joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2669d
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x60]
push esi
push edi
lea edi, [ebx + 0x1c]
mov dword [edi], 0
movzx eax, byte [edx]
sub eax, 0
mov esi, 0xc0000002
je 0x266ac
sub eax, 2
je 0x266ac
sub eax, 0xc
jne case.0x267fc.1673486111
mov eax, dword [edx + 0xc]
mov ecx, eax
cmp ecx, 0x9c4060d4
ja 0x26759
je 0x26725
cmp ecx, 0x9c40208c
ja 0x266fe
je 0x266f0
add ecx, 0x63bfe000
cmp ecx, 0x88
ja case.0x267fc.1673486111
movzx eax, byte [ecx + 0x26868]
jmp dword [eax*4 + 0x26854]
mov ecx, dword [ebx + 0xc]
mov dword [ecx], 0x1020005
mov dword [edi], 4
xor esi, esi
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x2ab14]
mov edx, dword [ebx + 0xc]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
jmp 0x266a6
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026980
mov esi, eax
jmp case.0x267fc.1673486111
mov edx, dword [ebx + 0xc]
push edi
call fcn.00026a20
mov esi, eax
jmp case.0x267fc.1673486111
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026ab0
mov esi, eax
jmp case.0x267fc.1673486111
cmp ecx, 0x9c4060cc
ja 0x2671d
je 0x26725
cmp ecx, 0x9c402090
je 0x2671a
cmp ecx, 0x9c4060c4
je 0x26725
jmp case.0x267fc.1673486111
hlt
cmp ecx, 0x9c4060d0
jne case.0x267fc.1673486111
mov esi, dword [ebx + 0xc]
mov edx, dword [edx + 8]
mov ecx, dword [esi]
mov dword [esp + 0xc], edx
cmp eax, 0x9c4060cc
je 0x26745
push edx
call fcn.00026b50
mov esi, eax
jmp case.0x267fc.1673486111
push ecx
call dword [sym.imp.HAL.dll_READ_PORT_UCHAR]
mov edx, dword [esp + 0xc]
mov byte [esi], al
mov dword [edi], edx
jmp 0x266ac
cmp ecx, 0x9c40a0dc
ja 0x267e6
je case.0x267fc.1673486112
cmp ecx, 0x9c40a0c8
ja 0x267c1
je case.0x267fc.1673486112
cmp ecx, 0x9c406104
je 0x267a2
cmp ecx, 0x9c406144
jne case.0x267fc.1673486111
cmp dword [edx + 8], 8
mov esi, dword [edx + 4]
mov eax, dword [ebx + 0xc]
jne 0x26834
push eax
call fcn.00026be0
mov esi, eax
jmp case.0x267fc.1673486111
cmp dword [edx + 8], 0x10
mov eax, dword [edx + 4]
mov esi, dword [ebx + 0xc]
jne 0x26834
push edi
push eax
push esi
call fcn.00026cb0
mov esi, eax
jmp case.0x267fc.1673486111
cmp ecx, 0x9c40a0d8
jne case.0x267fc.1673486111
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
cmp eax, 0x9c40a0d8
je 0x26803
push edx
call fcn.00026ba0
mov esi, eax
jmp case.0x267fc.1673486111
add ecx, 0x63bf5f20
cmp ecx, 0x6c
ja case.0x267fc.1673486111
movzx ecx, byte [ecx + 0x26908]
jmp dword [ecx*4 + 0x268f4]
movzx eax, byte [ecx + 4]
push eax
push edx
call dword [sym.imp.HAL.dll_WRITE_PORT_UCHAR]
jmp 0x266ac
mov edx, dword [edx + 8]
mov ecx, dword [ebx + 0xc]
cmp edx, 8
jb 0x26834
push edx
mov eax, edi
call fcn.00026c60
mov esi, eax
jmp case.0x267fc.1673486111
mov dword [edi], 0
mov esi, 0xc000000d
jmp case.0x267fc.1673486111
mov ecx, dword [edx + 4]
mov edx, dword [ebx + 0xc]
push ecx
mov eax, edi
call fcn.000247e0
mov esi, eax
jmp case.0x267fc.1673486111
Function at 0x266c6
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x60]
push esi
push edi
lea edi, [ebx + 0x1c]
mov dword [edi], 0
movzx eax, byte [edx]
sub eax, 0
mov esi, 0xc0000002
je 0x266ac
sub eax, 2
je 0x266ac
sub eax, 0xc
jne case.0x267fc.1673486111
mov eax, dword [edx + 0xc]
mov ecx, eax
cmp ecx, 0x9c4060d4
ja 0x26759
je 0x26725
cmp ecx, 0x9c40208c
ja 0x266fe
je 0x266f0
add ecx, 0x63bfe000
cmp ecx, 0x88
ja case.0x267fc.1673486111
movzx eax, byte [ecx + 0x26868]
jmp dword [eax*4 + 0x26854]
mov ecx, dword [ebx + 0xc]
mov dword [ecx], 0x1020005
mov dword [edi], 4
xor esi, esi
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x2ab14]
mov edx, dword [ebx + 0xc]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
jmp 0x266a6
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026980
mov esi, eax
jmp case.0x267fc.1673486111
mov edx, dword [ebx + 0xc]
push edi
call fcn.00026a20
mov esi, eax
jmp case.0x267fc.1673486111
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026ab0
mov esi, eax
jmp case.0x267fc.1673486111
cmp ecx, 0x9c4060cc
ja 0x2671d
je 0x26725
cmp ecx, 0x9c402090
je 0x2671a
cmp ecx, 0x9c4060c4
je 0x26725
jmp case.0x267fc.1673486111
hlt
cmp ecx, 0x9c4060d0
jne case.0x267fc.1673486111
mov esi, dword [ebx + 0xc]
mov edx, dword [edx + 8]
mov ecx, dword [esi]
mov dword [esp + 0xc], edx
cmp eax, 0x9c4060cc
je 0x26745
push edx
call fcn.00026b50
mov esi, eax
jmp case.0x267fc.1673486111
push ecx
call dword [sym.imp.HAL.dll_READ_PORT_UCHAR]
mov edx, dword [esp + 0xc]
mov byte [esi], al
mov dword [edi], edx
jmp 0x266ac
cmp ecx, 0x9c40a0dc
ja 0x267e6
je case.0x267fc.1673486112
cmp ecx, 0x9c40a0c8
ja 0x267c1
je case.0x267fc.1673486112
cmp ecx, 0x9c406104
je 0x267a2
cmp ecx, 0x9c406144
jne case.0x267fc.1673486111
cmp dword [edx + 8], 8
mov esi, dword [edx + 4]
mov eax, dword [ebx + 0xc]
jne 0x26834
push eax
call fcn.00026be0
mov esi, eax
jmp case.0x267fc.1673486111
cmp dword [edx + 8], 0x10
mov eax, dword [edx + 4]
mov esi, dword [ebx + 0xc]
jne 0x26834
push edi
push eax
push esi
call fcn.00026cb0
mov esi, eax
jmp case.0x267fc.1673486111
cmp ecx, 0x9c40a0d8
jne case.0x267fc.1673486111
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
cmp eax, 0x9c40a0d8
je 0x26803
push edx
call fcn.00026ba0
mov esi, eax
jmp case.0x267fc.1673486111
add ecx, 0x63bf5f20
cmp ecx, 0x6c
ja case.0x267fc.1673486111
movzx ecx, byte [ecx + 0x26908]
jmp dword [ecx*4 + 0x268f4]
movzx eax, byte [ecx + 4]
push eax
push edx
call dword [sym.imp.HAL.dll_WRITE_PORT_UCHAR]
jmp 0x266ac
mov edx, dword [edx + 8]
mov ecx, dword [ebx + 0xc]
cmp edx, 8
jb 0x26834
push edx
mov eax, edi
call fcn.00026c60
mov esi, eax
jmp case.0x267fc.1673486111
mov dword [edi], 0
mov esi, 0xc000000d
jmp case.0x267fc.1673486111
mov ecx, dword [edx + 4]
mov edx, dword [ebx + 0xc]
push ecx
mov eax, edi
call fcn.000247e0
mov esi, eax
jmp case.0x267fc.1673486111
Function at 0x2683e
Capabilities:
Complete processing asynchronous io request

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 8]
mov edx, dword [ebx + 0x60]
push esi
push edi
lea edi, [ebx + 0x1c]
mov dword [edi], 0
movzx eax, byte [edx]
sub eax, 0
mov esi, 0xc0000002
je 0x266ac
sub eax, 2
je 0x266ac
sub eax, 0xc
jne case.0x267fc.1673486111
mov eax, dword [edx + 0xc]
mov ecx, eax
cmp ecx, 0x9c4060d4
ja 0x26759
je 0x26725
cmp ecx, 0x9c40208c
ja 0x266fe
je 0x266f0
add ecx, 0x63bfe000
cmp ecx, 0x88
ja case.0x267fc.1673486111
movzx eax, byte [ecx + 0x26868]
jmp dword [eax*4 + 0x26854]
mov ecx, dword [ebx + 0xc]
mov dword [ecx], 0x1020005
mov dword [edi], 4
xor esi, esi
xor dl, dl
mov ecx, ebx
mov dword [ebx + 0x18], esi
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [0x2ab14]
mov edx, dword [ebx + 0xc]
mov ecx, dword [eax + 4]
mov dword [edx], ecx
jmp 0x266a6
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026980
mov esi, eax
jmp case.0x267fc.1673486111
mov edx, dword [ebx + 0xc]
push edi
call fcn.00026a20
mov esi, eax
jmp case.0x267fc.1673486111
mov ecx, dword [ebx + 0xc]
push edi
push ecx
call fcn.00026ab0
mov esi, eax
jmp case.0x267fc.1673486111
cmp ecx, 0x9c4060cc
ja 0x2671d
je 0x26725
cmp ecx, 0x9c402090
je 0x2671a
cmp ecx, 0x9c4060c4
je 0x26725
jmp case.0x267fc.1673486111
hlt
cmp ecx, 0x9c4060d0
jne case.0x267fc.1673486111
mov esi, dword [ebx + 0xc]
mov edx, dword [edx + 8]
mov ecx, dword [esi]
mov dword [esp + 0xc], edx
cmp eax, 0x9c4060cc
je 0x26745
push edx
call fcn.00026b50
mov esi, eax
jmp case.0x267fc.1673486111
push ecx
call dword [sym.imp.HAL.dll_READ_PORT_UCHAR]
mov edx, dword [esp + 0xc]
mov byte [esi], al
mov dword [edi], edx
jmp 0x266ac
cmp ecx, 0x9c40a0dc
ja 0x267e6
je case.0x267fc.1673486112
cmp ecx, 0x9c40a0c8
ja 0x267c1
je case.0x267fc.1673486112
cmp ecx, 0x9c406104
je 0x267a2
cmp ecx, 0x9c406144
jne case.0x267fc.1673486111
cmp dword [edx + 8], 8
mov esi, dword [edx + 4]
mov eax, dword [ebx + 0xc]
jne 0x26834
push eax
call fcn.00026be0
mov esi, eax
jmp case.0x267fc.1673486111
cmp dword [edx + 8], 0x10
mov eax, dword [edx + 4]
mov esi, dword [ebx + 0xc]
jne 0x26834
push edi
push eax
push esi
call fcn.00026cb0
mov esi, eax
jmp case.0x267fc.1673486111
cmp ecx, 0x9c40a0d8
jne case.0x267fc.1673486111
mov ecx, dword [ebx + 0xc]
mov edx, dword [ecx]
cmp eax, 0x9c40a0d8
je 0x26803
push edx
call fcn.00026ba0
mov esi, eax
jmp case.0x267fc.1673486111
add ecx, 0x63bf5f20
cmp ecx, 0x6c
ja case.0x267fc.1673486111
movzx ecx, byte [ecx + 0x26908]
jmp dword [ecx*4 + 0x268f4]
movzx eax, byte [ecx + 4]
push eax
push edx
call dword [sym.imp.HAL.dll_WRITE_PORT_UCHAR]
jmp 0x266ac
mov edx, dword [edx + 8]
mov ecx, dword [ebx + 0xc]
cmp edx, 8
jb 0x26834
push edx
mov eax, edi
call fcn.00026c60
mov esi, eax
jmp case.0x267fc.1673486111
mov dword [edi], 0
mov esi, 0xc000000d
jmp case.0x267fc.1673486111
mov ecx, dword [edx + 4]
mov edx, dword [ebx + 0xc]
push ecx
mov eax, edi
call fcn.000247e0
mov esi, eax
jmp case.0x267fc.1673486111
Function at 0x27070
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x100
xor eax, eax
jmp 0x27080
mov byte [esp + eax], al
inc eax
cmp eax, 0x100
jb 0x27080
push ebx
push ebp
push esi
xor ecx, ecx
xor eax, eax
push edi
xor esi, esi
jmp 0x270a0
movzx edi, byte [eax + 0x297f0]
mov dl, byte [esp + esi + 0x10]
movzx ebx, dl
add edi, ecx
add ebx, edi
and ebx, 0xff
inc eax
mov ecx, ebx
cmp eax, 0x70
jb 0x270c2
xor eax, eax
mov bl, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], bl
inc esi
mov byte [esp + ecx + 0x10], dl
cmp esi, 0x100
jb 0x270a0
xor edi, edi
xor esi, esi
mov eax, 0x2a7aa
lea ebp, [edi + 0x7a]
inc esi
and esi, 0xff
mov dl, byte [esp + esi + 0x10]
movzx ecx, dl
add ecx, edi
and ecx, 0xff
movzx ebx, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], bl
mov byte [esp + ecx + 0x10], dl
movzx edi, byte [esp + esi + 0x10]
movzx edx, dl
add edi, edx
and edi, 0xff
movzx edx, byte [esp + edi + 0x10]
xor byte [eax - 2], dl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx edx, bl
add edx, ecx
and edx, 0xff
movzx ecx, byte [esp + edx + 0x10]
mov byte [esp + esi + 0x10], cl
mov byte [esp + edx + 0x10], bl
movzx ecx, byte [esp + esi + 0x10]
movzx edi, bl
add ecx, edi
and ecx, 0xff
movzx ecx, byte [esp + ecx + 0x10]
xor byte [eax - 1], cl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx ecx, bl
add ecx, edx
and ecx, 0xff
movzx edx, byte [esp + ecx + 0x10]
mov byte [esp + esi + 0x10], dl
mov byte [esp + ecx + 0x10], bl
movzx edx, byte [esp + esi + 0x10]
movzx edi, bl
add edx, edi
and edx, 0xff
movzx edx, byte [esp + edx + 0x10]
xor byte [eax], dl
inc esi
and esi, 0xff
mov bl, byte [esp + esi + 0x10]
movzx edx, bl
add edx, ecx
and edx, 0xff
movzx ecx, byte [esp + edx + 0x10]
mov byte [esp + esi + 0x10], cl
mov byte [esp + edx + 0x10], bl
movzx ecx, byte [esp + esi + 0x10]
movzx edi, bl
add ecx, edi
and ecx, 0xff
movzx ecx, byte [esp + ecx + 0x10]
xor byte [eax + 1], cl
inc esi
and esi, 0xff
mov cl, byte [esp + esi + 0x10]
movzx edi, cl
add edi, edx
and edi, 0xff
movzx edx, byte [esp + edi + 0x10]
mov byte [esp + esi + 0x10], dl
mov byte [esp + edi + 0x10], cl
movzx edx, byte [esp + esi + 0x10]
movzx ecx, cl
add edx, ecx
and edx, 0xff
movzx edx, byte [esp + edx + 0x10]
xor byte [eax + 2], dl
add eax, 5
sub ebp, 1
jne 0x270e3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x100
ret

Function at 0x27a80
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov ecx, 0x1fc
or eax, 0xffffffff
push esi
lea esp, [esp]
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x29008]
dec ecx
inc edx
test ecx, ecx
jne 0x27a90
not eax
pop esi
ret

Function at 0x27ba0
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push 0
push 0
push eax
mov eax, dword [esp + 0x18]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push 0
push 0
push eax
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ntoskrnl.exe_ZwReadFile]
test eax, eax
setge al
test al, al
je 0x27be2
test esi, esi
je 0x27be2
mov ecx, dword [esp + 4]
mov dword [esi], ecx
add esp, 8
ret 4
Function at 0x27bf0
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x24
xor eax, eax
push 5
push 0x18
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.ntoskrnl.exe_ZwQueryInformationFile]
test eax, eax
jl 0x27c41
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov al, 1
add esp, 0x24
ret
xor al, al
add esp, 0x24
ret

Function at 0x27c50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
push esi
push 0x54
mov esi, eax
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0
call sub.ntoskrnl.exe_memset
add esp, 0xc
test esi, esi
je 0x27ccd
test edi, edi
je 0x27ccd
mov eax, dword [ebp + 8]
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], 0x67452301
mov dword [esp + 0x10], 0xefcdab89
mov dword [esp + 0x14], 0x98badcfe
mov dword [esp + 0x18], 0x10325476
call fcn.00027220
push edi
lea esi, [esp + 0xc]
call fcn.000272e0
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x2b034
Capabilities:
Create device object
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call section.INIT
pop ebp
jmp fcn.00025be0
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x360d0d1c
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x42e0d2
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x679659ef
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x4015e7
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
push dword [esi + 0x58]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [ebp + 0xc], eax
jne 0x40165e
lea ecx, [ebp - 0x20]
call fcn.00401d13
and byte [ebp - 0xc], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov eax, 0x104
mov dword [ebp - 8], ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.004016d3
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x10]
call fcn.004016ac
lea ecx, [ebp - 0x20]
call fcn.00401876
push 1
push dword [ebp - 0x1c]
push 0
push 0x425064
push 0x42505c
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x20]
call fcn.0040166e
xor eax, eax
pop esi
leave
ret 0x10

Function at 0x401c6e
Capabilities:
Check os version
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
mov dword [ebp - 0x94], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
jae 0x401ce9
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
cmp ax, 0x804
jne 0x401caa
push 0x4250a8
jmp 0x401cd4
cmp ax, 0x404
jne 0x401cb7
push 0x4250a0
jmp 0x401cd4
and eax, 0xff
cmp ax, 0x11
jne 0x401cc9
push 0x425090
jmp 0x401cd4
cmp ax, 0x12
jne 0x401ce9
push 0x425088
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0xc]
mov word [eax], 9
mov al, 1
leave
ret
xor al, al
leave
ret
Function at 0x40201a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x13c
push ebx
xor ebx, ebx
cmp dword [0x428bc8], ebx
push esi
push edi
jne 0x402168
lea ecx, [ebp - 0x18]
call fcn.004021b8
push 0x20019
push 0x4250ec
push SysReAllocStringLen
lea ecx, [ebp - 4]
mov dword [ebp - 0x18], 0x422424
mov dword [ebp - 4], ebx
call fcn.0040217a
mov eax, 0x104
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x18]
mov byte [ebp - 0x28], bl
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ebx
call fcn.004016d3
lea ecx, [ebp - 0x1c]
mov dword [ebp - 8], ebx
push ecx
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0x428bc4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x2c]
mov esi, eax
call fcn.004016ac
cmp esi, ebx
jne 0x4020c9
lea eax, [ebp - 0x38]
lea ecx, [ebp - 0x18]
push eax
call fcn.00402391
push eax
lea ecx, [ebp - 0x18]
call fcn.004021cc
lea ecx, [ebp - 0x38]
call fcn.0040166e
push 0x4250dc
jmp 0x402101
lea eax, [ebp - 0x13c]
push 0x4250b0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x2c]
push 1
push eax
call fcn.00402204
add esp, 0x10
lea ecx, [ebp - 0x18]
push eax
call fcn.004021cc
lea ecx, [ebp - 0x2c]
call fcn.0040166e
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x18]
call fcn.00402b24
mov eax, dword [ebp - 0xc]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x402117
xor esi, esi
jmp 0x402143
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0041cd70
mov esi, esp
push ebx
push ebx
push edi
push esi
push 0xffffffffffffffff
push dword [ebp - 8]
mov byte [esi], bl
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp dword [ebp - 4], ebx
mov dword [0x428bc8], eax
je 0x402160
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x18]
call fcn.0040166e
mov eax, dword [0x428bc8]
lea esp, [ebp - 0x148]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402204
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x12f]
mov byte [ebp - 0x130], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
mov dword [ebp - 4], ebx
push eax
push 0x42514c
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40227c
cmp dword [ebp + 0xc], 1
mov dword [ebp - 0xc], 0x104
mov eax, 0x42513c
je 0x40225c
mov eax, 0x42512c
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x130]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x130], bl
lea eax, [ebp - 0x130]
push eax
je 0x4022ac
lea ecx, [ebp - 0x2c]
call fcn.004022f5
push 1
lea ecx, [ebp - 0x2c]
pop ebx
mov dword [ebp - 0x2c], 0x422424
push 0x425128
call fcn.004028cc
jmp 0x4022c1
lea ecx, [ebp - 0x1c]
call fcn.004022f5
push 2
mov dword [ebp - 0x1c], 0x422424
pop ebx
lea eax, [ebp - 0x1c]
mov edi, dword [ebp + 8]
push eax
mov ecx, edi
call fcn.0040235b
test bl, 2
mov dword [edi], 0x422424
je 0x4022e2
lea ecx, [ebp - 0x1c]
and ebx, 0xfffffffd
call fcn.0040166e
test bl, 1
je 0x4022ef
lea ecx, [ebp - 0x2c]
call fcn.0040166e
mov eax, edi
pop edi
pop ebx
leave
ret

Function at 0x4034b3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.004033ee
lea ecx, [ebp - 0x10]
call fcn.00401876
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4034dd
mov bl, 1
jmp 0x4034df
xor bl, bl
lea ecx, [ebp - 0x10]
call fcn.0040166e
mov al, bl
pop ebx
leave
ret
Function at 0x406112
Capabilities:
Create process on windows

Disassembly:
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgCtrlID]
push dword [esi + 0x5c]
call edi
cmp dword [esp + 0x10], eax
jne 0x406139
push 3
pop edi
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_EndDialog]
mov dword [esi + 0x50], edi
jmp 0x406176
push dword [esi + 0xac]
call edi
cmp dword [esp + 0x10], eax
jne 0x406176
lea edi, [esi + 0xf8]
push ebx
mov ecx, edi
call fcn.00401876
mov ebx, dword [edi + 4]
mov ecx, edi
call fcn.00401876
push 1
push ebx
push 0
push dword [edi + 4]
push 0x42505c
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop ebx
pop edi
xor eax, eax
pop esi
ret 0x10

Function at 0x40662a
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
push dword [esp + 8]
call dword [sym.imp.USER32.dll_PostQuitMessage]
pop esi
ret 4

Function at 0x406a49
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov esi, ecx
push dword [esi + 0x64]
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
cmp dword [ebp + 0xc], eax
jne 0x406ac0
lea ecx, [ebp - 0x20]
call fcn.00401d13
and byte [ebp - 0xc], 0
and dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
mov eax, 0x104
mov dword [ebp - 8], ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], eax
call fcn.004016d3
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [ebp - 0x10]
call fcn.004016ac
lea ecx, [ebp - 0x20]
call fcn.00401876
push 1
push dword [ebp - 0x1c]
push 0
push 0x425064
push 0x42505c
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x20]
call fcn.0040166e
xor eax, eax
pop esi
leave
ret 0x10
Function at 0x40a1b3
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push esi
push ecx
lea ecx, [ebp - 0x10]
call fcn.0040235b
xor esi, esi
mov eax, 0x425780
cmp word [0x425780], si
mov dword [ebp - 0x10], 0x422424
mov ecx, eax
je 0x40a1e3
inc ecx
inc ecx
cmp word [ecx], si
jne 0x40a1dc
sub ecx, eax
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.00402a9c
push dword [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.004059e6
push 0x44
lea eax, [ebp - 0x64]
push esi
push eax
call fcn.0041cd10
push 0x10
lea eax, [ebp - 0x20]
push esi
push eax
mov dword [ebp - 0x64], 0x44
call fcn.0041cd10
add esp, 0x18
lea ecx, [ebp - 0x10]
call fcn.00401876
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x64]
push eax
push esi
push esi
push 0x20
push esi
push esi
push esi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
lea ecx, [ebp - 0x10]
call fcn.0040166e
pop esi
leave
ret 4