joyce8/EMBER2024-capa huggingface dataset:
Function at 0x515dcd
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
jmp 0x51557f
mov dword [esp + 3], eax
push word [esp + 1]
lea esp, [esp + 0xb]
lea esp, [esp + 3]
jmp 0x515e03
mov ecx, dword [esp + 0x18]
jmp 0x515dc7
jmp 0x51564f
call fcn.00515ba2
push edx
pushal
push dword [esp + 0x10]
pop word [esp + 0x1b]
lea esp, [esp + 2]
jmp 0x515ad0
jmp 0x51598d
call 0x515e0e
sahf
adc eax, 0xd91fec85
or byte [esi + 0x3a8e7314], al
mov edx, 0x3dceab3b
mov word [esi + 0x685ebe9], ds
mov bl, byte [eax]
jg 0x5155d2
jmp 0x5155c8
xor eax, 0xdabf2fa4
sub dword [ebp - reloc.kernel32.dll_DeleteCriticalSection], eax
inc eax
rol byte [eax - 0x2a], cl
mov cl, 0x40
xchg byte [ebp + 0x4c], bh
lea esp, [esp + 0x28]
sub esp, 0x14
jmp 0x5156ef
lea esp, [esp + 0x10]
test edx, edx
pushal
call 0x515683
ror byte [ebp - 0x14dbdb9c], 1
dec ecx
inc eax
xlatb
inc edi
and dl, cl
imul ebx, esi, 0x48
fidivr word [ecx - 0x1a8f09b8]
jne 0x5156b5
out dx, eax
sub byte [edi + eax + 0x3424648d], dl
lea esp, [esp + 0x34]
push edi
sub esp, 0x10
pop word [esp + 5]
push word [esp + 7]
jmp 0x515676
xor al, 0xf6
scasb al, byte es:[edi]
cmp dword [ecx - reloc.kernel32.dll_DeleteCriticalSection], ebp
mov esi, dword [esp + 0x20]
sub esp, 0x1c
pop dword [esp + 6]
sub esp, 0x1e
lea esp, [esp + 2]
jmp 0x51569d
push ebp
push esi
lea esi, [eax + edx]
mov si, 0xf501
jmp 0x5156be
mov esi, dword [edi]
lea ecx, [eax*4]
mov ecx, dword [edi + 8]
pushal
jmp 0x515a36
mov bl, 0x14
bt esi, esp
mov ebx, dword [edi + 0xc]
bts esi, ebx
mov esi, dword [esp]
jmp 0x515969
xor edx, edx
btr eax, ebx
mov eax, esi
call fcn.005159ec
pop word [esp]
lea esp, [esp + 2]
test edx, edx
call 0x515a61
mov word [esp], sp
jmp 0x515a46
lea esp, [esp + 0x20]
test ebx, ebx
je 0x515641
xchg edx, eax
jmp 0x515a05
lea esp, [esp + 4]
jne 0x5155fa
je 0x515a79
rcl dword [edi - 0x39], cl
mov byte [0xc84bea51], al
pop esi
cmp eax, ecx
jg 0x515a44
adc al, 0x87
jmp 0x515a20
popal
jmp 0x5155fa
pushal
mov dword [esp + 0x1c], ebp
pushal
mov byte [esp + 0x1a], dh
lea esp, [esp + 0x20]
jmp 0x515a63
lea esp, [esp + 0x24]
mov ebp, dword [esp + 0x14]
bt edx, ebx
lea edx, [eax - 0x29]
jmp 0x515b37
rdtsc
btc ebp, edi
clc
lea edx, reloc.kernel32.dll_DeleteCriticalSection
jmp 0x515aa0
sub ebp, eax
bsf ax, si
setbe dh
add esi, ebp
jmp 0x515ab6
lea esp, [esp + 1]
div ebp
stc
call fcn.00515add
lea esp, [esp + 4]
mov dword [esp + 0x10], edx
jmp 0x515bc4
mov eax, ecx
sub esp, 6
push dword [esp + 2]
mov byte [esp + 6], ch
lea esp, [esp + 9]
jmp 0x515afa
bts edx, ebx
bswap edx
xor edx, edx
xchg al, ah
stc
jmp 0x515b1e
test edx, edx
jne 0x5155de
call 0x515b83
inc ecx
call fcn.00515db1
mov word [esp + 2], sp
lea esp, [esp + 2]
jmp 0x515e87
xor eax, eax
lea esp, [esp + 0x14]
jmp 0x515628
pop word [esp]
push word [esp + 1]
lea esp, [esp + 4]
jl 0x515610
jge 0x515578
sub al, 0xa1
xor dword [eax - 0x5d], edx
push ss
pushal
mov dword [reloc.kernel32.dll_DeleteCriticalSection], eax
push word [esp + 3]
lea esp, [esp + 2]
lea esp, [esp + 8]
mov dword [esp + 0x18], ecx
push edx
jmp 0x515e2a
lea esp, [esp + 4]
add edi, 0x28
push esp
cmp ecx, eax
push edx
jmp 0x515e4f
Function at 0x515f83
Capabilities:
Execute anti-debugging instructions

Disassembly:
push dword [esp]
call fcn.00515f6c
ficom dword [ebp - 0x3b]
lodsb al, byte [esi]
pop edi
out dx, eax
push esp
invalid

Function at 0x51601e
Capabilities:
Execute anti-debugging instructions

Disassembly:
sub esp, 0x10
jmp 0x51615a
mov ax, bp
sub esp, 0x1e
push edx
xchg byte [esp + 0x22], dh
pushal
lea esp, [esp + 0x52]
jmp 0x516105
bswap eax
rdtsc
add bl, cl
call fcn.005160b9
out 0x7a, eax
call 0xfc0cdb70
pop edi
iretd
rdtsc
stc
jmp 0x5160cf
bts eax, ebx
jge 0x5160ed
rdtsc
stc
bswap eax
rdtsc
jmp 0x5160d3
push edx
xchg byte [esp + 0x22], dh
pushal
jmp 0x51606b
je 0x51605f
mov ax, bp
sub esp, 0x1e
jmp 0x516134

Function at 0x608592
Capabilities:
Execute anti-debugging instructions

Disassembly:
pushal
rdtsc
pop cx
push dword [esp + 2]
btr edi, edx
push word [esp + 0x11]
jmp 0x608577
pushal
lea esp, [esp + 0x51]
mov cl, byte [esp]
lea ecx, [eax - 0x39]
mov cl, ch
mov ecx, eax
jmp 0x60852f
xchg byte [esp], dl
cld
mov bp, sp
xchg ah, bl
add esp, 0
mov edx, dword [esp]
jmp 0x6085bb
mov al, ah
lea ebp, [ecx*4]
sub esp, 4
xchg edx, edi
lea esp, [esp + 0x23]
pop eax
jmp 0x60855e
xchg esi, edi
add esp, 0x15
mov eax, dword [esp + 8]
pushal
sub esp, 4
jmp 0x60854d
mov edi, 0xd79355b2
xchg byte [esp], bl
mov al, ah
add esp, 0
lea esp, [esp]
add esp, 0
jmp 0x6085f6
mov di, 0xb949
xchg byte [esp], al
cpuid
lea edx, [eax + ebx]
jmp 0x6085a1
mov ax, 0xff53
add esp, 0
lea ecx, [edx + ebx]
rdtsc
neg ecx
rdtsc
jmp 0x6085db

Function at 0x608940
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0x42]
sub bl, ah
jmp 0x60894c
shr edi, 0x1f
mov eax, ebp
btc ebx, ebx
mov cx, sp
lea ecx, [esi + edi]
mov esi, 0x4e5d43a6
jmp 0x6089af
pushal
lea edi, [edx*4]
mov ebx, eax
mov ebp, 0x208ff57a
mov word [esp + 0xe], sp
push edx
jmp 0x608977
mov bl, byte [esp]
mov bl, bh
rdtsc
mov ebp, esi
lea ebp, [ecx - 0xcb]
lea ecx, [edx + ebx]
jmp 0x608992
Function at 0x608ac3
Capabilities:
Execute anti-debugging instructions

Disassembly:
cpuid
rcl di, cl
lea esi, [ebx + esi]
xchg word [esp + 9], di
xchg dword [esp + 0xa], ecx
jmp 0x608b3c
shr ecx, 0x1f
add bp, 0xe5ce
pop word [esp + 0xf]
push word [esp + 0x23]
add esp, 0x10
mov word [esp + 0x13], di
jmp 0x608bf7
stc
mov bl, bh
mov word [esp + 0x1f], bx
pop dword [esp + 0x1d]
btr ebx, esp
neg bh
jmp 0x608af6
xchg ebp, ebx
mov ebp, 0x76cfa40
sub esp, 0x1e
mov bl, 8
bsf bp, si
neg cx
jmp 0x608b19
lea esp, [esp + 3]
neg ah
mov esi, eax
xchg edi, ecx
mov word [esp], sp
xchg ah, bl
jmp 0x608bc0
xchg byte [esp], bl
mov eax, dword [esp]
lea esi, [ebx + ebp]
xchg ecx, edi
cmc
lea ebp, [edi + ebp]
jmp 0x608ba5
inc cx
push esp
mov byte [esp + 1], bh
neg ebp
lea ebx, [esi*4]
sete dh
jmp 0x608b51
xchg dword [esp + 0x25], ebx
btr ebp, edx
pop eax
lea esp, [esp + 0x1a]
xchg byte [esp + 0xa], dl
jmp 0x608bd8
rcl di, cl
ror bh, 3
sub esp, 0x12
sub esp, 0x1c
rdtsc
pop edi
jmp 0x608b8f
lea ebx, [esi*4]
lea esp, [esp + 2]
rdtsc
lea esp, [esp]
add esp, 0
add esp, 0
jmp 0x608b63
ror bh, 3
call 0x608c47
mov cl, 0xd2
xchg byte [esp + 0xa], bl
btc edi, edi
call fcn.00608c2e
push ebx
je 0x608c42
imul edi, dword [eax + 0x65], reloc.kernel32.dll_DeleteCriticalSection
invalid
setle dh
mov ch, byte [esp + 5]
rcr ch, 5
add esp, 0x16
lea esp, [esp + 1]
lea eax, [edi*4]
jmp 0x608b7a
dec ebx
jns 0x608c47
mov al, ah
mov cx, word [esp + 0xb]
mov bl, bh
xchg edi, ebp
mov edx, eax
jmp 0x608be0

Function at 0x608e32
Capabilities:
Execute anti-debugging instructions

Disassembly:
xchg dword [esp + 0xc], edi
pop word [esp + 5]
pop word [esp + 9]
lea edx, [ecx*4]
xchg esi, ebp
mov word [esp + 2], bx
jmp 0x608dbe
mov word [esp + 1], sp
lea esi, [edx + edi]
not ebx
rdtsc
lea eax, [edi*4]
mov bl, 0x80
jmp 0x608cf3
mov bp, 0xdfd1
pop dword [esp + 4]
mov edx, dword [esp + 3]
mov byte [esp + 5], dh
not bh
rdtsc
jmp 0x608d7e
neg ebp
shr ch, 5
xchg byte [esp + 8], dl
mov eax, 0xf185c788
cpuid
mov dx, word [esp + 1]
jmp 0x608d30
rdtsc
sub esp, 0xc
sub esp, 0x14
bsr bp, cx
pop ebx
bsf bp, ax
jmp 0x608d94
pop word [esp + 4]
lea edx, reloc.kernel32.dll_DeleteCriticalSection
mov al, 0x4e
and cl, bh
xchg dh, al
xchg dword [esp], edi
jmp 0x608d66
mov cl, ch
inc dx
cpuid
mov al, 0x8e
lea edx, [ecx*4]
setp ch
jmp 0x608e06
cld
rdtsc
mov bp, word [esp + 8]
xchg dword [esp + 7], ebp
xchg dh, al
mov bl, bh
jmp 0x608dec
mov bx, di
cpuid
lea eax, [eax + ebx]
mov dword [esp + 6], ecx
not dx
btr ebx, edx
jmp 0x608d4f
pop dword [esp + 6]
xchg word [esp + 0xc], bp
lea eax, [ebp*4]
jmp 0x608e1b
mov si, sp
mov dword [esp + 1], esi
bsf di, si
mov esi, eax
xchg bh, cl
xchg si, cx
jmp 0x608dd5
lea esp, [esp + 0xc]
setnp dh
xchg edi, esi
not esi
pop dword [esp + 1]
mov dword [esp + 0xd], eax
jmp 0x608da8
mov bl, 0xa0
mov esi, dword [esp + 8]
sub ebp, eax
rdtsc
mov dl, dh
xchg ah, bl
jmp 0x609065
xchg word [esp + 3], bp
add al, dh
xchg bh, cl
jmp 0x608d19
add esp, 2
pop word [esp + 1]

