joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11798c0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
xor esi, esi
push edi
mov edi, ecx
cmp ebx, esi
je 0x1179994
mov eax, dword [edi + 0xc]
cmp eax, esi
je 0x11798f8
sub eax, 1
je 0x11798ed
sub eax, 1
jne 0x11798f8
push 0xfffffffffffffff4
jmp 0x11798ef
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.DLL_GetStdHandle]
mov dword [edi + 4], eax
mov dword [ebp - 4], esi
cmp dword [edi + 0xc], esi
je 0x117994d
cmp ebx, esi
jbe 0x117996b
mov ebx, dword [ebp + 8]
jmp 0x1179910
mov eax, dword [ebp + 0xc]
sub eax, esi
cmp eax, 0x4000
jb 0x1179921
mov eax, 0x4000
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov eax, dword [edi + 4]
lea edx, [esi + ebx]
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp eax, 1
sete al
test al, al
je 0x117996b
add esi, 0x4000
cmp esi, dword [ebp + 0xc]
jb 0x1179910
jmp 0x1179967
mov edx, dword [ebp + 8]
mov eax, dword [edi + 4]
push esi
lea ecx, [ebp - 4]
push ecx
push ebx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
cmp eax, 1
sete al
test al, al
jne 0x1179990
cmp byte [edi + 0x14], 0
je 0x1179990
cmp dword [edi + 0xc], 0
jne 0x1179990
lea ecx, [edi + 0x418]
push ecx
add edi, 0x17
push edi
push 0
push 0
mov ecx, 0x1189be8
call fcn.0116d260
mov byte [edi + 8], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x117a950
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x1c]
sub esp, 0x800
test eax, eax
je 0x117a965
mov byte [eax], 0
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
xor bl, bl
call fcn.01169f90
test eax, eax
je 0x117a9ca
test esi, esi
je 0x117a9ca
cmp word [esi], 0
je 0x117a9ca
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
cmp eax, 0xffffffff
setne al
test al, al
je 0x117aac9
test bl, bl
jne 0x117aa84
mov bl, 1
test esi, esi
je 0x117a9de
cmp word [esi], 0
je 0x117a9de
lea eax, [ebp - 0x800]
cmp eax, esi
je 0x117aa0d
push 0x400
mov ecx, eax
push esi
push ecx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
jmp 0x117aa0d
test edi, edi
je 0x117aac9
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jmp 0x117a992
test edi, edi
je 0x117aa04
push 0x400
lea eax, [ebp - 0x800]
push eax
push 0xffffffffffffffff
xor edx, edx
push edi
push edx
push edx
mov word [ebp - 0x800], dx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
jmp 0x117aa0d
xor ecx, ecx
mov word [ebp - 0x800], cx
lea eax, [ebp - 0x800]
xor edx, edx
push eax
mov word [ebp - 2], dx
call fcn.01178c70
test al, al
je 0x117aa84
test edi, edi
je 0x117aa4c
cmp byte [edi], 0
je 0x117aa4c
push 0
push 0
push 0x1000000
push edi
push 0xffffffffffffffff
lea ecx, [ebp - 0x800]
push ecx
push 0
push 0
mov byte [edi], 0
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
test esi, esi
je 0x117a970
cmp word [esi], 0
je 0x117a970
lea eax, [ebp - 0x800]
mov edx, esi
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x117aa70
jmp 0x117a970
mov eax, dword [ebp + 0x18]
xor bl, bl
cmp eax, 2
je 0x117aab0
cmp eax, 3
jne 0x117aac9
push esi
push edi
call fcn.01171f50
test al, al
jne 0x117a970
mov dword [ebp + 0x18], 0
jmp 0x117a970
mov eax, dword [ebp + 0x1c]
test eax, eax
je 0x117ab68
pop edi
pop esi
mov byte [eax], 1
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x24
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x117aaea
push 1
push esi
push edi
mov ecx, ebx
call fcn.0116d410
test al, al
je 0x117aaea
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x24
call fcn.01169f90
test eax, eax
je 0x117ab08
test esi, esi
je 0x117ab08
cmp word [esi], 0
je 0x117ab08
push 0
push esi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
jmp 0x117ab15
test edi, edi
je 0x117ab15
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
test esi, esi
je 0x117ab29
cmp word [esi], 0
je 0x117ab29
push 1
push esi
call fcn.01172320
jmp 0x117ab3a
test edi, edi
je 0x117ab3a
cmp byte [edi], 0
je 0x117ab3a
push 1
push edi
call fcn.01172200
test ebx, ebx
je 0x117ab52
push 1
push esi
push edi
mov ecx, ebx
call fcn.0116d410
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x24
test edi, edi
je 0x117ab68
push edi
call dword [sym.imp.msvcrt.dll_remove]
add esp, 4
test eax, eax
je 0x117aadf
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret 0x24
Function at 0x117eb91
Capabilities:
Terminate process

Disassembly:
push 0x58
push 0x1182a20
call fcn.0117f9d4
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.DLL_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, 0x118b068
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedCompareExchange]
test eax, eax
je 0x117e948
cmp eax, esi
jne 0x117e93b
xor esi, esi
inc esi
mov ebx, esi
jmp 0x117e94b
push 0x3e8
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x117e922
xor esi, esi
inc esi
mov eax, dword [0x118b064]
cmp eax, esi
jne 0x117e95e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x117e98d
mov eax, dword [0x118b064]
test eax, eax
jne 0x117e987
mov dword [0x118b064], esi
push 0x100181c
push 0x100180c
call fcn.0117e887
pop ecx
pop ecx
test eax, eax
je 0x117e98d
jmp 0x117eab5
mov dword [0x118ad34], esi
mov eax, dword [0x118b064]
cmp eax, esi
jne 0x117e9b1
push 0x1001808
push 0x10017f4
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x118b064], 2
test ebx, ebx
jne 0x117e9bd
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
cmp dword [0x118b078], 0
je 0x117e9e1
push 0x118b078
call fcn.0117f949
pop ecx
test eax, eax
je 0x117e9e1
push 0
push 2
push 0
call dword [0x118b078]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x20], esi
mov al, byte [esi]
cmp al, 0x20
ja 0x117ea3d
test al, al
je 0x117e9fb
cmp dword [ebp - 0x1c], 0
jne 0x117ea3d
mov al, byte [esi]
test al, al
je 0x117ea0b
cmp al, 0x20
ja 0x117ea0b
inc esi
mov dword [ebp - 0x20], esi
jmp 0x117e9fb
test byte [ebp - 0x3c], 1
je 0x117ea17
movzx eax, word [ebp - 0x38]
jmp 0x117ea1a
push 0xa
pop eax
push eax
push esi
push 0
push 0x1000000
call main
mov dword [0x118ad30], eax
cmp dword [0x118ad24], 0
jne 0x117ea91
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp al, 0x22
jne 0x117ea4c
xor ecx, ecx
cmp dword [ebp - 0x1c], ecx
sete cl
mov dword [ebp - 0x1c], ecx
movzx eax, al
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x117ea5f
inc esi
mov dword [ebp - 0x20], esi
inc esi
jmp 0x117e9e8
cmp dword [0x118ad34], 0
jne 0x117eaa0
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x118ad30]
jmp 0x117eac1
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0117fa19
ret
call fcn.0117fb21
jmp 0x117e8e8
Function at 0x1181080
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
jne 0x11810af
call dword [sym.imp.msvcrt.dll__errno]
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [eax], 0x16
call fcn.0117f21c
add esp, 0x14
jmp 0x118118d
mov eax, dword [esi + 0xc]
test al, 0x83
je 0x118118d
test al, 0x40
jne 0x118118d
test al, 2
je 0x11810d1
or eax, 0x20
mov dword [esi + 0xc], eax
jmp 0x118118d
or eax, 1
mov dword [esi + 0xc], eax
test eax, 0x10c
je 0x1181091
push dword [esi + 0x18]
mov eax, dword [esi + 8]
mov edi, dword [sym.imp.msvcrt.dll__fileno]
push eax
push esi
mov dword [esi], eax
call edi
pop ecx
push eax
call dword [sym.imp.msvcrt.dll__read]
add esp, 0xc
mov dword [esi + 4], eax
cmp eax, ebx
je 0x118117d
cmp eax, 0xffffffff
je 0x118117d
test byte [esi + 0xc], 0x82
jne 0x1181152
push esi
call edi
pop ecx
cmp eax, 0xffffffff
je 0x118113d
push esi
call edi
pop ecx
cmp eax, 0xfffffffe
je 0x118113d
push esi
call edi
mov ecx, dword [sym.imp.msvcrt.dll___pioinfo]
sar eax, 5
push esi
lea ebx, [ecx + eax*4]
call edi
and eax, 0x1f
imul eax, eax, 0x24
add eax, dword [ebx]
pop ecx
pop ecx
jmp 0x1181142
mov eax, dword [sym.imp.msvcrt.dll___badioinfo]
mov al, byte [eax + 4]
and al, 0x82
cmp al, 0x82
jne 0x1181152
or dword [esi + 0xc], 0x2000
cmp dword [esi + 0x18], 0x200
jne 0x1181170
mov eax, dword [esi + 0xc]
test al, 8
je 0x1181170
test eax, 0x400
jne 0x1181170
mov dword [esi + 0x18], 0x1000
mov ecx, dword [esi]
dec dword [esi + 4]
movzx eax, byte [ecx]
inc ecx
mov dword [esi], ecx
jmp 0x1181190
neg eax
sbb eax, eax
and eax, 0x10
add eax, 0x10
or dword [esi + 0xc], eax
mov dword [esi + 4], ebx
or eax, 0xffffffff
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x403320
Capabilities:
Initialize winsock library

Disassembly:
sub esp, 0x190
lea eax, [esp]
push ebx
mov ebx, dword [esp + 0x198]
push esi
push eax
mov esi, ecx
push ebx
call dword [sym.imp.WS2_32.DLL_WSAStartup]
test eax, eax
jne 0x403370
mov ax, word [esp + 8]
cmp al, bl
jne 0x40336a
xor ecx, ecx
xor edx, edx
mov cl, ah
mov dl, bh
cmp cl, dl
jne 0x40336a
mov dword [esi + 4], 1
pop esi
xor eax, eax
pop ebx
add esp, 0x190
ret 4
call dword [sym.imp.WS2_32.DLL_WSACleanup]
call dword [sym.imp.WS2_32.DLL_WSAGetLastError]
pop esi
pop ebx
add esp, 0x190
ret 4

Function at 0x417d34
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.00417db3
jae 0x417d40
xor ecx, ecx
call fcn.00417db3
jae 0x417d6a
xor eax, eax
call fcn.00417db3
jae 0x417d7b
mov al, 0x10
call fcn.00417db3
adc al, al
jae 0x417d5c
jne 0x417da8
stosb byte es:[edi], al
jmp 0x417d41
call fcn.00417dbf
dec ecx
loop 0x417d87
mov eax, ebp
call fcn.00417dbd
jmp 0x417da9
lodsb al, byte [esi]
shr eax, 1
je 0x417dcf
adc ecx, 2
mov ebp, eax
jmp 0x417da9
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.00417dbd
cmp eax, 0x7d00
jae 0x417da7
cmp eax, 0x500
jae 0x417da8
cmp eax, 0x7f
ja 0x417da9
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x417d41
pop ebp
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x16b76b0a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x2db90108
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x43ebb0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x43ebce
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x43ebc3
pop esi
ret

Function at 0x43ed10
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x43eda2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x43ed94
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x43ed8c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x43ed55
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x43b663
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x43b3c1
mov edx, ebx
inc ebx
mov ebx, edx
call fcn.0043b6a5
or edx, ebx
and edx, edx
and edx, ebx
xor dword [eax], edi
mov edx, edx
add ebx, 1
add eax, 1
sub edx, 1
cmp eax, esi
jne fcn.0043b663
sub ebx, edx
sub edx, 1
and ebx, ebx
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x54658b]
shl eax, 2
mov dword [0x54658f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0052523c
pop edx
call fcn.005251a0
call fcn.0052527c
push 0
call fcn.00526674
pop ecx
push 0x546534
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x546593], eax
push 0
jmp fcn.0052cabc

Function at 0x401770
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 4], eax
mov dl, byte [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov byte [eax + ecx], dl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jb 0x40177b
mov edx, dword [ebp + 8]
xor ecx, ecx
mov dword [edx + 0x104], ecx
mov eax, dword [ebp + 8]
mov dword [eax + 0x100], ecx
xor edx, edx
mov dword [ebp - 8], edx
xor eax, eax
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor edx, edx
div dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov al, byte [ecx + edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
add edx, dword [ebp - 8]
add eax, edx
and eax, 0xff
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + eax]
mov byte [ebp - 9], al
mov edx, dword [ebp - 8]
mov ecx, dword [ebp + 8]
mov al, byte [ecx + edx]
mov edx, dword [ebp - 4]
mov ecx, dword [ebp + 8]
mov byte [ecx + edx], al
mov eax, dword [ebp - 8]
mov edx, dword [ebp + 8]
mov cl, byte [ebp - 9]
mov byte [edx + eax], cl
inc dword [ebp - 4]
cmp dword [ebp - 4], 0x100
jb 0x4017b1
mov esp, ebp
pop ebp
ret
Function at 0x401812
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x18], edx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp + 8]
mov edx, dword [eax + 0x100]
mov dword [ebp - 4], edx
mov ecx, dword [ebp + 8]
mov eax, dword [ecx + 0x104]
mov dword [ebp - 8], eax
cmp dword [ebp - 0x14], 0
je 0x4018e0
mov edx, dword [ebp - 4]
inc edx
and edx, 0xff
mov dword [ebp - 4], edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor edx, edx
mov dl, byte [eax + ecx]
add edx, dword [ebp - 8]
and edx, 0xff
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov dl, byte [eax + ecx]
mov byte [ebp - 0x19], dl
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
mov dl, byte [eax + ecx]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
mov byte [eax + ecx], dl
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov al, byte [ebp - 0x19]
mov byte [ecx + edx], al
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov al, byte [ecx + edx]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + edx]
add eax, edx
and eax, 0x800000ff
jns 0x4018bf
dec eax
or eax, 0xffffff00
inc eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov al, byte [ecx + eax]
mov edx, dword [ebp - 0x18]
xor byte [edx], al
inc dword [ebp - 0x18]
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
jne 0x40184c
mov ecx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [ecx + 0x100], eax
mov edx, dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov dword [edx + 0x104], ecx
mov esp, ebp
pop ebp
ret

Function at 0x4034d0
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [0x547ce4], 3
je 0x4034e2
cmp dword [0x547ce4], 2
jne 0x4034e5
xor eax, eax
ret
push 0x54f6bb
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x547ccc], eax
cmp dword [0x547ccc], 0
jne 0x403518
push str.psapi.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x547ccc], eax
cmp dword [0x547ccc], 0
jne 0x403518
xor eax, eax
ret
push str.EnumProcesses
push dword [0x547ccc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5778b8], eax
push str.EnumProcessModules
push dword [0x547ccc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5778bc], eax
push str.GetModuleBaseNameW
push dword [0x547ccc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5778c0], eax
push str.GetModuleBaseNameA
push dword [0x547ccc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5778c4], eax
push 0x54f716
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x547cd0], eax
cmp dword [0x547cd0], 0
jne 0x40359f
push str.shell32.dll
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x547cd0], eax
cmp dword [0x547cd0], 0
jne 0x40359f
xor eax, eax
ret
push str.SHGetFolderPathW
push dword [0x547cd0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5778c8], eax
push str.SHGetFolderPathA
push dword [0x547cd0]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5778cc], eax
mov al, 1
ret
Function at 0x4036ec
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push esi
push edi
mov esi, 0x5481c4
lea edi, [ebp - 0x110]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
push 0x547b68
lea eax, [ebp - 0x110]
push eax
call fcn.005256f0
add esp, 8
push str.SES.dll
lea edx, [ebp - 0x110]
push edx
call fcn.00525614
add esp, 8
lea ecx, [ebp - 0x110]
push ecx
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x547cc8], eax
cmp dword [0x547cc8], 0
jne 0x40376c
lea eax, [ebp - 0x110]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x547cc8], eax
cmp dword [0x547cc8], 0
jne 0x40376c
xor eax, eax
jmp 0x403863
push str.SES_Init
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577944], eax
push str.SES_Exit
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577948], eax
push str.GetSES_APList
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x57794c], eax
push str.GetSESed_APList
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577950], eax
push str.IndicateAP
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577954], eax
push str.ConfigSESAP
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577958], eax
push str.GetConfigInfo
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x57795c], eax
push str.GetKey
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577960], eax
push str.SES2_Proceed
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577964], eax
push str.SES2_Cancel
push dword [0x547cc8]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577968], eax
mov eax, dword [sym.WMP54Gv4.exe__MainFrm]
call fcn.004f0554
push eax
push dword [0x547cbc]
lea edx, [ebp - 0xc]
push edx
push 0x577bb8
call dword [0x577944]
mov dword [ebp - 8], eax
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40386c
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push esi
push edi
mov esi, 0x5482c8
lea edi, [ebp - 0x104]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
push 0x547b68
lea eax, [ebp - 0x104]
push eax
call fcn.005256f0
add esp, 8
push str.Security.dll
lea edx, [ebp - 0x104]
push edx
call fcn.00525614
add esp, 8
lea ecx, [ebp - 0x104]
push ecx
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x547cbc], eax
cmp dword [0x547cbc], 0
jne 0x4038ec
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [0x547cbc], eax
cmp dword [0x547cbc], 0
jne 0x4038ec
xor eax, eax
jmp 0x4039fc
push str.InitializeSupplicant
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x57796c], eax
push str.CheckSupplicantFile
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577970], eax
push str.GetSupplicantStatus
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577978], eax
push str.SetSupplicant
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x57797c], eax
push str.GetCAInformation
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577980], eax
push str.QueryMonitorState
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577984], eax
push str.SuspendMonitorThread
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577988], eax
push str.QuerySupplicantStatus
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577998], eax
push str.IsAegisInstalled
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x5779a0], eax
push str.ReleaseSupplicant
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577974], eax
push str.SetTipToElement
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577990], eax
push str.GetTipFromElement
push dword [0x547cbc]
call sub.KERNEL32.DLL_GetProcAddress
mov dword [0x577994], eax
call dword [0x577978]
cmp eax, 0xf
jne 0x4039fa
mov byte [0x547c76], 1
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x40759c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
call sub.KERNEL32.DLL_GetTickCount
mov dword [ebp - 0xc], eax
jmp 0x4075be
mov eax, dword [0x577298]
mov eax, dword [eax]
call fcn.004dfdbc
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 8]
jb 0x4075b2
mov esp, ebp
pop ebp
ret

Function at 0x407cec
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push esi
push edi
call fcn.004309ec
mov dword [0x57e904], eax
cmp dword [0x57e904], 3
ja 0x407d3e
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.EnumNetworkMDC8021X0000
push 0x80000002
call sub.ADVAPI32.DLL_RegOpenKeyExA
mov dword [ebp - 8], eax
push dword [ebp - 4]
call sub.ADVAPI32.DLL_RegCloseKey
cmp dword [ebp - 8], 0
je 0x407d3e
push 0x3e8
call sub.KERNEL32.DLL_Sleep
jmp 0x407d0a
mov esi, 0x54959a
lea edi, [ebp - 0x110]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x54969e
lea edi, [ebp - 0x214]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
push 0x140
push 0xc8
lea eax, [ebp - 0x110]
push eax
call dword [0x5788f4]
push 0x53
push 0x64
lea edx, [ebp - 0x214]
push edx
call dword [0x5788f4]
push 0
lea ecx, [ebp - 0x214]
push ecx
lea eax, [ebp - 0x110]
push eax
push 0
call sub.USER32.DLL_MessageBoxA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jne 0x407db3
push 0
push 2
call sub.USER32.DLL_ExitWindowsEx
pop edi
pop esi
mov esp, ebp
pop ebp
ret