
je 0x4033dc
push str.120___R
mov ecx, esi
call fcn.00402a1a
lea ebx, [esi + 0x489]
push 0x1e
mov edi, str._USERNAME_
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push ebx
push edi
call fcn.00408170
pop ecx
test eax, eax
pop ecx
jne 0x403410
lea eax, [ebp - 4]
mov dword [ebp - 4], 0x1e
push eax
push ebx
call dword [0x417f64]
cmp dword [esi + 0x41c], 0
je 0x403425
push str.121___R
mov ecx, esi
call fcn.00402a1a
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x120]
push eax
call fcn.00408310
lea eax, [ebp - 0x120]
push str.WDUPDATE.NET
push eax
call fcn.00408320
add esp, 0x10
lea eax, [ebp - 0x120]
lea edi, [esi + 0x4a8]
lea ebx, [esi + 0x212]
push eax
push 0x14
push edi
push 0x418090
push str.VERSION
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esi + 0x4bd]
push ebx
push eax
mov dword [ebp - 4], eax
call fcn.00408310
mov eax, dword [esi + 0x6dc]
pop ecx
pop ecx
mov ecx, dword [eax]
push str._LOCK__r_n
push eax
call dword [ecx + 0x3c]
mov eax, dword [esi + 0x6dc]
pop ecx
pop ecx
mov edx, dword [eax]
lea ecx, [esi + 0x420]
push ecx
push str.MACHINE_s_r_n
push eax
call dword [edx + 0x3c]
mov eax, dword [esi + 0x6dc]
add esp, 0xc
lea ecx, [esi + 0x462]
mov edx, dword [eax]
push ecx
push str.IP_s_r_n
push eax
call dword [edx + 0x3c]
mov eax, dword [esi + 0x6dc]
add esp, 0xc
lea ecx, [esi + 0x47b]
mov edx, dword [eax]
push ecx
push str.DATECONNECT_s_r_n
push eax
call dword [edx + 0x3c]
mov eax, dword [esi + 0x6dc]
add esp, 0xc
lea ecx, [esi + 0x484]
mov edx, dword [eax]
push ecx
push str.HEURECONNECT_s_r_n
push eax
call dword [edx + 0x3c]
mov eax, dword [esi + 0x6dc]
add esp, 0xc
lea ecx, [esi + 0x489]
mov edx, dword [eax]
push ecx
push str.LOGIN_s_r_n
push eax
call dword [edx + 0x3c]
mov eax, dword [esi + 0x6dc]
add esp, 0xc
mov ecx, dword [eax]
push edi
push str.VERSION_s_r_n
push eax
call dword [ecx + 0x3c]
add esp, 0xc
mov esi, dword [esi + 0x6dc]
push dword [ebp - 4]
mov eax, dword [esi]
push str.APPLICATION_s_r_n
push esi
call dword [eax + 0x3c]
add esp, 0xc
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403550
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x4103c4
call fcn.00407a20
sub esp, 0x274
push ebx
push esi
mov esi, ecx
mov ebx, str.WDUPDATE.NET
push edi
push ebx
lea eax, [esi + 0x10d]
mov edi, str._s_s
push eax
lea eax, [ebp - 0x178]
push edi
push eax
call fcn.004084af
add esp, 0x10
lea eax, [esi + 8]
push ebx
push eax
lea eax, [ebp - 0x280]
push edi
push eax
call fcn.004084af
lea eax, [ebp - 0x178]
push eax
call fcn.00404788
add esp, 0x14
test eax, eax
jne 0x4036a6
lea eax, [ebp - 0x178]
xor ebx, ebx
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x14]
push str.Le_fichier_des_param
push eax
mov dword [esi + 0x5c4], ebx
call fcn.00406066
add esp, 0x10
lea ecx, [esi + 0x212]
push 0x14
push ecx
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00405c30
push eax
push ebx
call dword [0x41805c]
cmp eax, 7
lea ecx, [ebp - 0x14]
sete byte [ebp - 0xd]
or dword [ebp - 4], 0xffffffff
call fcn.00405bfb
cmp byte [ebp - 0xd], bl
je 0x403659
cmp dword [esi + 0x41c], ebx
push 1
pop edi
je 0x403652
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x14]
push str.127___Le_fichier_de_param
push eax
call fcn.00406066
add esp, 0x10
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00405c30
push eax
mov ecx, esi
call fcn.00402a1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405bfb
mov eax, edi
jmp 0x4036fb
cmp dword [esi + 0x41c], ebx
je 0x4036a2
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x178]
push eax
lea eax, [ebp - 0x18]
push str.126___Le_fichier_de_param
push eax
call fcn.00406066
add esp, 0x10
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.00405c30
push eax
mov ecx, esi
call fcn.00402a1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.00405bfb
xor eax, eax
jmp 0x4036fb
lea eax, [ebp - 0x178]
mov ebx, 0x418090
push eax
lea eax, [ebp - 0x44]
push 0x28
push eax
mov edi, str.VERSION
add esi, 0x212
push ebx
push edi
mov dword [ebp - 0x18], esi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
call esi
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x70]
push 0x28
push eax
push ebx
push edi
push dword [ebp - 0x18]
call esi
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.00408400
neg eax
pop ecx
sbb eax, eax
pop ecx
and eax, 2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x403998
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x41040c
call fcn.00407a20
mov eax, 0x10b4
call fcn.00408510
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 8]
push eax
lea eax, [ebp - 0x11c]
push eax
call fcn.00408310
lea eax, [ebp - 0x11c]
push str.WDUPDATE.NET
push eax
call fcn.00408320
add esp, 0x10
lea eax, [ebp - 0x11c]
xor ebx, ebx
lea edi, [esi + 0x212]
push eax
push ebx
push str.INSTALLENCOURS
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
cmp dword [esi + 0x41c], ebx
mov dword [ebp - 0x10], eax
je 0x403a2c
push eax
lea eax, [ebp - 0x14]
push str.125___Lecture_du_flag_dinstall_en_cours_:__i
push eax
call fcn.00406066
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.00405c30
push eax
mov ecx, esi
call fcn.00402a1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405bfb
cmp dword [ebp - 0x10], 1
jne 0x403a86
lea eax, [ebp - 0x11c]
push eax
lea eax, [ebp - 0x10c0]
push 0xfa0
push eax
push ebx
push str.MSG_INSTALLENCOURS
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
jne 0x403a69
lea eax, [ebp - 0x10c0]
push str.La_pr
push eax
call fcn.00408310
pop ecx
pop ecx
push 0x24
lea eax, [ebp - 0x10c0]
push edi
push eax
push ebx
call dword [0x41805c]
cmp eax, 6
jne 0x403a86
mov ecx, esi
call fcn.0040370a
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [ebp - 0x10], ebx
pop edi
pop esi
pop ebx
setne al
mov dword fs:[0], ecx
leave
ret

