joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4563fc
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
pushal
shl ebx, 0x11
add ebx, edx
mov edx, 0x16
sub dword [edx*4 + 0x4296ad], 0xaef7135
shr dword [edx*4 + 0x429a04], 3
sub bh, dl
setb al
mov edi, 0x8fb5192
xor ah, byte [ebp + 0x24]
inc eax
inc esi
mov edx, eax
not dword [0x429996]
mov dword [0x429a4c], 0x131d6b94
not eax
push edx
pop dword [ebp + 0x20]
mov dx, 0xbd3e
push dword [0x42993a]
or ecx, edx
push eax
rcr ah, 1
call fcn.00458cc3
add esp, 8
push dword [0x4293dd]
pop dword [0x4294fe]
mov dword [0x4293f3], eax
call fcn.00428b00
and edx, eax
imul eax
seta byte [0x429ae8]
mov dword [ebp + 0x20], 0x453358af
add bh, 0xfe
mov ecx, edx
and ebx, dword [0x4299c9]
add dword [0x4295fd], 0x1f3dc258
dec byte [0x429662]
jne 0x45664c
dec byte [ebp - 8]
and dword [ebp + 8], edx
jne 0x45664c
sete byte [0x429a04]
or cl, byte [0x429a5b]
add esi, 0x2b3f1439
mov byte [0x429761], 0x1f
mov edi, eax
push eax
mov ah, byte [ebp + 0x14]
dec dword [ebp + 0x20]
jno 0x4564f4
add dword [ebp + 0x28], 0xffffffe5
xor ebx, 0x22
inc dword [ebp + 0x24]
and bh, byte [0x429886]
neg esi
adc dword [0x4298c3], 0x652f0cef
sets byte [ebp + 0x2c]
shrd edi, edx, 0x19
call fcn.0045b507
or word [0x429885], 0xffe3
and dword [0x4293e1], 0x230f2622
push eax
push 0x213bf0b1
push dword [ebp + 0xc]
push dword [0x429960]
push edx
xor eax, dword [ebp - 0xc]
push 0x78877656
shl dword [ebp + 0x20], 0x1b
setge ch
push 0x6dbc4664
push dword [ebp + 8]
push dword [0x4294c7]
push dword [0x4293c1]
ror di, 1
push dword [0x429a91]
push dword [0x42940a]
add edx, 0x5b695022
call fcn.004588a7
push dword [0x429418]
push 0x2a2dce3
call fcn.00456cf3
add esp, 0x14
movsx eax, dx
mov edx, 0x42995f
inc ecx
shld eax, edx, 0x18
mov eax, edx
setne byte [0x429b82]
mov ecx, edx
push edx
push dword [edx]
push edx
pop dword [ebp - 0xc]
push 0x7497aade
call fcn.0045b5bc
push dword [0x429b66]
push 0x58058ea5
push dword [0x4297ae]
adc ebx, eax
mov ebx, eax
push dword [edx]
push eax
imul ecx, dword [0x429bf5]
push dword [0x42978a]
push edx
xor ebx, eax
jne 0x45661f
mul eax
sbb dh, al
imul edx
movsx esi, word [0x42979c]
shl dword [ebp + 0x28], 1
adc dword [0x4299d2], 0x14a96ec1
call fcn.0045a14a
push dword [0x429417]
pop dword [0x42984c]
clc
imul ecx, eax, 0x446a312a
shrd eax, edx, 9
imul eax, dword [ebp + 0x10]
and bl, 0xe4
rcl dword [ebp + 0x10]
and dword [0x429b3f], 0xe
mov dword [0x429a70], eax
imul eax, dword [0x429be6]
inc byte [ebp + 8]
imul edx, eax
pop edx
push dword [0x4295ba]
mov ebx, dword [str._n_n_n_n_n_n]
mov ecx, 0x15
adc ebx, dword [ecx*4 + 0x429b74]
dec dword [ebp + 0x24]
movzx edi, word [ecx*4 + 0x4294f9]
call fcn.00457c57
dec dword [ebp - 0xc]
pop eax
popal
mov esp, ebp
pop ebp
ret
Function at 0x457648
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
pushal
and dword [ebp + 0x18], 0x7f
push 0xa81b265
pop dword [0x4295d0]
add dword [ebp + 0xc], 0xffffffce
movzx ebx, word [0x429a41]
rcr bh, 1
sub byte [ebp + 0x10], al
push dword [0x429b62]
pop dword [0x4295b6]
shrd eax, edx, 0
movzx ebx, ax
add di, ax
or dh, dl
sub dword [0x429aeb], 0x220080ea
not dword [ebp + 0xc]
rcl ecx, 1
inc dword [0x429bab]
push 0x7370a110
mov byte [0x429816], dl
push 0x71eac7d8
push edx
or ecx, 0xffffffed
add esi, 0x7e
push dword [ebp + 8]
sub ebx, 0x68df4f
push dword [ebp + 0xc]
push edx
push dword [ebp + 0x10]
dec ecx
push dword [ebp + 0x10]
mov ecx, dword [0x4295d6]
call fcn.00428a7b
add esp, 0x20
or dword [0x4295d8], eax
mov si, dx
sbb dword [ebp + 8], 0x4cbcbc99
shrd ebx, edx, 0x14
mov dword [0x4299cf], 0x3a55952f
mov esi, 8
and edi, dword [esi*4 + 0x4298d8]
imul edx
sub edx, 0xfffffffa
dec cx
rcl dword [0x429512]
setge byte [0x4299a8]
mov eax, 0x17
and dword [ebp + 0x10], edx
dec dword [eax*4 + 0x429878]
rcl edi, 0x1c
add edx, 0xffffffcb
popal
pop ebp
ret 0x14
Function at 0x45c7f2
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
pushal
mov edi, 0x429ae0
sar esi, 1
mov dword [edi], 0x14be21fa
movsx ebx, dx
shrd ebx, edx, 0
mov bl, al
mov eax, 0x12
movsx esi, word [eax*4 + 0x429a3e]
xor dh, al
rcr bh, 1
movsx ecx, word [edi]
xor edi, 0xffffffea
shld dword [0x4297a6], eax, 0x1e
sbb esi, edx
adc dword [0x429a95], 0x14
mov edi, dword [0x429978]
imul ebx, edx, 0x3b927a6d
push dword [0x429700]
pop dword [0x429823]
mov esi, ecx
lea esi, [ebp - 4]
mov ebx, esi
push ebx
shld dword [0x429a2c], edx, 1
add word [0x429b14], 0x5a9a
push dword [ebp + 0x14]
imul eax
ror cx, 3
and eax, edx
mov ebx, dword [ebp + 0x10]
btr word [0x4297df], 0xd
add dword [0x429aa6], 0xffffff9e
shl ebx, 2
bt edi, edx
neg edi
mov dword [0x429998], 0x4b7e1b90
mov eax, dword [ebp + 8]
imul ecx, dword [0x4299a8], 0x45e72081
xor eax, 0x72e579ee
inc dword [0x42960e]
add ebx, eax
shl ch, 6
shl dword [0x429b1e], 1
sub edx, 0xc
mov byte [0x4297a1], 0x56
push ebx
rol esi, 7
call fcn.0045b9ca
inc dword [0x4296cf]
rol word [0x429675], 1
mov word [0x429adc], 0xc23d
mov ebx, dword [ebp + 0x10]
movsx edi, word [0x4297d8]
shl ebx, 2
imul edi, dword [0x42989e], 0x321be855
add ebx, dword [ebp + 0xc]
ror edx, 1
shld esi, eax, 0x18
push dword [ebp - 4]
mov eax, edx
pop dword [ebx]
test dword [0x4293cf], ecx
je 0x45c934
dec dword [0x42991a]
add eax, 0xffffffec
movsx ecx, word [0x429b42]
and ecx, 0x39617931
mov dword [0x4299d1], 0x7163a0c8
not byte [0x429794]
adc dword [0x4295aa], 0xffffffd5
mov dword [0x4294b6], eax
dec dword [ebp + 0x10]
js 0x45c990
dec dword [0x429981]
sbb ecx, edx
push dword [ebp + 0x14]
xor edx, eax
mov ecx, 0x4cff8ad3
push dword [ebp + 0x10]
imul edx, edx, 0x70a426e8
and eax, edx
push dword [ebp + 0xc]
xor edi, edx
dec cx
push dword [ebp + 8]
inc dword [0x429ade]
sbb edx, 0x55
call fcn.00428c44
mov dword [0x429aa6], 0x4b31d596
and dword [0x429498], eax
setbe byte [0x4296b2]
mul eax
xor dword [0x42942c], edx
movsx edx, word [0x4293b6]
popal
mov esp, ebp
pop ebp
ret 0x10

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x5725974
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e3d0
mov ecx, 0x534408fb
nop
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43006c
nop
popal
nop
nop
nop
nop
jmp 0x401219

Function at 0x4153ef
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4153fd
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
cmp esi, 8
push edi
not eax
mov ecx, 0xff
jl 0x4154e7
mov edi, esi
shr edi, 3
mov ebx, edi
neg ebx
lea esi, [esi + ebx*8]
mov dword [ebp + 0x10], esi
movzx ebx, byte [edx]
mov esi, eax
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x406180]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x406180]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x406180]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x406180]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x406180]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x406180]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x406180]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x406180]
xor eax, esi
inc edx
dec edi
jne 0x415425
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x415504
movzx ebx, byte [edx]
mov edi, eax
and edi, ecx
xor edi, ebx
shr eax, 8
mov edi, dword [edi*4 + 0x406180]
xor eax, edi
inc edx
dec esi
jne 0x4154eb
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x401007
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [eax]
mov eax, dword [eax + 4]
push esi
push edi
xor edi, edi
cmp dword [0x2b086dc], 0x594
mov dword [ebp - 8], eax
jne 0x40103b
push edi
lea eax, [ebp - 0x830]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [0x42fc68]
mov dword [ebp - 0x20], eax
mov eax, dword [0x42fc6c]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], edi
call fcn.00401000
mov eax, dword [0x42fc70]
mov esi, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [0x42fc74]
add esi, 0x23f
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x20
mov dword [ebp - 0xc], 2
add dword [ebp - 0xc], 3
mov eax, ebx
shl eax, 4
cmp dword [0x2b086dc], 0xc
mov dword [ebp - 4], eax
jne 0x4010b6
push edi
lea eax, [ebp - 0x430]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstVolumeMountPointA]
push edi
lea eax, [ebp - 0x30]
push eax
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_WriteConsoleA]
push edi
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov eax, dword [ebp - 0x2c]
add dword [ebp - 4], eax
mov eax, dword [0x2b086dc]
cmp eax, 0xfa9
jne 0x4010d2
mov dword [0x2b086d8], 0xedeb2e40
cmp eax, 0x3eb
jne 0x4010ed
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
mov dword [0x2b0808c], edi
mov ecx, dword [ebp - 0xc]
mov edx, ebx
lea eax, [esi + ebx]
shr edx, cl
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [0x2b086d4], 0xf4ea3dee
add edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edi
mov eax, dword [ebp - 0x10]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
xor dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor edx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add dword [ebp - 8], 0x64
sub dword [ebp - 8], eax
sub dword [ebp - 8], 0x64
mov eax, dword [ebp - 8]
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov eax, dword [ebp - 8]
lea ecx, [esi + eax]
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0xc]
shr eax, cl
add eax, dword [ebp - 0x24]
mov ecx, eax
mov eax, dword [ebp - 0x10]
xor dword [ebp - 4], eax
xor dword [ebp - 4], ecx
sub ebx, dword [ebp - 4]
add esi, 0x61c88647
dec dword [ebp - 0x1c]
jne 0x401076
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
pop edi
pop esi
mov dword [eax], ebx
mov dword [eax + 4], ecx
pop ebx
leave
ret 4
Function at 0x40372a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42f29c]
jne 0x403734
repz ret
jmp fcn.00405f0b

Function at 0x405873
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00402f44
and dword [ebp - 4], 0
cmp dword [0x433f84], 0
mov ebx, eax
jne 0x405924
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4059d5
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4059d5
push eax
call fcn.00402ed2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x433f84], eax
call esi
push eax
call fcn.00402ed2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x433f88], eax
call esi
push eax
call fcn.00402ed2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x433f8c], eax
call esi
push eax
call fcn.00402ed2
pop ecx
mov dword [0x433f94], eax
test eax, eax
je 0x405924
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402ed2
pop ecx
mov dword [0x433f90], eax
mov eax, dword [0x433f90]
cmp eax, ebx
je 0x40597c
cmp dword [0x433f94], ebx
je 0x40597c
push eax
call fcn.00402f4d
push dword [0x433f94]
mov esi, eax
call fcn.00402f4d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40597c
test edi, edi
je 0x40597c
call esi
test eax, eax
je 0x405973
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x405973
test byte [ebp - 0xc], 1
jne 0x40597c
or dword [ebp + 0x10], 0x200000
jmp 0x4059b5
mov eax, dword [0x433f88]
cmp eax, ebx
je 0x4059b5
push eax
call fcn.00402f4d
pop ecx
test eax, eax
je 0x4059b5
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4059b5
mov eax, dword [0x433f8c]
cmp eax, ebx
je 0x4059b5
push eax
call fcn.00402f4d
pop ecx
test eax, eax
je 0x4059b5
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x433f84]
call fcn.00402f4d
pop ecx
test eax, eax
je 0x4059d5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4059d7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
nop
sub eax, reloc.kernel32.dll_LoadLibraryW
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00431219
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401491
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x446cf0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401526
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e3
cmp dword [ebp + 0x10], ebx
jne 0x40151a
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401491
test eax, eax
jne 0x4014f5
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
jmp 0x516898
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x402e7e
Capabilities:
Check for time delay via gettickcount
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 8], esi
test edi, edi
jne 0x402e9b
mov dword [ebp - 8], ExpandEnvironmentStringsA
and dword [ebp - 4], 0
mov ebx, edi
test edi, edi
jne 0x402eaa
mov ebx, 0x417928
mov eax, dword [ebp + 8]
test eax, eax
jl 0x402ebf
mov ecx, dword [0x446c58]
add ecx, eax
push ecx
call fcn.00402e67
push 4
lea eax, [ebp + 0x14]
push eax
call fcn.00402e35
test eax, eax
jne 0x402ed6
push 0xfffffffffffffffd
pop eax
jmp 0x40302f
test dword [ebp + 0x14], 0x80000000
je 0x40300e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x427930
mov dword [ebp - 0xc], eax
call fcn.00406395
and dword [ebp + 0x14], 0x7fffffff
mov eax, dword [ebp + 0x14]
mov dword [ebp + 8], eax
jle 0x40302c
mov esi, 0x4000
cmp dword [ebp + 0x14], esi
jge 0x402f16
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x413928
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
sub dword [ebp + 0x14], esi
mov dword [0x427948], edi
mov dword [0x42794c], esi
mov eax, dword [ebp - 8]
mov ecx, 0x427930
mov dword [0x427950], ebx
mov dword [0x427954], eax
call fcn.004063b5
mov dword [ebp - 0x14], eax
test eax, eax
jl 0x403000
mov esi, dword [0x427950]
sub esi, ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x446cf4], 1
mov edi, eax
je 0x402fb4
sub eax, dword [ebp - 0xc]
cmp eax, 0xc8
ja 0x402f81
cmp dword [ebp + 0x14], 0
jne 0x402fb4
push dword [ebp + 8]
mov eax, dword [ebp + 8]
sub eax, dword [ebp + 0x14]
push 0x64
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [ebp - 0x54]
push str....__d__
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x54]
push eax
push 0
call fcn.0040490d
mov dword [ebp - 0xc], edi
xor eax, eax
cmp esi, eax
je 0x402ff5
cmp dword [ebp + 0x10], eax
jne 0x402fdd
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403007
cmp dword [ebp - 0x10], esi
jne 0x403007
add dword [ebp - 4], esi
jmp 0x402fe9
add dword [ebp - 4], esi
sub dword [ebp - 8], esi
mov ebx, dword [0x427950]
cmp dword [ebp - 0x14], 1
jne 0x402f35
jmp 0x40302c
cmp dword [ebp + 0x14], eax
jg 0x402f09
jmp 0x40302c
push 0xfffffffffffffffc
jmp 0x402ed0
jmp 0x516af0
test edi, edi
je 0x403075
cmp dword [ebp + 0x14], esi
jge 0x40301a
mov esi, dword [ebp + 0x14]
push esi
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
mov dword [ebp - 4], esi
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 0x10
mov esi, dword [ebp - 8]
cmp dword [ebp + 0x14], esi
jge 0x403041
mov esi, dword [ebp + 0x14]
push esi
mov edi, 0x413928
push edi
call fcn.00402e35
test eax, eax
je 0x402ece
push 0
lea eax, [ebp + 0x10]
push eax
push esi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x403007
cmp esi, dword [ebp + 0x10]
jne 0x403007
add dword [ebp - 4], esi
sub dword [ebp + 0x14], esi
cmp dword [ebp + 0x14], 0
jg 0x403036
jmp 0x40302c
Function at 0x405263
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, dword [0x446c0c]
push edi
push 3
call fcn.00405b0e
xor ebx, ebx
cmp eax, ebx
je 0x405294
push 1
push ebx
call eax
movzx eax, ax
cdq
push edx
push eax
push 0x477000
call fcn.00405860
jmp 0x4052de
push ebx
mov edi, 0x4319e8
push edi
push ebx
push str.Control_PanelDesktopResourceLocale
push 0x80000001
mov dword [0x477000], 0x7830
call fcn.004057e9
cmp byte [0x4319e8], bl
jne 0x4052d3
push ebx
push edi
push 0x40750e
push str..DEFAULTControl_PanelInternational
push 0x80000003
call fcn.004057e9
push edi
push 0x477000
call sub.KERNEL32.dll_lstrcatA
call fcn.0040393e
mov eax, dword [0x446c68]
and eax, 0x20
mov ebp, 0x471000
push ebp
mov dword [0x446cc0], eax
mov dword [0x446cdc], 0x10000
call fcn.00405be7
test eax, eax
jne 0x40538e
jmp 0x516578
push ebp
call fcn.00405be7
test eax, eax
jne 0x4053a4
push dword [esi + 0x118]
push ebp
call fcn.00405cbf
push 0x8040
push ebx
push ebx
push 1
push 0x67
push dword [0x446c08]
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [0x442bd0], eax
cmp dword [esi + 0x50], 0xffffffff
mov edi, 0x442ba0
je 0x405458
mov ecx, dword [0x446c08]
mov dword [0x442bb4], eax
lea eax, [esp + 0x10]
push edi
mov dword [esp + 0x14], 0x624e5f
mov dword [0x442ba4], 0x401000
mov dword [0x442bb0], ecx
mov dword [0x442bc4], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
je 0x405527
push ebx
lea eax, [esp + 0x18]
push eax
push ebx
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
mov eax, dword [esp + 0x20]
sub eax, dword [esp + 0x18]
push ebx
push dword [0x446c08]
push ebx
push ebx
push eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x28]
push eax
push dword [esp + 0x30]
lea eax, [esp + 0x2c]
push dword [esp + 0x30]
push 0x80000000
push ebx
push eax
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [0x42b9e4], eax
push ebx
call fcn.0040141a
test eax, eax
je 0x40546a
push 2
pop eax
jmp 0x405529
call fcn.0040393e
cmp dword [0x446ce0], ebx
jne 0x4054fe
push 5
push dword [0x42b9e4]
call dword [sym.imp.USER32.dll_ShowWindow]
push str.RichEd20
call fcn.00405aa0
test eax, eax
jne 0x4054a1
push str.RichEd32
call fcn.00405aa0
mov esi, dword [sym.imp.USER32.dll_GetClassInfoA]
push edi
mov ebp, str.RichEdit20A
push ebp
push ebx
call esi
test eax, eax
jne 0x4054cb
push edi
push str.RichEdit
push ebx
call esi
push edi
mov dword [0x442bc4], ebp
call dword [sym.imp.USER32.dll_RegisterClassA]
mov eax, dword [0x442bdc]
push ebx
push 0x404dd2
add eax, 0x69
movzx eax, ax
push ebx
push eax
push dword [0x446c08]
call dword [sym.imp.USER32.dll_DialogBoxParamA]
push 5
mov esi, eax
call fcn.0040141a
push 1
call fcn.00403732
mov eax, esi
jmp 0x405529
push ebx
call fcn.004049df
test eax, eax
je 0x405520
cmp dword [0x442bd4], ebx
jne 0x405462
push 2
call fcn.0040141a
jmp 0x405462
push 1
call fcn.0040141a
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret