joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401a30
Capabilities:
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [0x41100c], 0
mov dword [0x411008], 0x10
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0xc0
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapAlloc]
sub esp, 0xc
mov dword [0x411004], eax
test eax, eax
je 0x401a99
mov dword [esp + 4], 0
mov dword [esp], 0x401020
call fcn.00403bc8
sub esp, 8
test eax, eax
jne 0x401aa8
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0xc], section..text
mov esi, 0xfffffff4
xor ebx, ebx
mov dword [esp + 8], 0xc
mov eax, dword [0x41100c]
mov dword [esp + 4], eax
mov eax, dword [0x411004]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll_qsort]
call fcn.00403bb8
mov dword [esp + 4], 0x411000
mov dword [esp], eax
call fcn.00403b88
mov ecx, dword [0x411004]
xor edx, edx
mov eax, 1
sub esp, 8
lea esi, [esi]
nop
cmp ebx, dword [0x41100c]
jae 0x401b27
test edx, edx
je 0x401b80
mov edi, dword [ecx + esi + 0x10]
cmp dword [ecx + esi + 4], edi
jne 0x401b90
add edx, 1
add ebx, 1
add esi, 0xc
cmp ebx, dword [0x41100c]
jb 0x401b08
test eax, eax
setne bl
test edx, edx
je 0x401b51
test bl, bl
je 0x401b51
mov eax, dword [0x41100c]
sub eax, edx
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
call fcn.004013b0
mov ecx, dword [0x411004]
test eax, eax
setne bl
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapFree]
movzx eax, bl
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
add ebx, 1
add esi, 0xc
mov edx, 1
jmp 0x401b00
mov eax, ebx
sub eax, edx
lea eax, [eax + eax*2]
lea eax, [ecx + eax*4]
call fcn.004013b0
mov ecx, dword [0x411004]
test eax, eax
jne 0x401b80
xor ebx, ebx
jmp 0x401b51
Function at 0x401d80
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x26c
call fcn.00403bb8
mov dword [esp + 4], 0x411000
mov dword [esp], eax
call fcn.00403b88
sub esp, 8
lea esi, [esi]
mov dword [esp + 4], 0
mov dword [esp], 2
call sub.kernel32.dll_CreateToolhelp32Snapshot
sub esp, 8
mov edi, eax
test eax, eax
je 0x401ed8
mov dword [ebp - 0x244], 0x22c
lea ebx, [ebp - 0x244]
mov dword [esp + 4], ebx
mov dword [esp], eax
call sub.kernel32.dll_Process32FirstW
sub esp, 8
test eax, eax
je 0x401f30
mov dword [ebp - 0x24c], 0
jmp 0x401e17
mov dword [esp + 4], ebx
mov dword [esp], edi
call sub.kernel32.dll_Process32NextW
sub esp, 8
test eax, eax
je 0x401eb8
mov eax, dword [ebp - 0x23c]
mov edx, dword fs:[0x18]
cmp dword [edx + 0x20], eax
je 0x401e00
cmp eax, dword [section..bss]
je 0x401e00
mov dword [esp + 4], str.winewrapper
lea esi, [ebp - 0x220]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_wcsstr]
test eax, eax
jne 0x401e00
test byte [section..data], 8
jne 0x401ef0
mov eax, dword [ebp - 0x23c]
mov dword [esp + 4], 0
mov dword [esp], 1
mov dword [esp + 8], eax
call dword [sym.imp.kernelbase.dll_OpenProcess]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x401e00
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
cmp eax, 1
sbb dword [ebp - 0x24c], 0xffffffff
mov dword [esp], esi
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401e00
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
mov ecx, dword [ebp - 0x24c]
sub esp, 4
test ecx, ecx
jne 0x401da8
lea esi, [esi]
mov edx, dword [ebp + 8]
mov eax, dword [section..bss]
test edx, edx
je 0x401ee8
test eax, eax
jne 0x401f3e
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, esi
call fcn.004017f0
mov dword [esp + 0x14], eax
mov eax, dword [ebp - 0x23c]
mov dword [esp + 0xc], str.killing_process__04lx__s_n
mov dword [esp + 8], str.kill_processes
mov dword [esp + 4], 0x408000
mov dword [esp + 0x10], eax
mov dword [esp], 3
call fcn.00401490
jmp 0x401e59
mov dword [esp], edi
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401ed8
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov dword [esp], 1
call dword [sym.imp.kernelbase.dll_OpenProcess]
sub esp, 0xc
mov ebx, eax
test eax, eax
je 0x401ee8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_TerminateProcess]
sub esp, 8
mov dword [esp], ebx
call dword [sym.imp.kernelbase.dll_CloseHandle]
sub esp, 4
jmp 0x401ee8
Function at 0x402110
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x14
mov dword [esp], str.Usage:_wineboot__options__n
call fcn.004020b0
mov dword [esp], str.Options__n
call fcn.004020b0
mov dword [esp], str._____h___help_________Display_this_help_message_n
call fcn.004020b0
mov dword [esp], str._____e___end_session__End_the_current_session_cleanly_n
call fcn.004020b0
mov dword [esp], str._____f___force________Force_exit_for_processes_that_dont_exit_cleanly_n
call fcn.004020b0
mov dword [esp], str._____i___init_________Perform_initialization_for_first_Wine_instance_n
call fcn.004020b0
mov dword [esp], str._____k___kill_________Kill_running_processes_without_any_cleanup_n
call fcn.004020b0
mov dword [esp], str._____r___restart______Restart_only__dont_do_normal_startup_operations_n
call fcn.004020b0
mov dword [esp], str._____s___shutdown_____Shutdown_only__dont_reboot_n
call fcn.004020b0
mov dword [esp], str._____u___update_______Update_the_wineprefix_directory_n
call fcn.004020b0
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll_exit]
lea esi, [esi]

Function at 0x402320
Capabilities:
Access peb ldr_data
Get process heap flags
Get process heap force flags

Disassembly:
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x818]
push ebx
push ecx
sub esp, 0x838
mov edi, dword [ecx]
mov ebx, dword [ecx + 0xc]
mov dword [esp + 0x14], 0x8000
mov dword [esp + 0x10], 0x30
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], 1
mov dword [esp + 4], 0x7f05
mov dword [esp], 0
call fcn.00403b58
sub esp, 0x18
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x170
mov dword [esp + 4], 1
mov dword [esp], edi
call fcn.00403b18
sub esp, 0x14
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], 0xd
mov dword [esp + 4], 2
mov dword [esp], edi
call fcn.00403b18
sub esp, 0x14
cmp word [ebp - 0x818], 0
je 0x4024b8
mov eax, esi
lea esi, [esi]
nop
add eax, 2
cmp word [eax], 0
jne 0x4023e0
sub eax, esi
sar eax, 1
cmp word [ebx], 0
je 0x402407
mov ecx, ebx
lea esi, [esi]
add ecx, 2
cmp word [ecx], 0
jne 0x4023f8
sub ecx, ebx
sar ecx, 1
add eax, ecx
lea edx, [eax + 1]
lea eax, [edx + edx]
mov dword [ebp - 0x820], edx
mov ecx, dword fs:[0x18]
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x81c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapAlloc]
sub esp, 0xc
mov dword [esp + 0xc], ebx
mov ebx, eax
mov dword [esp + 8], esi
mov edx, dword [ebp - 0x820]
mov dword [esp], eax
mov dword [esp + 4], edx
call fcn.004021a0
mov dword [esp + 0x10], ebx
mov dword [esp], edi
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0xc
mov dword [esp + 4], 2
call fcn.00403b18
sub esp, 0x14
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov ecx, dword [ebp - 0x81c]
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0x10]
pop ecx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [ecx - 4]
ret 0x10
xor eax, eax
jmp 0x4023ed
Function at 0x4027e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExW
sub esp, 0x18
leave
ret

Function at 0x402820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, eax
sub esp, 0x24
cmp word [ecx], 0
je 0x402878
mov eax, ecx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x402838
sub eax, ecx
add eax, 2
mov dword [esp], ebx
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], edx
call sub.advapi32.dll_RegSetValueExW
mov ebx, dword [ebp - 4]
sub esp, 0x18
leave
ret
mov eax, 2
jmp 0x402846

Function at 0x402880
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov dword [ebp - 0x24], eax
mov esi, dword [ebp + 8]
mov eax, ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x28], edx
mov edi, dword [ebp + 0x10]
lea ebx, [esi + ecx]
test al, al
je 0x4028f2
cmp ecx, edi
jae 0x4028f2
movzx eax, al
xor ecx, ecx
mov dword [ebp - 0x20], eax
lea esi, [esi]
cmp byte [ebx], 0
je 0x4028f2
mov eax, dword [ebp - 0x20]
add ecx, 1
cmp ecx, eax
je 0x402937
mov eax, ebx
sub eax, esi
cmp eax, edi
jae 0x402933
mov dword [ebp - 0x1c], ecx
jmp 0x4028d4
cmp ecx, edi
jae 0x402930
movzx edx, byte [ebx]
mov eax, ebx
lea ebx, [ebx + 1]
mov ecx, ebx
sub ecx, esi
test dl, dl
jne 0x4028d0
mov ecx, dword [ebp - 0x1c]
lea ebx, [eax + 1]
mov eax, ebx
sub eax, esi
cmp eax, edi
jb 0x4028b0
xor ebx, ebx
mov ecx, 0x40948e
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x24]
call fcn.00402820
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov ecx, dword [ebp - 0x1c]
mov eax, ebx
jmp 0x4028e7
xor edx, edx
xor ecx, ecx
mov edi, dword [sym.imp.kernelbase.dll_MultiByteToWideChar]
mov dword [esp + 8], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
mov dword [esp + 4], ecx
mov dword [esp], ecx
mov dword [esp + 0xc], 0xffffffff
call edi
mov esi, eax
sub esp, 0x18
lea edx, [esi + esi]
mov dword [esp + 8], edx
xor edx, edx
mov dword [esp + 4], edx
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapAlloc]
sub esp, 0xc
test eax, eax
je 0x4028f2
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], esi
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [esp + 8], ebx
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], eax
call edi
mov ecx, dword [ebp - 0x1c]
sub esp, 0x18
mov ebx, ecx
jmp 0x4028f9
Function at 0x402d40
Capabilities:
Get process heap flags
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0xac
cmp word [eax], 0
mov dword [ebp - 0x8c], edx
je 0x402d69
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x402d60
sub eax, ebx
mov dword [esp + 4], 0
add eax, 0x26
mov dword [esp + 8], eax
mov edx, dword fs:[0x18]
mov eax, dword [edx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapAlloc]
sub esp, 0xc
mov esi, eax
test eax, eax
je 0x402f5d
xor eax, eax
nop
movzx ecx, word [ebx + eax]
mov word [esi + eax], cx
add eax, 2
test cx, cx
jne 0x402da0
mov dword [esp + 4], str..update_timestamp
mov dword [esp], esi
call fcn.00401ff0
mov edi, dword [sym.imp.ucrtbase.dll__wopen]
sub esp, 8
mov dword [esp + 4], 2
mov dword [esp], esi
call edi
mov ebx, eax
cmp eax, 0xffffffff
je 0x402ef6
lea edi, [ebp - 0x7c]
mov dword [esp + 8], 0x63
mov dword [esp + 4], edi
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__read]
test eax, eax
js 0x402e78
mov byte [ebp + eax - 0x7c], 0
mov dword [esp + 8], 7
mov dword [esp + 4], str.disable
mov dword [esp], edi
call sub.ucrtbase.dll_strncmp
test eax, eax
jne 0x402e57
xor edi, edi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__close]
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernelbase.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
mov dword [esp + 8], 0xa
mov dword [esp + 4], edx
mov dword [esp], edi
call dword [sym.imp.ucrtbase.dll_strtoul]
mov edx, dword [ebp - 0x8c]
cmp eax, edx
je 0x402e1e
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 8], ecx
mov dword [esp + 4], ecx
call dword [sym.imp.ucrtbase.dll__lseek]
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__chsize]
mov eax, dword [ebp - 0x8c]
mov dword [esp + 4], str._lu_n
mov dword [esp], edi
mov dword [esp + 8], eax
call fcn.00402790
mov dword [esp + 8], eax
mov dword [ebp - 0x8c], eax
mov dword [esp + 4], edi
mov dword [esp], ebx
call dword [sym.imp.ucrtbase.dll__write]
mov edx, dword [ebp - 0x8c]
cmp edx, eax
je 0x402f64
test byte [0x408090], 4
jne 0x402f2c
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.ucrtbase.dll__chsize]
jmp 0x402e1e
call dword [sym.imp.ucrtbase.dll__errno]
cmp dword [eax], 2
je 0x402f08
xor edi, edi
jmp 0x402e29
mov dword [esp + 8], 0x1b6
mov dword [esp + 4], 0x301
mov dword [esp], esi
call edi
mov ebx, eax
cmp eax, 0xffffffff
je 0x402f01
lea edi, [ebp - 0x7c]
jmp 0x402e9a
mov eax, esi
call fcn.00402c30
mov dword [esp + 0xc], str.failed_to_update_timestamp_in__s_n
mov dword [esp + 0x10], eax
mov dword [esp + 8], str.update_timestamp
mov dword [esp + 4], 0x408090
mov dword [esp], 2
call fcn.00402cb0
jmp 0x402ee2
xor edi, edi
jmp 0x402e4d
mov edi, 1
jmp 0x402e20
Function at 0x4047d0
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_narrow_argv
call sub.ucrtbase.dll__initialize_narrow_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___argv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_narrow_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call 0x404840
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00404930
mov dword [esp], eax
call sub.ucrtbase.dll_exit
jmp dword [sym.imp.ucrtbase.dll__set_app_type]
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
nop
sub eax, reloc.kernel32.dll_GetTimeFormatA
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x431030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
jmp loc.00401219
Function at 0x40110a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
lea eax, [ebp - 4]
push eax
push 0
push 0x80000000
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
je 0x40112e
xor eax, eax
jmp 0x4011bc
push esi
push 0
push dword [ebp + 8]
mov esi, 0x20a
mov edx, esi
lea ecx, [ebp - 0x31c]
call section..text
push str.ShellOpenCommand
mov edx, esi
lea ecx, [ebp - 0x31c]
call fcn.004010dc
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x31c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x105
call sub.advapi32.dll_RegQueryValueA
push dword [ebp - 4]
mov esi, eax
call sub.advapi32.dll_RegCloseKey
test esi, esi
je 0x40118b
xor eax, eax
jmp 0x4011bb
cmp byte [ebp - 0x110], 0
lea esi, [ebp - 0x110]
je 0x4011af
movzx eax, byte [esi]
push eax
call dword [0x4038d6]
test eax, eax
pop ecx
je 0x4011af
inc esi
cmp byte [esi], 0
jne 0x40119a
push esi
push dword [ebp + 0xc]
call sub.kernel32.dll_lstrcpyA
xor eax, eax
inc eax
pop esi
leave
ret 8

Function at 0x4011c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
imul eax, eax, 0x106
push ebx
lea ebx, [eax + 0x403260]
cmp byte [ebx], 0
jne 0x40127a
push esi
push edi
push 0x5c
mov esi, 0x403140
push esi
call dword [0x4038d2]
test eax, eax
pop ecx
pop ecx
mov edi, 0x118
jne 0x40120d
lea eax, [ebp - 0x118]
push eax
push 0x104
call sub.kernel32.dll_GetCurrentDirectoryA
jmp 0x401226
sub eax, esi
inc eax
cmp eax, edi
jbe 0x401216
mov eax, edi
push 0
push esi
mov edx, eax
lea ecx, [ebp - 0x118]
call section..text
push 0x4035a0
mov edx, edi
lea ecx, [ebp - 0x118]
call fcn.004010dc
push dword [ebp + 8]
call fcn.00401037
push eax
mov edx, edi
lea ecx, [ebp - 0x118]
call fcn.004010dc
lea eax, [ebp - 0x118]
push 0
push eax
call dword [0x4038ce]
test eax, eax
pop ecx
pop ecx
pop edi
pop esi
jne 0x40127a
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call section..text
pop ebx
leave
ret 4
Function at 0x40127f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
xor eax, eax
push 3
inc eax
call fcn.004011c0
cmp byte [0x403366], 0
jne 0x401394
push ebx
push edi
mov ebx, 0x403366
push 0x104
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push esi
mov esi, sub.kernel32.dll_lstrcatA
push 0x4035a0
lea eax, [ebp - 0x118]
push eax
call esi
push 3
call fcn.00401037
push eax
lea eax, [ebp - 0x118]
push eax
call esi
lea eax, [ebp - 0x118]
mov edi, dword [0x4038ce]
push 0
push eax
call edi
test eax, eax
pop ecx
pop ecx
pop esi
je 0x401326
push ebx
push 0x4035a4
call fcn.0040110a
test eax, eax
mov edi, dword [0x4038ce]
je 0x40131d
push 0
push ebx
call edi
test eax, eax
pop ecx
pop ecx
je 0x40131d
mov byte [0x403366], 0
jmp 0x401388
cmp byte [0x403366], 0
jne 0x401392
push 1
lea eax, [ebp - 0x118]
push eax
mov edx, 0x106
mov ecx, ebx
call section..text
cmp byte [0x403366], 0
jne 0x401392
push 0x403b31
push 0x403366
call sub.kernel32.dll_lstrcpyA
push 3
call fcn.00401037
push eax
push 0x403366
call sub.kernel32.dll_lstrcatA
push 0
push 0x403366
call dword [0x4038ce]
test eax, eax
pop ecx
pop ecx
je 0x40137f
and byte [0x403366], 0
cmp byte [0x403366], 0
jne 0x401392
xor eax, eax
inc eax
push 3
call fcn.004011c0
pop edi
pop ebx
leave
ret
Function at 0x4016f6
Capabilities:
Parse pe header

Disassembly:
call fcn.00401a25
push 0x74
push 0x4035f8
call fcn.004019d3
xor ebx, ebx
mov dword [ebp - 0x20], ebx
push ebx
mov edi, sub.kernel32.dll_GetModuleHandleA
call edi
cmp word [eax], 0x5a4d
jne 0x40173a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40173a
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x401752
cmp eax, 0x20b
je 0x40173f
mov dword [ebp - 0x1c], ebx
jmp 0x401766
cmp dword [ecx + 0x84], 0xe
jbe 0x40173a
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x401760
cmp dword [ecx + 0x74], 0xe
jbe 0x40173a
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [0x403886]
pop ecx
or dword [0x403474], 0xffffffff
or dword [0x403478], 0xffffffff
call dword [0x403882]
mov ecx, dword [0x403134]
mov dword [eax], ecx
call dword [0x40387e]
mov ecx, dword [0x403130]
mov dword [eax], ecx
mov eax, dword [0x40388a]
mov eax, dword [eax]
mov dword [0x403470], eax
call fcn.00401935
call fcn.004019d0
cmp dword [0x403014], ebx
jne 0x4017c6
push fcn.004019d0
call dword [0x40389a]
pop ecx
call fcn.004019bd
push 0x40300c
push 0x403008
call dword [0x40389e]
push 0x401979
call fcn.00401923
mov eax, dword [0x40312c]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
push dword [0x403128]
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [0x4038a2]
add esp, 0x20
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jge 0x40181c
push 8
call dword [0x4038a6]
pop ecx
push 0x403004
push section..data
call dword [0x40389e]
pop ecx
pop ecx
mov eax, dword [0x4038aa]
mov esi, dword [eax]
mov dword [ebp - 0x24], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x40189a
cmp al, bl
je 0x401847
cmp dword [ebp - 0x20], ebx
jne 0x40189a
mov al, byte [esi]
cmp al, bl
je 0x401857
cmp al, 0x20
ja 0x401857
inc esi
mov dword [ebp - 0x24], esi
jmp 0x401847
mov dword [ebp - 0x58], ebx
lea eax, [ebp - 0x84]
push eax
call sub.kernel32.dll_GetStartupInfoA
test byte [ebp - 0x58], 1
je 0x401872
movzx eax, word [ebp - 0x54]
jmp 0x401875
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call fcn.00401416
mov esi, eax
mov dword [ebp - 0x40], esi
cmp dword [ebp - 0x1c], ebx
jne 0x401892
push esi
call dword [0x4038ae]
call dword [0x4038b2]
jmp 0x4018f0
cmp al, 0x22
jne 0x4018a9
xor ecx, ecx
cmp dword [ebp - 0x20], ebx
sete cl
mov dword [ebp - 0x20], ecx
movzx eax, al
push eax
call dword [0x4038b6]
pop ecx
test eax, eax
je 0x4018bc
inc esi
mov dword [ebp - 0x24], esi
inc esi
jmp 0x401835
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.00401a0e
ret
Function at 0x401a25
Capabilities:
Get common file path
Query environment variable

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x4038fc], eax
push pe_nt_image_headers32
push 0x403904
push dword [0x4038fc]
call sub.kernel32.dll_GetModuleFileNameA
push 0x403904
push 0x4039c5
call sub.kernel32.dll_lstrcpyA
push 0x4039c5
call sub.kernel32.dll_lstrlenA
mov ecx, eax
lea edi, [0x4039c5]
add edi, ecx
dec edi
mov al, 0x5c
std
repne scasb al, byte es:[edi]
cld
inc edi
inc edi
mov al, 0
cld
stosb byte es:[edi], al
push 0x80
push 0x403a88
call sub.kernel32.dll_GetSystemDirectoryA
push 0x403a86
push 0x403a88
call sub.kernel32.dll_lstrcatA
push 0x80
push 0x403b31
push str.CommonProgramFiles
call sub.kernel32.dll_GetEnvironmentVariableA
or eax, eax
je 0x401adb
push 0x403a86
push 0x403b31
call sub.kernel32.dll_lstrcatA
push str.Microsoft_SharedVFP
push 0x403b31
call sub.kernel32.dll_lstrcatA
push 0x403a86
push 0x403b31
call sub.kernel32.dll_lstrcatA
jmp 0x401aea
push 0x403a88
push 0x403b31
call sub.kernel32.dll_lstrcpyA
push 0x4039c5
push 0x403bb2
call sub.kernel32.dll_lstrcpyA
push str.vfpcore.dll
push 0x403bb2
call sub.kernel32.dll_lstrcatA
push 0x403bb2
call sub.kernel32.dll_LoadLibraryA
or eax, eax
jne 0x401b71
push 0x403a88
push 0x403bb2
call sub.kernel32.dll_lstrcpyA
push str.vfpcore.dll
push 0x403bb2
call sub.kernel32.dll_lstrcatA
push 0x403bb2
call sub.kernel32.dll_LoadLibraryA
or eax, eax
jne 0x401b71
push 0x403b31
push 0x403bb2
call sub.kernel32.dll_lstrcpyA
push str.vfpcore.dll
push 0x403bb2
call sub.kernel32.dll_lstrcatA
push 0x403bb2
call sub.kernel32.dll_LoadLibraryA
or eax, eax
jne 0x401b71
xor eax, eax
ret
mov dword [0x403698], eax
lea esi, str.FOXMESSAGEBOX
lea edi, [0x40373c]
cmp byte [esi], 0
jne 0x401b89
jmp 0x401ba5
push esi
push dword [0x403698]
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
add edi, 4
jmp 0x401b82
push 0x4039c5
push 0x403bb2
call sub.kernel32.dll_lstrcpyA
push str.msvcr71.dll
push 0x403bb2
call sub.kernel32.dll_lstrcatA
push 0x403bb2
call sub.kernel32.dll_LoadLibraryA
or eax, eax
jne 0x401c2c
push 0x403a88
push 0x403bb2
call sub.kernel32.dll_lstrcpyA
push str.msvcr71.dll
push 0x403bb2
call sub.kernel32.dll_lstrcatA
push 0x403bb2
call sub.kernel32.dll_LoadLibraryA
or eax, eax
jne 0x401c2c
push 0x403b31
push 0x403bb2
call sub.kernel32.dll_lstrcpyA
push str.msvcr71.dll
push 0x403bb2
call sub.kernel32.dll_lstrcatA
push 0x403bb2
call sub.kernel32.dll_LoadLibraryA
or eax, eax
jne 0x401c2c
xor eax, eax
ret
mov dword [0x403768], eax
lea esi, str.__p__commode
lea edi, [0x40387e]
cmp byte [esi], 0
jne 0x401c44
jmp 0x401c60
push esi
push dword [0x403768]
call sub.kernel32.dll_GetProcAddress
mov dword [edi], eax
push esi
call sub.kernel32.dll_lstrlenA
add esi, eax
inc esi
add edi, 4
jmp 0x401c3d
mov eax, 1
ret