Function at 0x60bf12
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea esp, [esp + 0xd]
lea esp, [esp + 3]
lea esp, [esp + 4]
pushal
rdtsc
jmp 0x60be8f
Function at 0x60c08f
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg si
btc ebx, edi
bswap edi
rdtsc
pop ebp
bsr dx, cx
jmp 0x60c0e8
xchg dword [esp], esi
rdtsc
mov ebp, esi
mov dword [esp], ebp
xchg edx, esi
jmp 0x60c077
inc bx
mov eax, 0x9ebf985e
mov dl, 0xc
bswap ebx
rdtsc
ror ebp, 0x19
jmp 0x60c15a
add esp, 0
xchg esi, ebp
not cx
cld
btc edx, ebx
cpuid
jmp 0x60c0d2
bswap eax
bswap edx
mov cl, ch
mov word [esp + 9], dx
rdtsc
xchg byte [esp + 6], dl
jmp 0x60c1c9
cmc
bsr bx, bp
xchg bx, bp
xchg ecx, esi
lea ebx, [edi*4]
shl di, cl
jmp 0x60c117
xchg di, si
stc
sub esi, eax
sub esp, 0x14
lea eax, [eax - 0x19]
xchg bx, si
jmp 0x60c13a
lea edi, reloc.kernel32.dll_DeleteCriticalSection
xchg byte [esp + 2], bl
xchg bh, cl
neg bx
cmc
shr ebx, 0x15
jmp 0x60c1a2
push dword [esp + 0xb]
xchg byte [esp], al
mov edi, 0xd080e676
push word [esp + 8]
pop word [esp + 8]
mov dh, byte [esp + 4]
jmp 0x60c16b
lea ecx, [ebp*4]
btc ebp, ebx
not ebp
xchg ch, dl
mov cl, 0x5a
pop word [esp + 0xc]
jmp 0x60c216
xchg word [esp + 6], dx
mov ecx, ebp
xchg ch, dl
xchg byte [esp + 4], al
ror ch, 5
cpuid
jmp 0x60c186
bsr bx, cx
mov word [esp + 7], di
sete ah
call fcn.0060c1dd
pop ds
xchg edi, eax
pop es
bound edx, qword [ecx + 0x54258a71]
invalid
mov word [esp + 0xf], bx
lea ecx, [ebp*4]
mov byte [esp + 0x13], dh
jmp 0x60c1fa
Function at 0x60c271
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg edi
jmp 0x60c279
pop dword [esp + 8]
ror bh, 3
push word [esp + 2]
cpuid
jmp 0x60c2d3
sub esp, 4
mov bx, word [esp + 0xc]
inc si
bswap esi
mov al, 0x2e
jmp 0x60c307
mov eax, 0xf0e005ac
lea ebp, [esp + ebx]
mov dx, 0x792d
xchg dh, al
push word [esp + 3]
jmp 0x60c2bd
lea edi, [edx*4]
pop eax
shr bh, 3
xchg bp, ax
mov bl, 0x70
mov word [esp + 0xc], di
jmp 0x60c3dd
neg cx
lea esp, [esp + 5]
mov ebp, dword [esp + 3]
setne ah
mov ax, 0x838f
bswap edi
jmp 0x60c3c2
xchg dword [esp], ecx
cld
mov ax, sp
neg bp
push dword [esp + 2]
mov dl, 0xe4
jmp 0x60c33c
bsf cx, ax
inc esi
bsf ax, si
mov esi, dword [esp]
jmp 0x60c52a
lea ecx, [eax*4]
mov bp, di
inc edx
bswap ecx
bswap edi
mov dl, 0x1c
jmp 0x60c368
pop bx
xchg esi, ebx
rdtsc
mov ebp, esi
lea esi, [eax + 0x59]
mov ch, byte [esp]
jmp 0x60c380
mov bp, di
xchg ebp, ecx
add esp, 2
xchg dx, ax
lea ecx, [edx + edi]
mov edi, 0x15b82dc
jmp 0x60c3a1
mov dword [esp + 6], ebp
mov ecx, esi
xchg edx, ecx
neg ax
mov dword [esp], ecx
add esp, 0xb
jmp 0x60c356
lea ecx, [ebx*4]
mov bl, 0xc0
xchg byte [esp], bl
rdtsc
call fcn.0060c44d
mov ch, byte [esp + 0x21]
mov ebp, dword [esp + 0xd]
cld
popal
push dword [esp]
shl dx, cl
jmp 0x60c5ae
lea ecx, [edi + ebp]
rol ax, cl
mov cl, ch
mov ebx, 0x42b4d426
mov word [esp + 4], dx
lea ebx, [esp + ebx]
jmp 0x60cc3b
xchg bh, cl
xchg dx, bp
mov dword [esp + 1], eax
call fcn.0060c5e0
pop dword [esp + 0x1c]
shr esi, 0x15
call fcn.0060c667
xor bh, byte [edi + 0x60b94a2f]
adc cl, byte [ebp + 0x61766f1c]
pop word [esp + 1]
xchg word [esp + 1], di
mov word [esp + 0xa], dx
xchg ch, dl
xchg byte [esp + 1], al
pushal
jmp 0x60c608
mov edx, dword [esp + 7]
inc bp
cpuid
rcr bh, 3
push word [esp + 0xb]
neg esi
jmp 0x60c5fa
xchg esi, ebp
mov dx, word [esp + 6]
push dword [esp + 6]
pop dword [esp]
push dword [esp + 2]
btr ebp, esp
jmp 0x60c6a6

Function at 0x60ca5a
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 6], ah
pop dword [esp]
neg cx
xchg edi, esi
mov esi, ecx
jmp 0x60c826

Function at 0x60cb25
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x60cb6c
setae dh
add esp, 0
lea ecx, [ebx + edi]
xchg bh, cl
xchg bp, ax
mov di, word [esp + 1]
jmp 0x60cb56
Function at 0x401098
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
mov dword [ebp - 4], 0
push 0xa
push dword [ebp + 8]
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
jne 0x4010b8
jmp 0x4010d8
push eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
mov dword [0x4055b0], eax
pop eax
push eax
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
jne 0x4010d5
jmp 0x4010d8
mov dword [ebp - 4], eax
popal
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x4010e0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
pushal
mov esi, dword [ebp + 0xc]
lea ebx, [ebp - 0x400]
push esi
push ebx
call sub.kernel32.dll_lstrcpyA
xor ecx, ecx
jmp 0x4010ff
inc ecx
cmp byte [ecx + ebx], 0x5c
jne 0x4010fe
mov byte [ecx + ebx], 0
lea esi, [ecx + esi + 1]
mov edi, 0x403388
push str.HKEY_CLASSES_ROOT
push ebx
call edi
or eax, eax
jne 0x401125
mov eax, 0x80000000
jmp 0x401186
push str.HKEY_CURRENT_CONFIG
push ebx
call edi
or eax, eax
jne 0x401138
mov eax, 0x80000005
jmp 0x401186
push str.HKEY_CURRENT_USER
push ebx
call edi
or eax, eax
jne 0x40114b
mov eax, 0x80000001
jmp 0x401186
push str.HKEY_LOCAL_MACHINE
push ebx
call edi
or eax, eax
jne 0x40115e
mov eax, 0x80000002
jmp 0x401186
push str.HKEY_USERS
push ebx
call edi
or eax, eax
jne 0x401171
mov eax, 0x80000003
jmp 0x401186
push str.HKEY_DYN_DATA
push ebx
call edi
or eax, eax
jne 0x401184
mov eax, 0x80000006
jmp 0x401186
jmp 0x4011a2
mov byte [ebx], 0
push dword [ebp + 0x10]
push esi
push eax
push ebx
call fcn.00403500
cmp byte [ebx], 0
je 0x4011a2
push ebx
push dword [ebp + 8]
call sub.kernel32.dll_SetEnvironmentVariableA
popal
leave
ret 0xc
Function at 0x401220
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [ebp - 8], eax
mov ebx, eax
push dword [ebp + 0xc]
push ebx
call sub.user32.dll_LoadBitmapA
test eax, eax
je 0x4013ea
mov dword [ebp - 0xc], eax
push dword [ebp + 0x10]
push ebx
call sub.user32.dll_LoadBitmapA
test eax, eax
je 0x4013ea
mov dword [ebp - 0x10], eax
push dword [ebp + 0x14]
push ebx
call sub.user32.dll_LoadBitmapA
test eax, eax
je 0x4013ea
mov dword [ebp - 0x14], eax
push dword [ebp + 0x18]
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
test eax, eax
je 0x4013ea
mov esi, eax
push ebx
lea ebx, [ebp - 0x3c]
push ebx
push esi
call sub.user32.dll_GetWindowRect
lea edi, [ebp - 0x2c]
push edi
push dword [ebp + 8]
call sub.user32.dll_GetWindowRect
mov eax, dword [ebx]
sub eax, dword [edi]
mov dword [ebp - 0x18], eax
mov eax, dword [ebx + 4]
sub eax, dword [edi + 4]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 8]
call fcn.00401400
pop ebx
push 0
push esi
call sub.user32.dll_ShowWindow
jmp 0x4012d9
lea esi, [ebp - 0x6c]
mov dword [esi], 0x30
mov dword [esi + 4], 0x2000
mov dword [esi + 8], 0x4014d0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0x14
mov dword [esi + 0x14], ebx
mov dword [esi + 0x20], 0x10
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0x4012c8
mov dword [esi + 0x18], 0
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [esi + 0x1c], eax
mov dword [esi + 0x2c], 0
push esi
call sub.user32.dll_RegisterClassExA
push 0
push ebx
push dword [ebp + 0x18]
push dword [ebp + 8]
push 0
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
push 0x50000000
push 0
push 0x4012c8
push 0x20
call sub.user32.dll_CreateWindowExA
mov ebx, eax
push dword [ebp - 0xc]
push 0
push ebx
call sub.user32.dll_SetWindowLongA
push dword [ebp - 0x10]
push 4
push ebx
call sub.user32.dll_SetWindowLongA
push dword [ebp - 0x14]
push 8
push ebx
call sub.user32.dll_SetWindowLongA
push 0
push dword [ebp - 8]
push dword [ebp + 0x18]
push ebx
push 0
push 0
push 0
push 0
push 0x5000000e
push 0
push str.STATIC
push 0
call sub.user32.dll_CreateWindowExA
mov dword [ebp - 4], eax
push dword [ebp - 0xc]
push 0
push 0x172
push eax
call sub.user32.dll_SendMessageA
push edi
push dword [ebp - 4]
call sub.user32.dll_GetWindowRect
push dword [ebp - 4]
push 0xc
push ebx
call sub.user32.dll_SetWindowLongA
mov ecx, dword [edi + 0xc]
sub ecx, dword [edi + 4]
mov eax, dword [edi + 8]
sub eax, dword [edi]
push 2
push ecx
push eax
push 0
push 0
push 0
push ebx
call sub.user32.dll_SetWindowPos
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40180c
Capabilities:
Check if file exists
Copy file
Get file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x405a3a
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcpyA
push str..BAK
push esi
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x401843
push 0
push esi
push dword [ebp + 8]
call sub.kernel32.dll_CopyFileA
mov al, 0
jmp 0x401845
mov al, 1
mov byte [0x405e52], al
popal
leave
ret 4

Function at 0x40184f
Capabilities:
Copy file
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, 0x405a3a
cmp dword [ebp + 8], 0
jne 0x401885
cmp byte [0x405e52], 0
jne 0x401874
push 0
push 0x40563a
push esi
call sub.kernel32.dll_CopyFileA
cmp byte [0x405e52], 0
jne 0x4018d5
push esi
call sub.kernel32.dll_DeleteFileA
jmp 0x4018d5
push 0x6b
push dword [0x4055d5]
call sub.user32.dll_IsDlgButtonChecked
cmp byte [0x405ef9], 1
jne 0x4018b0
cmp byte [0x405efa], 1
jne 0x4018ab
mov eax, 1
jmp 0x4018b0
mov eax, 0
cmp eax, 1
jne 0x4018d3
push str.Backup_file:
call fcn.004017cb
push esi
call fcn.004017cb
push dword [0x405e3a]
push esi
call sub.kernel32.dll_SetFileAttributesA
jmp 0x4018d5
jmp 0x401874
popal
leave
ret 4

Function at 0x4018da
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push esi
lea esi, [ebp - 0x400]
push dword [ebp + 8]
push esi
call sub.kernel32.dll_lstrcpyA
push str..tmp
push esi
call sub.kernel32.dll_lstrcatA
push esi
call sub.kernel32.dll_DeleteFileA
push esi
push dword [ebp + 8]
call sub.kernel32.dll_MoveFileA
cmp eax, 1
jne 0x401927
push 1
push dword [ebp + 8]
push esi
call sub.kernel32.dll_CopyFileA
cmp eax, 1
jne 0x401927
mov eax, 1
pop esi
leave
ret 4
Function at 0x40192c
Capabilities:
Check if file exists
Get file attributes
Get file size
Query environment variable
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7fc
pushal
mov dword [ebp - 0x804], 0
mov byte [0x405e53], 0
push 0x400
push 0x40563a
push dword [ebp + 8]
call sub.kernel32.dll_ExpandEnvironmentStringsA
push 0x40563a
call sub.kernel32.dll_GetFileAttributesA
mov dword [0x405e3a], eax
test eax, 1
je 0x40197d
xor eax, 1
push eax
push 0x40563a
call sub.kernel32.dll_SetFileAttributesA
push 0x40563a
call fcn.0040180c
push 0
push 0x82
push 3
push 0
push 2
push 0xc0000000
push 0x40563a
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x401adf
cmp byte [0x405ef9], 0
jne 0x401ada
push 0x40563a
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x401a80
push 0x40563a
call fcn.004034a0
cmp word [eax], 0x2e2a
je 0x401a03
cmp word [eax], 0
je 0x401a03
push 0x34
push 0x40563a
push str.Can_not_find_the_file._Search_the_file_
push dword [0x4055d5]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x401ada
lea esi, [ebp - 0x400]
mov edi, 0x40563a
cmp byte [edi + 1], 0x3a
jne 0x401a1c
push edi
call fcn.004034a0
mov edi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
push esi
call sub.kernel32.dll_lstrlenA
cmp eax, 0
jbe 0x401a2f
inc eax
push esi
push eax
add esi, eax
push edi
push esi
call sub.kernel32.dll_lstrcpyA
pop eax
add esi, eax
push 0x2e
push str.Exe_Files__.exe_
push esi
call sub.kernel32.dll_RtlMoveMemory
pop esi
lea ebx, [ebp - 0x800]
push 0x40563a
push ebx
call sub.kernel32.dll_lstrcpyA
push ebx
call fcn.0040177a
push dword [0x4055d5]
push ebx
push esi
push 0x40563a
call fcn.00403440
cmp eax, 1
jne 0x401a7e
jmp 0x401959
jmp 0x401ada
test dword [ebp + 0x10], 2
je 0x401ab9
cmp byte [0x405e53], 0
jne 0x401ada
push 0x40563a
call fcn.004018da
cmp eax, 1
jne 0x401ab7
mov byte [0x405e53], 1
push str.File_is_in_use____using_rename_method
call fcn.004017cb
jmp 0x401959
jmp 0x401ada
push 0x34
push 0x40563a
push str.Can_not_access_the_file._Maybe_its_in_use..._r_nPlease_close_the_file_before_patching__r_n_r_nTry_to_access_the_file_again_now_
push dword [0x4055d5]
call sub.user32.dll_MessageBoxA
cmp eax, 6
jne 0x401ada
jmp 0x401959
jmp 0x401b86
push str.loading_file:
call fcn.004017cb
push 0x40563a
call fcn.004017cb
mov dword [0x405e3e], eax
push 0
push eax
call sub.kernel32.dll_GetFileSize
mov dword [0x405e42], eax
cmp dword [ebp + 0xc], 0
jne 0x401b0e
mov dword [ebp + 0xc], eax
test dword [ebp + 0x10], 4
je 0x401b30
add eax, 0x238
add eax, dword [0x4055b0]
push 0x100
push eax
call fcn.004034e0
mov dword [ebp + 0xc], eax
push dword [ebp + 0xc]
pop dword [0x405e4e]
push 0
push dword [0x405e4e]
push 0
push 4
push 0
push dword [0x405e3e]
call sub.kernel32.dll_CreateFileMappingA
or eax, eax
jne 0x401b62
push str.Can_not_open_file_
call fcn.004017cb
jmp 0x401b86
mov dword [0x405e4a], eax
push 0
push 0
push 0
push 2
push eax
call sub.kernel32.dll_MapViewOfFile
or eax, eax
jne 0x401b7b
jmp 0x401b56
mov dword [0x405e46], eax
mov dword [ebp - 0x804], eax
popal
mov eax, dword [ebp - 0x804]
leave
ret 0xc
Function at 0x401b91
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
pushal
mov esi, dword [0x405e3e]
or esi, esi
je 0x401be9
push dword [0x405e46]
call sub.kernel32.dll_UnmapViewOfFile
push dword [0x405e4a]
call sub.kernel32.dll_CloseHandle
push 0
push 0
push dword [0x405e4e]
push esi
call sub.kernel32.dll_SetFilePointer
push esi
call sub.kernel32.dll_SetEndOfFile
push esi
call sub.kernel32.dll_CloseHandle
push dword [ebp + 8]
call fcn.0040184f
push dword [0x405e3a]
push 0x40563a
call sub.kernel32.dll_SetFileAttributesA
popal
leave
ret 4

Function at 0x401c18
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbfc
pushal
mov byte [ebp - 0x401], 0
push 1
push 8
call fcn.00401057
or eax, eax
je 0x401c75
mov esi, eax
push 0x400
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
push str.BASSMOD.dll
lea eax, [ebp - 0x400]
push eax
call sub.kernel32.dll_lstrcatA
mov ecx, dword [esi + 1]
lea eax, [esi + 5]
push ecx
push eax
lea eax, [ebp - 0x400]
push eax
call fcn.004033e4
mov byte [ebp - 0x401], 1
popal
movzx eax, byte [ebp - 0x401]
leave
ret

Function at 0x402b84
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
push str._REGISTRY_PATCH_
call fcn.004017cb
mov esi, dword [ebp + 8]
lea eax, [esi + 9]
push dword [esi + 1]
push eax
push str.c:_regpatch.reg
call fcn.004033e4
test eax, eax
je 0x402bd7
mov edi, 0x40563a
mov byte [edi], 0
push str.regedit.exe__s
push edi
call sub.kernel32.dll_lstrcatA
push str.c:_regpatch.reg
push edi
call sub.kernel32.dll_lstrcatA
push 0
push edi
call sub.kernel32.dll_WinExec
cmp eax, 0x1f
ja 0x402be3
push str.Registry_patch_failed_
call fcn.004017cb
jmp 0x402bed
push str.Registry_patch_OK_
call fcn.004017cb
push str.c:_regpatch.reg
call sub.kernel32.dll_DeleteFileA
push str....done_
call fcn.004017cb
push 0x4052a0
call fcn.004017cb
pop ebx
pop edi
pop esi
leave
ret 4