joyce8/EMBER2024-capa huggingface dataset:
Function at 0x468b9c
Capabilities:
Get session integrity level

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x468d1a
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x49c6ac], 0xffffffff
je 0x468bf4
cmp dword [0x49c6b0], 0xffffffff
je 0x468bf4
cmp dword [0x49c6bc], 0
je 0x468bf4
cmp dword [0x49c6b4], 0
je 0x468bf4
cmp dword [0x49c6b8], 0
jne 0x468bf8
xor ebx, ebx
jmp 0x468bfa
mov bl, 1
test bl, bl
jne 0x468c78
call fcn.004536ec
test al, al
je 0x468cff
mov eax, dword [ebp - 4]
test eax, eax
je 0x468c28
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x468c28
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406450
mov ebx, eax
test ebx, ebx
je 0x468c33
sub ebx, 4
mov ebx, dword [ebx]
mov eax, dword [ebp - 4]
call fcn.004070f0
mov edx, eax
lea eax, [ebp - 0xc]
mov ecx, ebx
call fcn.004071a0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0xc]
call fcn.004532f0
mov ebx, eax
mov eax, dword [ebp - 0x20]
mov dword [esi], eax
test bl, bl
je 0x468cff
mov eax, dword [ebp - 0x28]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x24]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x468cff
mov eax, dword [ebp - 4]
test eax, eax
je 0x468c95
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x468c95
lea eax, [ebp - 4]
mov edx, dword [ebp - 4]
call fcn.00406450
test eax, eax
je 0x468c9e
sub eax, 4
mov eax, dword [eax]
mov ecx, eax
mov edx, dword [ebp - 4]
mov eax, dword [0x49c6bc]
call fcn.00410d24
mov eax, dword [0x49c6b4]
push eax
call sub.kernel32.dll_SetEvent
mov eax, dword [0x49c6b8]
mov dword [ebp - 0x14], eax
mov eax, dword [0x49c6ac]
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x14]
push eax
push 2
call sub.kernel32.dll_WaitForMultipleObjects
test eax, eax
jne 0x468cfd
lea eax, [ebp - 8]
mov edx, dword [0x49c6bc]
call fcn.00407220
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00410360
mov ebx, eax
mov eax, dword [ebp - 0x18]
mov dword [esi], eax
jmp 0x468cff
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x468d21
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.0040705c
ret
Function at 0x469b6c
Capabilities:
Get session integrity level

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
test dl, dl
je 0x469b84
add esp, 0xfffffff0
call fcn.004054f8
mov ebx, edx
mov dword [ebp - 4], eax
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x469d5a
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0046977c
call fcn.00451a08
mov eax, dword [0x496808]
mov eax, dword [eax]
mov edx, 0x469d8c
call fcn.00454c48
test al, al
je 0x469bde
lea ecx, [ebp - 8]
mov eax, dword [0x496808]
mov eax, dword [eax]
mov edx, 0x469d8c
call fcn.00454bf4
mov edx, dword [ebp - 8]
mov eax, dword [edi]
add eax, 0x94
call fcn.00407064
jmp 0x469bef
mov eax, dword [edi]
add eax, 0x94
mov edx, 0x469da8
call fcn.00407064
mov eax, dword [0x496808]
mov eax, dword [eax]
mov edx, 0x469dc4
call fcn.00454c48
test al, al
je 0x469c25
lea ecx, [ebp - 0xc]
mov eax, dword [0x496808]
mov eax, dword [eax]
mov edx, 0x469dc4
call fcn.00454bf4
mov edx, dword [ebp - 0xc]
mov eax, dword [0x4965a0]
call fcn.00407064
mov eax, dword [edi]
mov dword [eax + 0x74], 0x60
mov eax, dword [edi]
add eax, 0x50
mov edx, 0x469de0
call fcn.00407064
push ebp
call fcn.00469a98
pop ecx
cmp byte [0x49c6c1], 0
jne 0x469c57
call fcn.004536ec
mov byte [0x49c6c0], al
push ebp
call fcn.004698f8
pop ecx
mov eax, dword [0x496618]
mov edx, dword [edi]
mov edx, dword [edx + 0x5c]
mov ecx, 0
call fcn.004072a0
push 0
push 0xffffffffffffffff
push 0
call fcn.0040ae84
mov edx, dword [edi]
mov dword [edx + 0x14], eax
mov eax, dword [edi]
mov dword [eax + 0xac], 1
mov eax, dword [edi]
mov dword [eax + 0xb0], 2
mov eax, dword [edi]
mov dword [eax + 0xb4], 1
mov dl, 1
mov eax, dword [0x468290]
call fcn.00404fb4
mov esi, eax
mov eax, dword [edi]
mov dword [eax + 0x40], esi
mov eax, dword [edi]
mov dword [esi + 4], eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x45c2a4]
call fcn.0045e6e0
mov edx, dword [edi]
mov dword [edx + 0x44], eax
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventW
mov edx, dword [edi]
mov dword [edx + 0x34], eax
push 0
call sub.ole32.dll_CoInitialize
mov eax, dword [edi]
mov eax, dword [eax + 0x14]
push eax
call sub.kernel32.dll_ReleaseMutex
mov eax, dword [edi]
call fcn.0046a7a4
mov eax, dword [edi]
mov dword [eax + 0x2c], 0x64
mov eax, dword [edi]
mov dword [0x49c698], eax
mov eax, dword [edi]
mov eax, dword [eax + 0x34]
push eax
mov ecx, dword [edi]
mov dl, 1
mov eax, dword [0x467854]
call fcn.0046b530
mov esi, eax
mov eax, dword [edi]
mov dword [eax + 0x38], esi
mov eax, esi
call fcn.00435648
mov dl, 1
mov eax, dword [0x467a1c]
call fcn.00476c60
mov edx, dword [edi]
mov dword [edx + 0x3c], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x469d61
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.0040705c
ret
Function at 0x470348
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x470350
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x47054d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
call sub.kernel32.dll_DeleteFileW
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.004109f0
mov eax, dword [ebp - 0x24]
call fcn.00452ac4
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
je 0x4704f0
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x4704a9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x470498
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
mov ebx, dword [eax + 0x70]
mov eax, ebx
call fcn.0040887c
push eax
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 0x18]
call fcn.00470a94
mov edx, dword [ebp - 0x28]
mov ecx, ebx
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebx + 0xfc]
call dword [ebx + 0xf8]
lea eax, [ebp - 0xc]
mov ecx, 0x47056c
mov edx, dword [ebp - 4]
call fcn.00407530
push 0xff00
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x426280]
call fcn.0042f23c
mov dword [ebp - 0x20], eax
mov eax, dword [0x49c698]
mov ecx, dword [eax + 0x5c]
lea eax, [ebp - 0x10]
mov edx, 0x470584
call fcn.00407530
mov eax, dword [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x14]
call fcn.00407054
mov ecx, eax
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.0046000c
mov byte [ebp - 0x19], al
cmp byte [ebp - 0x19], 0
jne 0x470482
cmp dword [ebp - 0x14], 0
je 0x470475
mov eax, dword [ebp - 0x14]
push eax
mov ecx, 0x4705ac
mov edx, dword [ebp - 0x18]
mov eax, 0x4705cc
call fcn.00476a04
jmp 0x470482
mov edx, dword [ebp - 0x18]
mov eax, 0x4705cc
call fcn.004769b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47049f
mov eax, dword [ebp - 0x20]
call fcn.00404fe4
ret
cmp byte [ebp - 0x19], 0
je 0x47051d
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
lea eax, [ebp - 0x34]
mov ecx, 0x47056c
mov edx, dword [ebp - 4]
call fcn.00407530
mov eax, dword [ebp - 0x34]
call fcn.004070f0
push eax
call sub.kernel32.dll_MoveFileW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x470554
lea eax, [ebp - 0x34]
call fcn.00407054
lea eax, [ebp - 0x28]
mov edx, 2
call fcn.0040705c
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.0040705c
ret
Function at 0x47803c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], edx
mov ebx, eax
mov eax, dword [esp]
call fcn.00406264
push 0xe
push ebx
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_FindResourceW
mov ebp, eax
test ebp, ebp
je 0x47821a
push ebp
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_LoadResource
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
test ebx, ebx
je 0x47821a
lea edx, [ebx + 6]
sub edx, ebx
movzx eax, word [ebx + 4]
movzx ecx, ax
shl ecx, 4
add edx, ecx
mov dword [esp + 8], edx
mov edx, dword [esp + 8]
mov dword [esp + 0xc], edx
movzx edi, ax
dec edi
test edi, edi
jl 0x4780ca
inc edi
xor esi, esi
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
mov eax, dword [ebx + eax*2 + 0xe]
add dword [esp + 0xc], eax
inc esi
dec edi
jne 0x4780b4
mov eax, dword [esp]
xor ecx, ecx
mov edx, dword [esp + 0xc]
call fcn.00406c28
mov eax, dword [esp + 8]
mov dword [esp + 0xc], eax
lea eax, [ebx + 6]
sub eax, ebx
mov dword [esp + 8], eax
movzx edi, word [ebx + 4]
dec edi
test edi, edi
jl 0x478205
inc edi
xor esi, esi
push 3
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
movzx eax, word [ebx + eax*2 + 0x12]
push eax
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_FindResourceW
mov ebp, eax
test ebp, ebp
je 0x4781eb
push ebp
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [esp + 0x14], eax
push ebp
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_LoadResource
mov dword [esp + 4], eax
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_LockResource
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10], 0
je 0x4781e1
lea edx, [esp + 0x18]
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
lea eax, [ebx + eax*2 + 6]
mov ecx, 0xe
call fcn.00404350
mov eax, dword [esp + 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [esp]
call fcn.00406a2c
mov edx, esi
shl edx, 4
add edx, dword [esp + 8]
lea edx, [eax + edx]
lea eax, [esp + 0x18]
mov ecx, 0x10
call fcn.00404350
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
mov eax, dword [ebx + eax*2 + 0xe]
cmp eax, dword [esp + 0x14]
jae 0x4781c5
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
mov eax, dword [ebx + eax*2 + 0xe]
mov dword [esp + 0x14], eax
mov eax, dword [esp]
call fcn.00406a2c
mov edx, dword [esp + 0xc]
lea edx, [eax + edx]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
call fcn.00404350
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_FreeResource
mov eax, esi
add eax, eax
add eax, eax
add eax, eax
sub eax, esi
mov eax, dword [ebx + eax*2 + 0xe]
add dword [esp + 0xc], eax
inc esi
dec edi
jne 0x4780f9
mov eax, dword [esp]
call fcn.00406a2c
mov edx, eax
mov eax, ebx
mov ecx, dword [esp + 8]
call fcn.00404350
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x47e8f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp + 8], edx
mov dword [esp], eax
mov eax, dword [esp + 8]
xor edx, edx
call fcn.00407064
mov esi, dword [esp]
shr esi, 4
inc esi
call sub.kernel32.dll_GetThreadLocale
and ax, 0x3ff
or ax, 0x400
movzx eax, ax
push eax
mov edi, esi
push edi
push 6
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_FindResourceExW_1
mov ebx, eax
test ebx, ebx
jne 0x47e94d
mov eax, 0x409
push eax
push edi
push 6
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_FindResourceExW_1
mov ebx, eax
test ebx, ebx
je 0x47e9d0
push ebx
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_SizeofResource
mov esi, eax
push ebx
mov eax, dword [0x499c38]
push eax
call sub.kernel32.dll_LoadResource
mov ebp, eax
test esi, esi
je 0x47e9ca
test ebp, ebp
je 0x47e9ca
push ebp
call sub.kernel32.dll_LockResource
mov ebx, eax
mov eax, ebx
cdq
push edx
push eax
mov eax, esi
xor edx, edx
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov dword [esp + 0xc], eax
xor edi, edi
cmp ebx, dword [esp + 0xc]
jae 0x47e9ca
movzx esi, word [ebx]
add ebx, 2
mov eax, dword [esp]
and eax, 0xf
cmp edi, eax
jne 0x47e9bc
movzx ecx, si
mov eax, dword [esp + 8]
mov edx, ebx
call fcn.004071a0
jmp 0x47e9ca
inc edi
movzx eax, si
add eax, eax
add ebx, eax
cmp ebx, dword [esp + 0xc]
jb 0x47e99c
push ebp
call sub.kernel32.dll_FreeResource
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x485a80
Capabilities:
Get graphical window text
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, eax
mov edi, dword [ebp + 8]
mov edi, dword [edi - 8]
call fcn.004560e0
mov ebx, eax
mov edx, 0x485b34
mov eax, ebx
call fcn.00456268
mov dl, 5
mov eax, ebx
call fcn.00456258
mov eax, 0xd
call fcn.0047ea88
mov ecx, eax
mov edx, 4
mov eax, ebx
call fcn.00456224
mov eax, dword [edi + 0x64]
call fcn.00458a78
push 0
mov eax, dword [edi + 0xa4]
push eax
call sub.user32.dll_ShowWindow
push 0
mov eax, dword [edi + 0x9c]
push eax
call sub.user32.dll_ShowWindow
push 1
mov eax, ebx
call fcn.004563c4
push eax
push 0x30
mov eax, dword [edi + 0xa0]
push eax
call sub.user32.dll_SendMessageW_1
mov eax, dword [esi + 0x50]
call fcn.004070f0
push eax
mov eax, dword [edi + 0xa0]
push eax
call sub.user32.dll_SetWindowTextW
push 5
mov eax, dword [edi + 0xa0]
push eax
call sub.user32.dll_ShowWindow
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x486f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
test dl, dl
je 0x486f45
add esp, 0xfffffff0
call fcn.004054f8
mov dword [ebp - 4], ecx
mov byte [ebp - 5], dl
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040704c
xor eax, eax
push ebp
push 0x486fc9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.kernel32.dll_GetModuleHandleW_3
mov esi, eax
push 0
mov eax, dword [ebp - 4]
call fcn.004070f0
push eax
mov eax, dword [ebp + 8]
push eax
push esi
call sub.kernel32.dll_FindResourceExW_1
mov edi, eax
mov dword [ebx + 0xc], edi
test edi, edi
je 0x486fb3
push edi
push esi
call sub.kernel32.dll_LoadResource
mov dword [ebx + 0x10], eax
cmp dword [ebx + 0x10], 0
je 0x486fb3
mov eax, dword [ebx + 0x10]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebx + 0x14], eax
mov eax, dword [ebx + 0xc]
push eax
push esi
call sub.kernel32.dll_SizeofResource
mov dword [ebx + 0x20], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x486fd0
lea eax, [ebp - 4]
call fcn.00407054
ret
Function at 0x2580fc62
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x2580fc71
pop dword [ebp - 0x20]
mov eax, 0xd547f352
sub eax, 0xafc6f6e1
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x1e8593a0
add dword [ebp - 0x30], 0x2fccb1ab
mov dword [ebp - 0x2c], 0x44d867a1
add dword [ebp - 0x2c], 0xed5ae4a4
mov dword [ebp - 0x28], 0xf446c934
sub dword [ebp - 0x28], 0xa7fa8506
mov dword [ebp - 0x24], 0xe369e519
sub dword [ebp - 0x24], 0xe369e519
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x48d12a1
sub dword [ebp - 0x30], 0x901aa94b
mov dword [ebp - 0x2c], 0x4a279338
sub dword [ebp - 0x2c], 0x8bb31c3
mov dword [ebp - 0x28], 0xfc299e00
sub dword [ebp - 0x28], 0x98ba3194
mov dword [ebp - 0x24], 0x9278921b
add dword [ebp - 0x24], 0x6d876de5
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x5be73263
add eax, 0xc99a9e1d
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3d2d6
push 0
call eax
mov ecx, 0x4a5c
xor edi, edi
add edi, eax
mov ebx, 0x25829600
add ebx, dword [ebp - 0x20]
mov edx, 0xccc65ae4
add edx, 0xbbf55859
mov esi, dword [ebx]
sub dword [ebp - 4], 0x12f2624c
sub esi, edx
xor dword [ebp - 0x1c], 0xb14423b
mov dword [edi], esi
sub dword [ebp - 0x14], 0xc119f7d5
add edi, 4
add ebx, 0x32b402a7
sub ebx, 0x32b402a3
loop 0x2580fd84
add eax, 0x31bc3624
sub eax, 0x31bb19e1
xor ebx, ebx
add ebx, eax
add eax, 0xec777a6e
sub eax, 0xec777a69
mov ecx, 0x25800000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x405a8c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc edx
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.0040461a
cmpsd dword [esi], dword es:[edi]
cli
sahf
pop eax
lea eax, [ebp - 0x72c]
push eax
call fcn.0040462a
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.004045df
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.0040461a
add al, 0xe0
test eax, 0xe8858d5e
clc
invalid

Function at 0x4068df
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x4572d0
push esi
call fcn.0040616a
push esi
call fcn.00405eb9
mov edi, eax
test edi, edi
jne 0x406900
xor eax, eax
jmp 0x40695d
push edi
call fcn.00406199
test byte [0x472e28], 0x80
je 0x40691c
movzx eax, word [edi]
test ax, ax
je 0x4068fc
cmp eax, 0x5c
je 0x4068fc
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x40693e
push esi
call fcn.00406436
test eax, eax
je 0x406938
test byte [eax], 0x10
je 0x406962
push esi
call fcn.004068b2
push esi
call ebx
cmp eax, edi
jg 0x406929
push esi
call fcn.00406883
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x40695c
Function at 0x40fc98
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
mov word [ebp - 0xc], 0x500
lea eax, [ebp - 8]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov ecx, eax
mov dword [ebp - 4], ecx
test ecx, ecx
je 0x40fcf1
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 8]
neg eax
sbb eax, eax
and dword [ebp - 4], eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
xor eax, eax
test ecx, ecx
pop ebx
setne al
mov esp, ebp
pop ebp
ret

Function at 0x4104f5
Capabilities:
Create thread

Disassembly:
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi], ebx
jbe 0x410570
push ebp
push edi
lea edi, [esi + 4]
lea eax, [esp + 0x10]
push eax
push 0
push esi
push 0x41062f
push 0x10000
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ebp, eax
test ebp, ebp
jne 0x41054c
push str.CreateThread_failed
push 0x4400e0
call fcn.00406cce
pop ecx
pop ecx
mov ecx, 0x4400e0
call fcn.0041e214
push 2
mov ecx, 0x4400e0
call fcn.00406cc9
mov dword [edi], ebp
inc dword [esi + 0x104]
mov eax, dword [0x447368]
test eax, eax
je 0x410566
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
inc ebx
add edi, 4
cmp ebx, dword [esi]
jb 0x410505
pop edi
pop ebp
pop esi
pop ebx
pop ecx
ret
Function at 0x418fe6
Capabilities:
Hide graphical window

Disassembly:
mov al, byte [esp + 0x14]
sub esp, 0x10
push ebx
push ebp
mov ebp, dword [esp + 0x20]
mov ebx, ecx
push esi
push 0
push ebp
mov dword [ebx + 8], ebp
mov byte [ebx + 0x26], al
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esp + 0x20]
mov ecx, ebx
call fcn.00418d3f
cmp dword [ebx + 0x1c], 0
je 0x41901f
push dword [ebx + 0x1c]
call fcn.00422b4e
pop ecx
cmp dword [esp + 0x28], 0
jne 0x41902a
xor eax, eax
jmp 0x419034
push dword [esp + 0x28]
call fcn.0042668c
pop ecx
mov dword [ebx + 0x1c], eax
mov eax, dword [esp + 0x2c]
mov dword [ebx + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetWindowRect]
push 2
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.dll_GetParent]
push eax
push 0
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebx + 4], 0
je 0x419070
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esp + 0xc]
mov esi, dword [esp + 0x14]
push edi
push ebx
push dword [ebx]
sub esi, eax
lea edi, [eax + 1]
push 0
push ebp
sub esi, 2
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov eax, dword [esp + 0x2c]
sub eax, dword [esp + 0x24]
push eax
push esi
push dword [esp + 0x2c]
xor esi, esi
push edi
push 0x40000000
push esi
push 0x4331b4
push esi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebx + 4], eax
pop edi
cmp dword [ebx + 0x10], esi
jne 0x4190f2
test ebp, ebp
je 0x419108
cmp dword [ebx + 0x20], esi
jne 0x419108
cmp dword [ebx + 0x1c], esi
je 0x419108
push dword [ebx + 0x1c]
mov ecx, ebx
call fcn.00418e11
mov esi, eax
test esi, esi
je 0x419108
push 5
push ebp
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetWindowTextW]
push esi
call fcn.00422b4e
pop ecx
jmp 0x419108
test eax, eax
je 0x419108
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 0x14

Function at 0x4195f8
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8
Function at 0x41963a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push 0x4333bc
push dword [esp + 0x10]
push dword [0x440060]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
je 0x419730
push ebx
push esi
push dword [0x440060]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
test ebx, ebx
je 0x41968d
push esi
push dword [0x440060]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41968d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x419694
xor eax, eax
jmp 0x41972f
push ebp
push edi
push ebx
xor ebp, ebp
push 2
mov dword [esp + 0x18], ebp
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x419729
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x419722
push ebx
push esi
push eax
call fcn.0041ea80
add esp, 0xc
mov dword [esp + 0x18], ebp
lea eax, [esp + 0x18]
push eax
push ebp
push edi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x41971b
push ebp
push dword [esp + 0x1c]
call fcn.004195cf
mov ecx, dword [esp + 0x18]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
test esi, esi
je 0x41971b
mov ecx, dword [esi + 8]
mov dword [esi + 8], ebp
test ecx, ecx
jne 0x419713
push 0xffffff
lea eax, [esp + 0x14]
push eax
push dword [esi + 4]
call sub.gdiplus.dll_GdipCreateHBITMAPFromBitmap
test eax, eax
je 0x419713
mov dword [esi + 8], eax
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
pop ecx
ret 4

Function at 0x419d99
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
cmp dword [0x43d610], 0
push ebx
push esi
push edi
mov ebx, 0x400
jne 0x419de4
push 0x64
lea eax, [ebp - 0x12c]
push eax
push 0xf
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ax, word [ebp - 0x12c]
mov word [0x45de30], ax
xor eax, eax
mov word [0x45de32], ax
mov dword [0x43d610], 0x45de30
push 0x32
lea eax, [ebp - 0x64]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040f980
mov edi, dword [ebp + 0x10]
xor eax, eax
mov esi, dword [ebp + 0x14]
push esi
push edi
push 0x43d600
mov word [edi], ax
lea eax, [ebp - 0x64]
push eax
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetNumberFormatW]
xor eax, eax
mov word [edi + esi*2 - 2], ax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10