joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401207
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x834
mov eax, dword [0x4182d8]
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [0x4182dc]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x10], edx
mov esi, dword [edi]
mov ebx, dword [edi + 4]
mov dword [ebp - 4], esi
mov dword [ebp - 0x28], 0x9e3779b9
mov dword [ebp - 0x34], eax
call fcn.00401200
add dword [ebp - 0x10], 0x23f
cmp dword [0xec34a4], 0x14
jne 0x401263
push edx
lea eax, [ebp - 0x834]
push eax
push edx
call dword [sym.imp.KERNEL32.dll_FindNextVolumeW]
mov eax, dword [0x4182e4]
mov edi, dword [0x4182e0]
push 0x20
pop edx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], 2
add dword [ebp - 0x1c], 3
mov eax, esi
mov dword [ebp - 0xc], 0xedeb2e40
shl eax, 4
add eax, edi
cmp dword [0xec34a4], 0xfa9
mov dword [ebp - 8], eax
mov eax, dword [0xec34a0]
cmove eax, dword [ebp - 0xc]
and dword [ebp - 0xc], 0
cmp dword [0xec34a4], 0x3eb
mov dword [0xec34a0], eax
mov eax, dword [0xec33f8]
cmove eax, dword [ebp - 0xc]
mov dword [0xec33f8], eax
mov eax, dword [ebp - 0x10]
add eax, esi
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
shr eax, 5
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
and dword [ebp - 0x14], 0
mov dword [0xec349c], 0xf4ea3dee
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 4]
sub ebx, eax
mov dword [ebp - 0x18], eax
mov eax, ebx
shl eax, 4
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
add dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x1c]
add eax, ebx
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
add dword [ebp - 4], eax
mov eax, dword [ebp - 4]
xor dword [ebp - 0x14], eax
cmp dword [0xec34a4], 0xb03
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
jne 0x401362
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleAliasesLengthA]
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x20]
xor eax, dword [ebp - 0x18]
sub esi, eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x28]
sub dword [ebp - 0x10], eax
dec edx
mov dword [ebp - 0x20], edx
jne 0x401277
mov edi, dword [ebp - 0x30]
mov dword [edi], esi
mov dword [edi + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c062
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x417f10]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00407f6c
mov dword [ebp - 0x14], eax
cmp dword [0x81ec94], esi
jne 0x40c155
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c0e2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c235
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c235
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c235
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x81ec94], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x81ec98], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x81ec9c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81eca4], eax
test eax, eax
je 0x40c152
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x81eca0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c17a
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c16d
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c18f
push 4
pop eax
jmp 0x40c237
cmp dword [ebp - 0x14], esi
je 0x40c18f
push dword [0x81ec94]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c174
mov eax, dword [0x81eca0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c1ed
cmp dword [0x81eca4], edi
je 0x40c1ed
push eax
call ebx
push dword [0x81eca4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c1ed
test eax, eax
je 0x40c1ed
call ecx
test eax, eax
je 0x40c1e2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c1e2
test byte [ebp - 8], 1
jne 0x40c1ed
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c21d
mov eax, dword [0x81ec98]
cmp eax, edi
je 0x40c21a
push eax
call ebx
test eax, eax
je 0x40c21a
call eax
mov esi, eax
test esi, esi
je 0x40c21a
mov eax, dword [0x81ec9c]
cmp eax, edi
je 0x40c21a
push eax
call ebx
test eax, eax
je 0x40c21a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x81ec94]
call ebx
test eax, eax
je 0x40c235
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c237
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004040a8
mov esp, ebp
pop ebp
ret
Function at 0x4010c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x60
fldz
xor eax, eax
mov word [esp], ax
push esi
xor esi, esi
mov dword [esp + 8], esi
fstp qword [esp + 8]
mov cx, word [0x423c98]
movsx edx, cx
mov dword [esp + 8], edx
fild dword [esp + 8]
fstp qword [esp + 8]
dec word [0x423c98]
fld qword [0x423ef8]
mov dword [esp + 0x20], 0x44
fadd qword [0x41f340]
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], esi
fstp qword [0x423ef8]
mov ax, word [esp + 4]
movsx ecx, ax
mov dword [esp + 8], ecx
fild dword [esp + 8]
fsub qword [0x423ef8]
call fcn.0040b240
xor edx, edx
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 0x6c]
mov word [esp + 0x56], dx
lea edx, [esp + 0x24]
push edx
push esi
push esi
push 8
push esi
mov word [esp + 0x1c], ax
push esi
mov eax, 1
mov word [esp + 0x6c], ax
mov eax, dword [esp + 0x88]
push esi
push eax
push ecx
mov dword [esp + 0x74], 1
mov dword [esp + 0x7c], esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop esi
add esp, 0x60
ret

Function at 0x4013d0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10
fldz
push esi
fstp qword [esp + 0xc]
push edi
fldz
mov edi, dword [esp + 0x20]
mov dword [esp + 0xc], 0
fstp dword [esp + 8]
push edi
call fcn.0040b489
dec word [0x423a88]
mov esi, eax
mov ax, word [0x423a88]
movsx ecx, ax
mov eax, dword [esp + 0x10]
mov edx, 0x95663ed0
sub edx, ecx
mov dword [esp + 0x24], edx
add esp, 4
fild dword [esp + 0x20]
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fadd qword [esp + 0x10]
fsub qword [0x41f388]
fcompp
fnstsw ax
fld qword [esp + 0x10]
fld1
fsub st(1), st(0)
fxch st(1)
fstp qword [esp + 0x10]
test ah, 1
jne 0x40147d
inc dword [0x423ed4]
mov ecx, dword [0x423ed4]
mov dword [esp + 0x20], ecx
fild dword [esp + 0x20]
fadd dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [esp + 0x20], edx
fild dword [esp + 0x20]
faddp st(1)
call fcn.0040b240
mov dword [esp + 0xc], eax
fadd dword [esp + 8]
fstp dword [esp + 8]
jmp 0x40147f
fstp st(0)
push ebx
mov ebx, dword [esp + 0x20]
push edi
push ebx
push esi
call fcn.0040b560
mov eax, dword [0x4276e4]
sub eax, 0x423004
add esp, 0xc
add edi, esi
add eax, ebx
mov ecx, esi
pop ebx
cmp esi, edi
je 0x4014c6
fld dword [0x4230cc]
inc ecx
fadd dword [esp + 8]
inc eax
fadd qword [0x423b78]
fstp qword [0x423b78]
mov dl, byte [eax - 1]
xor byte [ecx - 1], dl
cmp ecx, edi
jne 0x4014a4
pop edi
mov eax, esi
pop esi
add esp, 0x10
ret
Function at 0x4023a0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
xor eax, eax
mov dword [esp + 0x14], 0
xor ecx, ecx
push 3
mov word [esp + 0x14], ax
push str.E:RI9n
mov word [esp + 0x14], cx
call fcn.004013d0
mov ebx, dword [esp + 0x24]
mov esi, eax
push esi
push ebx
call fcn.0040bc6f
mov edi, eax
add esp, 0x10
test edi, edi
jne 0x402442
mov edx, dword [esp + 0x14]
mov ax, word [esp + 0x10]
movsx ecx, ax
mov dword [esp + 0x14], edx
sub ecx, 0x13560c34
fild dword [esp + 0x14]
mov dword [esp + 0x14], ecx
fild dword [esp + 0x14]
fsub dword [0x425db8]
fsubp st(1)
call fcn.0040b240
mov dword [esp + 0x14], eax
fld dword [0x425db8]
fsub qword [0x41f340]
push 0x3e8
fstp dword [0x425db8]
dec dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push ebx
call fcn.0040bc6f
mov edi, eax
add esp, 8
test edi, edi
je 0x40246c
push edi
push 1
lea edx, [esp + 0x28]
push 4
push edx
call fcn.0040bb29
push edi
call fcn.0040b94b
fld dword [0x423cec]
