joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47442c
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x4744c9
push ebx
push esi
call fcn.004743f5
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.00470a88
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x474476
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4744c8
push edi
push eax
call fcn.0046f180
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x474496
call fcn.0046e85a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x4744c7
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.00470a88
add esp, 0x20
test eax, eax
jne 0x4744b5
push edi
call fcn.0046e85a
jmp 0x4744bd
push ebx
call fcn.0046e85a
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x4744cc
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x4744dd
pop esi
ret
push ebx
push edi
push esi
call fcn.004743f5
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.0046f180
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x474505
push ebx
push esi
push edi
call fcn.004586d0
add esp, 0xc
push 0
call fcn.0046e85a
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x474c5f
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047477a

Function at 0x4784a7
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4933c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
cmp eax, 0x1a
jbe 0x4784ea
call fcn.00465cd3
mov dword [eax], 0xf
call fcn.00465ce6
mov dword [eax], 0xd
call fcn.0046e7b9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004572a2
leave
ret
test eax, eax
jne 0x4784f1
inc eax
jmp 0x4784de
add eax, 0x40
push 0x3a
mov word [ebp - 0xc], ax
pop eax
mov word [ebp - 0xa], ax
push 0x5c
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ecx, eax
test ecx, ecx
je 0x4784dc
xor eax, eax
cmp ecx, 1
setne al
jmp 0x4784de

Function at 0x47b240
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x47b26d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x47b26d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4010cd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push 0
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4010f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 2
pop eax
pop ebp
ret
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 0x10]
neg eax
sbb eax, eax
and eax, 3
pop ebp
ret

Function at 0x40162b
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
lea eax, [ebp - 4]
push esi
push eax
push 0x40d378
xor ebx, ebx
push 1
push ebx
push 0x40d368
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jl 0x40171a
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
push dword [ebp + 8]
lea eax, [ebp - 0x10c]
push eax
call fcn.00407ec0
lea eax, [ebp - 0x10c]
push 0x5c
push eax
call fcn.00407fb0
add esp, 0x10
cmp eax, ebx
je 0x40169b
mov byte [eax], bl
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x10c]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp + 0x10]
cmp eax, ebx
je 0x4016b0
cmp byte [eax], bl
je 0x4016b0
mov ecx, dword [ebp - 4]
push eax
push ecx
mov edx, dword [ecx]
call dword [edx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x4016c4
push dword [ebp + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x40d388
mov ecx, dword [eax]
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jl 0x401711
lea eax, [ebp - 0x314]
push 0x104
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x314]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x4025ef
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [0x40fa44]
push dword [0x40fa40]
call fcn.00407ec0
mov esi, dword [ebp + 8]
pop ecx
pop ecx
cmp byte [esi + 0xb], 2
jne 0x40265b
push dword [0x40faec]
push dword [0x40fa40]
call fcn.00407ec0
push 0x5c
push dword [0x40fa40]
call fcn.00407fb0
mov edi, eax
add esp, 0x10
test edi, edi
je 0x40263e
inc edi
jmp 0x402644
mov edi, dword [0x40fa40]
push 0
push esi
call fcn.004025ba
push eax
push edi
call fcn.00407ec0
add esp, 0x10
jmp 0x40282d
movzx eax, byte [esi + 8]
dec eax
je 0x4027fa
dec eax
je 0x402692
dec eax
jne 0x40280b
lea eax, [ebp + 8]
push eax
push 0x14
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push dword [0x40fa40]
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
jmp 0x40280b
push 1
push 0x30c
call fcn.004081cb
mov edi, eax
pop ecx
test edi, edi
pop ecx
je 0x40280b
lea eax, [edi + 0x104]
push 0
push esi
mov dword [ebp - 4], eax
lea ebx, [edi + 0x208]
call fcn.004025ba
push dword [0x40fa40]
mov esi, eax
call fcn.00406084
push 0x5c
push esi
call fcn.00407fb0
add esp, 0x14
test eax, eax
je 0x4026e3
inc eax
mov dword [ebp + 8], eax
jmp 0x4026e6
mov dword [ebp + 8], esi
mov esi, 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea eax, [ebp - 0xc]
push edi
push eax
push dword [ebp - 4]
mov dword [ebp - 0xc], esi
push dword [0x40fa40]
push ebx
push dword [ebp + 8]
push 1
call sub.VERSION.dll_VerFindFileA
mov ebx, eax
shr ebx, 1
and ebx, 1
cmp byte [edi], 0
je 0x402783
push edi
call fcn.0040605d
push dword [ebp + 8]
push edi
call fcn.00407ed0
push edi
push dword [0x40fa40]
call fcn.00407ec0
push 0
push dword [0x40fa40]
call section..text
add esp, 0x1c
cmp eax, 0xffffffff
je 0x402765
push eax
call fcn.0040121f
push edi
call fcn.0040819c
pop ecx
pop ecx
jmp 0x4027f6
mov esi, dword [ebp - 4]
cmp byte [esi], 0
je 0x40282d
push esi
call fcn.0040605d
push dword [ebp + 8]
push esi
call fcn.00407ed0
push edi
jmp 0x4027e9
push esi
push dword [0x40fa40]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
call fcn.0040819c
push dword [0x40fa40]
call fcn.0040605d
push dword [ebp + 8]
push dword [0x40fa40]
call fcn.00407ed0
push 0
push dword [0x40fa40]
call section..text
add esp, 0x18
cmp eax, 0xffffffff
je 0x4027cc
push eax
call fcn.0040121f
jmp 0x40275f
mov esi, dword [ebp - 4]
cmp byte [esi], 0
je 0x40282d
push esi
call fcn.0040605d
push dword [ebp + 8]
push esi
call fcn.00407ed0
push dword [0x40fa40]
push esi
call fcn.00408110
add esp, 0x14
test eax, eax
jne 0x40282d
mov eax, ebx
jmp 0x40282f
push 0x104
push dword [0x40fa40]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [0x40fa40]
call fcn.0040605d
push 0
push esi
call fcn.004025ba
push eax
push dword [0x40fa40]
call fcn.00407ed0
add esp, 0x14
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402834
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov esi, dword [ebp + 8]
push edi
push 1
pop edi
lea eax, [ebp + 8]
push eax
push 0x800
mov dword [ebp - 4], edi
call fcn.004060dd
pop ecx
test eax, eax
pop ecx
jne 0x402860
mov eax, edi
jmp 0x402980
lea eax, [ebp - 0x14]
push eax
push dword [0x40fa40]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 8], eax
je 0x402973
push eax
call fcn.00408248
test eax, eax
pop ecx
mov dword [ebp - 0x10], eax
je 0x402973
push eax
push dword [ebp - 8]
push dword [ebp - 0x14]
push dword [0x40fa40]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40296a
test byte [esi + 0xd], 2
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x402913
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x40f18c
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402913
mov edx, dword [ebp - 0xc]
mov ecx, dword [esi + 0x1a]
mov eax, dword [edx + 8]
cmp eax, ecx
ja 0x4028e2
jne 0x402913
mov eax, dword [edx + 0xc]
cmp eax, dword [esi + 0x1e]
jbe 0x402913
push 0x1d
push 6
call fcn.004012a5
cmp byte [eax], 0
pop ecx
pop ecx
je 0x402966
push dword [0x40fa40]
push eax
push dword [ebp + 8]
call edi
push 0x124
push dword [ebp + 8]
call fcn.004013bc
add esp, 0x14
cmp eax, 6
jne 0x402966
test byte [esi + 0xd], 4
je 0x40296a
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push str.VarFileInfoTranslation
push dword [ebp - 0x10]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40296a
mov eax, dword [ebp - 0xc]
movzx eax, word [eax]
cmp dword [esi + 0x2a], eax
je 0x40296a
push dword [0x40fa40]
push 0x1e
push 6
call fcn.004012a5
pop ecx
pop ecx
push eax
push dword [ebp + 8]
call edi
push 0x24
push dword [ebp + 8]
call fcn.004013bc
add esp, 0x14
cmp eax, 6
je 0x40296a
and dword [ebp - 4], 0
push dword [ebp - 0x10]
call fcn.0040819c
pop ecx
lea eax, [ebp + 8]
push eax
call fcn.00406110
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
leave
ret
Function at 0x403fe9
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, dword [ebp + 0xc]
push edi
push 2
pop edi
push str.Start_Menu
push esi
call fcn.00408110
pop ecx
test eax, eax
pop ecx
jne 0x40400f
push 0xb
jmp 0x404022
push str.Startup
push esi
call fcn.00408110
pop ecx
test eax, eax
pop ecx
jne 0x404025
push 7
pop edi
xor esi, esi
lea eax, [ebp + 0xc]
push eax
push edi
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
test esi, esi
je 0x404067
cmp byte [esi], 0
je 0x404067
lea eax, [ebp - 0x104]
push eax
call fcn.0040605d
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.00407ed0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call fcn.00406084
lea eax, [ebp - 0x104]
push eax
call fcn.00407fd7
pop ecx
test eax, eax
pop ecx
je 0x4040b4
lea eax, [ebp - 0x104]
push eax
call fcn.0040605d
lea eax, [ebp - 0x104]
push eax
call fcn.00406285
lea eax, [ebp - 0x104]
push eax
call fcn.00407fd7
add esp, 0xc
test eax, eax
jne 0x40413a
lea eax, [ebp - 0x104]
push eax
call fcn.0040605d
lea eax, [ebp - 0x104]
push eax
call fcn.00407e40
push dword [ebp + 0x10]
mov esi, eax
lea eax, [ebp - 0x104]
push eax
call fcn.00407ed0
lea eax, [ebp - 0x104]
push str..lnk
push eax
call fcn.00407ed0
push dword [ebp + 0x18]
lea eax, [ebp - 0x104]
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.0040162b
add esp, 0x28
cmp dword [ebp + 0x1c], 0xffffffff
je 0x40413a
test esi, esi
je 0x404118
and byte [ebp + esi - 0x105], 0
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 0x1c]
call fcn.0040216b
lea eax, [ebp + esi - 0x104]
push eax
push dword [ebp + 0x1c]
call fcn.0040216b
add esp, 0x10
pop edi
pop esi
leave
ret
Function at 0x4043d0
Capabilities:
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push ebx
xor ebx, ebx
cmp dword [0x40fb1c], ebx
push esi
push edi
je 0x404403
cmp dword [ebp + 8], ebx
jne 0x4043fc
push 4
push ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
jmp 0x40457f
push 5
push dword [ebp + 8]
jmp 0x4043ee
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
push dword [ebp + 0xc]
call edi
cmp dword [ebp + 8], ebx
je 0x40442d
lea eax, [ebp - 0x310]
push esi
push eax
push dword [ebp + 8]
call edi
lea eax, [ebp - 0x108]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [ebp - 0x108]
push str.WININIT.INI
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [ebp + 8], ebx
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
je 0x404485
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x310]
push eax
push str.Rename
call esi
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push ebx
call esi
jmp 0x40457f
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
push 0x40f208
push str.Rename
call esi
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
push ebx
call esi
lea eax, [ebp - 0x108]
push 2
push eax
call section..text
mov esi, eax
pop ecx
cmp esi, 0xffffffff
pop ecx
mov dword [ebp - 4], esi
je 0x40457f
push esi
call fcn.0040114d
mov edi, eax
lea eax, [ebp + 8]
push eax
lea eax, [edi + 0x200]
push eax
call fcn.004060b0
add esp, 0xc
test eax, eax
je 0x404576
push edi
push dword [ebp + 8]
push esi
call fcn.00401077
add esp, 0xc
test eax, eax
jne 0x40456c
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], ebx
lea ebx, [edi - 4]
test ebx, ebx
jbe 0x40456c
cmp byte [esi], 0x78
jne 0x40453d
cmp byte [esi + 1], 0x79
jne 0x40453d
cmp byte [esi + 2], 0x7a
jne 0x40453d
cmp byte [esi + 3], 0x3d
jne 0x40453d
lea eax, [ebp - 0x20c]
push eax
call fcn.00407e40
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [esi + 4]
push eax
call fcn.00408640
add esp, 0x10
test eax, eax
je 0x404548
inc dword [ebp + 0xc]
inc esi
cmp dword [ebp + 0xc], ebx
jb 0x404502
jmp 0x40456c
push 0
mov byte [esi], 0x4e
push dword [ebp - 4]
mov byte [esi + 1], 0x55
mov byte [esi + 2], 0x4c
call fcn.00401114
push edi
push dword [ebp + 8]
push dword [ebp - 4]
call fcn.004010cd
add esp, 0x14
lea eax, [ebp + 8]
push eax
call fcn.00406110
pop ecx
push dword [ebp - 4]
call fcn.0040121f
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x406127
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
or esi, 0xffffffff
push edi
cmp byte [ebx], 0x5c
jne 0x406173
cmp byte [ebx + 1], 0x5c
jne 0x406173
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4061d0
mov esi, dword [ebp + 8]
imul esi, dword [ebp - 8]
shr esi, 8
imul esi, dword [ebp - 4]
shr esi, 2
jmp 0x4061d0
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov edi, eax
test edi, edi
je 0x4061d0
push ebx
push edi
call fcn.00407ec0
cmp byte [edi + 1], 0x3a
pop ecx
pop ecx
jne 0x40619d
and byte [edi + 3], 0
mov byte [edi + 2], 0x5c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x4061c9
mov esi, dword [ebp + 8]
imul esi, dword [ebp - 8]
shr esi, 8
imul esi, dword [ebp - 4]
shr esi, 2
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4061d7
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0x20
cmp byte [ebx], 0x5c
pop edi
jne 0x406222
cmp byte [ebx + 1], 0x5c
jne 0x406222
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x40627e
mov edi, dword [ebp + 8]
imul edi, dword [ebp - 4]
add edi, 0x3ff
shr edi, 0xa
jmp 0x40627e
push 0x104
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x40627e
push ebx
push esi
call fcn.00407ec0
cmp byte [esi + 1], 0x3a
pop ecx
pop ecx
jne 0x40624c
and byte [esi + 3], 0
mov byte [esi + 2], 0x5c
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
je 0x406277
mov edi, dword [ebp + 8]
imul edi, dword [ebp - 4]
add edi, 0x3ff
shr edi, 0xa
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40667d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
xor ebx, ebx
push 5
push ebx
push ebx
push dword [ebp + 8]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
ja 0x40675d
lea eax, [ebp - 0x208]
mov esi, 0x80000000
push eax
push dword [ebp + 0xc]
push esi
call fcn.00406762
add esp, 0xc
test eax, eax
jne 0x40675d
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x208]
push str._shellopencommand
push eax
call edi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x208]
push eax
push esi
call fcn.00406762
add esp, 0xc
test eax, eax
jne 0x40675d
lea eax, [ebp - 0x208]
push str.__1_
push eax
call fcn.00408c00
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
jne 0x40673e
lea eax, [ebp - 0x208]
push 0x40f404
push eax
call fcn.00408c00
mov esi, eax
pop ecx
cmp esi, ebx
pop ecx
jne 0x40673e
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [ebp + eax - 0x209]
jmp 0x406740
mov byte [esi], bl
push 0x40f400
push esi
call edi
push dword [ebp + 8]
push esi
call edi
lea eax, [ebp - 0x208]
push 5
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406762
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push esi
push eax
push 1
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x4067a1
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x104
push eax
push dword [ebp + 0x10]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebp
ret

Function at 0x408314
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40833f
test byte [esp + 8], 0x80
je 0x40832e
and al, 0xfe
jmp 0x408330
or al, 1
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x408350
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409241
pop ecx
or eax, 0xffffffff
ret
xor eax, eax
ret

Function at 0x408455
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x408475
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00409241
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x408496
test byte [esp + 8], 2
je 0x408496
mov dword [0x40fb58], 0xd
mov dword [0x40fb5c], 5
jmp 0x408471
xor eax, eax
ret
Function at 0x40b871
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x40f9a0
cmp edx, dword [eax]
je 0x40b893
add eax, 8
inc ecx
cmp eax, 0x40fa30
jl 0x40b884
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x40f9a0]
jne 0x40b9c1
mov eax, dword [0x40fbac]
cmp eax, 1
je 0x40b99b
test eax, eax
jne 0x40b8c4
cmp dword [0x40f470], 1
je 0x40b99b
cmp edx, 0xfc
je 0x40b9c1
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b8fb
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407ec0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00407e40
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b93e
lea eax, [ebp - 0x1a4]
push eax
call fcn.00407e40
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d738
push edi
call fcn.00408750
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407ec0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407ed0
lea eax, [ebp - 0xa0]
push 0x40f108
push eax
call fcn.00407ed0
push dword [esi + 0x40f9a4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407ed0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040bf31
add esp, 0x2c
pop edi
jmp 0x40b9c1
lea eax, [ebp + 8]
lea esi, [esi + 0x40f9a4]
push 0
push eax
push dword [esi]
call fcn.00407e40
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x401320
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12d
mov dword [ebp - 0x28], 0x12
mov dword [ebp - 0x7f4], str.FFFTWAREFFasses
mov dword [ebp - 0x7a4], str.yysid0afaced1_e828_11d1_9187_b532f1e9575dinprocserver32
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12c
mov dword [ebp - 0x28], 0x11
mov dword [ebp - 0x854], 2
mov dword [ebp - 0x850], 3
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x82c], str.asdf
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea ecx, [ebp - 0x854]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x4380c8], ecx
mov edx, dword [ebp - 0x7f4]
mov byte [edx], 0x53
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 1], 0x4f
mov ecx, dword [ebp - 0x7f4]
mov byte [ecx + 2], 0x46
mov edx, dword [ebp - 0x7f4]
mov byte [edx + 9], 0x43
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 0xa], 0x6c
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x7f4]
push edx
push 0x80000002
call dword [0x4380c8]
test eax, eax
je 0x4014c3
xor eax, eax
jmp 0x401765
mov eax, dword [ebp - 0x7a4]
mov byte [eax], 0x63
mov ecx, dword [ebp - 0x7a4]
mov byte [ecx + 1], 0x6c
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x7a4]
push eax
push 0x80000000
call dword [0x4380c8]
test eax, eax
je 0x4014f7
xor eax, eax
jmp 0x401765
push 1
mov ecx, dword [0x4380c4]
push ecx
jmp 0x45b500
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret