joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4020c0
Capabilities:
Get disk information

Disassembly:
push ebp
xor ecx, ecx
mov ebp, esp
push edi
push esi
lea esi, [ebp - 0x830]
push ebx
lea ebx, [ebp - 0x818]
sub esp, 0x86c
movzx eax, word [0x40d594]
mov word [ebp - 0x826], cx
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x82c], 0
mov dword [ebp - 0x824], 0
mov word [ebp - 0x828], ax
mov dword [ebp - 0x820], 0
mov dword [esp + 4], 0x414068
mov dword [esp], 0x400
call dword [sym.imp.kernel32.dll_GetLogicalDriveStringsW]
sub esp, 8
mov dword [esp + 0x30], 0x14
mov dword [esp + 0x2c], 0xd
mov dword [esp + 0x28], 0x10
mov dword [esp + 0x24], 0xd
mov dword [esp + 0x20], 0x10
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], 0x65
mov eax, dword [0x414020]
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0x102
mov dword [esp + 4], 0x50001002
mov dword [esp + 0x10], eax
mov eax, dword [0x41402c]
mov dword [esp], eax
call sub.comctl32.dll_CreateToolbarEx
sub esp, 0x34
mov dword [0x414050], eax
mov dword [esp + 0xc], 0x400
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4b5
mov eax, dword [0x414020]
mov dword [esp], eax
call sub.user32.dll_LoadStringW
sub esp, 0x10
cmp word [ebp - 0x818], 0
je 0x402337
mov eax, ebx
lea esi, [esi]
add eax, 2
cmp word [eax], 0
jne 0x4021d8
sub eax, ebx
sar eax, 1
add eax, 1
xor edx, edx
mov word [ebp + eax*2 - 0x818], dx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov eax, dword [0x414050]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
mov dword [ebp - 0x82c], 0x9001
sub esp, 0x10
mov dword [esp + 0xc], esi
mov dword [esp + 8], 1
mov dword [esp + 4], 0x443
mov eax, dword [0x414050]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
add dword [ebp - 0x820], 1
sub esp, 0x10
mov dword [esp + 0xc], 0x414068
mov dword [esp + 8], 0
mov dword [esp + 4], 0x44d
mov eax, dword [0x414050]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
mov dword [ebp - 0x82c], 0x9002
sub esp, 0x10
cmp word [0x414068], 0
je 0x402313
mov ebx, 2
mov edi, 0x414068
lea esi, [esi]
mov dword [esp], edi
call dword [sym.imp.kernel32.dll_GetDriveTypeW]
sub esp, 4
cmp eax, 5
je 0x402330
ja 0x402320
mov ecx, 1
cmp eax, 2
je 0x4022c5
xor ecx, ecx
cmp eax, 4
sete cl
lea ecx, [ecx + ecx + 2]
mov dword [ebp - 0x830], ecx
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x443
mov eax, dword [0x414050]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
add dword [ebp - 0x82c], 1
sub esp, 0x10
add dword [ebp - 0x820], 1
lea esi, [esi]
add edi, 2
cmp word [edi - 2], 0
jne 0x402300
add ebx, 1
cmp word [edi], 0
jne 0x402298
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
xor ecx, ecx
cmp eax, 6
sete cl
lea ecx, [ecx + ecx*2 + 2]
jmp 0x4022c5
mov ecx, 3
jmp 0x4022c5
mov eax, 1
jmp 0x4021e8
Function at 0x402790
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
push ebx
mov ebx, eax
sub esp, 0x1c
mov dword [esp + 0xc], edx
mov dword [esp + 8], 0
mov dword [esp + 4], 0x18f
mov eax, dword [eax]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
sub esp, 0x10
mov esi, eax
mov dword [esp + 4], 0
mov eax, dword [ebx]
add esi, 1
mov dword [esp], eax
call sub.user32.dll_ShowWindow
sub esp, 8
jmp 0x402809
mov ecx, dword [edi + 0x14]
cmp dword [eax + 0x14], ecx
jle 0x402832
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x182
mov eax, dword [ebx]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
sub esp, 0x10
mov dword [esp + 0xc], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0x199
mov eax, dword [ebx]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
lea edx, [eax + 1]
sub esp, 0x10
cmp edx, 1
ja 0x4027e0
mov dword [edi + 0xc], 0
mov dword [esp + 4], 5
mov eax, dword [ebx]
mov dword [esp], eax
call sub.user32.dll_ShowWindow
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x402860
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, ecx
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x2c
mov dword [esp + 4], 0
mov eax, dword [eax]
mov dword [esp], eax
call sub.user32.dll_ShowWindow
sub esp, 8
test ebx, ebx
je 0x40295a
mov eax, dword [ebp + 8]
and eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
and eax, 0xe
mov dword [ebp - 0x20], eax
mov eax, dword [ebx + 0x18]
mov edx, dword [esi + 0x84]
and eax, 0x10
test edx, edx
jne 0x402980
test eax, eax
je 0x4028c0
test byte [ebp + 8], 1
je 0x402950
test edi, edi
je 0x4028d2
lea eax, [ebx + 0x44]
mov edx, edi
call fcn.004016b0
test eax, eax
je 0x402950
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x4028df
test byte [ebx + 0x18], 6
jne 0x402950
cmp dword [ebp - 0x20], 0xe
je 0x402908
lea eax, [ebx + 0x44]
call fcn.00401250
cmp eax, 1
je 0x4029f0
cmp eax, 2
je 0x4029b0
test byte [ebp + 8], 8
je 0x402950
lea esi, [esi]
cmp dword [ebp + 0xc], 0xffffffff
mov eax, 0xffffffff
je 0x40291a
add dword [ebp + 0xc], 1
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], 0x181
mov eax, dword [esi]
mov dword [esp], eax
call sub.user32.dll_SendMessageW
mov edx, dword [esi + 0x84]
sub esp, 0x10
test edx, edx
je 0x402950
mov eax, dword [ebx + 0xc]
test eax, eax
jne 0x4029c0
lea esi, [esi]
nop
mov ebx, dword [ebx]
test ebx, ebx
jne 0x40289e
mov dword [esp + 4], 5
mov eax, dword [esi]
mov dword [esp], eax
call sub.user32.dll_ShowWindow
mov eax, dword [ebp + 0xc]
sub esp, 8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
test eax, eax
je 0x402950
cmp word [ebx + 0x44], 0x2e
jne 0x4028c0
movzx eax, word [ebx + 0x46]
test ax, ax
je 0x402950
cmp ax, 0x2e
jne 0x4028c0
cmp word [ebx + 0x48], 0
jne 0x4028c0
jmp 0x402950
test byte [ebp + 8], 4
jne 0x402908
jmp 0x402950
mov edx, dword [ebx + 4]
test edx, edx
je 0x402950
mov eax, dword [ebp + 0xc]
mov ecx, edi
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, esi
call fcn.00402860
mov ebx, dword [ebx]
mov dword [ebp + 0xc], eax
test ebx, ebx
jne 0x40289e
jmp 0x40295a
test byte [ebp + 8], 2
jne 0x402908
jmp 0x402950
Function at 0x403120
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
push esi
mov esi, eax
push ebx
mov ebx, ecx
sub esp, 0x64c
mov eax, dword [eax + 0x90]
mov dword [ebp - 0x62c], edx
lea edx, [ebp - 0x220]
call fcn.00402f20
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], 0x4023c0
mov dword [esp + 0x10], eax
mov eax, dword [esi]
mov dword [esp + 4], 0x68
mov dword [esp + 8], eax
mov eax, dword [0x414020]
mov dword [esp], eax
call sub.user32.dll_DialogBoxParamW
sub esp, 0x14
cmp eax, 1
je 0x403190
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [ebp - 0x62c]
mov edi, eax
mov eax, dword [esi + 0x90]
call fcn.00402f20
xor eax, eax
cmp word [ebp - 0x220], 0x2f
je 0x4031c0
cmp word [ebp - 0x21e], 0x3a
jne 0x403258
lea esi, [esi]
movzx edx, word [ebp + eax - 0x220]
mov word [ebx + eax], dx
add eax, 2
test dx, dx
jne 0x4031c0
lea eax, [ebp - 0x220]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
sub esp, 4
cmp eax, 0xffffffff
je 0x40317e
test al, 0x10
je 0x40317e
lea esi, [ebp - 0x620]
mov dword [esp + 8], 0
lea eax, [ebp - 0x420]
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], eax
mov dword [esp + 4], 0
mov eax, dword [ebp - 0x62c]
mov dword [esp], eax
call dword [sym.imp.ucrtbase.dll__wsplitpath]
lea eax, [ebp - 0x420]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x220]
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str._s__s_s
call sub.user32.dll_wsprintfW
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esi + 0x90]
mov edx, ebx
mov eax, dword [eax + 8]
call fcn.00402f20
cmp word [ebx], 0
mov eax, ebx
je 0x4032c1
add eax, 2
cmp word [eax], 0
jne 0x403270
mov edx, eax
sub edx, ebx
lea esi, [edx - 2]
sar edx, 1
movzx esi, word [ebx + esi]
cmp si, 0x5c
je 0x40329d
cmp si, 0x2f
je 0x40329d
mov ecx, 0x2f
add edx, 1
mov word [eax], cx
lea esi, [ebx + edx*2]
xor eax, eax
lea esi, [esi]
movzx edx, word [ebp + eax - 0x220]
mov word [esi + eax], dx
add eax, 2
test dx, dx
jne 0x4032a8
jmp 0x4031d4
xor edx, edx
mov esi, 0xfffffffe
jmp 0x403282
Function at 0x403c60
Capabilities:
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, eax
push esi
mov esi, ecx
push ebx
mov ebx, edx
sub esp, 0x22c
cmp dword [eax + 0x2a0], 1
mov edx, dword [ebp + 8]
je 0x403d40
mov edx, ebx
call fcn.004017e0
mov edx, dword [0x414868]
test edx, edx
je 0x403d24
movzx eax, word [ebx]
test ax, ax
je 0x403dcf
lea ecx, [ebp - 0x220]
mov dword [ebp - 0x22c], ecx
nop
add ebx, 2
mov word [ecx], ax
add ecx, 2
movzx eax, word [ebx]
test ax, ax
jne 0x403cb0
mov ebx, dword [edi + 4]
mov eax, 0x5c
mov word [ecx], ax
test ebx, ebx
je 0x403d24
mov dword [ebp - 0x230], edi
mov edi, ebx
mov ebx, ecx
jmp 0x403ce6
mov edi, dword [edi]
test edi, edi
je 0x403d1e
test byte [edi + 0x18], 0x10
je 0x403ce0
xor eax, eax
nop
movzx edx, word [edi + eax + 0x44]
mov word [ebx + eax + 2], dx
add eax, 2
test dx, dx
jne 0x403cf0
mov edx, dword [ebp - 0x22c]
mov eax, edi
call fcn.004017e0
mov eax, edi
mov edx, esi
call fcn.00401a40
mov edi, dword [edi]
test edi, edi
jne 0x403ce6
mov edi, dword [ebp - 0x230]
add esp, 0x22c
mov edx, esi
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
jmp fcn.00401a40
mov dword [ebp - 0x22c], edx
call fcn.004034e0
mov eax, dword [0x414868]
test eax, eax
je 0x403d24
movzx ecx, word [ebx]
lea eax, [ebp - 0x220]
mov edx, dword [ebp - 0x22c]
test cx, cx
je 0x403d81
lea esi, [esi]
nop
add ebx, 2
mov word [eax], cx
add eax, 2
movzx ecx, word [ebx]
test cx, cx
jne 0x403d70
mov ebx, dword [edi + 4]
mov ecx, 0x5c
mov word [eax], cx
test ebx, ebx
je 0x403d24
mov dword [ebp - 0x22c], edi
mov edi, ebx
mov ebx, edx
jmp 0x403da6
mov edi, dword [edi]
test edi, edi
je 0x403dc4
test byte [edi + 0x18], 0x10
je 0x403da0
mov eax, edi
mov edx, ebx
call fcn.004034e0
mov eax, edi
mov edx, esi
call fcn.00401a40
mov edi, dword [edi]
test edi, edi
jne 0x403da6
mov edi, dword [ebp - 0x22c]
jmp 0x403d24
lea eax, [ebp - 0x220]
mov dword [ebp - 0x22c], eax
mov ecx, eax
jmp 0x403cc1
Function at 0x406ee0
Capabilities:
Set current directory

Disassembly:
test edx, edx
je 0x406fc0
push ebp
movd xmm1, edx
mov ebp, esp
push esi
mov esi, edx
push ebx
mov ebx, eax
xor eax, eax
sub esp, 0x220
mov dword [ebx + 0x94], edx
mov word [ebp - 0x210], ax
mov eax, dword [edx + 4]
test eax, eax
cmove eax, edx
movd xmm0, eax
punpckldq xmm0, xmm1
movq qword [ebx + 0x124], xmm0
mov edx, dword [edx + 0x10]
test edx, edx
je 0x406f88
mov eax, ebx
call fcn.00406cf0
lea edx, [ebp - 0x210]
mov eax, esi
call fcn.00402f20
xor eax, eax
nop
movzx edx, word [ebp + eax - 0x210]
mov word [ebx + eax + 0x164], dx
add eax, 2
test dx, dx
jne 0x406f40
mov eax, dword [ebx]
test eax, eax
je 0x406f73
lea ecx, [ebp - 0x210]
mov dword [esp], eax
mov dword [esp + 4], ecx
call sub.user32.dll_SetWindowTextW
sub esp, 8
cmp word [ebp - 0x210], 0
jne 0x406fa0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov eax, dword [ebp + 8]
mov edx, esi
mov dword [esp], eax
mov eax, ebx
call fcn.00406d70
jmp 0x406f30
lea eax, [ebp - 0x210]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryW]
sub esp, 4
test eax, eax
je 0x406f7d
call fcn.00401f60
jmp 0x406f7d
ret
Function at 0x406fd0
Capabilities:
Get process heap flags

Disassembly:
push edi
lea edi, [esp + 8]
and esp, 0xfffffff0
push dword [edi - 4]
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x84c
mov dword [ebp - 0x834], edx
mov dword [ebp - 0x830], ecx
mov eax, dword fs:[0x18]
mov dword [esp + 8], 0xe3c
mov dword [esp + 4], 0
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov ecx, 0x38f
mov edx, esi
movdqa xmm0, xmmword [0x40d5a0]
mov ebx, eax
add eax, 0x578
sub esp, 0xc
mov dword [ebp - 0x82c], eax
mov edi, ebx
xor eax, eax
rep stosd dword es:[edi], eax
movups xmmword [ebx + 0x14c], xmm0
mov dword [ebx + 0x88], 1
mov dword [ebx + 0x120], 0x6f
mov dword [ebx + 0x130], 0x2c
mov dword [ebx + 0x138], 1
mov dword [ebx + 0x15c], 0x12c
movzx ecx, word [esi]
test cx, cx
je 0x407250
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x407088
mov eax, edx
sub eax, esi
sar eax, 1
cmp cx, 0x22
je 0x407238
add eax, 1
lea edx, [ebx + 0x164]
mov ecx, edx
cmp eax, 1
ja 0x4070ce
jmp 0x4070d6
sub eax, 1
add ecx, 2
add esi, 2
mov word [ecx - 2], di
cmp eax, 1
je 0x407258
movzx edi, word [esi]
test di, di
jne 0x4070b8
test eax, eax
jne 0x407258
lea eax, [ebp - 0x420]
mov dword [esp], edx
mov dword [esp + 0x10], eax
lea edi, [ebp - 0x820]
lea eax, [ebp - 0x620]
mov dword [esp + 8], edi
lea esi, [ebp - 0x828]
mov dword [esp + 0xc], eax
mov dword [esp + 4], esi
call dword [sym.imp.ucrtbase.dll__wsplitpath]
xor eax, eax
lea esi, [esi]
movzx edx, word [eax + 0x40d2c8]
mov word [ebx + eax + 0x36c], dx
add eax, 2
test dx, dx
jne 0x407118
mov dword [ebx + 0x574], 0x1f
xor eax, eax
mov dword [ebx + 0x58c], 0
lea esi, [esi]
movzx edx, word [esi + eax]
mov word [ebp + eax - 0x220], dx
add eax, 2
test dx, dx
jne 0x407148
cmp word [ebp - 0x220], 0
lea edx, [ebp - 0x220]
je 0x407179
lea esi, [esi]
add edx, 2
cmp word [edx], 0
jne 0x407170
xor eax, eax
lea esi, [esi]
nop
movzx ecx, word [edi + eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x407180
mov eax, dword [ebp - 0x830]
lea edx, [ebp - 0x220]
mov dword [esp + 8], eax
mov eax, dword [ebx + 0xe38]
mov dword [esp], esi
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x834]
mov eax, dword [ebp - 0x82c]
call fcn.00404010
cmp dword [ebx + 0x818], 1
mov edi, eax
lea eax, [ebx + 0x5bc]
je 0x407268
lea edx, [ebx + 0xc30]
mov dword [esp + 8], esi
mov dword [esp + 0xc], edx
mov dword [esp + 4], 0x40d2b8
mov dword [esp], eax
call sub.user32.dll_wsprintfW
mov eax, dword [ebp - 0x82c]
mov edx, edi
xor ecx, ecx
mov dword [ebx + 0x590], 0x10
mov dword [ebx + 0x124], 0
mov dword [ebx + 0x90], eax
mov eax, dword [ebp - 0x830]
mov dword [esp], eax
mov eax, ebx
call fcn.00406ee0
lea esp, [ebp - 0xc]
mov eax, ebx
pop ebx
pop esi
pop edi
pop ebp
lea esp, [edi - 8]
pop edi
ret
cmp word [edx - 2], 0x22
jne 0x4070a1
add esi, 2
jmp 0x4070a4
lea ecx, [ebx + 0x164]
mov edx, ecx
xor eax, eax
mov word [ecx], ax
jmp 0x4070de
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4b4
mov eax, dword [0x414020]
mov dword [esp], eax
call sub.user32.dll_LoadStringW
sub esp, 0x10
jmp 0x4071f1
Function at 0x40b480
Capabilities:
Accept command line arguments
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x40b4f0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40b557
xor ecx, ecx
xor edx, edx
jmp 0x40b539
cmp ax, 0x5c
jne 0x40b5c8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40b557
cmp ax, 9
je 0x40b545
cmp ax, 0x20
jne 0x40b520
test ecx, ecx
je 0x40b5b3
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x40b539
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x40b5e8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040ab00
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x40b5b0
cmp ax, 0x20
je 0x40b5b0
jmp 0x40b557
cmp ax, 0x22
jne 0x40b549
and edx, 1
jne 0x40b549
xor ecx, 1
jmp 0x40b52d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x40b570
Function at 0x40b4f0
Capabilities:
Accept command line arguments
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call sub.ucrtbase.dll___p___argc
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call 0x40b4f0
mov dword [esp], eax
call sub.ucrtbase.dll_exit
lea ecx, [esp + 4]
and esp, 0xfffffff0
push dword [ecx - 4]
push ebp
mov ebp, esp
push esi
push ebx
push ecx
sub esp, 0x6c
call dword [sym.imp.kernel32.dll_GetCommandLineW]
mov ebx, eax
movzx eax, word [eax]
test ax, ax
je 0x40b557
xor ecx, ecx
xor edx, edx
jmp 0x40b539
cmp ax, 0x5c
jne 0x40b5c8
add edx, 1
movzx eax, word [ebx + 2]
add ebx, 2
test ax, ax
je 0x40b557
cmp ax, 9
je 0x40b545
cmp ax, 0x20
jne 0x40b520
test ecx, ecx
je 0x40b5b3
movzx eax, word [ebx + 2]
add ebx, 2
xor edx, edx
test ax, ax
jne 0x40b539
lea eax, [ebp - 0x5c]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetStartupInfoW]
sub esp, 4
test byte [ebp - 0x30], 1
je 0x40b5e8
movzx esi, word [ebp - 0x2c]
mov dword [esp], 0
call dword [sym.imp.kernel32.dll_GetModuleHandleW]
sub esp, 4
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [esp], eax
call fcn.0040ab00
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ecx
pop ebx
pop esi
pop ebp
lea esp, [ecx - 4]
ret
add ebx, 2
movzx eax, word [ebx]
cmp ax, 9
je 0x40b5b0
cmp ax, 0x20
je 0x40b5b0
jmp 0x40b557
cmp ax, 0x22
jne 0x40b549
and edx, 1
jne 0x40b549
xor ecx, 1
jmp 0x40b52d
mov eax, 1
mov esi, 1
mov word [ebp - 0x2c], ax
jmp 0x40b570
Function at 0x401870
Capabilities:
Create thread
Hide graphical window
Resume thread

Disassembly:
push ecx
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0x51
push 0
push 0
push 0xfffff830
push 0xfffff830
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
cmp dword [esi + 0x498], 0
jne 0x401917
lea eax, [esp]
push eax
push 0
push esi
push 0x401850
push 0
push 0
call dword [sym.imp.MSVCR90.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x498], eax
test eax, eax
je 0x401917
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ecx
ret
Function at 0x402530
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov eax, dword [0x40f01c]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.004028c0
push 0x40b700
lea ecx, [esp + 0x2c]
xor edi, edi
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::constructor_wchar_t_const__]
push str.IconTips
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.MSVCP90.dll_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t_____cdecl_std::operator_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const___wchar_t_const__]
add esp, 0xc
push eax
lea ecx, [esp + 0x2c]
call dword [sym.imp.MSVCP90.dll_public:_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t______thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::operator_class_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t___const__]
lea ecx, [esp + 0xc]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
cmp dword [esp + 0x40], 8
mov eax, dword [esp + 0x2c]
jae 0x4025ac
lea eax, [esp + 0x2c]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402601
mov edx, dword [ebp + 0x14]
mov edi, dword [sym.imp.USER32.dll_LoadStringW]
push 0x64
push 0x40f344
push 0x67
push esi
mov dword [0x40f33c], esi
mov dword [0x40f340], edx
call edi
push 0x64
push 0x40f40c
push 0x6d
push esi
call edi
mov eax, esi
call fcn.00402640
call fcn.00401e40
mov edi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
call fcn.00402820
call dword [sym.imp.ole32.dll_OleUninitialize]
call dword [sym.imp.ole32.dll_CoUninitialize]
lea ecx, [esp + 0x28]
call dword [sym.imp.MSVCP90.dll_public:_void___thiscall_std::basic_string_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__::destructor_void_]
mov ecx, dword [esp + 0x44]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00408c84
mov esp, ebp
pop ebp
ret 0x10
Function at 0x403ae0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, dword [esp + 0x10]
test ebp, ebp
jne 0x403af0
lea eax, [ebp + 0xd]
pop ebp
ret 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
push edi
xor edi, edi
mov esi, ebp
lea ecx, [ecx]
push esi
call ebx
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x403b00
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx]
push edi
push ebp
push 7
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc