joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ecfd
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc dword [eax]
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0041ddd3
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0041de05
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041ddba
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0041ddf5
invalid
Function at 0x42210b
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x42214a
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42214a
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42214a
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x42214a
cmp dword [ecx + 0x74], 0xe
jbe 0x42214a
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4347a0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4347cd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4347cd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4ad04e91
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4ad04ec8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ad14916
pop esi
leave
ret 4
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4ad14944
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ad04ec2

Function at 0x4ad05056
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x4ad05178
call fcn.4ad0162f
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x4ad05169
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ad05169
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
jne 0x4ad19012
cmp dword [ecx + 0x74], 0xe
jbe 0x4ad05169
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x4ad2fa50], 0xffffffff
or dword [0x4ad2fa4c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x4ad34888]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x4ad34884]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4ad2fa54], eax
call fcn.4ad04fe0
cmp dword [0x4ad34878], edi
je 0x4ad19037
call 0x4ad05194
push 0x4ad34870
push 0x4ad3486c
call 0x4ad05189
mov eax, dword [0x4ad34880]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x4ad3487c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp + 0x4e], eax
rol byte [0xc1f7f200], 0xef
fidiv dword [ecx + esi*8 - 0x39]
invalid
mov dword [0xcdc0f6f2], eax
jbe 0x4ad0517a
adc ecx, edx
sbb edx, eax
test ebx, 0x870219a4
sub edi, 0xbee
mov eax, edx
imul ecx, edi, 0xdabe4d9
add ebp, edi
mov ecx, esi
add ebp, 0x5a3
adc ebx, ebp
movzx ecx, ah
adc ecx, ecx
adc dh, 0x12
mov eax, 0x877d007a
jb 0x4ad051ae
mov al, al
mov ebx, eax
imul esi, esi, 0xcf349338
jae 0x4ad051b9
test dl, 0xf2
lea esi, [0x9ac70fd7]
adc edi, 0x85b0dab6
cmp ecx, esi
mov ecx, 0x45800042
inc eax
inc esi
mov ch, cl
push 0x9d9858
push esi
inc edx
push ebp
cmp edi, 0x4f5f
je 0x4ad051e5
and al, 0x9b
or ecx, 0x65dd997f
dec ebx
cmp eax, 0x20b
jne 0x4ad05169
cmp dword [ecx + 0x84], 0xe
jbe 0x4ad05169
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4ad050a8
push fcn.4ad04fe0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
jmp 0x4ad05101
Function at 0x1002aadf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x1002aaee
pop dword [ebp - 0xc]
mov eax, 0x1002aaee
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0xa4430da3
sub dword [ebp - 0x1c], 0x55f0c858
mov dword [ebp - 0x18], 0xece95568
add dword [ebp - 0x18], 0x4549f6dd
mov dword [ebp - 0x14], 0x6b388f84
sub dword [ebp - 0x14], 0x1eec4b56
mov dword [ebp - 0x10], 0x62abad74
add dword [ebp - 0x10], 0x9d54528c
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x1956a17d
sub eax, 0x953e145
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0x5eff8d46
add dword [ebp - 0x1c], 0x1572dc10
mov dword [ebp - 0x18], 0x655eb35
sub dword [ebp - 0x18], 0xc4e989c0
mov dword [ebp - 0x14], 0x78c1f881
sub dword [ebp - 0x14], 0x15528c15
mov dword [ebp - 0x10], 0x20e24b5a
add dword [ebp - 0x10], 0xdf1db4a6
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x6eea7d8d
sub eax, 0x5ee7bd65
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x33cb4
push 0
call eax
mov ecx, 0x3d4e
xor edx, edx
add edx, eax
mov ebx, 0x10039600
add ebx, dword [ebp - 0xc]
mov edi, 0x3d7e07b8
add edi, 0xce11d7d2
mov dword [ebp - 4], 0x6f43c641
mov esi, dword [ebx]
mov dword [ebp - 4], 0xd4b6997b
sub esi, edi
xor dword [ebp - 8], 0x8ea0fa16
mov dword [edx], esi
add dword [ebp - 4], edi
add edx, 0xb2650880
add edx, 0x4d9af784
add ebx, 0x34b5b24d
sub ebx, 0x34b5b249
loop 0x1002ac01
add eax, 0x522f426c
sub eax, 0x522e5a61
mov ebx, eax
add eax, 0xbe018b0
sub eax, 0xbe018ab
mov ecx, 0xc2278527
add ecx, 0x4dd87ad9
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x401ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x40
push ebx
push ebp
push esi
push edi
mov esi, eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401af9
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push esi
push 0
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
push esi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push esi
push ebx
push eax
call fcn.0042cc50
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
lea eax, [esp + 0x14]
push eax
push 1
push edi
mov dword [esp + 0x20], 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x401c67
cmp dword [esp + 0x14], eax
je 0x401c67
lea esi, [esp + 0x20]
call fcn.00401170
mov ecx, dword [esp + 0x14]
push ecx
mov edx, esi
push edx
call fcn.00401470
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x30]
xor ebx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x18], ecx
test eax, eax
jle 0x401c3f
xor ebp, ebp
cmp dword [esp + 0x18], ebp
jle 0x401c2c
lea esp, [esp]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
imul eax, ebx
cdq
imul ecx, ebp
and edx, 7
add eax, edx
sar eax, 3
add eax, dword [esp + 0x28]
movzx edi, byte [ecx + eax + 3]
movzx esi, byte [ecx + eax]
add ecx, eax
imul esi, edi
add esi, 0x7f
mov eax, 0x80808081
imul esi
add edx, esi
movzx esi, byte [ecx + 1]
sar edx, 7
imul esi, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx], al
add esi, 0x7f
mov eax, 0x80808081
imul esi
add edx, esi
movzx esi, byte [ecx + 2]
sar edx, 7
imul esi, edi
mov eax, edx
shr eax, 0x1f
add eax, edx
mov byte [ecx + 1], al
add esi, 0x7f
mov eax, 0x80808081
imul esi
add edx, esi
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
inc ebp
cmp ebp, dword [esp + 0x18]
mov byte [ecx + 2], al
jl 0x401ba0
inc ebx
cmp ebx, dword [esp + 0x1c]
jl 0x401b90
mov ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x2c]
push ecx
push ecx
push eax
mov ebx, eax
mov eax, dword [esp + 0x60]
lea esi, [esp + 0x2c]
call fcn.00401380
mov ecx, esi
call fcn.004011e0
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x40
ret 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x40
ret 4
Function at 0x401db0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
sub esp, 0x20
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xffffff7f
or eax, 0x40000
cmp dword [0x456b38], 1
jne 0x401ddb
or eax, 8
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
lea ecx, [esp]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [esp + 0x24], 0
mov eax, 0x49
je 0x401e24
mov eax, 0x4b
xor ecx, ecx
cmp dword [0x456b38], 1
jne 0x401e32
or ecx, 0xffffffff
push eax
mov eax, dword [esp + 8]
sub eax, dword [esp + 0x10]
push 0
add eax, dword [esp + 0x24]
push 0
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esp + 0x10]
sub eax, dword [esp + 0x18]
add eax, dword [esp + 0x28]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
push eax
mov eax, dword [edx + 0x48]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 1
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
add esp, 0x20
ret 4

Function at 0x401fe0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor eax, eax
cmp dword [0x456b38], 1
jne 0x40201d
or eax, 0xffffffff
push 0x41
push 0
push 0
push 0xfffff830
push 0xfffff830
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
ret
Function at 0x4039b0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
push ebx
push esi
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push edi
mov ecx, esi
call edx
test eax, eax
jne 0x4039ce
xor al, al
pop edi
pop esi
pop ebx
add esp, 0x18
ret
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [esi + 0x10]
mov eax, dword [esi + 8]
mov edi, dword [esi + 0xc]
mov ebx, dword [esi + 4]
push 0x40
mov edx, ecx
sub edx, eax
sub eax, ecx
add eax, dword [esp + 0x20]
push edx
mov edx, edi
sub edx, ebx
push edx
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, ebx
sub eax, edi
add eax, dword [esp + 0x28]
mov ecx, esi
cdq
sub eax, edx
sar eax, 1
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00403af0
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
pop edi
mov byte [esi + 0x1055], 0
pop esi
mov al, 1
pop ebx
add esp, 0x18
ret

Function at 0x403a60
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x18
push esi
mov esi, eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
test eax, eax
jne 0x403a7a
xor al, al
pop esi
add esp, 0x18
ret
push 0
lea eax, [esp + 0xc]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
push 0x40
push ecx
push edx
mov edx, dword [eax + 0x48]
push 0
push 0
push 0
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
call fcn.00403af0
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov byte [esi + 0x1055], 1
mov al, 1
pop esi
add esp, 0x18
ret
Function at 0x404220
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov esi, eax
mov eax, dword [0x455dc4]
push 0x9c
push eax
call dword [sym.imp.USER32.dll_LoadMenuW]
mov ebx, eax
test ebx, ebx
je 0x404336
push 0
push ebx
call dword [sym.imp.USER32.dll_GetSubMenu]
push 0x400
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_RemoveMenu]
mov ebp, dword [sym.imp.USER32.dll_DestroyMenu]
push ebx
call ebp
test edi, edi
je 0x404336
xor eax, eax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 0
mov ecx, esi
call eax
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
push 0
push ecx
push edx
push 0x102
push edi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push edi
mov ebx, eax
call ebp
mov eax, ebx
sub eax, 0x800d
je 0x4042f8
sub eax, 1
jne 0x404336
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0x104
push 0x446d68
push 0x446d70
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 7
je 0x404336
mov eax, esi
call fcn.00404340
mov eax, dword [esi]
mov edx, dword [eax + 0x44]
mov ecx, esi
call edx
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 1
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 0x1054], 0
je 0x40432c
mov dword [esi + 0xca4], 0
add esi, 0xc98
push esi
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
mov al, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0xc
ret

Function at 0x404370
Capabilities:
Hide graphical window

Disassembly:
sub eax, 0x202
push esi
mov esi, ecx
je 0x40438f
sub eax, 1
je 0x40438f
sub eax, 2
jne 0x4043c1
mov eax, esi
call fcn.00404220
xor eax, eax
pop esi
ret
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 5
call edx
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
cmp byte [esi + 0x1054], 0
je 0x4043c1
mov dword [esi + 0xca4], 0
add esi, 0xc98
push esi
push 2
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
xor eax, eax
pop esi
ret

Function at 0x4043d0
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, eax
mov eax, dword [0x455dc4]
push 0x97
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
call fcn.004041b0
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 0
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x40d2b0
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi + 4]
push edi
mov edi, ecx
cmp eax, 0x100
jb 0x40d328
cmp eax, 0x109
ja 0x40d328
cmp eax, 0x101
je 0x40d30e
mov eax, dword [esi + 8]
cmp eax, 0x43
je 0x40d2ea
cmp eax, 0x56
je 0x40d2ea
cmp eax, 0x58
je 0x40d2ea
cmp eax, 0x5a
jne 0x40d2fc
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, 0x8000
test cx, ax
jne 0x40d30e
mov eax, dword [esi + 8]
cmp eax, 9
je 0x40d30e
cmp eax, 0xd
je 0x40d30e
cmp eax, 0x2e
jne 0x40d388
mov edx, dword [edi + 0x880]
mov eax, dword [edx + 0x10]
lea ecx, [edi + 0x880]
push esi
call eax
pop edi
pop esi
add esp, 8
ret 4
cmp eax, 0x200
jb 0x40d388
cmp eax, 0x20e
ja 0x40d388
cmp eax, 0x201
je 0x40d344
cmp eax, 0x204
jne 0x40d388
mov edx, dword [edi]
mov eax, dword [edx + 0x48]
lea ecx, [esp + 8]
xor esi, esi
push ecx
mov ecx, edi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
call eax
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
mov eax, dword [0x455f5c]
push 1
push esi
push esi
push ecx
push edx
mov edx, dword [eax + 0x48]
push esi
mov ecx, 0x455f5c
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
pop edi
xor eax, eax
pop esi
add esp, 8
ret 4
Function at 0x40d3a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
sub esp, 0x20
push ebx
push edi
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
and eax, 0xfffbffff
or eax, 0x80
cmp dword [0x456b38], 1
jne 0x40d3cd
or eax, 8
push eax
mov eax, dword [esi]
mov edx, dword [eax + 0x48]
push 0xffffffffffffffec
mov ecx, esi
call edx
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 0
lea eax, [esp + 0x1c]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_GetClientRect]
cmp byte [esp + 0x2c], 0
mov ecx, dword [esi + 0x884]
push 0
je 0x40d451
push 0x32
push 0x32
push 0xffffffffffffff9c
push 0xffffffffffffff9c
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
mov edx, dword [esi + 0x928]
mov eax, dword [edx + 0x28]
lea ecx, [esi + 0x928]
push 1
push 0x4477a8
call eax
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [esi + 0x940], eax
jmp 0x40d469
push 0x1e7
push 0x380
push 0xc5
push 0x54
push ecx
call dword [sym.imp.USER32.dll_MoveWindow]
cmp byte [esi + 0x9f8], 0
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0x49
je 0x40d484
mov edi, 0x4b
jmp 0x40d492
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 0
mov ecx, esi
call eax
push eax
call ebx
xor ecx, ecx
cmp dword [0x456b38], 1
jne 0x40d4a0
or ecx, 0xffffffff
mov eax, dword [esp + 0xc]
sub eax, dword [esp + 0x14]
push edi
add eax, dword [esp + 0x28]
push 0
cdq
sub eax, edx
sar eax, 1
push 0
push eax
mov eax, dword [esp + 0x18]
sub eax, dword [esp + 0x20]
add eax, dword [esp + 0x30]
cdq
sub eax, edx
mov edx, dword [esi]
sar eax, 1
push eax
mov eax, dword [edx + 0x48]
push ecx
mov ecx, esi
call eax
push eax
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [esi]
mov eax, dword [edx + 0x48]
push 1
mov ecx, esi
call eax
push eax
call ebx
pop edi
pop ebx
add esp, 0x20
ret 4
Function at 0x410400
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x442360
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x4521a0]
xor eax, esp
mov dword [esp + 0x38], eax
push ebx
push esi
mov eax, dword [0x4521a0]
xor eax, esp
push eax
lea eax, [esp + 0x48]
mov dword fs:[0], eax
lea eax, [esp + 0x28]
push eax
call fcn.00417100
lea ecx, [esp + 0x2c]
push ecx
mov ebx, str.iconAnimate.exe
lea esi, [esp + 0x14]
mov dword [esp + 0x58], 0
call fcn.00412830
add esp, 8
push 0xffffffffffffffff
push 0
lea ecx, [esp + 0x30]
mov byte [esp + 0x58], 1
call fcn.00404c70
mov esi, 8
cmp dword [esp + 0x24], esi
jb 0x410482
mov edx, dword [esp + 0x10]
push edx
call fcn.00427b5c
add esp, 4
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], esi
jae 0x410490
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4104ba
mov eax, dword [esp + 0x2c]
cmp dword [esp + 0x40], esi
jae 0x4104a9
lea eax, [esp + 0x2c]
push 1
push 0
push 0
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x40], esi
jb 0x4104cd
mov eax, dword [esp + 0x2c]
push eax
call fcn.00427b5c
add esp, 4
mov ecx, dword [esp + 0x48]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, esp
call fcn.00427b67
add esp, 0x48
ret

Function at 0x410550
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
mov eax, dword [0x4521a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov word [esp + 0xc], cx
mov ecx, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x410582
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xc]
call fcn.00404d60
push str._uninstallsucc
mov ebx, 0xe
xor eax, eax
mov edx, esi
call fcn.00404a90
cmp eax, 0xffffffff
setne bl
cmp dword [esp + 0x20], 8
jb 0x4105c8
mov edx, dword [esp + 0xc]
push edx
call fcn.00427b5c
add esp, 4
mov ecx, dword [esp + 0x24]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00427b67
add esp, 0x20
ret

Function at 0x4105e0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x20
mov eax, dword [0x4521a0]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
xor ecx, ecx
mov word [esp + 0xc], cx
mov ecx, eax
mov dword [esp + 0x20], 7
mov dword [esp + 0x1c], 0
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x410612
sub ecx, esi
sar ecx, 1
push ecx
lea esi, [esp + 0xc]
call fcn.00404d60
push str._setupsucc
mov ebx, 0xa
xor eax, eax
mov edx, esi
call fcn.00404a90
cmp eax, 0xffffffff
setne bl
cmp dword [esp + 0x20], 8
jb 0x410658
mov edx, dword [esp + 0xc]
push edx
call fcn.00427b5c
add esp, 4
mov ecx, dword [esp + 0x24]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.00427b67
add esp, 0x20
ret