joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4023b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, str.HKEY_CLASSES_ROOT
mov ebp, esp
push edi
push esi
mov esi, 0x80000000
push ebx
sub esp, 0x2c
mov ebx, dword [ebp + 8]
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402448
mov dword [esp], ebx
mov eax, str.HKEY_CURRENT_USER
mov esi, 0x80000001
mov dword [esp + 4], eax
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402448
mov dword [esp], ebx
mov ecx, str.HKEY_LOCAL_MACHINE
mov esi, 0x80000002
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402448
mov dword [esp], ebx
mov esi, str.HKEY_USERS
mov dword [esp + 4], esi
mov esi, 0x80000003
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402448
mov dword [esp], ebx
mov edi, str.HKEY_CURRENT_CONFIG
mov esi, 0x80000005
mov dword [esp + 4], edi
call sub.msvcrt.dll_strstr
cmp eax, ebx
je 0x402448
lea esp, [ebp - 0xc]
xor eax, eax
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], ebx
mov ecx, 0x5c
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strchr
mov dword [esp], ebx
lea edi, [eax + 1]
mov eax, 0x5c
mov dword [esp + 4], eax
call sub.msvcrt.dll_strrchr
lea ebx, [eax + 1]
mov byte [ebx - 1], 0
mov edx, dword [0x40a020]
mov dword [ebp - 0x18], 0
test edx, edx
jne 0x402503
mov dword [esp + 4], edi
xor edx, edx
lea ecx, [ebp - 0x10]
mov dword [esp + 0x10], ecx
mov eax, 0x20019
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
jne 0x4024f4
lea edx, [ebp + 0x10]
xor ecx, ecx
lea esi, [ebp - 0x14]
mov dword [esp + 0x14], edx
mov edi, dword [ebp + 0xc]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ecx
mov dword [esp + 0x10], edi
mov dword [esp + 4], ebx
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
mov esi, dword [ebp - 0x10]
test eax, eax
sete dl
movzx edi, dl
mov dword [ebp - 0x18], edi
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
mov byte [ebx - 1], 0x5c
mov eax, dword [ebp - 0x18]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], edi
xor edx, edx
lea ecx, [ebp - 0x10]
mov dword [esp + 0x10], ecx
mov eax, 0x20119
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov dword [esp], esi
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x4024ae
jmp 0x402485
Function at 0x4027a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov edx, 0x104
mov ebp, esp
push edi
xor eax, eax
xor edi, edi
push esi
push ebx
sub esp, 0x25c
lea ebx, [ebp - 0x23c]
mov dword [esp + 8], edx
mov esi, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [ebp - 0x248], esi
lea esi, [ebp - 0x128]
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp + 0x10], ebx
mov ecx, dword [ebp - 0x248]
xor edx, edx
mov dword [esp + 8], edx
mov eax, dword [ebp + 8]
mov dword [esp], 0x80000002
and ecx, 0x100
or ecx, 0x20019
mov dword [esp + 0xc], ecx
mov dword [esp + 4], eax
call sub.ADVAPI32.DLL_RegOpenKeyExA
sub esp, 0x14
test eax, eax
je 0x402830
mov esi, 1
mov dword [0x4122dc], esi
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
xor edx, edx
lea ebx, [ebp - 0x238]
mov ecx, 0x104
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov dword [esp + 0x10], ebx
lea ecx, [ebp - 0x240]
mov eax, 0x104
mov dword [esp + 0x14], ecx
mov ecx, dword [ebp - 0x23c]
lea edx, [ebp - 0x244]
mov dword [ebp - 0x240], eax
mov ebx, str.JavaHome
xor eax, eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov dword [esp + 4], ebx
mov dword [esp], ecx
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x4028ed
xor edx, edx
lea esi, [esi]
lea edi, [edi]
movzx ebx, byte [edx + ebp - 0x238]
mov byte [edx + ebp - 0x128], bl
inc edx
test bl, bl
jne 0x4028a0
test byte [ebp - 0x248], 2
je 0x4028e3
mov dword [esp], esi
call sub.msvcrt.dll_strlen
cmp byte [eax + esi - 1], 0x5c
je 0x4028d2
mov word [eax + esi], 0x5c
mov dword [esp], esi
mov edi, 0x409203
mov dword [esp + 4], edi
call sub.msvcrt.dll_strcat
mov dword [esp], esi
call fcn.00402690
mov edi, eax
mov eax, dword [ebp - 0x23c]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegCloseKey
sub esp, 4
test edi, edi
je 0x402814
mov dword [esp + 4], esi
mov dword [esp], 0x412664
call sub.msvcrt.dll_strcpy
jmp 0x40281f
Function at 0x402cb0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 8], esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], edi
mov eax, dword [0x4122d0]
cmp eax, 9
je 0x402d50
cmp eax, 2
je 0x402d10
jle 0x402cf5
cmp eax, 3
je 0x402e12
cmp eax, 4
je 0x402d1a
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
dec eax
jne 0x402ce8
mov edx, dword [0x40a020]
test edx, edx
je 0x402ce8
mov ecx, ebx
or ecx, 0x100
mov dword [esp + 4], ecx
jmp 0x402d1e
mov edi, dword [0x40a020]
test edi, edi
jne 0x402d33
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00402920
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov dword [esp], esi
mov eax, ebx
or eax, 0x100
mov dword [esp + 4], eax
call fcn.00402920
test byte [0x4122d5], 1
jmp 0x402ce6
cld
xor eax, eax
lea edx, [ebp - 0x38]
mov edi, edx
mov ecx, 5
rep stosd dword es:[edi], eax
mov eax, 0x400
mov ecx, 0x1e
mov edi, edx
mov dword [esp + 0xc], eax
mov edx, 0xa
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov eax, dword [0x412880]
mov dword [esp], eax
call sub.KERNEL32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x402e39
mov dword [esp + 4], eax
mov edx, dword [0x412880]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
je 0x402e00
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
test eax, eax
mov ecx, eax
je 0x402e00
xor edx, edx
movzx eax, byte [edx + ecx]
mov byte [edx + edi], al
inc edx
test al, al
jne 0x402dc0
mov ecx, dword [0x40a028]
test ecx, ecx
je 0x402e00
mov eax, dword [0x40a090]
test eax, eax
je 0x402e00
mov dword [esp + 0xc], edi
mov ecx, 0x1e
mov edx, str.Resource__d:_t_s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea esi, [esi]
mov dword [esp], edi
call sub.msvcrt.dll_atoi
mov dword [0x4122d0], eax
jmp 0x402cd3
mov dword [esp + 4], ebx
mov dword [esp], esi
call fcn.00402920
mov eax, dword [0x4122d4]
test eax, eax
je 0x402cf8
test ah, 1
je 0x402ce8
jmp 0x402cf8
mov dword [esp], 0
call sub.KERNEL32.dll_SetLastError
mov byte [ebp - 0x38], 0
sub esp, 4
jmp 0x402e00
Function at 0x4051e0
Capabilities:
Extract resource via kernel32 functions
Set environment variable

Disassembly:
push ebp
mov eax, 0x1001c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00406c70
lea esi, [ebp - 0x8018]
xor ebx, ebx
mov edi, dword [ebp + 0xc]
mov dword [esp + 4], ebx
mov eax, 0x8000
lea ebx, [ebp - 0x10018]
mov dword [esp + 8], eax
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [esp], ebx
xor edx, edx
mov ecx, 0x7fff
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
call sub.msvcrt.dll_memset
mov eax, 0x400
mov ecx, 0x13
mov edx, 0xa
mov dword [esp + 0xc], eax
mov eax, dword [0x412880]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x40536c
mov dword [esp + 4], eax
mov edx, dword [0x412880]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
je 0x4052d0
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
test eax, eax
mov ecx, eax
je 0x4052d0
xor edx, edx
lea esi, [esi]
movzx eax, byte [edx + ecx]
mov byte [edx + ebx], al
inc edx
test al, al
jne 0x405290
mov ecx, dword [0x40a028]
test ecx, ecx
je 0x4052d0
mov eax, dword [0x40a090]
test eax, eax
je 0x4052d0
mov dword [esp + 0xc], ebx
mov ecx, 0x13
mov edx, str.Resource__d:_t_s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
lea esi, [esi]
mov dword [esp], ebx
mov eax, 0x409438
mov dword [esp + 4], eax
jmp 0x4052ff
mov dword [esp], ebx
mov ebx, 0x409438
mov dword [esp + 4], esi
call sub.KERNEL32.dll_SetEnvironmentVariableA
sub esp, 8
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.msvcrt.dll_strtok
test eax, eax
mov ebx, eax
je 0x405364
mov dword [esp], eax
mov ecx, 0x3d
mov dword [esp + 4], ecx
call sub.msvcrt.dll_strchr
mov byte [eax], 0
mov edx, dword [ebp + 8]
inc eax
mov byte [ebp - 0x8018], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00403100
mov eax, dword [0x40a090]
test eax, eax
je 0x4052e0
mov dword [esp + 0xc], esi
mov edx, str.Set_var:_t_s___s_n
mov dword [esp + 8], ebx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x4052e0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp], 0
call sub.KERNEL32.dll_SetLastError
mov byte [ebp - 0x10018], 0
sub esp, 4
jmp 0x4052d0
Function at 0x405b60
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov eax, 0x8010
mov ebp, esp
push esi
push ebx
call fcn.00406c70
lea esi, [ebp - 0x8008]
xor edx, edx
mov ebx, dword [ebp + 8]
mov dword [esp + 4], edx
mov ecx, 0x8000
mov dword [esp + 8], ecx
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov eax, 0x400
mov ecx, 0xd
mov edx, 0xa
mov dword [esp + 0xc], eax
mov eax, dword [0x412880]
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.KERNEL32.dll_FindResourceExA
sub esp, 0x10
test eax, eax
je 0x405ced
mov dword [esp + 4], eax
mov edx, dword [0x412880]
mov dword [esp], edx
call sub.KERNEL32.dll_LoadResource
sub esp, 8
test eax, eax
je 0x405c3b
mov dword [esp], eax
call sub.KERNEL32.dll_LockResource
sub esp, 4
test eax, eax
mov ecx, eax
je 0x405c3b
xor edx, edx
mov esi, esi
movzx eax, byte [edx + ecx]
mov byte [edx + esi], al
inc edx
test al, al
jne 0x405bf0
mov ecx, dword [0x40a028]
test ecx, ecx
je 0x405c13
mov eax, dword [0x40a090]
test eax, eax
jne 0x405d08
mov dword [esp], 0x40a2a8
call sub.msvcrt.dll_strlen
mov dword [esp + 4], esi
mov edx, 0x20
mov word [eax + 0x40a2a8], dx
mov dword [esp], 0x40a2a8
call sub.msvcrt.dll_strcat
cmp byte [ebx], 0
jne 0x405c47
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 4], ebx
mov dword [esp], esi
mov esi, esi
mov ebx, str.__l4j_
call sub.msvcrt.dll_strcpy
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strstr
test eax, eax
mov ebx, eax
je 0x405ca5
lea esi, [esi]
mov dword [esp], ebx
mov eax, 0x20
mov dword [esp + 4], eax
call sub.msvcrt.dll_strchr
test eax, eax
je 0x405c8b
cmp byte [eax + 1], 0
jne 0x405ce0
mov byte [ebx], 0
mov ebx, str.__l4j_
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strstr
test eax, eax
mov ebx, eax
jne 0x405c70
cmp byte [ebp - 0x8008], 0
je 0x405c40
mov dword [esp], 0x40a2a8
call sub.msvcrt.dll_strlen
mov dword [esp + 4], esi
mov ecx, 0x20
mov word [eax + 0x40a2a8], cx
mov dword [esp], 0x40a2a8
call sub.msvcrt.dll_strcat
jmp 0x405c40
mov dword [esp], ebx
inc eax
mov dword [esp + 4], eax
jmp 0x405c50
mov dword [esp], 0
call sub.KERNEL32.dll_SetLastError
mov byte [ebp - 0x8008], 0
sub esp, 4
jmp 0x405c3b
mov dword [esp + 0xc], esi
mov ecx, 0xd
mov edx, str.Resource__d:_t_s_n
mov dword [esp + 8], ecx
mov dword [esp + 4], edx
mov dword [esp], eax
call sub.msvcrt.dll_fprintf
jmp 0x405c13
Function at 0x406860
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov eax, 0x808c
mov ebp, esp
push edi
push esi
push ebx
call fcn.00406c70
cld
mov edx, 0x44
xor eax, eax
lea esi, [ebp - 0x68]
xor ebx, ebx
mov edi, 0x4122b0
mov ecx, 4
rep stosd dword es:[edi], eax
mov dword [esp + 8], edx
xor edi, edi
mov dword [esp + 4], ebx
lea ebx, [ebp - 0x8068]
mov dword [esp], esi
call sub.msvcrt.dll_memset
mov dword [ebp - 0x68], 0x44
mov eax, 0x8000
mov dword [esp + 4], edi
mov edi, 0x4122b0
mov dword [esp + 8], eax
mov dword [esp], ebx
call sub.msvcrt.dll_memset
mov ecx, 0x22
mov edx, 0x40a1a4
mov word [ebp - 0x8068], cx
mov dword [esp + 4], edx
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp], ebx
call sub.msvcrt.dll_strlen
mov word [eax + ebx], 0x2022
mov byte [eax + ebx + 2], 0
mov eax, 0x40a2a8
mov dword [esp + 4], eax
mov dword [esp], ebx
call sub.msvcrt.dll_strcat
mov dword [esp + 0x20], esi
xor ecx, ecx
xor esi, esi
mov dword [esp + 0x24], edi
mov eax, 1
xor edi, edi
mov dword [esp + 0x1c], esi
xor esi, esi
mov dword [esp + 0x18], ecx
mov edx, dword [0x4122c0]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], edi
mov dword [esp + 0x14], edx
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], 0
call sub.KERNEL32.dll_CreateProcessA
sub esp, 0x28
test eax, eax
je 0x406970
mov esi, dword [ebp + 8]
test esi, esi
jne 0x406983
mov ebx, dword [ebp + 0xc]
mov eax, 1
mov dword [ebx], 0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp + 0xc]
xor eax, eax
mov dword [edx], 0xffffffff
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov esi, 0xffffffff
mov dword [esp + 4], esi
mov eax, dword [0x4122b0]
mov dword [esp], eax
call sub.KERNEL32.dll_WaitForSingleObject
mov edi, dword [ebp + 0xc]
sub esp, 8
mov dword [esp + 4], edi
mov ecx, dword [0x4122b0]
mov dword [esp], ecx
call sub.KERNEL32.dll_GetExitCodeProcess
mov edx, dword [0x4122b4]
sub esp, 8
mov dword [esp], edx
call sub.KERNEL32.dll_CloseHandle
mov ebx, dword [0x4122b0]
sub esp, 4
mov dword [esp], ebx
call sub.KERNEL32.dll_CloseHandle
sub esp, 4
mov eax, 1
jmp 0x406962
Function at 0x406a10
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov eax, 0x10
mov ebp, esp
push ebx
sub esp, 0x64
and esp, 0xfffffff0
call fcn.00406c70
call fcn.00406c00
call sub.KERNEL32.dll_GetCommandLineA
mov ebx, eax
lea eax, [ebp - 0x58]
mov dword [esp], eax
call sub.KERNEL32.dll_GetStartupInfoA
sub esp, 4
test ebx, ebx
jne 0x406a48
jmp 0x406ae6
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
or eax, edx
test al, 1
jne 0x406a47
cmp cl, 0x22
je 0x406aa0
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
je 0x406ac0
lea esi, [esi]
lea edi, [edi]
test cl, cl
je 0x406ac0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
setne al
xor edx, edx
cmp cl, 9
setne dl
test eax, edx
jne 0x406a80
jmp 0x406ac0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x22
setne al
xor edx, edx
test cl, cl
setne dl
test eax, edx
jne 0x406aa0
cmp cl, 0x22
je 0x406b22
lea esi, [esi]
cmp cl, 0x20
sete al
cmp cl, 9
sete dl
jmp 0x406ae0
inc ebx
movzx ecx, byte [ebx]
cmp cl, 0x20
sete dl
cmp cl, 9
sete al
or eax, edx
test al, 1
jne 0x406ad0
mov dword [esp], 0
call sub.KERNEL32.dll_GetModuleHandleA
sub esp, 4
test byte [ebp - 0x2c], 1
mov edx, 0xa
je 0x406b04
movzx edx, word [ebp - 0x28]
mov dword [esp + 8], ebx
xor ebx, ebx
mov dword [esp + 4], ebx
mov dword [esp + 0xc], edx
mov dword [esp], eax
call fcn.004013b0
sub esp, 0x10
mov ebx, dword [ebp - 4]
leave
ret
inc ebx
movzx ecx, byte [ebx]
jmp 0x406ac0
Function at 0x4032fd
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor ecx, ecx
xor eax, eax
lea edi, [ebp - 8]
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x20], ecx
stosd dword es:[edi], eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x4069f0]
cmp eax, ecx
je 0x403347
push eax
call fcn.004042af
pop ecx
mov ecx, eax
cmp ecx, 1
jb 0x403347
mov eax, dword [0x4069f4]
push 0x14
xor edx, edx
pop edi
lea esi, [eax + 0x64]
mov eax, ecx
div edi
cmp esi, eax
jb 0x403360
add ecx, 0x4e20
push ecx
push dword [0x4069f0]
call fcn.00404266
pop ecx
mov dword [0x4069f0], eax
pop ecx
mov byte [ebp - 1], 1
movzx esi, byte [ebp - 1]
push esi
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov bx, ax
shr ebx, 0xf
and bl, 1
cmp byte [esi + 0x406d20], bl
jne 0x40338b
inc byte [ebp - 1]
cmp byte [ebp - 1], 0xff
jb 0x403364
jmp 0x403395
movzx eax, byte [ebp - 1]
mov byte [eax + 0x406d20], bl
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, byte [ebp - 1]
cmp al, 0xff
jae 0x4033fc
cmp al, 1
je 0x4033d9
cmp al, 2
je 0x4033e5
cmp al, 0xa0
je 0x4033fc
neg bl
movzx esi, al
sbb ebx, ebx
push 0
add ebx, 0x101
push esi
mov dword [ebp - 0x20], ebx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov ebx, eax
mov eax, dword [ebp - 8]
mov edi, ebx
shl edi, 8
or edi, esi
jmp 0x403405
neg bl
sbb ebx, ebx
add ebx, 0x202
jmp 0x4033ef
neg bl
sbb ebx, ebx
add ebx, 0x205
mov eax, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
mov dword [ebp - 0x20], ebx
mov ebx, eax
jmp 0x403405
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], 0
jne 0x40343f
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4034af
test eax, eax
je 0x4034af
lea edx, [eax + ecx]
cmp dl, byte [0x406d20]
je 0x4034af
mov ebx, eax
add al, cl
mov dword [ebp - 0x20], 0x200
mov edi, ecx
mov byte [0x406d20], al
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ecx, dword [0x4069f4]
mov edx, dword [0x4069f0]
lea ecx, [ecx + ecx*4]
mov dword [edx + ecx*4 + 0x10], eax
mov eax, dword [0x4069f4]
mov ecx, dword [0x4069f0]
mov edx, dword [ebp - 0x20]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4], edx
mov eax, dword [0x4069f4]
mov ecx, dword [0x4069f0]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4 + 4], edi
mov eax, dword [0x4069f4]
mov ecx, dword [0x4069f0]
lea eax, [eax + eax*4]
mov dword [ecx + eax*4 + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4069f4]
mov edx, dword [0x4069f0]
lea ecx, [ecx + ecx*4]
mov dword [edx + ecx*4 + 0xc], eax
inc dword [0x4069f4]
push 0
push 0xa
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40392f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push edi
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x11b]
mov byte [ebp - 0x11c], bl
cmp dword [ebp + 8], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x403b05
cmp dword [ebp + 0xc], ebx
je 0x403b05
push esi
push 0x406c18
lea eax, [ebp - 0x11c]
push 0xff
push eax
push 0x406e20
mov edi, 0x40611c
push str.toolbar_image
push edi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x11c], bl
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
je 0x403a3e
push 0x2050
push ebx
push ebx
lea eax, [ebp - 0x11c]
push ebx
push eax
push ebx
mov byte [0x406d1e], 1
call dword [sym.imp.USER32.dll_LoadImageA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4039f8
lea ecx, [ebp - 0x1c]
push ecx
push 0x18
push eax
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp dword [ebp - 0x14], 0xa
jl 0x4039f8
mov eax, dword [ebp - 0x18]
push 7
cdq
pop ecx
idiv ecx
cmp eax, 0xa
jl 0x4039f8
push ebx
call esi
cmp dword [ebp - 0x18], eax
jle 0x403a39
mov eax, dword [0x406a00]
or eax, 0x12030
push eax
lea eax, [ebp - 0x11c]
push eax
push str.Invalid_toolbar_BMP__too_small_or_big__n_nReverting_to_stock_toolbar
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 0x406c18
push ebx
push str.toolbar_image
push edi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
cmp dword [ebp - 4], ebx
je 0x403a3e
push dword [ebp - 4]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov dword [ebp - 4], ebx
cmp dword [ebp - 4], ebx
jne 0x403a5e
push ebx
push ebx
push ebx
push ebx
push 0xfa2
push ebx
mov byte [0x406d1e], bl
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.USER32.dll_LoadImageA]
mov dword [ebp - 4], eax
mov eax, dword [0x4069e8]
cmp eax, ebx
je 0x403a6e
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp - 4]
mov dword [0x4069e8], eax
mov eax, dword [0x4069ec]
cmp eax, ebx
je 0x403a86
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
push dword [0x4069e8]
call fcn.00403842
pop ecx
mov dword [0x4069ec], eax
pop ecx
lea eax, [ebp - 0x1c]
push eax
push 0x18
push dword [0x4069e8]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x18]
push 7
cdq
pop ecx
idiv ecx
push ecx
mov dword [0x406010], eax
mov eax, dword [ebp - 0x14]
mov dword [0x406014], eax
call esi
mov edi, eax
push 4
movzx eax, byte [0x406040]
add edi, eax
call esi
mov ecx, dword [0x406014]
push 7
add ecx, eax
lea eax, [ecx + edi*2]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
movzx edi, byte [0x406040]
call esi
mov ecx, eax
mov eax, dword [0x406010]
add eax, edi
pop esi
lea eax, [eax + eax*2]
add ecx, eax
lea eax, [edi + ecx*2]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
pop edi
pop ebx
leave
ret
Function at 0x403b09
Capabilities:
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
push 0x4f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x240]
mov dword [ebp - 0x244], ebx
push 0x40
rep stosd dword es:[edi], eax
pop ecx
lea edi, [ebp - 0x103]
mov byte [ebp - 0x104], bl
mov esi, dword [ebp + 8]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
cmp esi, ebx
stosb byte es:[edi], al
je 0x403c6a
cmp byte [esi], bl
je 0x403c6a
lea eax, [ebp - 0x104]
push eax
push esi
call fcn.004041b8
pop ecx
lea eax, [ebp - 0x104]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
test al, 0x10
jne 0x403bc7
lea eax, [ebp - 0x104]
push 0x2a
push eax
call fcn.00404525
pop ecx
test eax, eax
pop ecx
jne 0x403bcf
lea eax, [ebp - 0x104]
push 0x3f
push eax
call fcn.00404525
pop ecx
test eax, eax
pop ecx
jne 0x403bcf
push ebx
push 0x80
push 3
push ebx
push 3
lea eax, [ebp - 0x104]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x403c6a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 1
pop eax
jmp 0x403c6c
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp byte [esi], bl
mov edi, eax
je 0x403bf5
push esi
call fcn.004043d7
movsx ebx, byte [eax + esi - 1]
pop ecx
cmp ebx, 0x5c
jne 0x403c08
cmp edi, 0xffffffff
je 0x403c6a
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x403bc7
or ebx, 0xffffffff
cmp edi, ebx
je 0x403c6a
mov esi, dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x218]
push 0x40677c
push eax
call fcn.0040448e
pop ecx
test eax, eax
pop ecx
je 0x403c43
lea eax, [ebp - 0x218]
push 0x406778
push eax
call fcn.0040448e
pop ecx
test eax, eax
pop ecx
jne 0x403c5e
lea eax, [ebp - 0x244]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x403c5a
push edi
call esi
mov edi, ebx
cmp edi, ebx
jne 0x403c15
cmp edi, ebx
je 0x403c6a
push edi
call esi
jmp 0x403bc7
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret