joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457a5e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, ecx
call edi
sub eax, dword [esi + 0x58]
cmp eax, 0x7530
jbe 0x457a97
mov eax, dword [esi + 0x4c]
and dword [esi + 0x4c], 0
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x54]
and dword [esi + 0x54], 0
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x50]
and dword [esi + 0x50], 0
mov dword [esi + 0x44], eax
call edi
mov dword [esi + 0x58], eax
mov eax, dword [esi + 0x48]
test eax, eax
je 0x457ac3
mov ecx, dword [esi + 0x40]
cmp ecx, 0x19999999
jbe 0x457ab3
shr ecx, 1
shr eax, 1
mov dword [esi + 0x40], ecx
mov dword [esi + 0x48], eax
mov eax, dword [esi + 0x40]
xor edx, edx
lea eax, [eax + eax*4]
shl eax, 1
div dword [esi + 0x48]
imul eax, eax, 0x64
pop edi
pop esi
ret

Function at 0x457c25
Capabilities:
Check http status code

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 8]
mov esi, ecx
push eax
push 0x20000013
push dword [esi + 4]
mov dword [ebp - 4], 4
call fcn.00456a7c
add esp, 0x14
test eax, eax
je 0x457c63
mov eax, dword [ebp - 8]
cmp eax, 0xc8
jb 0x457c67
cmp eax, 0x12c
jae 0x457c67
mov al, 1
jmp 0x457c7d
add eax, 0xd3c0
or eax, 0x80040000
push eax
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor al, al
pop esi
leave
ret

Function at 0x457d6f
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 8]
push ebx
push eax
mov ebx, ecx
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
test eax, eax
mov dword [ebp - 4], eax
je 0x457dc1
push eax
call fcn.004597af
pop ecx
mov dword [ebx + 0x40], eax
push eax
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x457dc1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4801b8
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x457dc5
xor al, al
jmp 0x457e26
push esi
push edi
mov edi, ebx
lea eax, [ebx + 4]
neg edi
sbb edi, edi
mov esi, dword [ebp - 0xc]
push 0xd
and edi, eax
pop ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10]
push eax
push str.VarFileInfoTranslation
rep movsd dword es:[edi], dword [esi]
push dword [ebx + 0x40]
call sub.VERSION.dll_VerQueryValueA
pop edi
pop esi
test eax, eax
je 0x457e24
mov eax, dword [ebp - 4]
shr eax, 2
mov dword [ebx + 0x3c], eax
shl eax, 2
push eax
call fcn.004597af
mov dword [ebx + 0x38], eax
xor eax, eax
cmp dword [ebx + 0x3c], eax
pop ecx
jbe 0x457e24
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebx + 0x38]
mov edx, dword [edx + eax*4]
mov dword [ecx + eax*4], edx
inc eax
cmp eax, dword [ebx + 0x3c]
jb 0x457e12
mov al, 1
pop ebx
leave
ret 4
Function at 0x457ecc
Capabilities:
Delete file
Move file
Read .ini file

Disassembly:
mov eax, 0x46907b
call fcn.0045962c
sub esp, 0x1dc
and dword [ebp - 0x10], 0
push ebx
push esi
push edi
and dword [ebp - 4], 0
lea eax, [ebp + 8]
push eax
call fcn.004486b2
test al, 0x10
pop ecx
je 0x458047
push 1
lea eax, [ebp + 8]
pop edi
push 0x481290
push eax
lea eax, [ebp - 0x88]
push eax
call fcn.00429f47
add esp, 0xc
lea ecx, [ebp - 0x1e8]
mov byte [ebp - 4], 1
push ecx
mov ecx, eax
call fcn.004171f3
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.0040bf10
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
cmp esi, 0xffffffff
je 0x457ff2
test edi, edi
je 0x457feb
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
lea eax, [ebp - 0x1bc]
push 0x48128c
push eax
call edi
test eax, eax
je 0x457fd6
lea eax, [ebp - 0x1bc]
push 0x481288
push eax
call edi
test eax, eax
je 0x457fd6
lea eax, [ebp - 0x11]
push 0
push eax
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], 0x46ab58
mov dword [ebp - 0x20], 0x46ab50
call fcn.00416fa1
sub esp, 0x28
lea ecx, [ebp - 0x40]
mov eax, esp
mov dword [ebp - 0x18], esp
push ecx
lea ecx, [ebp + 8]
push ecx
push eax
mov byte [ebp - 4], 4
call fcn.00429edd
add esp, 0xc
call fcn.00457ecc
add esp, 0x28
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 3
call fcn.0040bf10
lea eax, [ebp - 0x1e8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, eax
jmp 0x457f50
push esi
call ebx
or dword [ebp - 0x10], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004171f3
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x458021
lea eax, [ebp + 8]
push 1
push eax
lea ecx, [ebp - 0x60]
call fcn.004190f4
lea eax, [ebp - 0x60]
push 0x471ea8
push eax
call fcn.00459775
cmp dword [ebp - 0x10], 0xffffffff
je 0x45802c
push dword [ebp - 0x10]
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0040bf10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
lea ecx, [ebp + 8]
call fcn.004171f3
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x45802c
lea eax, [ebp + 8]
push 1
push eax
lea ecx, [ebp - 0xa8]
call fcn.004190f4
lea eax, [ebp - 0xa8]
push 0x471ea8
push eax
call fcn.00459775
Function at 0x458d6e
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
lea eax, [ebp - 0xc]
push edi
xor ebx, ebx
push eax
push ebx
push 8
mov byte [ebp - 0x1c], bl
mov byte [ebp - 0x1b], bl
mov byte [ebp - 0x1a], bl
mov byte [ebp - 0x19], bl
mov byte [ebp - 0x18], bl
mov byte [ebp - 0x17], 5
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenThreadToken]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x458dd8
call esi
cmp eax, 0x3f0
jne 0x458dc8
lea eax, [ebp - 0xc]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call esi
cmp eax, 0x78
jne 0x458dd4
mov al, 1
jmp 0x458e93
cmp eax, ebx
je 0x458e47
lea eax, [ebp - 8]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push eax
push ebx
push ebx
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
jne 0x458e47
call esi
cmp eax, 0x7a
jne 0x458e47
push dword [ebp - 8]
call fcn.004597af
mov esi, eax
pop ecx
lea eax, [ebp - 8]
cmp esi, ebx
push eax
push dword [ebp - 8]
setne byte [ebp - 0x24]
push esi
push 2
push dword [ebp - 0xc]
call edi
test eax, eax
je 0x458e3b
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
lea eax, [ebp - 0x1c]
push 2
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x458e4b
cmp byte [ebp - 0x24], bl
je 0x458e47
push esi
call fcn.004523d5
pop ecx
xor al, al
jmp 0x458e93
xor edi, edi
cmp dword [esi], ebx
mov byte [ebp - 1], bl
jbe 0x458e7b
lea eax, [esi + 4]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x458e77
add dword [ebp - 0x10], 8
inc edi
cmp edi, dword [esi]
jb 0x458e5a
jmp 0x458e7b
mov byte [ebp - 1], 1
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
cmp byte [ebp - 0x24], bl
je 0x458e90
push esi
call fcn.004523d5
pop ecx
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x45d28c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x483730
cmp edx, dword [eax]
je 0x45d2ae
add eax, 8
inc ecx
cmp eax, 0x4837c0
jl 0x45d29f
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x483730]
jne 0x45d3dc
mov eax, dword [0x499dcc]
cmp eax, 1
je 0x45d3b6
test eax, eax
jne 0x45d2df
cmp dword [0x482ff4], 1
je 0x45d3b6
cmp edx, 0xfc
je 0x45d3dc
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x45d316
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.0045bd90
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00459e30
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x45d359
lea eax, [ebp - 0x1a4]
push eax
call fcn.00459e30
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x46c910
push edi
call fcn.0045e660
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.0045bd90
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0045bda0
lea eax, [ebp - 0xa0]
push 0x46c8f0
push eax
call fcn.0045bda0
push dword [esi + 0x483734]
lea eax, [ebp - 0xa0]
push eax
call fcn.0045bda0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0045ec47
add esp, 0x2c
pop edi
jmp 0x45d3dc
lea eax, [ebp + 8]
lea esi, [esi + 0x483734]
push 0
push eax
push dword [esi]
call fcn.00459e30
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x408a90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x41102a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov al, byte [esp + 3]
push esi
push edi
mov esi, ecx
xor edi, edi
mov dword [esp + 0xc], esi
mov byte [esi + 4], al
mov dword [esi + 8], edi
mov dword [esi + 0xc], edi
mov dword [esi + 0x10], edi
mov cl, byte [esp + 0xb]
mov dword [esp + 0x18], edi
mov byte [esi + 0x14], cl
mov dword [esi + 0x18], edi
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
mov dl, byte [esp + 0xb]
mov dword [esi + 0x28], edi
mov byte [esi + 0x24], dl
mov dword [esi + 0x2c], edi
mov dword [esi + 0x30], edi
mov al, byte [esp + 0xb]
mov dword [esi + 0x3c], edi
mov byte [esi + 0x38], al
mov dword [esi + 0x40], edi
mov dword [esi + 0x44], edi
lea ecx, [esi + 0x484c]
mov byte [esp + 0x18], 3
call fcn.00409ce0
lea ecx, [esi + 0x60b8]
mov byte [esp + 0x18], 4
call fcn.00409ce0
mov ecx, dword [esp + 0x10]
mov dword [esi + 0x7924], edi
mov dword [esi + 0x7970], edi
mov dword [esi], 0x41289c
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x401020
Capabilities:
Check if file exists
Copy file
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc48
mov eax, dword [0x40e044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0xc40], ecx
call fcn.004018b0
push eax
mov dword [ebp - 0xc48], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x401069
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00401af1
mov esp, ebp
pop ebp
ret
test al, 0x10
jne 0x401056
xor ebx, ebx
mov dword [ebp - 0xc44], ebx
lea edx, [ebp - 0x624]
push edx
push 0x30c
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push ebx
push str.BGI__06d.exe
lea edx, [ebp - 0xc3c]
call fcn.00401000
lea eax, [ebp - 0xc3c]
add esp, 8
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4010a3
lea edi, [ebp - 0x624]
sub eax, edx
add edi, 0xfffffffe
lea esp, [esp]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x4010c0
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebp - 0x624]
and ecx, 3
push 0x60003
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.004015b0
mov edx, dword [ebp - 0xc48]
add esp, 8
push 0
lea ecx, [ebp - 0x624]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x40111f
inc ebx
cmp ebx, 0x186a0
jl 0x401075
mov esi, dword [ebp - 0xc44]
jmp 0x401124
mov esi, 1
mov ecx, dword [ebp - 0xc40]
lea eax, [ebp - 0x624]
push eax
call fcn.00401860
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401af1
mov esp, ebp
pop ebp
ret
Function at 0x401150
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe9c
mov eax, dword [0x40e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x44
xor ebx, ebx
lea eax, [ebp - 0xe98]
pxor xmm0, xmm0
push ebx
push eax
mov esi, ecx
mov edi, edx
movq qword [ebp - 0xe50], xmm0
movq qword [ebp - 0xe48], xmm0
call fcn.004067d0
mov ecx, 1
add esp, 0xc
mov eax, esi
mov dword [ebp - 0xe98], 0x44
mov dword [ebp - 0xe6c], 1
mov word [ebp - 0xe68], cx
call fcn.004018c0
test eax, eax
je 0x4012a9
mov eax, edi
call fcn.004018b0
mov ebx, eax
push str.Execute_as_a_launcher.
mov eax, esi
call fcn.004018d0
push eax
push ebx
push str._s___s____s_
lea edx, [ebp - 0xe40]
call fcn.00401000
add esp, 0x10
lea edx, [ebp - 0xe50]
push edx
lea eax, [ebp - 0xe98]
push eax
mov eax, edi
call fcn.004018d0
push eax
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0xe40]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401280
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
push 1
call edi
mov edx, dword [ebp - 0xe50]
push 0xffffffffffffffff
push edx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov eax, dword [ebp - 0xe50]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 1
call edi
mov ecx, dword [ebp - 0xe4c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0xe50]
push edx
call esi
xor esi, esi
push 0x60003
push ebx
call fcn.004015b0
add esp, 8
test eax, eax
jne 0x401293
push 0xa
call edi
inc esi
cmp esi, 0x64
jl 0x401264
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401af1
mov esp, ebp
pop ebp
ret
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401af1
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00401af1
mov esp, ebp
pop ebp
ret
Function at 0x4015b0
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
mov eax, dword [0x40e044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4015ea
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401af1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
test eax, 0x40000
je 0x401604
mov eax, ebx
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, dword [ebp + 0xc]
test bl, 0x10
je 0x401704
push esi
push str._s
lea edx, [ebp - 0x620]
call fcn.00401000
mov ebx, dword [ebp + 0xc]
add esp, 8
test bl, 2
je 0x4015d7
test ebx, 0x20000
je 0x4016f3
lea ecx, [ebp - 0x870]
push ecx
lea edx, [ebp - 0x620]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4016f3
lea eax, [ebp - 0x870]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x4016ec
lea ebx, [ebx]
lea ecx, [ebp - 0x844]
mov eax, 0x40d20c
jmp 0x401680
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x4016a6
test dx, dx
je 0x4016a2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x4016a6
add eax, 4
add ecx, 4
test dx, dx
jne 0x401680
xor eax, eax
jmp 0x4016ab
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4016da
lea ecx, [ebp - 0x844]
push ecx
push esi
push str._s_s
lea edx, [ebp - 0x620]
call fcn.00401000
add esp, 0xc
lea edx, [ebp - 0x620]
push ebx
push edx
call fcn.004015b0
add esp, 8
lea eax, [ebp - 0x870]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401670
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
test ebx, 0x10000
jne 0x401714
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x401724
test al, 1
je 0x4015d7
push esi
test eax, 0x10000
je 0x40171e
call fcn.00401740
add esp, 4
jmp 0x401724
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.00401af1
mov esp, ebp
pop ebp
ret

Function at 0x401af1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e044]
jne 0x401afb
repz ret
jmp fcn.0040206d
Function at 0x407adc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40e044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00403f8e
and dword [ebp - 0x14], 0
cmp dword [0x40fad8], 0
mov dword [ebp - 0x18], eax
jne 0x407b8f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x407c37
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x407c37
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40fad8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40fadc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40fae0], eax
call edi
push eax
call esi
mov dword [0x40fae8], eax
test eax, eax
je 0x407b8f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40fae4], eax
mov eax, dword [0x40fae4]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x407be8
cmp dword [0x40fae8], ecx
je 0x407be8
push eax
call esi
push dword [0x40fae8]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x407be8
test ebx, ebx
je 0x407be8
call edi
test eax, eax
je 0x407bdf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407bdf
test byte [ebp - 8], 1
jne 0x407be8
or dword [ebp + 0x10], 0x200000
jmp 0x407c1b
mov eax, dword [0x40fadc]
cmp eax, dword [ebp - 0x18]
je 0x407c1b
push eax
call esi
test eax, eax
je 0x407c1b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407c1b
mov eax, dword [0x40fae0]
cmp eax, dword [ebp - 0x18]
je 0x407c1b
push eax
call esi
test eax, eax
je 0x407c1b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40fad8]
call esi
test eax, eax
je 0x407c37
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407c39
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401af1
leave
ret

Function at 0x40ed59
Capabilities:
Encode data using xor

Disassembly:
mov edi, 0x40eae0
push eax
mov esi, dword [esp]
add esp, 4
call fcn.0040ed83
sub esi, esi
sub esi, 0x12ce1126
xor dword [edx], edi
dec esi
add eax, esi
inc edx
add eax, 0xa2ce201d
cmp edx, ebx
jne fcn.0040ed59
ret
Function at 0x4028c0
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebx
push esi
add esp, 0xfffffdf4
mov esi, edx
mov ebx, eax
test bl, bl
je 0x4028fd
xor eax, eax
mov al, bl
add eax, 0x41
dec eax
mov byte [esp], al
mov byte [esp + 1], 0x3a
mov byte [esp + 2], 0
lea eax, [esp + 0x108]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
push esp
call sub.KERNEL32.DLL_SetCurrentDirectoryA
lea eax, [esp + 4]
push eax
push 0x104
call sub.KERNEL32.DLL_GetCurrentDirectoryA
test bl, bl
je 0x40291d
lea eax, [esp + 0x108]
push eax
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esi
lea edx, [esp + 4]
mov ecx, 0x104
call fcn.00404080
add esp, 0x20c
pop esi
pop ebx
ret

Function at 0x402adc
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov esi, edx
mov ebx, eax
test ebx, ebx
jne 0x402b0b
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_2
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403f38
jmp 0x402b29
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, esi
mov eax, edi
call fcn.00402a04
mov edi, eax
test ebx, ebx
je 0x402b29
cmp dword [esi], 0
je 0x402b29
dec ebx
jmp 0x402b12
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402f50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [section.DATA]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402fe8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402fc8
xor eax, eax
push ebp
push 0x402fc1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403004
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402fc8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [section.DATA]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [section.DATA], ax
mov esp, ebp
pop ebp
ret

Function at 0x403e04
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, 8
call fcn.00402798
mov dword [eax], edi
mov edx, dword [ebp + 0x10]
mov dword [eax + 4], edx
mov byte [0x4cd045], 1
mov edx, dword [ebp + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
push eax
mov eax, 0x403dcc
push eax
push esi
push ebx
call sub.KERNEL32.DLL_CreateThread_1
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
Function at 0x406388
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_2
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406544
push reloc.ARAR.dll_Ordinal_1
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x4063e9
lea eax, [ebp - 8]
push eax
push 0xf003f
push 0
push 0x406560
push reloc.ARAR.dll_Ordinal_1
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x40645b
xor eax, eax
push ebp
push 0x406454
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
call fcn.004061e0
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x40643d
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x406580
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40645b
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrcpyA_1
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.KERNEL32.DLL_GetThreadLocale_1
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA_1
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x40653c
cmp byte [ebp - 0xd], 0
jne 0x40649d
cmp byte [ebp - 0x12], 0
je 0x40653c
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x4064b6
dec ebx
cmp byte [ebx], 0x2e
je 0x4064c5
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x4064b5
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x40653c
inc ebx
cmp byte [ebp - 0x12], 0
je 0x4064f2
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA_1
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40653c
cmp byte [ebp - 0xd], 0
je 0x40653c
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA_1
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x40653c
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.KERNEL32.DLL_lstrcpyA_1
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.KERNEL32.DLL_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40c0d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
test eax, eax
jle 0x40c10d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403f38
jmp 0x40c116
mov eax, ebx
mov edx, esi
call fcn.00403ea4
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4