joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415c4d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00411a5d
and dword [ebp - 4], 0
cmp dword [0x435a98], 0
mov ebx, eax
jne 0x415cfe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x415daf
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x415daf
push eax
call fcn.004119eb
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x435a98], eax
call esi
push eax
call fcn.004119eb
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x435a9c], eax
call esi
push eax
call fcn.004119eb
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x435aa0], eax
call esi
push eax
call fcn.004119eb
pop ecx
mov dword [0x435aa8], eax
test eax, eax
je 0x415cfe
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004119eb
pop ecx
mov dword [0x435aa4], eax
mov eax, dword [0x435aa4]
cmp eax, ebx
je 0x415d56
cmp dword [0x435aa8], ebx
je 0x415d56
push eax
call fcn.00411a66
push dword [0x435aa8]
mov esi, eax
call fcn.00411a66
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x415d56
test edi, edi
je 0x415d56
call esi
test eax, eax
je 0x415d4d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x415d4d
test byte [ebp - 0xc], 1
jne 0x415d56
or dword [ebp + 0x10], 0x200000
jmp 0x415d8f
mov eax, dword [0x435a9c]
cmp eax, ebx
je 0x415d8f
push eax
call fcn.00411a66
pop ecx
test eax, eax
je 0x415d8f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x415d8f
mov eax, dword [0x435aa0]
cmp eax, ebx
je 0x415d8f
push eax
call fcn.00411a66
pop ecx
test eax, eax
je 0x415d8f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x435a98]
call fcn.00411a66
pop ecx
test eax, eax
je 0x415daf
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415db1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x418291
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x435ea0], 0
push esi
jne 0x418204
call fcn.0041812a
test eax, eax
je 0x418247
mov eax, dword [0x435ea0]
cmp eax, 1
jne 0x418225
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x418247
pop esi
ret
push eax
call dword [0x435ea8]
test eax, eax
jne 0x41828f
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41824b
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x435ea0]
call dword [0x435ea8]
mov edi, eax
test edi, edi
je 0x418270
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41828c
mov edi, esi
add esi, 0xff0
push edi
push dword [0x435ea0]
call dword [0x435ea4]
add edi, 0x10
cmp edi, esi
jb 0x418278
mov eax, edi
pop edi
pop esi
ret
jmp 0x4181f1
Function at 0x419b3a
Capabilities:
Get common file path

Disassembly:
push esi
add eax, 0x22c
push eax
mov esi, 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x419b5a
cmp eax, esi
jae 0x419b5a
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x41adc1
Capabilities:
Hide graphical window

Disassembly:
jmp method.CPage.virtual_20
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_LockWindowUpdate]
lea esi, [ecx + 0x214]
push dword [esi]
call edi
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi]
call dword [sym.imp.USER32.dll_DestroyWindow]
push 0
call edi
pop edi
pop esi
ret

Function at 0x41b4f9
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 1
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
call fcn.0041af8a
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [ebx + 0xc]
call dword [sym.imp.USER32.dll_SetFocus]
pop ebx
ret

Function at 0x41b800
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
xor ebx, ebx
cmp byte [esi + 0x276], bl
jne 0x41b89e
mov eax, dword [esi]
cmp eax, ebx
je 0x41b837
add eax, 0x23c
cmp dword [eax], ebx
je 0x41b830
mov eax, dword [eax]
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x24]
mov ecx, dword [esi]
call fcn.00420ffa
cmp byte [0x435f5e], bl
je 0x41b89e
xor eax, eax
push 0x206
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push ebx
push eax
call fcn.0040cdd0
lea eax, [ebp - 0x208]
add esp, 0xc
push eax
call fcn.00420477
mov dword [esp], str.ArcadeCandyACGames.exe
lea eax, [ebp - 0x208]
push 0x104
push eax
call fcn.0040f46c
add esp, 0xc
push ebx
push ebx
push 0x427ffc
lea eax, [ebp - 0x208]
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebx
leave
ret
Function at 0x41bfa6
Capabilities:
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
mov ebx, eax
lea eax, [ebp - 0x208]
push eax
xor eax, eax
push eax
push eax
push 0x801c
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [ebp - 0x208]
push eax
call edi
test eax, eax
jg 0x41bff3
lea eax, [ebp - 0x208]
push eax
xor eax, eax
push eax
push eax
push 0x801a
push eax
call esi
lea eax, [ebp - 0x208]
push eax
call edi
test eax, eax
jg 0x41c007
xor al, al
jmp 0x41c18c
mov esi, dword [sym.imp.SHLWAPI.dll_StrNCatW]
mov edi, 0x104
push edi
push str.The_Weather_Channel
lea eax, [ebp - 0x208]
push eax
call esi
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push str.Desktop
lea eax, [ebp - 0x208]
push eax
call esi
push 0
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edi
push str._apps.ini
lea eax, [ebp - 0x208]
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea eax, [ebp - 0x208]
push eax
push 0x42a908
push 0x42aebc
mov edi, str.SoftwareThe_Weather_ChannelAppsAppData
push edi
call esi
lea eax, [ebp - 0x208]
push eax
push 0x42a908
push 0x42aec4
push edi
call esi
lea ecx, [ebp - 0x208]
push ecx
lea eax, [ebx + 0x1a06]
push eax
push str.temp
push edi
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 0x19f2]
push eax
push 0x42af44
mov edi, str.SoftwareThe_Weather_ChannelAppsAppDataUserProfile
push edi
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 0x1a2e]
push eax
push str.gender
push edi
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 0x1a06]
push eax
push str.temp
push edi
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 0x1862]
push eax
push str.dispname_1
mov edi, str.SoftwareThe_Weather_ChannelAppsAppDatalocations
push edi
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 0x1a1a]
push eax
push str.locid_1
push edi
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 0x192a]
push eax
push str.zip_1
push edi
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 0x17fe]
push eax
push str.dma_1
push edi
call esi
lea eax, [ebp - 0x208]
push eax
push 0x42a908
push str.loctype_1
push edi
call esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebx + 0x198e]
push eax
push str.st_1
push edi
call esi
lea eax, [ebp - 0x208]
push eax
add ebx, 0x18c6
push ebx
push str.ctry_1
push edi
call esi
mov al, 1
pop edi
pop esi
pop ebx
leave
ret

Function at 0x41c1fb
Capabilities:
Terminate thread

Disassembly:
push esi
mov esi, ecx
push 0
push dword [esi + 0x15f0]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, esi
pop esi
jmp method.CPage.virtual_20
Function at 0x41c67e
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20cc
call fcn.00416990
push ebx
push edi
push 0x64
lea eax, [ebp - 0xcc]
push eax
push dword [esi + 0x234]
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0xcc]
push eax
push str.http:__desktopfw.weather.com_search_search__where_s
mov edi, 0x400
lea eax, [ebp - 0x8cc]
push edi
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push 0x4000000
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10cc]
push eax
lea eax, [ebp - 0x8cc]
push eax
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_UrlEscapeW]
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
xor ebx, ebx
cmp eax, 2
push ebx
push ebx
jge 0x41c737
push 0x18b
push dword [esi + 0x238]
call edi
test eax, eax
jle 0x41c7ec
push ebx
push ebx
push 0x184
push dword [esi + 0x238]
call edi
mov eax, dword [esi + 0x254]
cmp eax, ebx
je 0x41c7ec
jmp 0x41c7e1
push 0x184
push dword [esi + 0x238]
call edi
push str.Search_in_progress_...
push ebx
push 0x180
push dword [esi + 0x238]
call edi
push ebx
push 0x800
lea eax, [ebp - 0x20cc]
push eax
lea eax, [ebp - 0x10cc]
push eax
call fcn.0040181c
add esp, 0x10
cmp eax, 0xffffffff
je 0x41c786
lea eax, [ebp - 0x20cc]
push eax
mov eax, esi
call fcn.0041c4c1
push ebx
push ebx
push 0x18b
push dword [esi + 0x238]
call edi
test eax, eax
jle 0x41c7ec
push ebx
push ebx
push 0x186
push dword [esi + 0x238]
call edi
push ebx
push ebx
push 0x147
push dword [esi + 0x24c]
call edi
test eax, eax
jle 0x41c7db
push ebx
push ebx
push 0x188
push dword [esi + 0x238]
call edi
cmp eax, 0xffffffff
je 0x41c7db
mov eax, dword [esi + 0x254]
xor edx, edx
push ebx
inc edx
jmp 0x41c7e5
mov eax, dword [esi + 0x254]
xor edx, edx
inc edx
push edx
push edx
push edx
call fcn.00420b3e
pop edi
pop ebx
leave
ret

Function at 0x41c822
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0x258], bl
je 0x41c908
push ebx
push ebx
push 0xf0
push dword [esi + 0x230]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 1
jne 0x41c908
push edi
push dword [esi + 0x214]
mov byte [esi + 0x258], bl
call dword [sym.imp.USER32.dll_LockWindowUpdate]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push ebx
push dword [esi + 0x230]
call edi
push ebx
push dword [esi + 0x22c]
call edi
push 5
push dword [esi + 0x234]
call edi
push 5
push dword [esi + 0x238]
call edi
push 5
push dword [esi + 0x23c]
call edi
push 5
push dword [esi + 0x240]
call edi
push 5
push dword [esi + 0x244]
call edi
push 5
push dword [esi + 0x248]
call edi
push 5
push dword [esi + 0x24c]
call edi
push ebx
call dword [sym.imp.USER32.dll_LockWindowUpdate]
push ebx
push ebx
push esi
push 0x41c7f0
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push ebx
push ebx
push dword [esi + 0x214]
mov dword [esi + 0x15f0], eax
call dword [sym.imp.USER32.dll_InvalidateRect]
mov eax, dword [esi + 0x254]
pop edi
cmp eax, ebx
je 0x41c904
push 1
push 1
push 1
mov dl, 1
call fcn.00420b3e
mov al, 1
jmp 0x41c90a
xor al, al
pop esi
pop ebx
ret
Function at 0x41d976
Capabilities:
Get common file path
Move file
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc84
push ebx
push esi
push edi
lea eax, [esp + 0x668]
push eax
push 0x104
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [edi + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor eax, eax
push 0x62
mov word [esp + 0x14], ax
xor ebx, ebx
lea eax, [esp + 0x16]
push ebx
push eax
call fcn.0040cdd0
push 0x42a694
lea eax, [esp + 0x20]
push 0x32
push eax
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
add esp, 0x18
cmp byte [edi + 0x22c], bl
jne 0x41d9ec
push str._ToolbarSkipInstall
lea eax, [esp + 0x14]
push eax
call esi
cmp byte [edi + 0x22d], bl
jne 0x41da00
push str._SkipDefaultSearch
lea eax, [esp + 0x14]
push eax
call esi
cmp byte [edi + 0xa65], bl
je 0x41da14
push str._FORCEHOMEPAGE
lea eax, [esp + 0x14]
push eax
call esi
lea ecx, [esp + 0x10]
lea eax, [edi + 0x44c]
push ecx
push eax
lea esi, [esp + 0x878]
call fcn.00407baa
push ebx
call fcn.00407ae4
mov byte [esp + 0xf], al
cmp al, bl
jne 0x41da72
push 0xcb
push 0x68
mov eax, edi
call fcn.0041adec
lea esi, [esp + 0x80]
call fcn.00407599
mov ecx, esi
call fcn.004073c1
lea eax, [esp + 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov byte [esp + 0xf], bl
jmp 0x41db03
mov al, byte [edi + 0x22c]
cmp al, bl
je 0x41dac7
cmp byte [edi + 0x22d], bl
je 0x41da95
cmp byte [edi + 0xa65], bl
je 0x41da95
push 0x131
push 0x64
jmp 0x41dae9
cmp al, bl
je 0x41dac7
cmp byte [edi + 0x22d], bl
je 0x41dab0
cmp byte [edi + 0xa65], bl
jne 0x41dab0
push 0x132
jmp 0x41da91
cmp al, bl
je 0x41dac7
cmp byte [edi + 0xa65], bl
je 0x41dac3
push 0x133
jmp 0x41da91
cmp al, bl
jne 0x41db03
cmp byte [edi + 0xa65], bl
je 0x41dad6
push 0x134
jmp 0x41dae7
cmp al, bl
jne 0x41db03
cmp byte [edi + 0xa65], bl
jne 0x41db03
push 0x12d
push 0x69
mov eax, edi
call fcn.0041adec
lea esi, [esp + 0x80]
call fcn.00407599
mov ecx, esi
call fcn.004073c1
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 5
push ebx
lea eax, [edi + 0x44c]
push eax
call esi
push 5
push ebx
lea eax, [edi + 0x654]
push eax
call esi
push 5
push ebx
add edi, 0x85c
push edi
call esi
lea eax, [esp + 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov al, byte [esp + 0xf]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41e192
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x708
push esi
push edi
lea eax, [esp + 8]
push eax
mov esi, ecx
mov dword [esp + 0xc], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 0xc], 5
jne 0x41e225
cmp dword [esp + 0x10], 1
jne 0x41e225
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
push str.Service_Pack_2
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
je 0x41e225
push str.Service_Pack_3
lea eax, [esp + 0x20]
push eax
call edi
test eax, eax
je 0x41e225
cmp byte [esi + 0x248], 0
je 0x41e1fa
mov eax, dword [esi + 0x454]
jmp 0x41e200
mov eax, dword [esi + 0x228]
push 0x12c
push 0x67
add esi, 0x345c
push esi
lea esi, [esp + 0x12c]
call fcn.0040a19a
mov ecx, esi
call fcn.004073c1
xor al, al
jmp 0x41e227
mov al, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e9e4
Capabilities:
Check if file exists
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push ebx
push esi
push edi
lea eax, [ebp - 0x410]
push eax
xor eax, eax
push eax
push eax
push 0x26
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push str.Dogpile_toolbarToolbar.dll
lea eax, [ebp - 0x410]
push eax
push str._s_s
mov ebx, 0x104
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call edi
test eax, eax
je 0x41ea44
mov al, 1
jmp 0x41ea70
push str.Dogpile_Bundle_ToolbarToolbar.dll
lea eax, [ebp - 0x410]
push eax
push str._s_s
lea eax, [ebp - 0x208]
push ebx
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
call edi
test eax, eax
setne al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41f5ad
Capabilities:
Get common file path
Move file
Set current directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, 0x10a4
call fcn.00416990
push ebx
push esi
push edi
lea eax, [esp + 0x668]
push eax
push 0x104
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [edi + 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor eax, eax
push 0x62
push eax
mov word [esp + 0x18], ax
lea eax, [esp + 0x1a]
push eax
call fcn.0040cdd0
mov ebx, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
push 0x4297b4
push str._tb_s
lea eax, [esp + 0x24]
push 0x32
push eax
call ebx
add esp, 0x1c
lea ecx, [esp + 0x10]
lea eax, [edi + 0x44c]
push ecx
push eax
lea esi, [esp + 0x878]
call fcn.00407baa
push 1
call fcn.00407ae4
test al, al
je 0x41f7d1
cmp dword [esp + 0xc8c], 0
jne 0x41f7d1
push 0x4297b4
push str.toolbar_s
lea eax, [esp + 0x18]
push 0x32
push eax
call ebx
mov esi, dword [sym.imp.SHLWAPI.dll_StrCatW]
add esp, 0x10
cmp byte [edi + 0x22c], 0
je 0x41f678
push str._tbr
lea eax, [esp + 0x14]
push eax
call esi
cmp byte [edi + 0x22d], 0
je 0x41f68d
push str._sa
lea eax, [esp + 0x14]
push eax
call esi
cmp byte [edi + 0xa65], 0
je 0x41f6a2
push str._hpr
lea eax, [esp + 0x14]
push eax
call esi
lea eax, [esp + 0x10]
push eax
lea eax, [edi + 0x44c]
push eax
lea esi, [esp + 0xc98]
call fcn.00407baa
xor ebx, ebx
push ebx
call fcn.00407ae4
mov byte [esp + 0xf], al
test al, al
jne 0x41f702
push 0xcb
push 0x68
mov eax, edi
call fcn.0041adec
lea esi, [esp + 0x80]
call fcn.00407599
mov ecx, esi
call fcn.004073c1
lea eax, [esp + 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov byte [esp + 0xf], bl
jmp 0x41f793
mov al, byte [edi + 0x22c]
test al, al
je 0x41f757
cmp byte [edi + 0x22d], bl
je 0x41f725
cmp byte [edi + 0xa65], bl
je 0x41f725
push 0x131
push 0x64
jmp 0x41f779
test al, al
je 0x41f757
cmp byte [edi + 0x22d], bl
je 0x41f740
cmp byte [edi + 0xa65], bl
jne 0x41f740
push 0x132
jmp 0x41f721
test al, al
je 0x41f757
cmp byte [edi + 0xa65], bl
je 0x41f753
push 0x133
jmp 0x41f721
test al, al
jne 0x41f793
cmp byte [edi + 0xa65], bl
je 0x41f766
push 0x134
jmp 0x41f777
test al, al
jne 0x41f793
cmp byte [edi + 0xa65], bl
jne 0x41f793
push 0x12d
push 0x69
mov eax, edi
call fcn.0041adec
lea esi, [esp + 0x80]
call fcn.00407599
mov ecx, esi
call fcn.004073c1
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 5
push ebx
lea eax, [edi + 0x44c]
push eax
call esi
push 5
push ebx
lea eax, [edi + 0x654]
push eax
call esi
push 5
push ebx
add edi, 0x85c
push edi
call esi
lea eax, [esp + 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov al, byte [esp + 0xf]
jmp 0x41f802
push 0x12f
push 0x67
mov eax, edi
call fcn.0041adec
lea esi, [esp + 0x80]
call fcn.00407599
mov ecx, esi
call fcn.004073c1
lea eax, [esp + 0x668]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41f9f2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 5
jne 0x41fa26
xor eax, eax
inc eax
cmp dword [ebp - 0x10c], eax
je 0x41fa28
xor al, al
leave
ret

Function at 0x41fa2a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
push eax
mov dword [ebp - 0x114], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x110], 5
jne 0x41fa60
cmp dword [ebp - 0x10c], 0
jne 0x41fa60
mov al, 1
leave
ret
xor al, al
leave
ret

Function at 0x41fa64
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
dec eax
neg eax
sbb eax, eax
inc eax
leave
ret

Function at 0x41fa7c
Capabilities:
Check mutex on windows

Disassembly:
push str.mtx_acandy_setup_app
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
setne al
ret

Function at 0x4202a0
Capabilities:
Get explorer pid

Disassembly:
push 0x434
push 0x42e3b0
call fcn.004210a8
xor ebx, ebx
mov byte [ebp - 0x19], bl
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetShellWindow]
mov dword [ebp - 0x2c], ebx
lea ecx, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x2c], ebx
je 0x4203a7
push dword [ebp - 0x2c]
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x28], eax
cmp eax, ebx
jne 0x4202fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x4203a7
lea ecx, [ebp - 0x24]
push ecx
push 0xa
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4203a7
mov dword [ebp - 0x20], ebx
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push 1
push dword [ebp - 0x24]
mov esi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call esi
test eax, eax
jne 0x420335
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4203a7
push dword [ebp - 0x20]
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
mov dword [ebp - 0x30], edi
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
push edi
push 1
push dword [ebp - 0x24]
call esi
test eax, eax
je 0x4203a7
mov dword [ebp - 0x20], 0x104
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x444]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x23c]
push eax
push dword [edi]
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x4203a7
mov byte [ebp - 0x19], 1
lea eax, [ebp - 0x23c]
push eax
push 0x428290
push 0x208
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
or dword [ebp - 4], 0xffffffff
call fcn.004203bb
mov al, byte [ebp - 0x19]
call fcn.004210e3
ret
Function at 0x4203e6
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x414], ax
lea eax, [ebp - 0x412]
push eax
call fcn.0040cdd0
xor eax, eax
push esi
push eax
mov word [ebp - 0x20c], ax
lea eax, [ebp - 0x20a]
push eax
mov dword [ebp - 4], 0x208
call fcn.0040cdd0
add esp, 0x18
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x414]
push eax
mov bl, 1
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x420471
lea eax, [ebp - 0x20c]
push eax
call fcn.004202a0
pop ecx
test al, al
je 0x420471
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0040ce4a
pop ecx
pop ecx
test eax, eax
je 0x420471
xor bl, bl
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x420477
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa30
push ebx
push esi
push edi
call fcn.004203e6
xor edi, edi
test al, al
je 0x4204b7
push dword [ebp + 8]
mov esi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push edi
push edi
push 0x1c
push edi
call esi
cmp eax, edi
jge 0x4204af
push dword [ebp + 8]
push 1
push edi
push 0x1c
push edi
call esi
cmp eax, edi
sete al
jmp 0x420619
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x828], ax
lea eax, [ebp - 0x826]
push edi
push eax
call fcn.0040cdd0
xor eax, eax
push esi
mov word [ebp - 0x418], ax
lea eax, [ebp - 0x416]
push edi
push eax
call fcn.0040cdd0
xor eax, eax
push esi
mov word [ebp - 0x620], ax
lea eax, [ebp - 0x61e]
push edi
push eax
call fcn.0040cdd0
lea eax, [ebp - 0x620]
push eax
call fcn.004202a0
add esp, 0x28
test al, al
je 0x420617
xor eax, eax
push esi
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.0040cdd0
xor eax, eax
push esi
mov word [ebp - 0xa30], ax
lea eax, [ebp - 0xa2e]
push edi
push eax
call fcn.0040cdd0
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
push edi
push edi
push 0x1c
push edi
mov dword [ebp - 8], 0x208
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x420617
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x828]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x420617
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfW]
lea eax, [ebp - 0x828]
push eax
push 0x4282d8
mov ebx, 0x104
lea eax, [ebp - 0x418]
push ebx
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x418]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 4], eax
cmp eax, edi
je 0x420617
lea ecx, [ebp - 0x210]
sub eax, ecx
push ecx
sar eax, 1
inc eax
push 0x428290
push eax
lea eax, [ebp - 0xa30]
push eax
call esi
lea eax, [ebp - 0x418]
push eax
call fcn.0040cdb1
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2]
add esp, 0x14
cmp eax, edi
je 0x420617
push eax
lea eax, [ebp - 0x620]
push eax
lea eax, [ebp - 0xa30]
push eax
push str._s_s_s
push ebx
push dword [ebp + 8]
call esi
add esp, 0x18
mov al, 1
jmp 0x420619
xor al, al
pop edi
pop esi
pop ebx
leave
ret