joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418220
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aca8d
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 7
mov word [ebp - 0x48], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0x530043
lea edx, [eax + 2]
mov dword [ebp - 0x24], 0x430052
mov dword [ebp - 0x20], 0x720068
mov dword [ebp - 0x1c], 0x2e006d
mov dword [ebp - 0x18], 0x780065
mov dword [ebp - 0x14], 0x65
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x418297
sub eax, edx
lea ecx, [ebp - 0x48]
sar eax, 1
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00404350
cmp dword [ebp - 0x34], 8
lea edx, [ebp - 0x48]
push 0x1fffff
cmovae edx, dword [ebp - 0x48]
lea ecx, [ebp - 0x30]
xorps xmm0, xmm0
push 0
push 1
movlpd qword [ebp - 0x30], xmm0
call fcn.00432ee0
xor eax, eax
lea ecx, [ebp - 0x30]
add esp, 0xc
cmp eax, dword [ebp - 0x2c]
sbb esi, esi
neg esi
call fcn.00409cc0
mov edx, dword [ebp - 0x34]
cmp edx, 8
jb 0x418321
mov ecx, dword [ebp - 0x48]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418317
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41833d
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3

Function at 0x418350
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0x63002f
xor eax, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
push edi
mov dword [esi], eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x24], 0x760073
mov dword [ebp - 0x20], 0x300032
mov dword [ebp - 0x1c], 0x320032
mov dword [ebp - 0x18], 0x300031
mov dword [ebp - 0x14], 0x300032
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x78006e
mov word [ebp - 8], ax
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4183c0
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
Function at 0x4183f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0x63002f
xor eax, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x24], 0x760073
lea edx, [ecx + 2]
mov dword [esi], eax
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x20], 0x300032
mov dword [ebp - 0x1c], 0x330032
mov dword [ebp - 0x18], 0x330030
mov dword [ebp - 0x14], 0x310030
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x78006e
mov word [ebp - 8], ax
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418460
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret

Function at 0x418490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0x72002f
xor eax, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
push edi
mov dword [esi], eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x24], 0x700069
mov dword [ebp - 0x20], 0x300032
mov dword [ebp - 0x1c], 0x330032
mov dword [ebp - 0x18], 0x330030
mov dword [ebp - 0x14], 0x390032
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x78006e
mov word [ebp - 8], ax
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418500
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret

Function at 0x418530
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x28], 0x73002f
xor eax, eax
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], esi
push edi
mov dword [esi], eax
lea edx, [ecx + 2]
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], 7
mov dword [ebp - 0x24], 0x70006e
mov dword [ebp - 0x20], 0x300032
mov dword [ebp - 0x1c], 0x330032
mov dword [ebp - 0x18], 0x330030
mov dword [ebp - 0x14], 0x300033
mov dword [ebp - 0x10], 0x690073
mov dword [ebp - 0xc], 0x78006e
mov word [ebp - 8], ax
mov word [esi], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4185a0
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
Function at 0x4185d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
mov dword [ebp - 0x2c], 0x63002f
xor eax, eax
mov dword [ebp - 0x30], esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], esi
push edi
mov dword [esi], 0
lea edx, [ecx + 2]
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov dword [ebp - 0x28], 0x720073
mov dword [ebp - 0x24], 0x75006c
mov dword [ebp - 0x20], 0x32006e
mov dword [ebp - 0x1c], 0x320030
mov dword [ebp - 0x18], 0x300033
mov dword [ebp - 0x14], 0x310034
mov dword [ebp - 0x10], 0x730030
mov dword [ebp - 0xc], 0x6e0069
mov dword [ebp - 8], 0x78
mov word [esi], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x418650
sub ecx, edx
lea eax, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret

Function at 0x418680
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.00418350
mov edx, dword [ebp - 8]
lea esi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp edx, 8
cmovae esi, ecx
test edi, edi
je 0x4186ce
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x4186ce
mov esi, 1
jmp 0x4186d0
xor esi, esi
cmp edx, 8
jb 0x418700
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4186f6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x418712
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3

Function at 0x418720
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.004183f0
mov edx, dword [ebp - 8]
lea esi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp edx, 8
cmovae esi, ecx
test edi, edi
je 0x41876e
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x41876e
mov esi, 1
jmp 0x418770
xor esi, esi
cmp edx, 8
jb 0x4187a0
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418796
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4187b2
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3
Function at 0x4187c0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ade3d
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x28]
mov edi, eax
call fcn.00418490
mov dword [ebp - 4], 0
lea esi, [ebp - 0x28]
mov edx, dword [ebp - 0x14]
cmp edx, 8
mov ecx, dword [ebp - 0x28]
cmovae esi, ecx
test edi, edi
je 0x4188dd
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
push esi
push edi
call ebx
mov ecx, eax
test ecx, ecx
je 0x4188d7
cmp dword [ebp - 0x2c], 0
je 0x4188ca
cmp dword [ebp - 0x30], 0
je 0x4188ca
mov eax, dword [ebp - 0x18]
lea esi, [ecx + eax*2]
mov edi, esi
cmp word [edi], 0
je 0x4188ca
cmp word [edi + 2], 0x22
jne 0x4188ca
push 0x4c5098
add edi, 4
push edi
call ebx
mov ebx, eax
test ebx, ebx
je 0x4188ca
mov eax, esi
cdq
mov ecx, eax
mov esi, edx
mov eax, ebx
cdq
sub eax, ecx
mov ecx, dword [ebp - 0x2c]
sbb edx, esi
add eax, 0xfffffffc
adc edx, 0xffffffff
shrd eax, edx, 1
push eax
push edi
call fcn.00404350
cmp word [ebx + 2], 0
je 0x4188ca
cmp word [ebx + 4], 0x22
jne 0x4188ca
push 0x4c5098
add ebx, 6
push ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x4188ca
mov ecx, dword [ebp - 0x30]
cdq
mov edi, eax
mov esi, edx
mov eax, ebx
cdq
sub edi, eax
sbb esi, edx
shrd edi, esi, 1
push edi
push ebx
call fcn.00404350
mov edx, dword [ebp - 0x14]
mov esi, 1
mov ecx, dword [ebp - 0x28]
jmp 0x4188df
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x28]
xor esi, esi
cmp edx, 8
jb 0x41890f
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x418905
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x41892d
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3

Function at 0x418940
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x1c]
mov edi, eax
call fcn.00418530
mov edx, dword [ebp - 8]
lea esi, [ebp - 0x1c]
mov ecx, dword [ebp - 0x1c]
cmp edx, 8
cmovae esi, ecx
test edi, edi
je 0x41898e
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov edx, dword [ebp - 8]
mov ecx, dword [ebp - 0x1c]
test eax, eax
je 0x41898e
mov esi, 1
jmp 0x418990
xor esi, esi
cmp edx, 8
jb 0x4189c0
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4189b6
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4189d2
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
int3
Function at 0x419210
Capabilities:
Check mutex on windows

Disassembly:
push ebx
push esi
push edi
push str.CSBUBS202303301635mutex
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
call esi
cmp eax, 0xb7
jne 0x419259
test ebx, ebx
je 0x41923e
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push eax
push str.HandleUpdateBrowserSetting
push str._s:CreateMutex___alreadly_run:_d
call fcn.00404c50
add esp, 0xc
xor eax, eax
pop edi
pop esi
pop ebx
ret
push 0x96
xor edx, edx
mov edi, 1
xor esi, esi
call fcn.0040f2e0
test eax, eax
jne 0x4192b2
push esi
push str.HandleUpdateBrowserSetting
push str._s:InitBrowserPlusPathAndConfig_RetryCount_d__failed
call fcn.00404c50
add esp, 0xc
test edi, edi
je 0x419296
push 0
push 1
push 0
xor edx, edx
call fcn.00410570
xor edi, edi
push 0x7d0
inc esi
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x96
xor edx, edx
call fcn.0040f2e0
test eax, eax
je 0x419270
push esi
push str.HandleUpdateBrowserSetting
push str._s:InitBrowserPlusPathAndConfig_RetryCount_d__succeed
call fcn.00404c50
add esp, 0xc
xor edx, edx
push 0
push 1
push 0
call fcn.00410570
test ebx, ebx
je 0x4192dd
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x41b500
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword fs:[0x2c]
push ebx
push esi
push edi
mov esi, dword [eax]
mov edi, ecx
mov eax, dword [0x4def24]
mov ebx, edx
mov dword [ebp - 4], edi
cmp eax, dword [esi + 4]
jle 0x41b556
push 0x4def24
call fcn.0044af51
add esp, 4
cmp dword [0x4def24], 0xffffffff
jne 0x41b556
push str.xmbpcbrowser_sinx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0x4def24
mov dword [0x4def28], eax
call fcn.0044af07
add esp, 4
cmp dword [0x4dedc8], 0
jne 0x41b60b
xor eax, eax
nop word [eax + eax]
mov byte [eax + 0x4decc8], al
inc eax
cmp eax, 0x100
jl 0x41b570
mov esi, dword [0x4def28]
xor ecx, ecx
mov eax, ecx
cdq
idiv esi
mov al, byte [edx + str.xmbpcbrowser_sinx]
mov byte [ecx + 0x4debc8], al
inc ecx
cmp ecx, 0x100
jl 0x41b586
xor edi, edi
xor esi, esi
nop dword [eax]
nop dword [eax + eax]
mov dl, byte [esi + 0x4decc8]
movzx eax, byte [esi + 0x4debc8]
add edi, eax
movzx ecx, dl
add edi, ecx
and edi, 0x800000ff
jns 0x41b5d4
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [edi + 0x4decc8]
xor al, dl
mov byte [esi + 0x4decc8], al
xor byte [edi + 0x4decc8], al
movzx eax, byte [edi + 0x4decc8]
xor byte [esi + 0x4decc8], al
inc esi
cmp esi, 0x100
jl 0x41b5b0
mov edi, dword [ebp - 4]
mov dword [0x4dedc8], 1
xor esi, esi
xor edx, edx
test ebx, ebx
jle 0x41b63f
movzx eax, dl
movzx eax, byte [eax + 0x4decc8]
add esi, eax
and esi, 0x800000ff
jns 0x41b62f
dec esi
or esi, 0xffffff00
inc esi
mov al, byte [esi + 0x4decc8]
lea ecx, [edx + edi]
xor byte [ecx], al
inc edx
cmp edx, ebx
jl 0x41b613
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41ca20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae44e
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x34], esi
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x2c], 1
lea edx, [ecx + 2]
mov dword [ebp - 0x28], 0x720050
mov dword [ebp - 0x24], 0x660065
mov dword [ebp - 0x20], 0x720065
mov dword [ebp - 0x1c], 0x6e0065
mov dword [ebp - 0x18], 0x650063
mov dword [ebp - 0x14], 0x73
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41cab0
sub ecx, edx
lea eax, [ebp - 0x28]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
Function at 0x41f640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae7fe
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x40], esi
xor eax, eax
mov dword [ebp - 0x38], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x38], 1
lea edx, [ecx + 2]
mov dword [ebp - 0x34], 0x480053
mov dword [ebp - 0x30], 0x4c0045
mov dword [ebp - 0x2c], 0x44004c
mov dword [ebp - 0x28], str.resource_unavailable_try_again
mov dword [ebp - 0x24], 0x44005f
mov dword [ebp - 0x20], 0x660065
mov dword [ebp - 0x1c], 0x690056
mov dword [ebp - 0x18], 0x770065
mov word [ebp - 0x14], ax
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f6e0
sub ecx, edx
lea eax, [ebp - 0x34]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret

Function at 0x41f7e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae84e
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x34], esi
mov dword [ebp - 0x38], esi
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], 1
lea edx, [ecx + 2]
mov dword [ebp - 0x2c], 0x690044
mov dword [ebp - 0x28], 0x650072
mov dword [ebp - 0x24], 0x740063
mov dword [ebp - 0x20], 0x490055
mov dword [ebp - 0x1c], str._Ul3
mov dword [ebp - 0x18], 0x44004e
mov word [ebp - 0x14], ax
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41f870
sub ecx, edx
lea eax, [ebp - 0x2c]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.00404350
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
Function at 0x41fa20
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41fad6
cmp word [esi], 0
je 0x41fad6
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x41facd
call dword [sym.imp.USER32.dll_EmptyClipboard]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x41fac7
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 4], eax
test eax, eax
je 0x41fac7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push esi
push dword [ebp - 4]
call fcn.004723c0
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x41fac2
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, 1
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x41fbf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004a63c0
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x2000
lea eax, [ebp - 0x2004]
mov edi, ecx
push 0
push eax
call fcn.00472940
add esp, 0xc
lea eax, [ebp - 0x2004]
push 0
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41fc74
lea edx, [ebp - 0x2004]
push esi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41fc41
sub edx, esi
lea eax, [ebp - 0x2004]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.00404350
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret

Function at 0x41fc90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.004a63c0
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x2000
lea eax, [ebp - 0x2004]
mov edi, ecx
push 0
push eax
call fcn.00472940
add esp, 0xc
lea eax, [ebp - 0x2004]
push 0
push 0x10
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x41fd14
lea edx, [ebp - 0x2004]
push esi
lea esi, [edx + 2]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x41fce1
sub edx, esi
lea eax, [ebp - 0x2004]
sar edx, 1
mov ecx, edi
push edx
push eax
call fcn.00404350
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
Function at 0x420200
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4ae94d
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4d500c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x34], edx
xor eax, eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 7
mov word [ebp - 0x2c], ax
lea ecx, [ebp - 0x4c]
mov dword [ebp - 4], eax
call fcn.004208e0
push eax
lea ecx, [ebp - 0x2c]
call fcn.00403f10
mov edx, dword [ebp - 0x38]
cmp edx, 8
jb 0x420297
mov ecx, dword [ebp - 0x4c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x42028d
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4203d4
push edx
push ecx
call fcn.0044b3bd
add esp, 8
cmp dword [ebp - 0x18], 8
lea ebx, [ebp - 0x2c]
push 0
cmovae ebx, dword [ebp - 0x2c]
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov esi, eax
test esi, esi
je 0x42037e
add esi, 0x20
push esi
call fcn.0047c2f8
mov edi, eax
add esp, 4
test edi, edi
je 0x42037e
push edi
push esi
push 0
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x420375
lea eax, [ebp - 0x14]
mov dword [ebp - 0x30], 0
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x14], 0
push eax
push 0x4c4740
push edi
call dword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x420375
mov eax, dword [ebp - 0x30]
movzx esi, word [eax + 0xa]
movzx edx, word [eax + 8]
movzx ecx, word [eax + 0xe]
movzx eax, word [eax + 0xc]
push eax
push ecx
push edx
push esi
lea eax, [ebp - 0x4c]
push str._d._d._d._d
push eax
call fcn.0041a6e0
mov ecx, dword [ebp - 0x34]
add esp, 0x18
push eax
call fcn.004041b0
mov edx, dword [ebp - 0x38]
cmp edx, 0x10
jb 0x420365
mov ecx, dword [ebp - 0x4c]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x42035b
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4203d9
push edx
push ecx
call fcn.0044b3bd
add esp, 8
push edi
call fcn.0047a879
add esp, 4
mov esi, 1
jmp 0x420380
push edi
call fcn.0047a879
add esp, 4
xor esi, esi
mov edx, dword [ebp - 0x18]
cmp edx, 8
jb 0x4203b6
mov ecx, dword [ebp - 0x2c]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x4203ac
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4203de
push edx
push ecx
call fcn.0044b3bd
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0044ae26
mov esp, ebp
pop ebp
ret
call fcn.0047aa50
call fcn.0047aa50
call fcn.0047aa50
int3