fsub qword [0x41f460]
add esp, 0x14
fstp dword [0x423cec]
xor eax, eax
mov word [esp + 0xc], ax
mov word [esi], ax
mov dword [esp + 0xc], eax
mov byte [esi + 2], al
fld dword [0x423c0c]
fadd qword [0x41f340]
fstp dword [0x423c0c]
fld dword [0x423c0c]
fsubr qword [0x41f398]
call fcn.0040b240
mov word [esp + 0xc], ax
push esi
call fcn.0040b324
mov cx, word [esp + 0x14]
add esp, 4
pop edi
movsx edx, cx
sub dword [esp + 0x10], edx
pop esi
pop ebx
add esp, 0xc
ret

Function at 0x402e90
Capabilities:
Set registry value

Disassembly:
sub esp, 0xc
fldz
push ebp
fstp qword [esp + 4]
push 0x2e
fldz
mov dword [esp + 8], 0
push 0x423bcc
fstp dword [esp + 0xc]
call fcn.004013d0
add esp, 8
mov ebp, eax
lea eax, [esp + 0xc]
push eax
push ebp
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x402f18
push esi
push edi
push 0x34
push 0x424378
call fcn.004013d0
mov edx, dword [esp + 0x24]
mov esi, eax
mov eax, edx
add esp, 8
lea edi, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402ef0
mov ecx, dword [esp + 0x14]
sub eax, edi
push eax
push edx
push 1
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push esi
push 0x34
call fcn.004015c0
add esp, 8
pop edi
pop esi
xor edx, edx
push 0x2e
push edx
mov word [esp + 0xc], dx
mov dword [esp + 0xc], edx
push ebp
call fcn.0040b3c0
fld dword [0x423c0c]
fadd qword [0x41f340]
fstp dword [0x423c0c]
fld dword [0x423c0c]
fsubr qword [0x41f398]
call fcn.0040b240
mov word [esp + 0x10], ax
push ebp
call fcn.0040b324
mov eax, dword [0x423ecc]
sub eax, 0x31cfd3be
mov dword [esp + 0x14], eax
dec dword [0x423ecc]
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebp
add esp, 0xc
ret
Function at 0x40b8c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425ee0]
jne 0x40b8cf
repz ret
jmp fcn.0040fab7

Function at 0x4168e4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00411ff8
and dword [ebp - 4], 0
cmp dword [0x428154], 0
mov ebx, eax
jne 0x416995
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x416a46
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x420b78
push edi
call esi
test eax, eax
je 0x416a46
push eax
call fcn.00411f86
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x428154], eax
call esi
push eax
call fcn.00411f86
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x428158], eax
call esi
push eax
call fcn.00411f86
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x42815c], eax
call esi
push eax
call fcn.00411f86
pop ecx
mov dword [0x428164], eax
test eax, eax
je 0x416995
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00411f86
pop ecx
mov dword [0x428160], eax
mov eax, dword [0x428160]
cmp eax, ebx
je 0x4169ed
cmp dword [0x428164], ebx
je 0x4169ed
push eax
call fcn.00412001
push dword [0x428164]
mov esi, eax
call fcn.00412001
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4169ed
test edi, edi
je 0x4169ed
call esi
test eax, eax
je 0x4169e4
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4169e4
test byte [ebp - 0xc], 1
jne 0x4169ed
or dword [ebp + 0x10], 0x200000
jmp 0x416a26
mov eax, dword [0x428158]
cmp eax, ebx
je 0x416a26
push eax
call fcn.00412001
pop ecx
test eax, eax
je 0x416a26
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x416a26
mov eax, dword [0x42815c]
cmp eax, ebx
je 0x416a26
push eax
call fcn.00412001
pop ecx
test eax, eax
je 0x416a26
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x428154]
call fcn.00412001
pop ecx
test eax, eax
je 0x416a46
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x416a48
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401ec8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
mov dword [ebp - 4], ecx
mov ebx, eax
cmp dword [ebp + 8], 0
je 0x401ee8
mov eax, dword [ebp + 8]
mov byte [eax], 0
test ebx, ebx
je 0x401ef1
cmp byte [ebx], 0
jne 0x401ef5
xor eax, eax
jmp 0x401f74
xor esi, esi
jmp 0x401f36
inc ebx
xor ecx, ecx
mov cl, al
cmp ecx, 0x3d
jne 0x401f1d
cmp dword [ebp - 4], 0
je 0x401f1d
test esi, esi
jne 0x401f1d
cmp dword [ebp + 8], 0
je 0x401f19
mov eax, dword [ebp + 8]
mov byte [eax], 1
mov esi, edx
jmp 0x401f36
xor ecx, ecx
mov cl, al
cmp ecx, 0xd
je 0x401f2b
cmp ecx, 0xa
jne 0x401f33
cmp ecx, 0xd
jne 0x401f3c
inc ebx
jmp 0x401f3c
mov byte [edx], al
inc edx
mov al, byte [ebx]
test al, al
jne 0x401ef9
mov byte [edx], 0
cmp dword [ebp - 4], 0
je 0x401f72
mov edx, dword [ebp - 4]
test esi, esi
mov byte [edx], 0
je 0x401f72
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push esi
call sub.KERNEL32.DLL_ExpandEnvironmentStringsA
lea edx, [ebp - 0x1004]
mov eax, dword [ebp - 4]
call fcn.004053fc
mov byte [esi], 0
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x401f7c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
add esp, 0xfffff7c0
mov esi, eax
mov al, byte [0x40b6c4]
test al, al
mov byte [esp], dl
je 0x401fb3
xor edx, edx
mov dl, al
cmp edx, 0x20
je 0x401fa7
mov edx, 0x40a205
mov eax, esi
call fcn.004054d0
mov edx, 0x40b6c4
mov eax, esi
call fcn.004054d0
lea eax, [esp + 4]
mov ecx, 0x3c
xor edx, edx
call fcn.00405350
mov dword [esp + 4], 0x3c
mov dword [esp + 8], 0x5c0
xor eax, eax
mov al, byte [esi]
cmp eax, 0x22
jne 0x401fe1
lea edx, [esi + 1]
jmp 0x401fe3
mov edx, esi
mov dword [esp + 0x14], edx
xor eax, eax
jmp 0x402036
xor ecx, ecx
mov cl, dl
cmp ecx, 0x22
jne 0x40200d
jmp 0x402006
xor edx, edx
mov dl, byte [esi + eax]
cmp edx, 0x22
jne 0x402006
mov byte [esi + eax], 0x20
jmp 0x40200d
inc eax
cmp byte [esi + eax], 0
jne 0x401ff6
xor edx, edx
mov dl, byte [esi + eax]
cmp edx, 0x20
je 0x402022
xor ecx, ecx
mov cl, byte [esi + eax + 1]
cmp ecx, 0x2f
jne 0x402035
cmp edx, 0x20
jne 0x40202b
mov byte [esi + eax], 0
lea eax, [eax + esi + 1]
mov dword [esp + 0x18], eax
jmp 0x40203d
inc eax
mov dl, byte [esi + eax]
test dl, dl
jne 0x401feb
mov dword [esp + 0x20], 1
mov eax, dword [esp + 0x14]
call fcn.0040537c
cmp eax, 4
jle 0x402070
mov edx, str..inf
add eax, dword [esp + 0x14]
add eax, 0xfffffffc
call fcn.00405484
test eax, eax
jne 0x402070
mov dword [esp + 0x10], 0x40a20c
xor edx, edx
mov eax, dword [esp + 0x14]
call fcn.00404950
mov ebx, eax
test bl, bl
je 0x402096
lea edx, [esp + 0x40]
mov eax, dword [esp + 0x14]
call fcn.004049e4
lea ecx, [esp + 0x40]
mov dword [esp + 0x14], ecx
cmp byte [esp], 0
je 0x4020d7
test bl, bl
jne 0x4020d7
lea eax, [esp + 0x440]
mov edx, dword [esp + 0x14]
call fcn.004053fc
mov edx, str..exe
lea eax, [esp + 0x440]
call fcn.004054d0
lea eax, [esp + 0x440]
xor edx, edx
call fcn.00404950
test al, al
je 0x402165
lea ecx, [esp + 4]
push ecx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
jne 0x40210b
and dword [esp + 8], 0xfffffbff
mov dword [esp + 0x14], esi
lea edx, [esp + 4]
push edx
call sub.SHELL32.DLL_ShellExecuteExA
test eax, eax
setne al
and eax, 1
test al, al
je 0x402165
cmp byte [0x40a041], 0
jne 0x40211e
cmp byte [esp], 0
je 0x402129
push 0xffffffffffffffff
push dword [esp + 0x40]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x3c]
call sub.KERNEL32.DLL_CloseHandle
cmp byte [0x40a041], 0
je 0x40214d
cmp byte [esp], 0
jne 0x40214d
push 0x1b58
call sub.KERNEL32.DLL_Sleep
jmp 0x402165
cmp byte [esp], 0
je 0x40215a
mov edx, 0xc8
jmp 0x40215f
mov edx, 0x3e8
push edx
call sub.KERNEL32.DLL_Sleep
add esp, 0x840
pop esi
pop ebx
ret
Function at 0x40216e
Capabilities:
Delete file
Get common file path
Set current directory

Disassembly:
add esp, 0xfffff7e0
lea eax, [esp + 0x400]
push eax
push 0x400
call sub.KERNEL32.DLL_GetTempPathA
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
lea eax, [esp + 0x400]
call fcn.0040537c
mov ecx, eax
mov edx, esp
lea eax, [esp + 0x400]
call fcn.00405450
test eax, eax
jne 0x402205
push 0x40a219
call sub.KERNEL32.DLL_SetCurrentDirectoryA
mov eax, esp
call fcn.0040537c
mov byte [esp + eax + 1], 0
lea eax, [esp + 0x800]
mov ecx, 0x1e
xor edx, edx
call fcn.00405350
mov dword [esp + 0x804], 3
mov word [esp + 0x810], 0x14
mov eax, esp
mov dword [esp + 0x808], eax
lea edx, [esp + 0x800]
push edx
call sub.SHELL32.DLL_SHFileOperationA
add esp, 0x820
ret

Function at 0x4023ec
Capabilities:
Get geographical location

Disassembly:
add esp, 0xffffff9c
push 0x64
lea eax, [esp + 4]
push eax
push 0xf
push 0x400
call sub.KERNEL32.DLL_GetLocaleInfoA
xor eax, eax
mov al, byte [esp]
add esp, 0x64
ret

Function at 0x402530
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9ec
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edx
mov esi, eax
xor ebx, ebx
push 0
call sub.OLE32.DLL_OleInitialize
lea eax, [ebp - 8]
push eax
push 0x40a9bc
push 1
push 0
push 0x40a9cc
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x40262f
push esi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
push edi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x402593
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x4025a5
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0x40c]
mov edx, esi
call fcn.004053fc
lea eax, [ebp - 0x40c]
call fcn.004047b0
cmp byte [ebp - 0x40c], 0
je 0x4025d6
lea edx, [ebp - 0x40c]
push edx
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x24]
lea edx, [ebp - 0xc]
push edx
push 0x40a9dc
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax]
test eax, eax
jl 0x402626
push 0x104
lea edx, [ebp - 0x614]
push edx
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea ecx, [ebp - 0x614]
push ecx
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 0x18]
test eax, eax
jl 0x40261d
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
call sub.OLE32.DLL_OleUninitialize
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x402640
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push esi
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x402f50
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov eax, 0x40a23c
push ebx
push esi
mov esi, 0x40b6c4
call fcn.00405540
call sub.KERNEL32.DLL_GetCommandLineA
mov ebx, eax
test ebx, ebx
je 0x402f8a
xor eax, eax
mov al, byte [ebx]
cmp eax, 0x22
jne 0x402f8a
lea eax, [ebx + 1]
mov edx, 0x22
call fcn.0040538c
mov ebx, eax
test ebx, ebx
je 0x402fdf
mov edx, 0x40a131
mov eax, ebx
call fcn.004053d0
mov ebx, eax
test eax, eax
je 0x402fa9
mov eax, esi
mov edx, ebx
call fcn.004053fc
xor eax, eax
jmp 0x402fd9
xor edx, edx
mov dl, byte [esi + eax]
cmp edx, 0x2d
je 0x402fbc
cmp edx, 0x2f
jne 0x402fd8
xor edx, edx
mov dl, byte [esi + eax + 1]
cmp edx, 0x73
je 0x402fcc
cmp edx, 0x53
jne 0x402fd8
mov dword [0x40a04c], 1
jmp 0x402fdf
inc eax
cmp byte [esi + eax], 0
jne 0x402fad
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov ebx, eax
push 0x64
mov dword [0x40aa20], ebx
mov dword [0x40aa1c], ebx
push ebx
call sub.USER32.DLL_LoadIconA
mov dword [0x40bac4], eax
mov word [ebp - 0x1c], 8
lea eax, [ebp - 8]
call fcn.004040f0
inc dword [ebp - 0x10]
mov word [ebp - 0x1c], 0x14
push 0x400
push 0x40b2c4
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA
mov edx, 0x40b2c4
mov eax, 0x40aa24
call fcn.004037b0
call fcn.0040100c
cmp dword [0x40a048], 0
jle 0x403050
mov eax, dword [0x40a044]
call fcn.0040518c
push dword [0x40bac4]
call sub.GDI32.DLL_DeleteObject
dec dword [ebp - 0x10]
lea eax, [ebp - 8]
mov edx, 2
call fcn.004041a8
mov word [ebp - 0x1c], 0
cmp dword [0x40aa10], 0
jne 0x403092
cmp dword [0x40a9f4], 0
je 0x403092
mov eax, 0x40aa10
mov edx, 0xff
call fcn.0040507c
mov dword [0x40a9f4], 2
push dword [0x40aa10]
call sub.KERNEL32.DLL_ExitProcess
mov ecx, dword [ebp - 0x2c]
mov dword fs:[0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret