joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443700
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push 0
push 0
push eax
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x443734
push str.SetFilePointerEx__
push eax
push 0xed
push str..QHImageHlp.c
call fcn.00441bc0
add esp, 0x10
xor eax, eax
ret
mov eax, dword [esp + 0xc]
push 0
lea edx, [esp + 8]
push edx
push edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x443767
push str.ReadFile__
push eax
push pe_nt_image_headers32
push str..QHImageHlp.c
call fcn.00441bc0
add esp, 0x10
xor eax, eax
ret
cmp edi, dword [esp + 4]
je 0x443789
push 0x44f950
push 1
push 0xf2
push str..QHImageHlp.c
call fcn.00441bf0
add esp, 0x10
xor eax, eax
ret
mov eax, 1
ret
Function at 0x445610
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x445640
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x445670
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
neg eax
sbb eax, eax
inc eax
ret
Function at 0x403185
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push 8
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x408010]
cmp eax, ebx
jne 0x403211
mov esi, dword [section..rdata]
mov edi, 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
jne 0x4031fc
cmp dword [ebp + 0x10], ebx
jne 0x4031ee
lea eax, [ebp - 0x10c]
push ebx
push eax
push dword [ebp - 4]
call fcn.00403185
test eax, eax
jne 0x4031fc
lea eax, [ebp - 0x10c]
push edi
push eax
push ebx
push dword [ebp - 4]
jmp 0x4031c1
push dword [ebp - 4]
call dword [0x40801c]
push 1
pop eax
jmp 0x403211
push dword [ebp - 4]
call dword [0x40801c]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [0x408014]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x406215
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x14]
xor ebx, ebx
push eax
push 0x20019
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [0x408010]
test eax, eax
jne 0x406279
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x2000
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [0x408020]
test eax, eax
jne 0x406268
cmp dword [ebp + 0x14], 1
je 0x40626a
cmp dword [ebp + 0x14], 2
je 0x40626a
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x1fff], bl
call dword [0x40801c]
pop esi
pop ebx
pop ebp
ret 0x10
Function at 0x40686f
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x44bdc4], esi
push edi
jne 0x4068a9
mov ecx, 0x44bdc0
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x406885
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x44c1c0
jl 0x406880
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x4068de
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x44bdc0]
xor eax, esi
inc ecx
dec edx
jne 0x4068c1
pop edi
pop esi
not eax
ret 0xc
Function at 0x10005bcf
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x3c4
mov eax, 0x1003132a
call fcn.10009696
mov edi, ecx
cmp dword [edi + 0x20], 0
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3cc], eax
je 0x10005d61
cmp dword [esi + 0x14], 8
mov eax, esi
mov dword [ebp - 0x3bc], 7
mov dword [ebp - 0x3b8], 1
jb 0x10005c14
mov eax, dword [esi]
lea ecx, [ebp - 0x3b8]
xor ebx, ebx
push ecx
push ebx
lea ecx, [ebp - 0x3bc]
push ecx
push ebx
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
cmp ecx, 2
je 0x10005d57
cmp dword [ebp - 0x3bc], 7
jne 0x10005d57
test ecx, ecx
je 0x10005c64
push esi
lea eax, [edi + 8]
push eax
push ecx
push ecx
push ecx
lea ecx, [ebp - 0x3b4]
call fcn.1000ebf4
jmp 0x10005d6e
mov eax, dword [ebp - 0x3b8]
add eax, 2
mov dword [ebp - 0x3c8], ebx
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3c4], ebx
mov dword [ebp - 0x3c0], ebx
lea ecx, [ebp - 0x3c8]
mov dword [ebp - 4], ebx
push ecx
push eax
call fcn.1000ebf4
mov dword [ebp - 4], 1
mov eax, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
sub eax, ecx
push 0
pop eax
cmove ecx, eax
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x10005cba
mov eax, dword [esi]
lea edx, [ebp - 0x3b8]
push edx
push ecx
lea ecx, [ebp - 0x3bc]
push ecx
push ebx
push eax
push dword [edi + 0x20]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
test ecx, ecx
jne 0x10005c4c
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
sub edx, ecx
mov esi, dword [ebp - 0x3cc]
xor eax, eax
test edx, edx
cmove ecx, eax
lea eax, [ecx + ebx*2]
push eax
lea ecx, [ebp - 0x28]
call fcn.1000ebf4
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 2
push eax
mov ecx, esi
call fcn.1000ebf4
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
inc eax
mov byte [ebp - 4], 1
add ebx, eax
call fcn.100023a0
mov edx, dword [ebp - 0x3c4]
mov ecx, dword [ebp - 0x3c8]
sub edx, ecx
push 0
mov eax, ecx
pop edi
cmove eax, edi
cmp byte [eax + ebx*2], 0
jne 0x10005cf2
test ecx, ecx
je 0x10005d53
mov edx, dword [ebp - 0x3c0]
sub edx, ecx
call fcn.10002962
mov al, 1
jmp 0x10005d59
xor al, al
call fcn.10009655
ret 8
push ecx
push ecx
lea ecx, [ebp - 0x3b4]
call fcn.10005db1
push 0x100437bc
lea eax, [ebp - 0x3b4]
push eax
call fcn.1000ebf4
int3

Function at 0x100063cd
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x10041bf0
call fcn.10009a30
mov edi, edx
push 0x1c
lea eax, [ebp - 0x34]
push eax
push ecx
call dword [sym.imp.kernel32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov ecx, dword [ebp - 0x30]
cmp word [ecx], ax
jne 0x10006443
mov edx, dword [ecx + 0x3c]
cmp dword [edx + ecx], 0x4550
jne 0x10006443
mov esi, dword [edx + ecx + 0xd8]
lea eax, [ecx + esi]
cmp edi, eax
jb 0x10006443
mov eax, dword [edx + ecx + 0xdc]
add eax, esi
add eax, ecx
cmp edi, eax
jae 0x10006443
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x1000644c
mov dword [ebp - 4], 0xfffffffe
xor al, al
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000663a
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x10047b00]
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x10047af4]
test edx, edx
jne 0x10006682
test eax, eax
je 0x10006695
mov edx, eax
mov dword [0x10047b00], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x10006695
cmp ecx, ebx
jb 0x10006695
cmp ecx, edi
jbe 0x10006779
mov edx, eax
test eax, eax
jmp 0x100066b7
test edx, edx
je 0x100066b2
mov eax, dword [edx + 8]
test eax, eax
je 0x100066b2
cmp eax, ebx
jb 0x100066b2
cmp eax, edi
jbe 0x10006779
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x10047b00], edx
jne 0x1000669b
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x100066f9
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
cmp esi, 0x40000000
jae 0x10006721
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, esi
mov ecx, ebx
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, edi
mov ecx, esi
call fcn.1000ebf4
mov edx, eax
test edx, edx
je 0x1000679e
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10047af4]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10047b00], edx
mov dword [0x10047af4], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x10006769
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x1000679e
cmp esi, edi
ja 0x1000679e
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.1000aff4
add esp, 0xc
mov eax, esi
jmp 0x100067a0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x10006641
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov edx, dword [0x10047b00]
push ebx
push esi
mov esi, ecx
mov ebx, 0x10000
cmp esi, 0x7ff80000
push edi
mov edi, 0xfff80000
lea eax, [esi - 0x7ff80000]
cmova ebx, eax
cmp esi, 0x80000000
lea eax, [esi + 0x7ff80000]
cmovb edi, eax
mov eax, dword [0x10047af4]
test edx, edx
jne 0x10006682
test eax, eax
je 0x10006695
mov edx, eax
mov dword [0x10047b00], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x10006695
cmp ecx, ebx
jb 0x10006695
cmp ecx, edi
jbe 0x10006779
mov edx, eax
test eax, eax
jmp 0x100066b7
test edx, edx
je 0x100066b2
mov eax, dword [edx + 8]
test eax, eax
je 0x100066b2
cmp eax, ebx
jb 0x100066b2
cmp eax, edi
jbe 0x10006779
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x10047b00], edx
jne 0x1000669b
and esi, 0xffff0000
cmp esi, 0x40000000
jbe 0x100066f9
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
lea edx, [esi - 0x40000000]
mov ecx, ebx
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
cmp esi, 0x40000000
jae 0x10006721
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, edi
lea ecx, [esi + 0x40000000]
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, esi
mov ecx, ebx
call fcn.1000ebf4
mov edx, eax
test edx, edx
jne 0x1000673f
mov edx, edi
mov ecx, esi
call fcn.1000ebf4
mov edx, eax
test edx, edx
je 0x1000679e
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10047af4]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10047b00], edx
mov dword [0x10047af4], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x10006769
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, ebx
jb 0x1000679e
cmp esi, edi
ja 0x1000679e
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.1000aff4
add esp, 0xc
mov eax, esi
jmp 0x100067a0
xor eax, eax
pop edi
pop esi
pop ebx
ret
Function at 0x1000783d
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x24
push 0x10041c30
call fcn.10009a30
mov dword [ebp - 0x30], edx
mov ebx, ecx
xor esi, esi
test ebx, ebx
jne 0x1000785d
push esi
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
mov ebx, eax
mov dword [ebp - 4], esi
mov eax, 0x5a4d
cmp word [ebx], ax
je 0x10007874
push 0xc1
jmp 0x10007985
mov edi, dword [ebx + 0x3c]
cmp dword [edi + ebx], 0x4550
je 0x1000788a
push 0xbf
jmp 0x10007985
cmp word [edi + ebx + 0x14], si
je 0x10007980
mov edi, dword [edi + ebx + 0x78]
lea eax, [edi + ebx]
neg edi
sbb edi, edi
and edi, eax
mov dword [ebp - 0x28], edi
je 0x10007980
mov ecx, dword [edi + 0x1c]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov dword [ebp - 0x34], ecx
mov edx, dword [edi + 0x20]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x2c], edx
mov edx, dword [edi + 0x24]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
mov dword [ebp - 0x24], edx
mov eax, esi
mov dword [ebp - 0x1c], esi
cmp eax, dword [edi + 0x14]
jae 0x10007957
test ecx, ecx
je 0x100078f4
mov edx, dword [ecx + eax*4]
lea eax, [edx + ebx]
neg edx
sbb edx, edx
and edx, eax
jmp 0x100078f6
mov edx, esi
mov ecx, esi
mov eax, esi
mov dword [ebp - 0x20], esi
cmp eax, dword [edi + 0x18]
jae 0x10007927
mov edi, dword [ebp - 0x24]
movzx eax, word [edi + eax*2]
cmp eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x28]
jne 0x1000794e
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1000794a
mov ecx, dword [ebp - 0x20]
mov ecx, dword [eax + ecx*4]
lea eax, [ecx + ebx]
neg ecx
sbb ecx, ecx
and ecx, eax
mov eax, dword [edi + 0x10]
add eax, dword [ebp - 0x1c]
push edx
push ecx
push eax
push dword [ebp - 0x30]
mov eax, 0x10006382
call eax
test eax, eax
je 0x10007957
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x34]
jmp 0x100078dd
mov ecx, esi
jmp 0x10007927
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
jmp 0x100078fd
push esi
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
inc eax
jmp 0x10007994
push 0xc0
call dword [sym.imp.kernel32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x4943f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.00494360
add esp, 4
lea ecx, [ebp - 8]
push ecx
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push 0x65a499
mov esi, eax
call fcn.004943b0
add esp, 4
test esi, esi
je 0x494438
mov eax, dword [ebp + 0x14]
lea edx, [ebp - 4]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
jmp fcn.00c0c579

Function at 0x5305f5
Capabilities:
Encode data using xor

Disassembly:
pop edi
mov byte [0x39754860], al
pop ebp
sub cl, ah
lodsd eax, dword [esi]
arpl bp, cx
dec edi
iretd
jecxz 0x530505
jl 0x5305cd
adc eax, 0x25e18ffa
test al, 0xd
push eax
stosb byte es:[edi], al
and edx, dword [esi - 0x5d]
and al, 0x18
cmove ebx, edi
inc eax
push esp
mov ch, 0x19
inc ebp
cmp esi, ebp
lahf
in al, 0xdf
mov al, byte [0x619cddf9]
in al, dx
invalid
test dword [ebp - 0x1e], 0x50cc0df
or al, 5
test eax, 0x1bfff975
pop esi
and al, 0x7f
out 9, al
popfd
xor byte [edi], ah
jns 0x530619
leave
ja 0x530574
adc al, 8
pop edi
scasd eax, dword es:[edi]
mov byte [0x675bd0ba], al
in eax, 0xe6
div dword [edi]
aam 0xa4
movsb byte es:[edi], byte [esi]
movsb byte es:[edi], byte [esi]
cld
add al, 0x7d
cmpsb byte fs:[esi], byte es:[edi]
out dx, eax
movsb byte es:[edi], byte [esi]
xchg esi, eax
mov edx, 0x46265f17
xor bh, byte [edx + 0x16]
jo 0x5305f9
pop esi
and eax, 0x4033e019
das
push edi
and eax, 0xc5be9397
pop ebx
call 0xee09a673
mov dh, 0xed
jns 0x53068c
nop
scasd eax, dword es:[edi]
ficom dword [ecx + 0x57]
fidiv word [ebp + 5]
xchg byte [ecx + 7], al
not byte [ebx - 0xb]
jno 0x53069a
dec eax
lodsd eax, dword [esi]
or ah, byte [0x7126a43b]
push edi
sub cl, al
jge 0x5305d2
fst st(2)
test dh, al
invalid
pop ebx
retf 0xddfc
std
pop ebx
lodsd eax, dword [esi]
sti
Function at 0x401220
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push edi
push eax
push 0x20019
push 0
push str.SOFTWAREThunder_NetworkThunderOem_thunder_backwnd
mov esi, ecx
push 0x80000002
mov dword [esp + 0x1c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401257
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
mov eax, dword [esp + 8]
lea ecx, [esp + 0xc]
push ebp
lea edi, [esi + 0xc4]
push ecx
lea edx, [esp + 0x18]
push edi
push edx
push 0
push str.Path
push eax
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 0xc]
mov ebp, eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebp, ebp
pop ebp
je 0x4012a5
pop edi
xor eax, eax
pop esi
add esp, 0xc
ret
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [ecx + esi + 0xc4]
mov cl, byte [ecx + esi + 0xc4]
cmp cl, 0x5c
je 0x4012cb
mov cl, byte [eax - 1]
dec eax
cmp cl, 0x5c
jne 0x4012c2
mov byte [eax + 1], 0
pop edi
mov eax, 1
pop esi
add esp, 0xc
ret
Function at 0x4012e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0xc8
push ebx
push esi
push edi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edx, eax
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
mov al, byte [edx]
not ecx
dec ecx
add ecx, edx
cmp al, 0x22
jne 0x401353
inc edx
cmp edx, ecx
jae 0x401328
cmp byte [edx], 0x22
je 0x401324
inc edx
cmp edx, ecx
jb 0x40130c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc8
ret 8
cmp edx, ecx
jb 0x401336
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc8
ret 8
inc edx
cmp edx, ecx
jae 0x401385
cmp byte [edx], 0x20
jne 0x401381
inc edx
cmp edx, ecx
jb 0x40133b
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc8
ret 8
cmp edx, ecx
jae 0x401373
cmp byte [edx], 0x20
je 0x40136f
inc edx
cmp edx, ecx
jb 0x401357
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc8
ret 8
cmp edx, ecx
jb 0x40133b
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc8
ret 8
cmp edx, ecx
jb 0x401393
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc8
ret 8
lea esi, [esp + 0xc]
mov al, byte [edx]
cmp al, 0x7c
je 0x4013a5
mov byte [esi], al
inc edx
inc esi
cmp edx, ecx
jb 0x401397
mov byte [esi], 0
mov al, byte [edx]
cmp al, 0x7c
je 0x4013bc
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0xc8
ret 8
lea edi, [edx + 1]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x70]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.fromfile
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll__stricmp]
lea ecx, [esp + 0x10]
push ecx
call esi
mov edi, dword [sym.imp.MSVCRT.dll_atoi]
add esp, 8
test eax, eax
jne 0x401411
mov ecx, ebx
call fcn.00401470
mov edx, dword [esp + 0xd8]
mov dword [edx], eax
jmp 0x401424
lea eax, [esp + 0xc]
push eax
call edi
mov ecx, dword [esp + 0xdc]
add esp, 4
mov dword [ecx], eax
lea edx, [esp + 0x70]
push str.fromfile
push edx
call esi
add esp, 8
test eax, eax
jne 0x401440
mov ecx, ebx
call fcn.00401470
jmp 0x40144a
lea edx, [esp + 0x70]
push edx
call edi
add esp, 4
mov ecx, dword [esp + 0xdc]
pop edi
pop esi
pop ebx
mov dword [ecx], eax
mov eax, 1
add esp, 0xc8
ret 8

Function at 0x401470
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x104
add ecx, 0xc4
lea eax, [esp]
push str.ProfilesUserConfig.ini
push ecx
push 0x41208c
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [esp]
push ecx
push 0xffffffffffffffff
push str.CurrentLangIndex
push str.LanguageConfig
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
add esp, 0x104
ret
Function at 0x4014c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x12c
lea eax, [esp + 0x28]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea esi, [ecx + 0xc4]
push str.ProfilesUserConfig.ini
push esi
push 0x41208c
push eax
call edi
mov ecx, dword [esp + 0x14c]
lea edx, [esp + 0x30]
push ecx
push str.LangValue_d
push edx
call edi
add esp, 0x1c
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0x34]
lea ecx, [esp + 0xc]
push eax
push 0x14
push ecx
lea edx, [esp + 0x2c]
push 0x4141b8
push edx
push str.LanguageConfig
call ebx
cmp eax, 1
jae 0x401534
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x12c
ret 0xc
lea eax, [esp + 0xc]
lea ecx, [esp + 0x34]
push eax
push esi
push str._sLanguages_sLanguage.ini
push ecx
call edi
mov eax, dword [esp + 0x150]
add esp, 0x10
lea edx, [esp + 0x34]
push edx
push 0x100
push eax
push 0x4141b8
push str.MenuDownload
push str.BrowserExtension
call ebx
cmp eax, 1
jae 0x40157f
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x12c
ret 0xc
mov edx, dword [esp + 0x144]
lea ecx, [esp + 0x34]
push ecx
push 0x100
push edx
push 0x4141b8
push str.MenuDownloadAll
push str.BrowserExtension
call ebx
cmp eax, 1
pop edi
sbb eax, eax
pop esi
inc eax
pop ebx
add esp, 0x12c
ret 0xc

Function at 0x4015c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x4015d5
xor eax, eax
ret 4
not al
and eax, 0xff
shr eax, 4
and eax, 1
ret 4

Function at 0x401640
Capabilities:
Delete registry key

Disassembly:
sub esp, 0x104
xor eax, eax
push ebx
push ebp
push esi
mov esi, ecx
push edi
or ecx, 0xffffffff
lea edx, [esi + 0x638]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov edi, edx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40168d
push edx
push str.SoftwareMicrosoftInternet_ExplorerMenuExt
lea eax, [esp + 0x18]
push str._s_s
push eax
call ebx
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x80000001
call ebp
lea edx, [esi + 0x738]
or ecx, 0xffffffff
mov edi, edx
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x4016c2
push edx
push str.SoftwareMicrosoftInternet_ExplorerMenuExt
lea edx, [esp + 0x18]
push str._s_s
push edx
call ebx
add esp, 0x10
lea eax, [esp + 0x10]
push eax
push 0x80000001
call ebp
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x104
ret
Function at 0x4016e0
Capabilities:
Set registry value

Disassembly:
sub esp, 0x108
mov eax, dword [esp + 0x10c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, ecx
push eax
push str.SoftwareMicrosoftInternet_ExplorerMenuExt
lea ecx, [esp + 0x18]
xor ebx, ebx
push str._s_s
push ecx
mov dword [esp + 0x1c], ebx
call edi
add esp, 0x10
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40173a
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x108
ret 0xc
mov ecx, dword [esp + 0x11c]
add esi, 0xc4
push ecx
push esi
lea edx, [esp + 0x18]
push 0x41208c
push edx
call edi
lea edi, [esp + 0x20]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea eax, [esp + 0x10]
not ecx
push ecx
mov ecx, dword [esp + 0x10]
push eax
push 1
push ebx
push ebx
push ecx
call esi
test eax, eax
jne 0x4017a2
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x120]
push 4
push edx
push 4
push ebx
push str.Contexts
push eax
call esi
test eax, eax
jne 0x4017a2
mov ebx, 1
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x108
ret 0xc