joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40198c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
and byte [ebp - 0x10], 0
push ebx
push edi
xor eax, eax
lea edi, [ebp - 0xf]
and byte [ebp - 0x618], 0
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], ecx
push dword [ebp + 8]
stosb byte es:[edi], al
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x617]
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x618]
push 0x400
push eax
push 0x40427c
push str.NotUseDefaultDllPath
push 0x404238
call ebx
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push 0xa
push eax
lea eax, [ebp - 0x618]
push eax
call fcn.00401cf7
cmp byte [ebp - 0x10], 0x31
jne 0x401a19
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
call fcn.00401d8a
jmp 0x401aef
and byte [ebp - 0x218], 0
push esi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x217]
rep stosd dword es:[edi], eax
push dword [ebp + 8]
mov esi, 0x104
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x218]
push esi
push eax
push 0
push str.DllPath
push str.DefaultValue
call ebx
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
push esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, dword [ebp - 4]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x218]
push dword [ebp + 0xc]
push eax
call fcn.00401c73
lea eax, [ebp - 0x114]
pop esi
test eax, eax
je 0x401aa9
lea eax, [ebp - 0x114]
push 0x3a
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
pop ecx
test eax, eax
pop ecx
jne 0x401abb
cmp byte [ebp - 0x114], 0x5c
je 0x401abb
push dword [ebp + 0x14]
lea eax, [ebp - 0x114]
push dword [ebp + 0x10]
push eax
jmp 0x401a09
cmp dword [ebp + 0x10], 0
je 0x401aef
cmp dword [ebp + 0x14], 0
jle 0x401aef
lea eax, [ebp - 0x114]
push eax
call sub.MSVCRT.dll_strlen
cmp eax, dword [ebp + 0x14]
pop ecx
jae 0x401aef
lea eax, [ebp - 0x114]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [0x40401c]
add esp, 0xc
pop edi
pop ebx
leave
ret 0x10
Function at 0x401af5
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push ebx
push esi
push edi
mov ebx, ecx
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x103]
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push esi
lea eax, [ebp - 0x104]
push 0x104
xor edi, edi
push eax
push edi
push str.Path
push str.Redirect
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [ebp - 0x104]
lea eax, [ebp - 0x104]
test ecx, ecx
je 0x401bb2
mov cl, byte [ebp - 0x104]
test cl, cl
je 0x401bb2
cmp cl, 0x20
je 0x401b61
cmp cl, 9
jne 0x401b67
mov cl, byte [eax + 1]
inc eax
jmp 0x401b53
lea eax, [ebp - 0x104]
push 0x3a
push eax
call dword [sym.imp.MSVCRT.dll__mbschr]
pop ecx
test eax, eax
pop ecx
jne 0x401b9c
cmp byte [ebp - 0x104], 0x5c
je 0x401b9c
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
mov ecx, ebx
push dword [ebp + 0xc]
push eax
push esi
call fcn.00401d8a
jmp 0x401bdc
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
mov ecx, ebx
push dword [ebp + 0xc]
push eax
call fcn.00401af5
jmp 0x401bdc
cmp dword [ebp + 0xc], edi
je 0x401bdc
cmp dword [ebp + 0x10], edi
jle 0x401bdc
cmp esi, edi
je 0x401bdc
push esi
call sub.MSVCRT.dll_strlen
cmp eax, dword [ebp + 0x10]
pop ecx
jae 0x401bdc
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [0x40401c]
add esp, 0xc
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x404494
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410782
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x10], eax
mov eax, 1
test eax, eax
je 0x404548
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 0x10]
xor edx, edx
mov ecx, 0x3e8
div ecx
cmp eax, dword [ebp + 0xc]
jbe 0x4044e0
xor eax, eax
jmp 0x404548
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x20]
call fcn.0040101a
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
call fcn.00402ad0
push eax
call fcn.00403cc9
add esp, 4
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 0x14], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.004010d9
mov ecx, dword [ebp - 0x14]
and ecx, 0xff
test ecx, ecx
je 0x404538
mov eax, 1
jmp 0x404548
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4044b8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4066bd
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41089e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x538
mov dword [ebp - 0x53c], ecx
cmp dword [0x417b28], 0
jne 0x4066f1
xor eax, eax
jmp 0x4068b4
mov dword [ebp - 0x518], 0xfa
lea eax, [ebp - 0x514]
push eax
call fcn.00409b5e
push eax
lea ecx, [ebp - 0x538]
call fcn.0040101a
mov dword [ebp - 0x540], eax
mov ecx, dword [ebp - 0x540]
mov dword [ebp - 0x544], ecx
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x544]
call fcn.00402ad0
push eax
call fcn.00403e36
add esp, 8
sub eax, 1
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x52c], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x538]
call fcn.004010d9
mov edx, dword [ebp - 0x52c]
and edx, 0xff
test edx, edx
je 0x406823
mov dword [ebp - 0x520], 4
mov dword [ebp - 0x528], 4
lea eax, [ebp - 0x524]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x510]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406823
lea edx, [ebp - 0x528]
push edx
lea eax, [ebp - 0x51c]
push eax
lea ecx, [ebp - 0x520]
push ecx
push 0
push str.ATIPOLLINTERVAL
mov edx, dword [ebp - 0x524]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406816
cmp dword [ebp - 0x51c], 0xfa
jae 0x4067f2
mov dword [ebp - 0x518], 0xfa
jmp 0x406816
cmp dword [ebp - 0x51c], 0x7d0
jbe 0x40680a
mov dword [ebp - 0x518], 0x7d0
jmp 0x406816
mov eax, dword [ebp - 0x51c]
mov dword [ebp - 0x518], eax
mov ecx, dword [ebp - 0x524]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.HKeyPollerTimerEvent
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov edx, dword [ebp - 0x53c]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 0x53c]
cmp dword [eax + 0x24], 0
jne 0x406856
push str.FAILURE:_Failed_to_create_event_for_HKeyPollerTimerEvent
call fcn.00409a98
add esp, 4
push 0
mov ecx, dword [ebp - 0x518]
push ecx
push 0x4d2
mov edx, dword [0x417b28]
push edx
call dword [sym.imp.USER32.dll_SetTimer]
mov ecx, dword [ebp - 0x53c]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp - 0x53c]
cmp dword [edx + 0x28], 0
jne 0x406893
push str.FAILURE:_Failed_to_SetTimer
call fcn.00409a98
add esp, 4
mov eax, dword [ebp - 0x53c]
cmp dword [eax + 0x28], 0
je 0x4068b2
mov ecx, dword [ebp - 0x53c]
cmp dword [ecx + 0x24], 0
je 0x4068b2
mov eax, 1
jmp 0x4068b4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x409a98
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x417b14]
and eax, 0x80000000
test eax, eax
je 0x409acc
lea ecx, [ebp + 0xc]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00409bdc
add esp, 8
mov dword [ebp - 4], 0
mov ecx, dword [0x417b14]
and ecx, 0x40000000
test ecx, ecx
je 0x409b5a
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.ATIExtEvent
push str.__s___lu_:
lea edx, [ebp - 0x404]
push edx
call fcn.0040b887
add esp, 0x10
lea eax, [ebp + 0xc]
mov dword [ebp - 0x408], eax
mov ecx, dword [ebp - 0x408]
push ecx
mov edx, dword [ebp + 8]
push edx
lea eax, [ebp - 0x404]
push eax
call fcn.0040b770
add esp, 4
lea ecx, [ebp + eax - 0x404]
push ecx
call fcn.0040c386
add esp, 0xc
mov dword [ebp - 0x408], 0
push 0x416648
lea edx, [ebp - 0x404]
push edx
call fcn.0040b690
add esp, 8
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov esp, ebp
pop ebp
ret
Function at 0x409bdc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x1f4
push 0
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040b250
add esp, 0xc
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTime]
mov edx, dword [0x417b40]
and edx, 1
test edx, edx
je 0x409c4f
mov eax, dword [ebp - 0x202]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x206]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x208]
and edx, 0xffff
push edx
push str._04d__02d__02d
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040b887
add esp, 0x14
mov ecx, dword [0x417b40]
and ecx, 2
test ecx, ecx
je 0x409cb3
mov edx, dword [ebp - 0x1fa]
and edx, 0xffff
push edx
mov eax, dword [ebp - 0x1fc]
and eax, 0xffff
push eax
mov ecx, dword [ebp - 0x1fe]
and ecx, 0xffff
push ecx
mov edx, dword [ebp - 0x200]
and edx, 0xffff
push edx
push str.__02d:_02d:_02d:_03d
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040b770
add esp, 4
lea ecx, [ebp + eax - 0x1f4]
push ecx
call fcn.0040b887
add esp, 0x18
mov edx, dword [0x417b40]
and edx, 4
test edx, edx
je 0x409ceb
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str._0x_08x
lea eax, [ebp - 0x1f4]
push eax
call fcn.0040b770
add esp, 4
lea ecx, [ebp + eax - 0x1f4]
push ecx
call fcn.0040b887
add esp, 0xc
push 0x416788
lea edx, [ebp - 0x1f4]
push edx
call fcn.0040b690
add esp, 8
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x1f4]
push edx
call fcn.0040b770
add esp, 4
lea eax, [ebp + eax - 0x1f4]
push eax
call fcn.0040c386
add esp, 0xc
push 0x41678c
lea ecx, [ebp - 0x1f4]
push ecx
call fcn.0040b690
add esp, 8
movsx edx, byte [ebp - 1]
test edx, edx
je 0x409d54
push str.____________________Log_Msg_Too_Long____________________
call fcn.00409bb7
add esp, 4
jmp 0x409dd4
push 0
push 0x20
push 4
push 0
push 1
push 0x40000000
push str.LogMsg.txt
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x1f8], eax
cmp dword [ebp - 0x1f8], 0xffffffff
je 0x409dd4
push 2
push 0
push 0
mov eax, dword [ebp - 0x1f8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0x20c], 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
lea edx, [ebp - 0x1f4]
push edx
call fcn.0040b770
add esp, 4
push eax
lea eax, [ebp - 0x1f4]
push eax
mov ecx, dword [ebp - 0x1f8]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x1f8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x40a0cf
Capabilities:
Create service
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov dword [ebp - 0x218], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0
jne 0x40a103
xor eax, eax
jmp 0x40a291
push 0x104
lea eax, [ebp - 0x104]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x104]
push ecx
push 1
push 2
push 0x110
push 0xf01ff
mov edx, dword [ebp - 0x218]
add edx, 4
push edx
mov eax, dword [ebp - 0x218]
add eax, 4
push eax
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov dword [ebp - 0x108], eax
cmp dword [ebp - 0x108], 0
jne 0x40a17a
mov edx, dword [ebp - 0x10c]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40a291
mov dword [ebp - 0x114], 0
push str.SYSTEMCurrentControlSetServicesEventLogApplication_
lea eax, [ebp - 0x214]
push eax
call fcn.0040b680
add esp, 8
mov ecx, dword [ebp - 0x218]
add ecx, 4
push ecx
lea edx, [ebp - 0x214]
push edx
call fcn.0040b690
add esp, 8
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x214]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40a1ef
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor eax, eax
jmp 0x40a291
lea ecx, [ebp - 0x104]
push ecx
call fcn.0040b770
add esp, 4
add eax, 1
push eax
lea edx, [ebp - 0x104]
push edx
push 2
push 0
push str.EventMessageFile
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x110], 7
push 4
lea ecx, [ebp - 0x110]
push ecx
push 4
push 0
push str.TypesSupported
mov edx, dword [ebp - 0x114]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
mov ecx, dword [ebp - 0x218]
add ecx, 4
push ecx
push 0x64
push 4
mov ecx, dword [ebp - 0x218]
call fcn.0040a343
mov edx, dword [ebp - 0x108]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x10c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40a295
Capabilities:
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40a2bd
xor eax, eax
jmp 0x40a33f
mov dword [ebp - 8], 0
push 0x10000
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a332
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40a311
push 0
push 0
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
push 0x65
push 4
mov ecx, dword [ebp - 0x10]
call fcn.0040a343
mov dword [ebp - 8], 1
jmp 0x40a328
push 0
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
push 0x66
push 1
mov ecx, dword [ebp - 0x10]
call fcn.0040a343
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x40a343
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 0x18]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x40a377
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x40a392
mov ecx, dword [ebp - 8]
cmp dword [ebp + ecx*4 - 0x14], 0
je 0x40a390
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
jmp 0x40a36e
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x70], 0
jne 0x40a3b0
mov ecx, dword [ebp - 0x18]
add ecx, 4
push ecx
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov edx, dword [ebp - 0x18]
mov dword [edx + 0x70], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax + 0x70], 0
je 0x40a3e0
push 0
lea ecx, [ebp - 0x14]
push ecx
push 0
mov dx, word [ebp - 4]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
push 0
mov cx, word [ebp + 8]
push ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [edx + 0x70]
push eax
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40a890
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
push 0x94
push 0
lea eax, [ebp - 0x94]
push eax
call fcn.0040b250
add esp, 0xc
mov dword [ebp - 0x94], 0x94
lea ecx, [ebp - 0x94]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x40a8d1
xor eax, eax
jmp 0x40a9ab
mov dword [ebp - 0x98], 0
mov edx, dword [ebp - 0x84]
mov dword [ebp - 0x9c], edx
cmp dword [ebp - 0x9c], 0
je 0x40a99b
cmp dword [ebp - 0x9c], 1
je 0x40a94a
cmp dword [ebp - 0x9c], 2
je 0x40a90b
jmp 0x40a9a5
cmp dword [ebp - 0x90], 5
jae 0x40a920
mov dword [ebp - 0x98], 0x10
jmp 0x40a948
cmp dword [ebp - 0x90], 5
jb 0x40a948
cmp dword [ebp - 0x8c], 0
jne 0x40a93e
mov dword [ebp - 0x98], 0x11
jmp 0x40a948
mov dword [ebp - 0x98], 0x12
jmp 0x40a9a5
cmp dword [ebp - 0x90], 4
ja 0x40a965
cmp dword [ebp - 0x90], 4
jne 0x40a971
cmp dword [ebp - 0x8c], 0xa
jbe 0x40a971
mov dword [ebp - 0x98], 4
jmp 0x40a999
cmp dword [ebp - 0x90], 4
jne 0x40a98f
cmp dword [ebp - 0x8c], 0
jbe 0x40a98f
mov dword [ebp - 0x98], 3
jmp 0x40a999
mov dword [ebp - 0x98], 2
jmp 0x40a9a5
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
mov esp, ebp
pop ebp
ret
Function at 0x40aa00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
je 0x40aa16
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x40aa1b
jmp 0x40ab43
lea edx, [ebp - 0x14]
push edx
push 0xf003f
push 0
mov eax, dword [ebp + 8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40aa3e
jmp 0x40ab43
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 4
lea ecx, [ebp - 8]
push ecx
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 4]
push eax
push 0
push str.ATIPOLL
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40aa91
cmp dword [ebp - 8], 4
jne 0x40aa91
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov dword [edx], eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40ab43
mov dword [ebp - 0xc], 0
jmp 0x40aaa3
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
cmp dword [ebp - 0xc], 0xf
jae 0x40ab39
mov dword [ebp - 4], 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 4]
push edx
push 0
mov eax, dword [ebp - 0xc]
imul eax, eax, 0xc
mov ecx, dword [eax + 0x4112a0]
push ecx
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40ab0f
cmp dword [ebp - 8], 4
jne 0x40ab0f
cmp dword [ebp - 0x10], 1
jne 0x40ab0d
mov eax, dword [ebp - 0xc]
imul eax, eax, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
or edx, dword [eax + 0x4112a4]
mov eax, dword [ebp + 0xc]
mov dword [eax], edx
jmp 0x40ab34
mov ecx, dword [ebp - 0xc]
imul ecx, ecx, 0xc
cmp dword [ecx + 0x4112a8], 0
je 0x40ab34
mov edx, dword [ebp - 0xc]
imul edx, edx, 0xc
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
or ecx, dword [edx + 0x4112a4]
mov edx, dword [ebp + 0xc]
mov dword [edx], ecx
jmp 0x40aa9a
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x40af5f
Capabilities:
Copy file
Create process on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push str.OnSuspend_entry
call fcn.00409a98
add esp, 4
cmp dword [0x417b10], 0x10
jne 0x40b107
cmp dword [0x417b68], 0
jne 0x40b107
push 0x416e1c
push 0x416e28
call dword [sym.imp.KERNEL32.dll_MoveFileA]
push 0
push 0x416e34
push str.ATI2FSXX.pif
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x44
push 0
lea eax, [ebp - 0x44]
push eax
call fcn.0040b250
add esp, 0xc
mov dword [ebp - 0x44], 0x44
mov dword [ebp - 0x18], 0x20
mov word [ebp - 0x14], 3
push 0x10
push 0
push 0x417b58
call fcn.0040b250
add esp, 0xc
push 0x417b58
lea ecx, [ebp - 0x44]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
push str.c:winnt_system32ATI2FDXX.pif
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 0
je 0x40b04b
push str.Begin_to_wait_for_input_idle
call fcn.00409a98
add esp, 4
push 0xffffffffffffffff
mov edx, dword [0x417b58]
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
push str.Wait_for_input_idle_succeed
call fcn.00409a98
add esp, 4
mov dword [0x417b68], 1
jmp 0x40b058
push str.FAILURE:_Failed_on_CreateProcess_for_DosBox
call fcn.00409a98
add esp, 4
cmp dword [ebp - 0x48], 0
je 0x40b0f1
cmp dword [ebp + 8], 0
je 0x40b0f1
mov ecx, 0x417b48
call fcn.00401200
test eax, eax
jne 0x40b08a
call fcn.00409b5e
push eax
mov ecx, 0x417b48
call fcn.004010f5
mov ecx, 0x417b48
call fcn.00401200
test eax, eax
jne 0x40b0ab
call fcn.00409b5e
push eax
push str.FAILURE:_Failed_creating_CDC_for__s
call fcn.00409a98
add esp, 8
push str.Begin_waiting_for_quit_accelerated_mode
call fcn.00409a98
add esp, 4
mov eax, 1
test eax, eax
je 0x40b0e4
mov ecx, 0x417b48
call fcn.00402ad0
push eax
call fcn.00402fe3
add esp, 4
test eax, eax
jne 0x40b0da
jmp 0x40b0e4
push 5
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40b0b8
push str.End_waiting_for_quit_accelerated_mode
call fcn.00409a98
add esp, 4
cmp dword [0x417b68], 0
je 0x40b107
push str.Enter_full_screen_dos.
call fcn.00409a98
add esp, 4
mov esp, ebp
pop ebp
ret

Function at 0x40b10b
Capabilities:
Delete file
Move file
Terminate process

Disassembly:
push ebp
mov ebp, esp
push str.OnResume_entry
call fcn.00409a98
add esp, 4
cmp dword [0x417b10], 0x10
jne 0x40b1a2
cmp dword [0x417b68], 1
jne 0x40b1a2
push 0
mov eax, dword [0x417b58]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [0x417b5c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x417b58]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x10
push 0
push 0x417b58
call fcn.0040b250
add esp, 0xc
push 0x416f74
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str.Command.pif
push str.Command.old
call dword [sym.imp.KERNEL32.dll_MoveFileA]
mov ecx, 0x417b48
call fcn.00401191
mov dword [0x417b68], 0
push str.Exit_Dos_box.
call fcn.00409a98
add esp, 4
pop ebp
ret
Function at 0x40e53e
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x417298
cmp edx, dword [eax]
je 0x40e560
add eax, 8
inc ecx
cmp eax, 0x417328
jl 0x40e551
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x417298]
jne 0x40e68e
mov eax, dword [0x417b78]
cmp eax, 1
je 0x40e668
test eax, eax
jne 0x40e591
cmp dword [0x416fc4], 1
je 0x40e668
cmp edx, 0xfc
je 0x40e68e
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40e5c8
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0040b680
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0040b770
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40e60b
lea eax, [ebp - 0x1a4]
push eax
call fcn.0040b770
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x411758
push edi
call fcn.0040bc30
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0040b680
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0040b690
lea eax, [ebp - 0xa0]
push 0x411738
push eax
call fcn.0040b690
push dword [esi + 0x41729c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0040b690
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040ff2a
add esp, 0x2c
pop edi
jmp 0x40e68e
lea eax, [ebp + 8]
lea esi, [esi + 0x41729c]
push 0
push eax
push dword [esi]
call fcn.0040b770
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret