joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4982dc
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4d7fe0]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x49831c
cmp byte [ebx], 0xa
jne 0x49831c
or byte [eax + edi + 0x28], 4
jmp 0x498321
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x49841f
mov al, byte [edx]
cmp al, 0x1a
je 0x498401
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x498350
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x498375
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x49837f
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x498332
jmp 0x49841f
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4983fc
cmp dword [ebp - 0xc], 0
je 0x4983fc
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4d7fe0]
test byte [eax + edi + 0x28], 0x48
je 0x4983d6
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x4983c1
mov byte [esi], dl
jmp 0x4983d2
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4d7fe0]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x49841f
cmp byte [ebp - 1], 0xa
jne 0x4983e5
cmp esi, ebx
jne 0x4983e5
mov byte [esi], 0xa
jmp 0x49841e
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.0040197e
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x49841f
mov byte [esi], 0xd
jmp 0x49841e
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4d7fe0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x49841b
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x49841f
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49847b
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x4d7fe0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4984be
cmp word [esi], dx
jne 0x4984be
or byte [edi + eax + 0x28], 4
jmp 0x4984c3
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x498616
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x4985f6
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x498505
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x49853b
cmp eax, edx
jae 0x498547
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x4984dd
jmp 0x498616
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4985f2
cmp dword [ebp - 0x14], 0
je 0x4985f2
mov eax, dword [ebx*4 + 0x4d7fe0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x4985ca
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x498593
mov word [esi], cx
jmp 0x4985c6
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x4d7fe0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x4d7fe0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x4d7fe0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x498616
pop ebx
cmp word [ebp - 4], bx
jne 0x4985db
cmp esi, dword [ebp + 0xc]
jne 0x4985db
mov word [esi], bx
jmp 0x498613
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.0040197e
add esp, 0x10
cmp word [ebp - 4], bx
je 0x498616
push 0xd
jmp 0x49860f
mov ecx, dword [ebx*4 + 0x4d7fe0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x49860d
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x498616
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x49e4c1
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x4d4034]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x25c], ecx
cmp edx, edi
je 0x49e50c
movzx eax, word [edx]
lea ecx, [ebp - 0x255]
push eax
call fcn.0049e983
test al, al
jne 0x49e506
sub edx, 2
cmp edx, edi
jne 0x49e4ec
mov ecx, dword [ebp - 0x25c]
movzx esi, word [edx]
cmp esi, 0x3a
jne 0x49e52e
lea eax, [edi + 2]
cmp edx, eax
je 0x49e52e
push ecx
xor ebx, ebx
push ebx
push ebx
push edi
call fcn.0049e0ba
add esp, 0x10
jmp 0x49e628
push esi
lea ecx, [ebp - 0x255]
call fcn.0049e983
sub edx, edi
movzx eax, al
sar edx, 1
inc edx
neg eax
sbb eax, eax
xor ebx, ebx
push ebx
push ebx
and eax, edx
push ebx
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x254]
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileExW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x49e571
push dword [ebp - 0x25c]
jmp 0x49e51e
mov ebx, dword [ebp - 0x25c]
push 0x2e
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
sar eax, 2
mov dword [ebp - 0x25c], eax
pop eax
cmp word [ebp - 0x228], ax
jne 0x49e5ae
cmp word [ebp - 0x226], 0
je 0x49e5cf
cmp word [ebp - 0x226], ax
jne 0x49e5ae
cmp word [ebp - 0x224], 0
je 0x49e5cf
push ebx
push dword [ebp - 0x260]
lea eax, [ebp - 0x228]
push edi
push eax
call fcn.0049e0ba
add esp, 0x10
mov dword [ebp - 0x264], eax
test eax, eax
jne 0x49e61b
lea eax, [ebp - 0x254]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x49e588
mov eax, dword [ebx + 4]
mov edx, dword [ebx]
sub eax, edx
mov ecx, dword [ebp - 0x25c]
sar eax, 2
cmp ecx, eax
jne 0x49e603
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x49e628
push 0x49daa2
sub eax, ecx
push 4
push eax
lea eax, [edx + ecx*4]
push eax
call fcn.0040570e
add esp, 0x10
jmp 0x49e5f8
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x264]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040312a
leave
ret
Function at 0x5075e5
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
push esi
push edi
call fcn.0050746b
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatA]
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x40
xor eax, eax
cmp dword [ebp - 4], ebx
pop ecx
lea edi, [ebp - 0x158]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x158]
jne 0x507627
push 0x100
push eax
call dword [sym.imp.KERNEL32.DLL_GetWindowsDirectoryA]
jmp 0x507633
push eax
push 0x100
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
xor eax, eax
cmp byte [ebp - 0x158], bl
je 0x50766b
inc eax
cmp byte [ebp + eax - 0x158], bl
jne 0x50763d
cmp eax, ebx
je 0x50766b
mov cl, byte [ebp + eax - 0x159]
cmp cl, 0x5c
je 0x50766b
cmp cl, 0x2f
je 0x50766b
mov byte [ebp + eax - 0x158], 0x5c
mov byte [ebp + eax - 0x157], bl
lea eax, [ebp - 0x158]
push 0x502b18
push eax
call esi
lea eax, [ebp - 0x158]
push 0x501830
push eax
call esi
lea eax, [ebp - 0x158]
push 0x5025ac
push eax
call esi
push ebx
push 0x80
push 2
push ebx
push 3
lea eax, [ebp - 0x158]
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x5076c8
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x507601
jmp 0x50772b
push edi
call fcn.0050737c
pop ecx
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x258]
push 0x502b10
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x44
lea eax, [ebp - 0x48]
pop esi
push esi
push ebx
push eax
call sub.MSVCRT.dll_memset
add esp, 0x18
lea eax, [ebp - 0x58]
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x1c], 0x81
push eax
lea eax, [ebp - 0x48]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
lea eax, [ebp - 0x258]
push ebx
push eax
push ebx
mov word [ebp - 0x18], bx
call dword [sym.imp.KERNEL32.DLL_CreateProcessA]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..rdata
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x433072
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x27121210
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
cmp eax, 0
nop
nop
nop
je 0x4330d2
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5abf241c
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401e40
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, ebx
sub esp, 0x78
push esi
jno 0x401ebe
in al, 0xb8
lea ebp, [eax + ecx*4 - 0x73]
js 0x401ea1
push esi
call fcn.004086e0
mov al, 0x4d
or byte [ebx + 0x40c0c8cf], cl
add bh, al
push ecx
add edx, 0x40
push 0x8840d495
in al, dx
call dword [sym.imp.MSVCRT.dll_fprintf]
mov eax, dword [0x8641bdac]
clc
fistp word [0xf74c085]
push eax
push 0xbf40c354
call dword [0x40c12e]
add esp, 8
push esi
call dword [sym.imp.MSVCRT.dll_exit]
pop esi
and dl, byte [eax + 0x5b10c790]
movsb byte es:[edi], byte [esi]
nop
nop
nop
invalid
cmpsd dword [esi], dword es:[edi]
in al, dx
sub esp, 0x14
push ebx
push esi
mov esi, ecx
or byte [edi - 0x75], dl
inc esi
adc al, 0x89
inc ebp
or al, ch
dec ecx
dec ebx
add byte [eax], al
mov dword [0x410ba0], eax
jecxz 0x401ed3
or dword [ebx], 0xd840ea51
mov eax, dword [esi + 0x14]
test dword [edi + 0x3e], ebx
pushfd
jne 0x401f0d
mov ecx, dword [esi + 4]
push 0
push 0
push ecx
call fcn.00408c70
add byte [ecx - 0x18], dl
xchg esi, eax
insd dword es:[edi], dx
add byte [eax], al
sbb eax, 0x84099e
add byte [ecx + 0x8a4bb], cl
add bh, al
sub al, 0x18
add byte [eax + eax], bl
add byte [ebx + 0x4117a715], cl
add byte [ecx - 0x195eebaa], cl
add al, byte [ecx + 0x69]
test eax, eax
je 0x401f3a
sal dword [eax + 2], 0x41
add byte [ebx + 0x35c8039e], cl
push 0x8b2d29b5
mov ds, esi
rol dword [eax], cl
add byte [ecx + 0x404728], ah
mov ecx, dword [esi + 0xd3de]
mov eax, dword [0x404728]
mov edx, dword [0x5bd02c]
test eax, ecx
mov eax, dword [esi + 0x6100083c]
adc eax, edx
cmp edi, eax
or byte [edi + 0x6628e5], cl
pop ebp
push cs
sbb ebx, ecx
lcall 0x8baa, 0xdb8b
mov edx, 0x301d8b18
mov edi, dword [edx + 0x301d8b18]
inc dword [eax]
cwde
inc esi
add al, 0x4c
dec ebp
or byte [ebx], al
rcl dword [ecx + 0x52], cl
ret 0xece8
Function at 0x403b04
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x403bff
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x403b58
push 0x105
lea eax, [ebp - 0x10d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x10d]
mov eax, esi
call fcn.00401b50
jmp 0x403be6
call sub.kernel32.dll_GetCommandLineA
mov dword [edi], eax
mov eax, dword [edi]
call fcn.00403a8c
mov dword [edi], eax
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [edi]
call fcn.00403ab4
mov dword [edi], eax
test ebx, ebx
je 0x403b86
dec ebx
test ebx, ebx
jl 0x403b86
mov eax, dword [edi]
cmp eax, dword [ebp - 8]
jne 0x403b5f
push esi
lea eax, [ebp - 0x114]
mov edx, dword [ebp - 8]
call fcn.00401ba8
mov eax, dword [ebp - 0x114]
mov ecx, dword [edi]
sub ecx, dword [ebp - 8]
mov edx, 1
call fcn.00401e44
mov eax, dword [esi]
call fcn.00401bf0
cmp eax, 2
jl 0x403be6
mov eax, dword [esi]
cmp byte [eax], 0x22
jne 0x403be6
mov eax, dword [esi]
call fcn.00401bf0
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x22
jne 0x403be6
push esi
mov eax, dword [esi]
call fcn.00401bf0
mov ecx, eax
sub ecx, 2
mov eax, dword [esi]
mov edx, 2
call fcn.00401e44
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403c06
lea eax, [ebp - 0x114]
call fcn.00401a64
ret
Function at 0x403c60
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x403db4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00401a64
lea eax, [ebp - 4]
mov edx, esi
call fcn.00401afc
jmp 0x403d4f
lea ecx, [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x403dcc
call fcn.00403918
cmp dword [ebx], 0
je 0x403cce
mov eax, ebx
mov edx, 0x403dcc
call fcn.00401bf8
cmp dword [ebx], 0
jne 0x403cf5
mov eax, dword [ebp - 8]
call fcn.00401bf0
cmp eax, 2
jne 0x403cf5
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x403cf5
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00401ab8
jmp 0x403d4f
push 0x200
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov edx, dword [ebx]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 8]
call fcn.00401c3c
mov eax, dword [ebp - 0x16c]
call fcn.00401de8
push eax
call sub.shell32.dll_SHGetFileInfoA
cmp byte [ebp - 0x15c], 0
je 0x403d45
lea eax, [ebp - 8]
lea edx, [ebp - 0x15c]
mov ecx, 0x104
call fcn.00401bd8
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00401bf8
cmp dword [ebp - 4], 0
jne 0x403cad
lea edx, [ebp - 0x170]
mov eax, dword [ebx]
call fcn.00403f48
cmp dword [ebp - 0x170], 0
jne 0x403d89
lea edx, [ebp - 0x174]
mov eax, esi
call fcn.00403f48
mov edx, dword [ebp - 0x174]
mov eax, ebx
call fcn.00401bf8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403dbb
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00401a88
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401a88
ret

Function at 0x404088
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4040f2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00401ba8
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00403ec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4040f9
lea eax, [ebp - 0x10c]
call fcn.00401a64
ret

Function at 0x404100
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40416a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00401ba8
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00403ec0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404171
lea eax, [ebp - 0x10c]
call fcn.00401a64
ret

Function at 0x404178
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00401ba8
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00403ec0
ret
Function at 0x4041a8
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff44
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 0x20], 0x94
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_GetVersionExA
xor eax, eax
mov edx, dword [esp + 0x30]
cmp edx, 2
jne 0x4041de
cmp dword [esp + 0x24], 4
setae al
jmp 0x40420c
cmp edx, 1
jne 0x40420c
mov edx, dword [esp + 0x24]
cmp edx, 4
seta al
test al, al
jne 0x40420c
cmp edx, 4
jne 0x40420c
cmp dword [esp + 0x28], 0
seta al
test al, al
jne 0x40420c
cmp word [esp + 0x2c], 0x1111
setae al
test al, al
je 0x404229
push 0x404298
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x4042a4
push ebx
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x404244
push edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, esi
call fcn.00401de8
push eax
call ebx
jmp 0x40428c
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, esi
call fcn.00401de8
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
lea ecx, [esp + 0xb4]
mov eax, dword [esp]
imul dword [esp + 4]
xor edx, edx
call fcn.0040360c
lea eax, [esp + 0xb4]
mov ecx, edi
mov edx, dword [esp + 8]
call fcn.00408698
add esp, 0xbc
pop edi
pop esi
pop ebx
ret

Function at 0x40481c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp + 8], 4
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x404860
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.00401de8
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x404860
cmp dword [esp + 4], 4
je 0x404865
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x404870
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00401de8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete al
pop ebp
ret
Function at 0x4048ac
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00401a64
cmp dword [ebp - 0xc], 0
je 0x404952
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push ebp
call fcn.00404870
pop ecx
test al, al
je 0x404952
cmp dword [ebp - 4], 1
je 0x4048ef
cmp dword [ebp - 4], 2
jne 0x404952
mov eax, dword [ebp - 8]
call fcn.00401170
mov dword [ebp - 0x14], eax
push ebp
call fcn.00404870
pop ecx
test al, al
je 0x40494a
cmp dword [ebp - 4], 2
jne 0x404940
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, eax
mov eax, edi
call fcn.00401170
mov esi, eax
push edi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, ebx
mov edx, esi
call fcn.00401ba8
mov eax, esi
call fcn.00401188
jmp 0x40494a
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00401ba8
mov eax, dword [ebp - 0x14]
call fcn.00401188
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4049e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x404a0d
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00401de8
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404a11
xor eax, eax
jmp 0x404a13
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x404a50
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x404b10
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040abd4
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x404afa
cmp dword [ebp - 8], 0
jbe 0x404af8
mov eax, dword [ebp - 8]
inc eax
call fcn.00401170
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x404ad6
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00401ba8
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040abc4
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
jne 0x404ab9
mov eax, ebx
call fcn.00401188
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404b17
lea eax, [ebp - 0x10]
call fcn.00401a64
ret
Function at 0x404e04
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x404e80
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00401de8
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00401de8
push eax
mov eax, dword [ebp - 4]
call fcn.00401de8
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401de8
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x404e77
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00401bd8
jmp 0x404eb1
mov eax, edi
call fcn.00401a64
jmp 0x404eb1
mov eax, edi
mov edx, esi
call fcn.00401ab8
mov eax, dword [ebx + 0x19]
call fcn.00401de8
push eax
mov eax, esi
call fcn.00401de8
push eax
mov eax, dword [ebp - 4]
call fcn.00401de8
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401de8
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40893c
Capabilities:
Get file attributes

Disassembly:
call fcn.00403144
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x408950
dec eax
and al, 0x10
sete al
ret

Function at 0x4089c0
Capabilities:
Get file attributes

Disassembly:
push ebx
push eax
push 0x8001
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x4089db
dec eax
and al, 0x10
setne al
xchg ebx, eax
push eax
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
pop ebx
ret

Function at 0x409f24
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x409f30
or byte [eax + 0x37], 0x10
mov byte [eax + 0x52], dl
mov ecx, dword [eax + 0x28]
jecxz 0x409f4c
push eax
je 0x409f4d
call dword [0x417114]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x177], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x417114]
ret

Function at 0x40b454
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040b350
je 0x40b486
mov eax, ebx
push edx
call fcn.00407104
pop edx
cmp eax, edx
je 0x40b486
test edx, edx
mov eax, ebx
jne 0x40b478
pop ebx
inc edx
jmp fcn.004070f4
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.004070f4
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040b4a4
ret