Function at 0x403ad2
Capabilities:
Create mailslot

Disassembly:
mov eax, 0x410420
call fcn.00407a20
sub esp, 0x10c
mov al, byte [0x418090]
push esi
push edi
mov esi, ecx
push 0x41
mov byte [ebp - 0x118], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x117]
rep stosd dword es:[edi], eax
lea eax, [esi + 0x212]
push eax
lea eax, [ebp - 0x118]
push str..mailslot_s
push eax
call fcn.004084af
add esp, 0xc
xor edi, edi
lea eax, [ebp - 0x118]
push edi
push 0x1f4
push 0x2000
push eax
call dword [sym.imp.KERNEL32.dll_CreateMailslotA]
cmp eax, edi
mov dword [esi + 0x5d0], eax
jne 0x403b7b
cmp dword [esi + 0x41c], edi
je 0x403b7b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x10]
push str.Echec_de_la_cr
push eax
call fcn.00406066
add esp, 0xc
mov ecx, eax
mov dword [ebp - 4], edi
call fcn.00405c30
push eax
mov ecx, esi
call fcn.00402a1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00405bfb
mov ecx, dword [ebp - 0xc]
xor eax, eax
cmp dword [esi + 0x5d0], edi
pop edi
pop esi
mov dword fs:[0], ecx
setne al
leave
ret
Function at 0x403b94
Capabilities:
Create process on windows
Read .ini file

Disassembly:
mov eax, 0x410434
call fcn.00407a20
sub esp, 0x284
push ebx
push esi
push edi
mov edi, ecx
push str.INST.WXF
lea eax, [ebp - 0x188]
lea ebx, [edi + 0x10d]
push ebx
push str._s_s
push eax
call fcn.004084af
add esp, 0x10
lea eax, [ebp - 0x188]
push eax
lea eax, [ebp - 0x2c]
push 0x14
push eax
push 0x418090
push 0x414e84
push 0x414e80
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x2c]
push str.WXF7
push eax
call fcn.00408170
pop ecx
test eax, eax
pop ecx
jne 0x403cd0
xor esi, esi
cmp dword [edi + 0x41c], esi
je 0x403c19
push str.132___Retour
mov ecx, edi
call fcn.00402a1a
push 0x44
lea eax, [ebp - 0x80]
push esi
push eax
call fcn.00407d00
push ebx
mov dword [ebp - 0x80], 0x44
call fcn.004048f1
add esp, 0x10
lea eax, [ebp - 0x290]
push ebx
push ebx
push str._sWDSETUP7.EXE__REP_s
push eax
call fcn.004084af
add esp, 0x10
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push esi
push 0x20
push esi
push esi
lea eax, [ebp - 0x290]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, esi
jne 0x403ce1
push esi
lea eax, [ebp - 0x10]
push esi
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [edi + 0x41c], esi
je 0x403cc7
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push dword [ebp - 0x10]
push str.Impossible_de_lancer_lapplication_de_contr
push eax
call fcn.00406066
add esp, 0x10
mov ecx, eax
mov dword [ebp - 4], esi
call fcn.00405c30
push eax
mov ecx, edi
call fcn.00402a1a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00405bfb
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push 1
pop eax
jmp 0x403cd2