joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4036bf
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
push edi
mov dword [ebp - 0x160], ecx
mov dword [ebp - 0x15c], 1
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x44
push 0
lea eax, [ebp - 0x158]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x10
push 0
lea ecx, [ebp - 0x10]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x158]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._s__s
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
push str._ZSetupMain__File_Name___s_n
call fcn.00407a82
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x158]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x114]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x4037a9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
mov ecx, dword [ebp + 8]
push ecx
push str._ZSetupMain.DistributeXML__Unable_to_CreateProcess:__s_error_d_n
call fcn.00407a82
add esp, 0xc
mov dword [ebp - 0x15c], 0
jmp 0x4037c9
push 0xffffffffffffffff
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x15c]
pop edi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x404b89
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40c9b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x28], 0
je 0x404c57
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0
je 0x404bef
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x280]
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x27c]
push ecx
mov ecx, dword [ebp - 0x20]
call fcn.00406ab0
mov dword [ebp - 0x30], eax
jmp 0x404bf6
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 4]
push edx
mov ecx, dword [ebp - 0x10]
call fcn.00406b19
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x10]
call fcn.00406c8a
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
je 0x404c50
push 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x24]
call dword [edx]
mov dword [ebp - 0x34], eax
jmp 0x404c57
mov dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x27c]
push edx
push 0
push 0
push 0
push SysReAllocString
push 0
push SysReAllocString
push 0x80080000
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x16c]
push ecx
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x170]
push eax
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov ecx, dword [ebp - 0x2c]
mov dword [ecx + 0x280], eax
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x288], 0
jne 0x404ce9
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x2c]
mov dword [eax + 0x288], 1
lea ecx, [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x2c]
push edx
push 0x405b99
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x14], eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0x2c]
cmp dword [ecx + 0x2c], 0
je 0x404d06
push 3
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x280]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x404d18
push 2
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x280]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x280]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [ebp - 0x2c]
mov eax, dword [edx + 0x280]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x405be8
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
push edi
mov dword [ebp - 0x310], ecx
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [ebp + 8]
push eax
push 0x104
lea ecx, [ebp - 0x104]
push ecx
push 0x410d40
push str.ResourceDll
push str.Setup
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [ebp - 0x104]
push edx
push str._ZSetupMain::SetResourceDll__Resource_dll___s
call fcn.00407a82
add esp, 8
push 0x410d8c
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x405dab
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x30c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [ebp - 0x30c]
push ecx
mov ecx, dword [ebp - 0x310]
call fcn.00405db2
push 0x410d94
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405ce9
lea eax, [ebp - 0x104]
push eax
mov ecx, dword [ebp - 0x310]
mov edx, dword [ecx + 0x2b8]
push edx
push 0x410d9c
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
jmp 0x405d19
lea ecx, [ebp - 0x104]
push ecx
lea edx, [ebp - 0x30c]
push edx
mov eax, dword [ebp - 0x310]
mov ecx, dword [eax + 0x2b8]
push ecx
push 0x410da4
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
push 0x410dac
call fcn.00407a82
add esp, 8
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edx, dword [ebp - 0x310]
mov dword [edx + 0x3a8], eax
mov eax, dword [ebp - 0x310]
cmp dword [eax + 0x3a8], 0
jne 0x405dab
lea ecx, [ebp - 0x104]
push ecx
mov edx, dword [ebp - 0x310]
mov eax, dword [edx + 0x2b8]
push eax
push 0x410de4
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
push str._ZSetupMain::SetResourceDll__Resource_DLL_path___s_n
call fcn.00407a82
add esp, 8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 0x310]
mov dword [ecx + 0x3a8], eax
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x405db2
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push edi
mov dword [ebp - 0x314], ecx
mov byte [ebp - 0x104], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x30c], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x30b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov byte [ebp - 0x208], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x207]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push str.setup.ini
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax + 0x2b8]
push ecx
push 0x410e30
lea edx, [ebp - 0x30c]
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x30c]
push eax
push 0x104
mov ecx, dword [ebp + 8]
push ecx
push 0x410e38
mov edx, dword [ebp - 0x314]
add edx, 0x178
push edx
push 0x410e40
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x410e4c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405f52
mov ecx, dword [ebp - 0x314]
xor edx, edx
mov dx, word [ecx + 0x298]
push edx
push str._0.4x
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x30c]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
push 0x410e5c
lea eax, [ebp - 0x104]
push eax
push 0x410e64
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x410e70
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x405f52
push 0x104
push 0
lea edx, [ebp - 0x104]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x314]
xor ecx, ecx
mov cx, word [eax + 0x298]
and ecx, 0x3ff
mov word [ebp - 0x310], cx
mov edx, dword [ebp - 0x310]
and edx, 0xffff
push edx
push str._0.2x
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [ebp - 0x30c]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
push 0x410e80
lea eax, [ebp - 0x104]
push eax
push str.Languages
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x314]
mov eax, dword [edx + 0x2b8]
push eax
push str._s_s
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea edx, [ebp - 0x208]
push edx
mov ecx, dword [ebp - 0x314]
call fcn.004062eb
test eax, eax
jne 0x405f9d
push 0x410e9c
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp + 8]
push ecx
push str._ZSetupMain::SetLanguage__Language_Directory___s_n
call fcn.00407a82
add esp, 8
pop edi
mov esp, ebp
pop ebp
ret 4
Function at 0x406b3a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
cmp dword [ebp + 8], 0
jne 0x406b50
xor eax, eax
jmp 0x406bf2
mov dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
mov dword [ecx + 0x14], edx
lea eax, [ebp - 0x18]
push eax
push 0x18
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x14]
push edx
call dword [sym.imp.GDI32.dll_GetObjectA]
mov ecx, dword [ebp - 0x1c]
call fcn.00406bf8
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 4]
push edx
push 0
push 0
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
push 0
push 0
push 0x90000000
push 0x41106c
push 0x41107c
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov edx, dword [ebp - 0x1c]
mov dword [edx + 8], eax
push 1
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 8]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret 4

Function at 0x406fb0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ca0c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x11c], 0
xor eax, eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x110], eax
lea ecx, [ebp - 0x10c]
call fcn.00407e8e
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10c]
call fcn.004080af
test eax, eax
je 0x407075
lea ecx, [ebp - 0x120]
push ecx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x407075
lea edx, [ebp - 0x118]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x11c], 1
mov dword [ebp - 0x110], 2
push 0
push 0
push 0
lea eax, [ebp - 0x11c]
push eax
push 0
mov ecx, dword [ebp - 0x120]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x4070bb
push 0
push str.Sorry_Man_
push str.Reboot_Routine_Failed_
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov dword [ebp - 0x124], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c]
call fcn.00407ffa
mov eax, dword [ebp - 0x124]
jmp 0x4070dd
mov dword [ebp - 0x128], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10c]
call fcn.00407ffa
mov eax, dword [ebp - 0x128]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x407636
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x4115f4]
sub esp, 0x528
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x407658
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x4077cd
push dword [0x411150]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4077cd
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x40768d
mov byte [ebp - 0x528], bl
push esi
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x4076a5
mov byte [ebp - 0x320], bl
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
lea eax, [ebp - 0x110]
push eax
push dword [ebp - 4]
call edi
test eax, eax
jne 0x4076c3
mov byte [ebp - 0x110], bl
push esi
lea eax, [ebp - 0x218]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call edi
test eax, eax
pop edi
jne 0x4076e0
mov byte [ebp - 0x218], bl
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0040759b
lea eax, [ebp - 8]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4076fd
sub eax, edx
mov ecx, eax
lea eax, [ebp - 0x420]
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x407711
sub eax, esi
add eax, ecx
mov byte [ebp + eax - 0x217], bl
lea eax, [ebp - 0x420]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.0040759b
lea eax, [ebp - 8]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x407740
sub eax, ecx
lea ecx, [ebp - 0x420]
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x407752
sub ecx, esi
add ecx, eax
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x320]
push eax
mov byte [ebp + ecx - 0x10f], bl
call fcn.004074d5
test eax, eax
pop esi
jne 0x407793
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x320]
push eax
call fcn.004074d5
test eax, eax
jne 0x4077c1
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.004074d5
test eax, eax
jne 0x4077cd
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.004074d5
test eax, eax
je 0x4077cd
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
pop ebx
leave
ret

Function at 0x407a82
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
xor esi, esi
cmp dword [0x4111e8], esi
je 0x407ae4
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp - 0x400]
push dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_vsprintf]
mov esi, eax
add esp, 0xc
cmp esi, 1
jle 0x407ad7
cmp byte [ebp + esi - 0x401], 0xa
lea eax, [ebp + esi - 0x400]
jne 0x407ad7
cmp byte [eax - 2], 0xd
je 0x407ad7
inc esi
mov byte [eax], 0xd
and byte [ebp + esi - 0x400], 0
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, esi
pop esi
leave
ret
Function at 0x407c1c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
xor ebx, ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
mov edi, str.ProgramFilesDir
push eax
push ebx
push edi
push dword [ebp - 4]
call esi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 8]
push eax
push ebx
push edi
push dword [ebp - 4]
call esi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407c7b
Capabilities:
Get common file path

Disassembly:
xor eax, eax
cmp dword [esp + 8], eax
push eax
je 0x407c88
push 2
jmp 0x407c8a
push 0x17
push dword [esp + 0xc]
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov eax, dword [esp + 4]
ret
Function at 0x407e8e
Capabilities:
Get common file path
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebx], 0x40e460
mov dword [ebp - 4], 0x80
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov ecx, ebx
mov word [ebx + 8], ax
call fcn.0040816d
sub esp, 0x94
lea esi, [ebx + 0x34]
push 0x25
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
call fcn.00407b76
push 0x208
mov dword [ebx + 0xc], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x98
mov esi, 0x104
mov dword [ebx + 0x20], eax
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0x24], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0x10], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0x14], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0x18], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0x1c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0x28], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0x2c], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0x30], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
push esi
mov dword [ebx + 0xcc], eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 0x28
mov dword [ebx + 0xc8], eax
push esi
push dword [ebx + 0x10]
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push dword [ebx + 0x14]
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push dword [ebx + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [ebx + 0x1c]
call fcn.00407c1c
pop ecx
mov ecx, ebx
call fcn.004080a5
push eax
push dword [ebx + 0x20]
call fcn.00407c7b
pop ecx
lea eax, [ebp - 4]
pop ecx
push eax
push dword [ebx + 0x24]
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push dword [ebx + 0x28]
call fcn.00407ae9
pop ecx
lea eax, [ebp - 4]
push eax
push esi
push dword [ebx + 0x2c]
xor edi, edi
push 1
push edi
push edi
call sub.WINSPOOL.DRV_GetPrintProcessorDirectoryA
lea eax, [ebp - 4]
push eax
push esi
push dword [ebx + 0x30]
push 1
push edi
push edi
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryA
mov ecx, ebx
call fcn.004081d3
mov ecx, ebx
call fcn.00408123
mov ecx, ebx
call fcn.0040819b
mov ecx, ebx
call fcn.004081c5
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret

Function at 0x4081c5
Capabilities:
Get memory capacity

Disassembly:
add ecx, 0xe0
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
ret
Function at 0x40c610
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40e4c8
push 0x40c8e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x411618], 0xffffffff
mov dword [0x41161c], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x4115f0]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x4115ec]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x411620], ecx
call fcn.0040c8d0
mov eax, dword [0x411590]
test eax, eax
jne 0x40c6a1
push 0x40c8c0
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.0040c8a0
push 0x41000c
push 0x410008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x4115e8]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x4115e4]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x410004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [edx]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40c7af
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40c715
cmp al, 0x22
jne 0x40c707
cmp byte [esi], 0x22
jne 0x40c71e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x40c72e
cmp al, 0x20
ja 0x40c72e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40c71e
mov dword [ebp - 0x30], 0
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40c74f
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x40c754
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x40c794
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x40c71e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40c7af
Function at 0x40694b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x406983
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x406971
mov al, 1
jmp 0x4069e2
cmp dword [ebx + 0x54], ecx
jne 0x40697a
mov al, 2
jmp 0x4069e2
cmp dword [ebx + 0x7c], ecx
jne 0x4069e2
mov al, 3
jmp 0x4069e2
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x406998
mov al, 4
jmp 0x4069e2
cmp ecx, 5
jne 0x4069b8
cmp ebx, 0
jne 0x4069a6
mov al, 5
jmp 0x4069e2
cmp ebx, 1
jne 0x4069af
mov al, 6
jmp 0x4069e2
cmp ebx, 2
jne 0x4069b8
mov al, 7
jmp 0x4069e2
cmp ecx, 6
jne 0x4069e0
cmp ebx, 0
jne 0x4069c6
mov al, 8
jmp 0x4069e2
cmp ebx, 1
jne 0x4069cd
mov al, 9
cmp ebx, 2
jne 0x4069d4
mov al, 0xa
cmp ebx, 3
jne 0x4069db
mov al, 0xb
cmp ebx, 4
jne 0x4069e2
mov al, 0xc
pop ebx
leave
ret