joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100cec02
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.100cecab
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x100cec4a
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.100171d1
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.100090c9
jmp 0x100cec55
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.1003d61f
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x100dca98
Capabilities:
Get file system object information

Disassembly:
push 0x274
mov eax, 0x1018a0c9
call fcn.1015ea3a
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.10005109
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x278], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x278]
push 0
push 0x101c7e08
call fcn.1000579d
cmp eax, 0xffffffff
jne 0x100dcb73
push 0
push 0x101c8484
lea ecx, [ebp - 0x278]
call fcn.1000579d
cmp eax, 0xffffffff
jne 0x100dcb73
push 0
push 0x101c962c
lea ecx, [ebp - 0x278]
call fcn.1000579d
cmp eax, 0xffffffff
jne 0x100dcb73
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.10005109
add eax, 0x10
pop ecx
mov dword [ebp - 0x280], eax
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0x104
push edx
push eax
lea edi, [eax - 0x10]
push edx
mov dword [ebp - 0x27c], edi
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x100dcb42
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x10191a68]
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x27c]
mov edi, eax
call fcn.10003bf1
jmp 0x100dcbac
lea eax, [ebp - 0x114]
push eax
call fcn.1016ca70
pop ecx
push eax
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.1000522b
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.10003bf1
mov esi, dword [ebp - 0x278]
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x100dcb99
mov edi, dword [ebp - 0x274]
jmp 0x100dcbac
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call dword [0x10191a68]
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.10003bf1
mov eax, edi
call fcn.1015e9e9
ret

Function at 0x101245a9
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.1016e960
pop ecx
test eax, eax
jne 0x101245eb
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.10010c17
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x101245b1
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret
Function at 0x101786b1
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1017832e
Function at 0x100252cf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x10049fb4
call fcn.10046eeb
mov edi, ecx
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], 0x800
mov dword [ebp - 0x18], eax
lea ebx, [edi + 0x14]
push ebx
push dword [edi + 0xc]
mov dword [ebp - 4], eax
call fcn.1002c790
mov esi, eax
pop ecx
pop ecx
test esi, esi
jns 0x1002531e
push dword [edi + 0xc]
push esi
push 0x7d6
push 0x84e
call fcn.1003d19b
add esp, 0x10
jmp 0x10025489
cmp dword [edi + 4], 0
je 0x10025489
and dword [ebp - 0x10], 0
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.1003f5ed
and dword [edi + 4], 0
push 0x1002
mov byte [ebp - 4], 2
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
push eax
push 0
push 0x800
lea ecx, [ebp - 0x3c]
call fcn.1002c790
mov esi, eax
test esi, esi
jns 0x10025389
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.1003f607
cmp dword [ebp - 0x10], 0
je 0x10025489
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
jmp 0x10025489
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
lea ecx, [ebp - 0x3c]
test esi, esi
js 0x10025364
push 0x100057b0
push dword [ebp - 0x14]
push 0x100057d0
call fcn.1002c790
mov esi, eax
test esi, esi
js 0x10025361
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
push dword [ebp - 0x38]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100254bb
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x38]
lea eax, [ebp - 0x20]
push eax
push 0
push 0x100057e0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002543a
cmp dword [ebp - 0x1c], eax
jbe 0x1002543a
mov ebx, dword [sym.imp.MSVCR100.dll__wcsicmp]
push 0x1000580c
push dword [ebp - 0x38]
call ebx
pop ecx
pop ecx
test eax, eax
je 0x10025430
push 0x10005800
push dword [ebp - 0x38]
call ebx
pop ecx
pop ecx
test eax, eax
je 0x10025430
push 0x10005818
push dword [ebp - 0x38]
call ebx
pop ecx
pop ecx
test eax, eax
jne 0x10025437
mov dword [edi + 4], 1
lea ebx, [edi + 0x14]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.1003f607
cmp dword [ebp - 0x10], 0
mov byte [ebp - 4], 0
je 0x1002545d
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x10], 0
cmp dword [edi + 4], 0
je 0x10025489
lea eax, [ebp - 0x18]
push eax
push 0x10009ddc
push 7
push 0
push ebx
call fcn.1002c790
mov esi, eax
test esi, esi
js 0x10025489
push dword [ebp - 0x18]
lea ecx, [edi + 8]
call fcn.1002c790
mov esi, eax
cmp dword [ebp - 0x14], 0
je 0x10025498
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x18], 0
je 0x100254b3
xor ecx, ecx
lea eax, [ebp - 0x18]
xchg dword [eax], ecx
test ecx, ecx
je 0x100254b3
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov eax, esi
call fcn.10046fc3
ret
mov dword [edi + 4], 1
jmp 0x1002543a
Function at 0x1002c790
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x1002c79f
pop dword [ebp - 0x2c]
mov eax, 0xde7a5308
sub eax, 0xce778b69
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xf9532a9a
sub dword [ebp - 0x3c], 0xab00e54f
mov dword [ebp - 0x38], 0x652423f6
sub dword [ebp - 0x38], 0x32f0d7b1
mov dword [ebp - 0x34], 0xf31c0fb
add dword [ebp - 0x34], 0x3d1a8333
mov dword [ebp - 0x30], 0x11acc922
add dword [ebp - 0x30], 0xee5336de
lea eax, [ebp - 0x3c]
push eax
mov eax, 0xe3969aba
add eax, 0x2c6975ee
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xbfbe356e
sub dword [ebp - 0x3c], 0x4b4bcc18
mov dword [ebp - 0x38], 0x37bc0dcb
add dword [ebp - 0x38], 0x9b053aa
mov dword [ebp - 0x34], 0xbc7bbaf6
sub dword [ebp - 0x34], 0x590c4e8a
mov dword [ebp - 0x30], 0xab344c7
sub dword [ebp - 0x30], 0xab344c7
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x1f85c032
sub eax, 0xf85b012
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x3c76f
push 0
call eax
mov ecx, 0x3d93
mov edi, eax
mov edx, 0x10072600
add edx, dword [ebp - 0x2c]
mov esi, 0xa7ed829f
sub esi, 0x27fd4d6
add dword [ebp - 0x28], 0x21ce0d3f
mov ebx, dword [edx]
sub dword [ebp - 0x14], edi
xor ebx, esi
xor dword [ebp - 8], edi
mov dword [edi], ebx
add dword [ebp - 0xc], 0x7620d32f
add edi, 4
add edx, 0xbac947cb
add edx, 0x4536b839
loop 0x1002c8b5
add eax, 0xde3befd4
sub eax, 0xde3b06b5
mov ebx, eax
add eax, 0x4b00fe1d
sub eax, 0x4b00fe18
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1002ebed
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x44
mov eax, 0x1004aef9
call fcn.10046f54
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x30], eax
call fcn.1003f5ed
xor eax, eax
mov esi, 0x800
mov dword [ebp - 4], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, eax
mov dword [ebp - 0x24], eax
push 0x1002
mov byte [ebp - 4], 1
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
pop ecx
push eax
push edi
push esi
lea ecx, [ebp - 0x50]
call fcn.1002c790
mov esi, eax
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x20]
push eax
push ebx
call fcn.1002c790
mov esi, eax
pop ecx
pop ecx
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.ole32.dll_StringFromCLSID]
mov esi, eax
test esi, esi
js 0x1002ed6e
push 0x100057b0
push dword [ebp - 0x28]
lea ecx, [ebp - 0x50]
push 0x100057d0
call fcn.1002c790
mov esi, eax
test esi, esi
js 0x1002ed6e
lea eax, [ebp - 0x24]
push eax
push 0x20019
push edi
push dword [ebp - 0x4c]
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1002ed43
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x4c]
lea eax, [ebp - 0x34]
push eax
push edi
push 0x100057e0
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ed43
cmp dword [ebp - 0x2c], eax
jbe 0x1002ed43
mov edx, dword [ebp - 0x4c]
mov ecx, 0x1000580c
mov eax, edx
mov si, word [eax]
cmp si, word [ecx]
jne 0x1002ed03
test si, si
je 0x1002ecff
mov si, word [eax + 2]
cmp si, word [ecx + 2]
jne 0x1002ed03
add eax, 4
add ecx, 4
test si, si
jne 0x1002ecdd
xor eax, eax
jmp 0x1002ed08
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x1002ed40
mov eax, 0x10005818
mov cx, word [edx]
cmp cx, word [eax]
jne 0x1002ed37
test cx, cx
je 0x1002ed33
mov cx, word [edx + 2]
cmp cx, word [eax + 2]
jne 0x1002ed37
add edx, 4
add eax, 4
test cx, cx
jne 0x1002ed11
xor eax, eax
jmp 0x1002ed3c
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x1002ed43
xor edi, edi
inc edi
mov esi, edi
neg esi
sbb esi, esi
and esi, 0x7ff8ffa9
add esi, 0x80070057
js 0x1002ed6e
push dword [ebp - 0x30]
lea eax, [ebp - 0x20]
push 0x1000837c
push 7
push 0
push eax
call fcn.1002c790
mov esi, eax
cmp dword [ebp - 0x28], 0
je 0x1002ed7d
push dword [ebp - 0x28]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
test esi, esi
jns 0x1002ed95
push ebx
push esi
push 0x7d6
push 0x89f
call fcn.1003d19b
add esp, 0x10
cmp dword [ebp - 0x24], 0
je 0x1002eda8
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x24], 0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.1003f607
mov eax, esi
call fcn.10046fd7
ret 8

Function at 0x1004413c
Capabilities:
Delete file

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 2
jne 0x10044161
cmp dword [esi + 0x20], 0
je 0x10044161
push dword [esi + 0x20]
call dword [sym.imp.kernel32.dll_DeleteFileW]
push dword [esi + 0x20]
call sub.MSVCR100.dll_void___cdecl_operator_delete___void__
and dword [esi + 0x20], 0
pop ecx
xor eax, eax
pop esi
ret
Function at 0x410274
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x41029b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00411108
jmp 0x410350
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x14], eax
test eax, eax
je 0x4102bd
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x4102bf
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test edi, edi
jl 0x410344
jg 0x4102d4
test esi, esi
je 0x410344
test ecx, ecx
jl 0x41031d
jg 0x4102de
test eax, eax
je 0x41031d
cmp edi, ecx
jg 0x4102f2
jl 0x4102e8
cmp esi, eax
jae 0x4102f2
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x1c]
call fcn.004fe7d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x410320
mov edx, dword [ebp + 8]
test edi, edi
jl 0x410344
jg 0x41032a
test esi, esi
je 0x410344
cmp dword [ebx + 0x4c], 0
je 0x410344
push dword [ebx + 0x4c]
push esi
push 1
push edx
call fcn.0050fe03
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410359
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
cmp dword [edi + 0x38], 0
je 0x410380
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00411039
jmp 0x41044f
mov eax, dword [edi + 0x1c]
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], eax
test eax, eax
je 0x4103a2
mov eax, dword [edi + 0x2c]
mov eax, dword [eax]
jmp 0x4103a4
xor eax, eax
cdq
mov dword [esp + 0xc], eax
mov ecx, edx
mov dword [esp + 0x10], ecx
test ebx, ebx
jl 0x410443
jg 0x4103c1
test esi, esi
je 0x410443
test ecx, ecx
jl 0x41040e
jg 0x4103cb
test eax, eax
je 0x41040e
cmp ebx, ecx
jg 0x4103df
jl 0x4103d5
cmp esi, eax
jae 0x4103df
mov eax, esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebx
push eax
push dword [esp + 0x18]
push dword [ebp + 8]
call fcn.004fe7d0
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [edi + 0x2c]
add edx, ecx
sub esi, ecx
mov dword [esp + 0xc], edx
sbb ebx, dword [esp + 0x10]
sub dword [eax], ecx
mov eax, dword [edi + 0x1c]
add dword [eax], ecx
jmp 0x410415
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
test ebx, ebx
jl 0x410443
jg 0x41041f
test esi, esi
je 0x410443
cmp dword [edi + 0x4c], 0
je 0x410443
mov ecx, edi
call fcn.00410905
push dword [edi + 0x4c]
push esi
push 1
push dword [esp + 0x18]
call fcn.0050b7b6
add esp, 0x10
sub esi, eax
sbb ebx, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x410686
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x6e33d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
or edi, 0xffffffff
mov esi, ecx
cmp ebx, edi
jne 0x4106ac
xor eax, eax
jmp 0x41076e
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x4106d5
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
add eax, ecx
cmp ecx, eax
jae 0x4106d5
dec dword [edx]
mov eax, ebx
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 1]
mov dword [edx], ecx
mov byte [esi], bl
jmp 0x41076e
cmp dword [esi + 0x4c], 0
je 0x41076c
mov ecx, esi
call fcn.00410905
mov ecx, dword [esi + 0x38]
mov al, bl
test ecx, ecx
jne 0x410701
push dword [esi + 0x4c]
push eax
call fcn.00410f5b
test al, al
pop ecx
pop ecx
cmovne edi, ebx
jmp 0x41076c
mov byte [ebp - 0x28], al
lea eax, [ebp - 0x2c]
mov edx, dword [ecx]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x1c]
test eax, eax
js 0x41076c
cmp eax, 1
jle 0x41073b
cmp eax, 3
jne 0x41076c
push dword [esi + 0x4c]
push dword [ebp - 0x28]
jmp 0x4106f3
mov eax, dword [ebp - 0x2c]
lea ecx, [ebp - 0x24]
sub eax, ecx
mov dword [ebp - 0x30], eax
je 0x41075e
push dword [esi + 0x4c]
push eax
mov eax, ecx
push 1
push eax
call fcn.0050fe03
add esp, 0x10
cmp dword [ebp - 0x30], eax
jne 0x41076c
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x34], eax
mov eax, ebx
jne 0x41076e
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004e6543
leave
ret 4

Function at 0x410953
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x6e33d4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
cmp dword [esi + 0x38], 0
je 0x4109d5
cmp byte [esi + 0x3d], 0
je 0x4109d5
mov eax, dword [esi]
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x4109a7
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
mov edx, dword [ecx]
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [edx + 0x20]
sub eax, 0
je 0x4109ab
sub eax, 1
je 0x4109af
dec eax
sub eax, 1
je 0x4109d5
xor al, al
jmp 0x4109d7
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x4109cc
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0050fe03
add esp, 0x10
cmp edi, eax
jne 0x4109a7
cmp byte [esi + 0x3d], 0
sete al
jmp 0x4109d7
mov al, 1
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004e6543
leave
ret
Function at 0x412747
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x643a53
call fcn.004e70a5
cmp byte [ecx + 0x7b0], 0
je 0x41280a
lea eax, [ebp - 0x28]
push eax
call fcn.0040b037
mov ecx, eax
call fcn.004b5c6b
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
ja 0x412797
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.004c5a2f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040d2d8
lea ecx, [ebp - 0x40]
call fcn.0040b4f9
push str.xsSoft.exe
lea ecx, [ebp - 0x28]
call fcn.0040b45b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x412802
push 0x6c77cc
push str.88425814
lea eax, [ebp - 0x40]
push str._s_s
push eax
call fcn.004b6db9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x40]
push esi
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x40]
push esi
push ecx
push eax
call fcn.004b8fc4
add esp, 0x24
lea ecx, [ebp - 0x40]
call fcn.0040b4f9
lea ecx, [ebp - 0x28]
call fcn.0040b4f9
call fcn.004e704f
ret

Function at 0x412f7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x412fd3
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x412fd3
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 8]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x412fc5
cmp esi, ecx
jae 0x412fd3
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x412fb3
cmp esi, ecx
jae 0x412fd3
cmp word [esi], 0
je 0x412fd3
mov eax, esi
jmp 0x412fd5
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x414b0c
Capabilities:
Check if file exists

Disassembly:
push 0x34
mov eax, 0x643a53
call fcn.004e70a5
cmp byte [ecx + 0x858], 0
je 0x414bcf
lea eax, [ebp - 0x28]
push eax
call fcn.0040b037
mov ecx, eax
call fcn.004b5c6b
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], esi
ja 0x414b5c
lea eax, [ebp - 0x40]
push esi
push eax
call fcn.004c5a2f
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.0040d2d8
lea ecx, [ebp - 0x40]
call fcn.0040b4f9
push str.xsSoft.exe
lea ecx, [ebp - 0x28]
call fcn.0040b45b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414bc7
push 0x6c77cc
push str.88425814
lea eax, [ebp - 0x40]
push str._s_s
push eax
call fcn.004b6db9
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x40]
push esi
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], 8
push 0xffffffffffffffff
cmovae eax, dword [ebp - 0x40]
push esi
push ecx
push eax
call fcn.004b8fc4
add esp, 0x24
lea ecx, [ebp - 0x40]
call fcn.0040b4f9
lea ecx, [ebp - 0x28]
call fcn.0040b4f9
call fcn.004e704f
ret
Function at 0x4152fe
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push ecx
call fcn.004285f0
push 4
call fcn.00428a20
pop ecx
pop ecx
push 0x6c8ac4
push 0x82
call fcn.00420270
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x41536a
push edi
push esi
call fcn.00420270
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x415362
push esi
call fcn.00420270
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
je 0x415362
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
call fcn.00428a30
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
ret

Function at 0x4155ab
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x6e33d4]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x214]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push reloc.gdiplus.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x415622
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x415622
push 4
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 1
push eax
push 4
push 0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004e6543
leave
ret
Function at 0x41c0f0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
push 4
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_GetWindow]
mov dword [ebp - 4], eax
push 1
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_EnableWindow]
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c1ca
push 0
push 0
push 0
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x41c1ca
cmp dword [ebp - 0x24], 0x10
jne 0x41c196
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [eax + 4]
jne 0x41c196
mov edx, dword [ebp - 0x20]
mov dword [ebp - 0xc], edx
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
lea edx, [ebp - 0x28]
push edx
call fcn.00429120
add esp, 4
movzx eax, al
test eax, eax
jne 0x41c1bd
lea ecx, [ebp - 0x28]
push ecx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea edx, [ebp - 0x28]
push edx
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x24], 0x12
jne 0x41c1c5
jmp 0x41c1ca
jmp 0x41c144
push 1
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [ebp - 0x24], 0x12
jne 0x41c1f0
mov edx, dword [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret