joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40455c
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4110d0
push 1
push 0
push 0x4110e0
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x404627
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x4045a8
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x4045bc
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x4045ce
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4110f0
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x40461e
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x404615
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x404634
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
lea edx, [ebp - 8]
push edx
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x404670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, eax
lea eax, [ebp - 4]
push eax
call sub.SHELL32.DLL_SHGetMalloc
lea edx, [ebp - 8]
push edx
push 0x19
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [ebp - 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [ebp - 8]
mov ecx, dword [ebp - 4]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x14]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4046ac
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x4046c7
xor eax, eax
jmp 0x404734
lea eax, [ebp - 0x404]
mov ecx, 0x400
mov edx, ebx
call fcn.00404bdc
lea eax, [ebp - 0x404]
push eax
call fcn.004076d8
pop ecx
lea edx, [ebp - 0x424]
mov byte [ebp + eax - 0x403], 0
push 0x1e
push 0
push edx
call fcn.00407528
mov dword [ebp - 0x420], 3
mov word [ebp - 0x414], 0x14
add esp, 0xc
lea ecx, [ebp - 0x404]
mov dword [ebp - 0x41c], ecx
lea eax, [ebp - 0x424]
push eax
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404e7c
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov ebx, eax
push edi
mov dword [ebp - 4], edx
xor edx, edx
mov eax, dword [ebp + 0xc]
mov dword [ebx + 0xc18], edx
cmp byte [ebx + 0x16], 0
mov esi, ecx
je 0x404e9f
mov al, 1
cmp byte [ebp + 8], 0
mov edi, 0x80000000
je 0x404eb0
or edi, 0x40000000
mov dword [ebp - 8], 1
test al, al
je 0x404ebf
or dword [ebp - 8], 2
xor eax, eax
cmp byte [ebx + 0x15], 0
jne 0x404ecc
add eax, 0x8000000
mov dword [ebp - 0xc], eax
call fcn.004058c8
test eax, eax
je 0x404ef9
test esi, esi
je 0x404ef9
cmp word [esi], 0
je 0x404ef9
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push esi
call sub.KERNEL32.DLL_CreateFileW
mov edi, eax
jmp 0x404f10
push 0
push dword [ebp - 0xc]
push 3
push 0
push dword [ebp - 8]
push edi
push dword [ebp - 4]
call sub.KERNEL32.DLL_CreateFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x404f29
call sub.KERNEL32.DLL_GetLastError
cmp eax, 2
jne 0x404f29
mov dword [ebx + 0xc18], 1
xor edx, edx
cmp edi, 0xffffffff
mov byte [ebx + 0x12], 0
setne cl
mov dword [ebx + 0xc], edx
and ecx, 1
mov byte [ebx + 0x10], 0
mov byte [ebp - 0xd], cl
cmp byte [ebp - 0xd], 0
je 0x404f97
mov dword [ebx + 4], edi
test esi, esi
je 0x404f5e
lea eax, [ebx + 0x418]
mov edx, esi
call fcn.00404ad4
jmp 0x404f67
mov word [ebx + 0x418], 0
cmp dword [ebp - 4], 0
je 0x404f7e
push dword [ebp - 4]
lea ecx, [ebx + 0x17]
push ecx
call fcn.004076a8
add esp, 8
jmp 0x404f8d
lea edx, [ebx + 0x17]
mov ecx, 0x1000000
mov eax, esi
call fcn.00404ab0
mov edx, dword [ebx + 4]
mov eax, ebx
call fcn.00404fa4
mov al, byte [ebp - 0xd]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x405170
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push esi
push edi
mov edi, edx
cmp dword [ebx + 0xc], 1
mov esi, ecx
jne 0x40519a
cmp esi, 0x4e20
jle 0x405190
mov esi, 0x4e20
push 0xfffffffffffffff6
call sub.KERNEL32.DLL_GetStdHandle
mov dword [ebx + 4], eax
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push dword [ebx + 4]
call sub.KERNEL32.DLL_ReadFile
test eax, eax
jne 0x4051ea
mov eax, ebx
call fcn.004053c4
test al, al
je 0x4051d1
cmp esi, 0x4e20
jle 0x4051d1
mov ecx, 0x4e20
mov edx, edi
mov eax, ebx
call fcn.00405170
jmp 0x4051ed
cmp dword [ebx + 0xc], 1
jne 0x4051e5
call sub.KERNEL32.DLL_GetLastError
cmp eax, 0x6d
jne 0x4051e5
xor eax, eax
jmp 0x4051ed
or eax, 0xffffffff
jmp 0x4051ed
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x405958
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, 0x4165c4
mov dword [ebp - 4], edx
mov esi, ecx
cmp dword [edi + 4], 0
mov ebx, eax
jne 0x405978
call fcn.00405920
mov eax, dword [ebp - 4]
jmp 0x405991
mov edx, ebx
xor ecx, ecx
xor dl, byte [eax]
dec esi
mov cl, dl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
inc eax
mov ebx, edx
test esi, esi
jbe 0x405999
test al, 7
jne 0x40597d
cmp esi, 8
jb 0x405a22
xor ebx, dword [eax]
xor ecx, ecx
mov cl, bl
sub esi, 8
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
xor ebx, dword [eax + 4]
add eax, 8
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
xor ecx, ecx
mov ebx, edx
mov cl, bl
shr ebx, 8
mov edx, dword [edi + ecx*4]
xor edx, ebx
cmp esi, 8
mov ebx, edx
jae 0x4059a2
xor ecx, ecx
mov dword [ebp - 8], ecx
cmp esi, dword [ebp - 8]
jbe 0x405a4c
mov ecx, dword [ebp - 8]
mov edx, ebx
shr ebx, 8
xor dl, byte [eax + ecx]
and edx, 0xff
mov ecx, dword [edi + edx*4]
xor ecx, ebx
mov ebx, ecx
inc dword [ebp - 8]
cmp esi, dword [ebp - 8]
ja 0x405a2c
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x4071a8
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
mov dword [esp], 0x20
push esp
call sub.KERNEL32.DLL_GlobalMemoryStatus
mov eax, dword [esp + 0xc]
add esp, 0x20
ret

Function at 0x4083a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x4083bc
call fcn.004095dc
pop ebx
pop ebp
ret
test byte [ebp + 0xc], 2
je 0x4083d7
test bl, 1
je 0x4083d7
mov dword [0x412788], 5
or eax, 0xffffffff
pop ebx
pop ebp
ret
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x408584
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
test byte [ebp + 0xd], 0xc0
jne 0x4085a3
mov eax, dword [0x4118dc]
mov edx, dword [eax]
and edx, 0xc000
or dword [ebp + 0xc], edx
test byte [ebp + 0xd], 0x80
jne 0x4085b0
or dword [ebp + 0xc], 0x4000
mov ecx, dword [ebp + 0xc]
and ecx, 0x700
cmp ecx, 0x500
jg 0x4085dd
je 0x4085ef
sub ecx, 0x100
je 0x4085fd
sub ecx, 0x100
je 0x408604
sub ecx, 0x100
je 0x4085f6
jmp 0x40860b
sub ecx, 0x600
je 0x408604
sub ecx, 0x100
je 0x4085ef
jmp 0x40860b
mov edi, 1
jmp 0x408610
mov edi, 2
jmp 0x408610
mov edi, 4
jmp 0x408610
mov edi, 5
jmp 0x408610
mov edi, 3
test byte [ebp + 0xd], 1
je 0x408637
lea eax, [ebp + 0x10]
add eax, 4
mov eax, dword [eax - 4]
and eax, dword [0x411354]
test al, 0x80
je 0x408630
mov ebx, 0x80
jmp 0x408649
mov ebx, 1
jmp 0x408649
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov ebx, eax
cmp eax, 0xffffffff
jne 0x408649
xor ebx, ebx
mov eax, dword [ebp + 0xc]
and eax, 3
sub eax, 1
jb 0x40865b
je 0x408664
dec eax
je 0x40866d
jmp 0x408676
mov dword [ebp - 4], 0x80000000
jmp 0x408685
mov dword [ebp - 4], 0x40000000
jmp 0x408685
mov dword [ebp - 4], 0xc0000000
jmp 0x408685
push 1
call fcn.00409578
pop ecx
mov ebx, eax
jmp 0x408771
mov eax, dword [ebp + 0xc]
and eax, 0x70
sub eax, 0x10
je 0x4086a1
sub eax, 0x10
je 0x4086a8
sub eax, 0x10
je 0x4086b1
sub eax, 0x10
je 0x4086ba
jmp 0x4086ba
xor edx, edx
mov dword [ebp - 8], edx
jmp 0x4086c1
mov dword [ebp - 8], 1
jmp 0x4086c1
mov dword [ebp - 8], 2
jmp 0x4086c1
mov dword [ebp - 8], 3
mov dword [ebp - 0x14], 0xc
xor ecx, ecx
mov dword [ebp - 0x10], ecx
lea ecx, [ebp - 0x14]
mov eax, dword [ebp + 0xc]
and eax, 0x80
cmp eax, 1
sbb edx, edx
neg edx
mov dword [ebp - 0xc], edx
push 0
push ebx
push edi
push ecx
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
push ecx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
cmp eax, 0xffffffff
jne 0x40872a
call sub.KERNEL32.DLL_GetLastError
mov ebx, eax
and ebx, 0xffff
cmp ebx, 0x6e
jne 0x40871f
test byte [ebp + 0xd], 1
mov ebx, 0x50
jne 0x40871f
add ebx, 0xffffffb2
push ebx
call fcn.00409578
pop ecx
mov ebx, eax
jmp 0x408771
mov edi, esi
push edi
call fcn.004084f4
pop ecx
test eax, eax
je 0x40873e
or dword [ebp + 0xc], 0x2000
test bl, 1
jne 0x40874a
or dword [ebp + 0xc], 0x100
and dword [ebp + 0xc], 0xfffff8ff
mov eax, dword [ebp + 0xc]
push eax
push edi
call fcn.004092bc
add esp, 8
mov ebx, eax
inc eax
jne 0x408771
push 4
call fcn.00409578
pop ecx
push esi
call sub.KERNEL32.DLL_CloseHandle
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40cdf4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
test eax, eax
je 0x40ce56
call fcn.0040cda4
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push esi
call fcn.004076d8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push edi
call fcn.004076d8
pop ecx
push eax
push edi
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40ceb4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
cmp dword [0x412790], 0
push ebx
push esi
mov esi, dword [ebp + 8]
jne 0x40cf8e
cmp dword [0x41278c], 0
jne 0x40cf8e
cmp dword [0x412980], 0
je 0x40cf48
push 0x80
lea eax, [ebp - 0x84]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
push 0x5c
lea edx, [ebp - 0x84]
push edx
call fcn.0040cd4c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40cf2e
push 0x3a
lea edx, [ebp - 0x84]
push edx
call fcn.0040cd4c
add esp, 8
mov ebx, eax
test eax, eax
jne 0x40cf2e
lea ebx, [ebp - 0x84]
jmp 0x40cf2f
inc ebx
call fcn.0040ce70
or eax, 0x10010
push eax
push ebx
push esi
push 0
call sub.USER32.DLL_MessageBoxA
jmp 0x40cfc9
push 0xfffffffffffffff4
call sub.KERNEL32.DLL_GetStdHandle
mov ebx, eax
lea eax, [ebp - 4]
push 0
push eax
push 2
push 0x412794
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea edx, [ebp - 4]
push edx
push esi
call fcn.004076d8
pop ecx
push eax
push esi
push ebx
call sub.KERNEL32.DLL_WriteFile
push 0
lea ecx, [ebp - 4]
push ecx
push 2
push 0x412797
push ebx
call sub.KERNEL32.DLL_WriteFile
jmp 0x40cfc9
cmp dword [0x41278c], 0
je 0x40cfa8
cmp dword [0x41278c], 0xffffffff
je 0x40cfc9
push esi
call dword [0x41278c]
pop ecx
mov eax, dword [0x412790]
test eax, eax
je 0x40cfc9
cmp dword [0x412790], 0xffffffff
je 0x40cfc9
cmp byte [eax], 0
je 0x40cfc9
push esi
push eax
call fcn.0040cdf4
add esp, 8
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x110fe7f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x110fe7fa
pushal
call 0x110fe800
pop ebp
sub ebp, 0x10
sub ebp, 0x10fe7f0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x110fe824
and al, 0x28
add byte [eax], al
add byte [eax - 0x7bf0fe08], al
pop es
add byte [eax], al
add byte [ecx + 0x33], ah
rol byte [eax - 0x3e], 0xc
add cl, ch
add al, 0
add byte [eax], al
mov ch, byte [0xf0b8d5b7]
out 0xf, eax
add dword [ebx], eax
lds eax, [ecx + 0x63c0]
add byte [ecx + 0x5e5], bh
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x110fe82d
mov eax, 0x10fe7f0
add eax, ebp
add eax, 0x63
mov ecx, 0x5e5
mov edx, 0x99e0ae98
xor byte [eax], dl
inc eax
dec ecx
jne 0x110fe844
jmp 0x110fe857
add byte [eax], al
add byte [edi], ch
pop ss
invalid
adc edx, dword [ebp + 0x13]
adc dword [eax + ebx*4 + 0x59199898], esp
pushal
cwde
cwde
cwde
wait
push ebp
and byte [esi + 0x22989898], bl
mov al, 0x98
cwde
cwde
outsd dx, dword [esi]
jp 0x110fe80f
push eax
adc ebx, dword [ecx]
xchg esp, eax
cwde
cwde
cwde
wait
pop ebp
adc eax, 0x1164bcfc
pushfd
mov esp, 0x64bcfc15
adc dword [esp + edi*4 - 0x45680310], ebx
cwde
lock adc al, byte [eax + 0x75]
cwde
cdq
mov ah, 0xbc
lock adc byte [ebp - 0x628fc710], cl
cwde
cwde
cwde
jno 0x110fe850
cwde
cwde
cwde
adc eax, 0x1164bcfc
mov ah, 0xbc
int3
Function at 0x4014b0
Capabilities:
Delete file

Disassembly:
push 0x14
mov eax, 0x40d890
call fcn.00409686
mov eax, dword [0x41205c]
mov ecx, 0x41205c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
push str.RootGeniusEx.zip
lea ecx, [ebp - 0x18]
call fcn.004010f5
pop ecx
lea edi, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0040179c
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.00401f7c
mov edi, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
call esi
lea eax, [ebp - 0x14]
push eax
push 0x85
call fcn.004012f8
pop ecx
pop ecx
mov byte [ebp - 0xd], al
test al, al
je 0x40155c
push 0
push ecx
mov ecx, esp
mov dword [ebp - 0x1c], esp
push 0x40fc7c
call fcn.004010f5
mov byte [ebp - 4], 2
mov dword [ebp - 0x18], esp
lea eax, [edi - 0x10]
mov dword [ebp - 0x18], esp
call fcn.00401b0b
add eax, 0x10
mov ecx, esp
mov dword [ecx], eax
mov byte [ebp - 4], 0
call fcn.00401fac
add esp, 0xc
push edi
mov byte [ebp - 0xd], al
call esi
lea eax, [edi - 0x10]
call fcn.00401f7c
mov al, byte [ebp - 0xd]
call fcn.00409725
ret

Function at 0x40156d
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx edi, ax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x40fb30
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
and dword [ebp - 0x10], 0x80000000
and eax, 0x7fffffff
mov ebx, dword [sym.imp.USER32.dll_MessageBoxW]
mov dword [ebp - 0x20], eax
xor esi, esi
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], esi
fild qword [ebp - 0x24]
fild qword [ebp - 0x14]
fchs
faddp st(1)
fld qword [0x40fcb8]
fmul st(1), st(0)
fmulp st(1)
fcomp qword [0x40fcb0]
fnstsw ax
test ah, 5
jp 0x401607
push 4
mov eax, edi
pop ecx
and eax, 0x3ff
push 0x30
cmp cx, ax
jne 0x4015fa
push 0x40fb38
push 0x40fb40
jmp 0x401604
push str.Warning
push str.C_disk_space_will_cause_the_software_can_not_be_used_
push esi
call ebx
mov byte [ebp - 5], 1
call fcn.00401386
test al, al
jne 0x401619
mov byte [ebp - 5], al
jmp 0x401687
push 0x40fad8
lea ecx, [ebp - 0x10]
call fcn.004010f5
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop ecx
push dword [eax]
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004013f9
test al, al
jne 0x401657
mov byte [ebp - 5], al
jmp 0x40167a
push str.RootGenius.dll
lea ecx, [ebp - 0x10]
call fcn.004010f5
pop ecx
push dword [eax]
call esi
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], eax
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00401f7c
call fcn.004014b0
cmp byte [ebp - 5], 0
jne 0x4016b0
xor esi, esi
push 4
pop eax
and edi, 0x3ff
push 0x30
cmp ax, di
jne 0x4016a3
push 0x40fc04
push str.Root
jmp 0x4016ad
push str.Error
push str.Root_Genius_failed_to_initialize_
push esi
call ebx
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x402c2c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411020]
jne 0x402c36
repz ret
jmp fcn.0040361c

Function at 0x407b1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403794
and dword [ebp - 4], 0
cmp dword [0x412b68], 0
mov ebx, eax
jne 0x407bcd
push 0x40f0fc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407c7e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x40f0f0
push edi
call esi
test eax, eax
je 0x407c7e
push eax
call fcn.00403722
mov dword [esp], 0x40f0e0
push edi
mov dword [0x412b68], eax
call esi
push eax
call fcn.00403722
mov dword [esp], 0x40f0cc
push edi
mov dword [0x412b6c], eax
call esi
push eax
call fcn.00403722
mov dword [esp], 0x40f0b0
push edi
mov dword [0x412b70], eax
call esi
push eax
call fcn.00403722
pop ecx
mov dword [0x412b78], eax
test eax, eax
je 0x407bcd
push 0x40f098
push edi
call esi
push eax
call fcn.00403722
pop ecx
mov dword [0x412b74], eax
mov eax, dword [0x412b74]
cmp eax, ebx
je 0x407c25
cmp dword [0x412b78], ebx
je 0x407c25
push eax
call fcn.0040379d
push dword [0x412b78]
mov esi, eax
call fcn.0040379d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x407c25
test edi, edi
je 0x407c25
call esi
test eax, eax
je 0x407c1c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x407c1c
test byte [ebp - 0xc], 1
jne 0x407c25
or dword [ebp + 0x10], 0x200000
jmp 0x407c5e
mov eax, dword [0x412b6c]
cmp eax, ebx
je 0x407c5e
push eax
call fcn.0040379d
pop ecx
test eax, eax
je 0x407c5e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x407c5e
mov eax, dword [0x412b70]
cmp eax, ebx
je 0x407c5e
push eax
call fcn.0040379d
pop ecx
test eax, eax
je 0x407c5e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412b68]
call fcn.0040379d
pop ecx
test eax, eax
je 0x407c7e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407c80
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4045a4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffdf4
mov ebx, edx
mov esi, eax
mov eax, ebx
xor edx, edx
call fcn.004068a0
test esi, esi
jne 0x4045dc
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.004069dc
jmp 0x4045fa
call sub.kernel32.dll_GetCommandLineW
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.004044e8
mov edi, eax
test esi, esi
je 0x4045fa
cmp dword [ebx], 0
je 0x4045fa
dec esi
jmp 0x4045e3
add esp, 0x20c
pop edi
pop esi
pop ebx
ret

Function at 0x405e3c
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x4c0054], 0
je 0x405e9d
cmp word [0x4c0330], 0xd7b2
jne 0x405e65
cmp dword [0x4c0338], 0
jbe 0x405e65
mov eax, 0x4c032c
call dword [0x4c0348]
push 0
lea eax, [esp + 4]
push eax
push 0x1d
push str.Runtime_error_____at_00000000
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x405ec8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x4bd030], 0
jne 0x405eb9
push 0
push str.Error
push str.Runtime_error_____at_00000000
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x406028
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 0x10]
cmp dword [0x4bd034], 0
je 0x40604e
mov edx, esi
mov eax, ebx
call dword [0x4bd034]
jmp 0x40605d
mov eax, 8
call fcn.00404230
mov dword [eax], ebx
mov dword [eax + 4], esi
mov byte [0x4c0055], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x405ff0
push eax
mov eax, dword [ebp - 4]
push eax
push edi
call sub.kernel32.dll_CreateThread
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 0xc
Function at 0x4087cc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x164], ecx
mov dword [ebp - 0x168], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 8], edx
mov esi, eax
xor eax, eax
push ebp
push 0x408933
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004068a0
cmp si, word [0x4bd7dc]
jb 0x408866
cmp si, word [0x4bd9dc]
ja 0x408866
mov edi, 0x40
xor eax, eax
mov dword [ebp - 0xc], eax
cmp edi, dword [ebp - 0xc]
jb 0x408866
mov ebx, dword [ebp - 0xc]
add ebx, edi
shr ebx, 1
cmp si, word [ebx*8 + 0x4bd7dc]
jae 0x408840
mov edi, ebx
dec edi
jmp 0x408861
cmp si, word [ebx*8 + 0x4bd7dc]
jbe 0x408850
inc ebx
mov dword [ebp - 0xc], ebx
jmp 0x408861
mov edx, dword [ebp - 8]
mov eax, dword [ebx*8 + 0x4bd7e0]
call fcn.004086dc
jmp 0x408866
cmp edi, dword [ebp - 0xc]
jae 0x40882a
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x408915
push 2
movzx eax, si
push eax
call sub.kernel32.dll_IsValidLocale
test eax, eax
je 0x408915
push 0x55
lea eax, [ebp - 0xb6]
push eax
push 0x59
movzx ebx, si
push ebx
call sub.kernel32.dll_GetLocaleInfoW
push 0x55
lea eax, [ebp - 0x160]
push eax
push 0x5a
push ebx
call sub.kernel32.dll_GetLocaleInfoW
lea eax, [ebp - 0x164]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a88
push dword [ebp - 0x164]
push 0x408950
lea eax, [ebp - 0x168]
lea edx, [ebp - 0x160]
mov ecx, 0x55
call fcn.00406a88
push dword [ebp - 0x168]
push 0x408960
lea eax, [ebp - 0x16c]
lea edx, [ebp - 0xb6]
mov ecx, 0x55
call fcn.00406a88
push dword [ebp - 0x16c]
mov eax, dword [ebp - 8]
mov edx, 5
call fcn.00406e40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40893a
lea eax, [ebp - 0x16c]
mov edx, 3
call fcn.00406898
ret