joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406290
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2000
call fcn.0044c0a0
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [esi]
test edi, edi
je 0x4062c5
mov ebx, dword [esp + 0x2010]
test ebx, ebx
je 0x4062c5
lea eax, [esp + 0xc]
test eax, eax
jne 0x4062d3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2000
ret 4
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
push 0
push str.PageState
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0xc], 0
jne 0x4062f8
xor eax, eax
jmp 0x406353
push 0x20
lea edx, [esp + 0x10]
push str.Hide
push edx
call fcn.0044c0cf
add esp, 0xc
test eax, eax
jne 0x406317
mov eax, 1
jmp 0x406353
push 0x20
lea eax, [esp + 0x10]
push str.Minimized
push eax
call fcn.0044c0cf
add esp, 0xc
test eax, eax
jne 0x406336
mov eax, 2
jmp 0x406353
push 0x20
lea ecx, [esp + 0x10]
push str.Smart
push ecx
call fcn.0044c0cf
add esp, 0xc
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
mov edx, dword [esi + 0x20]
push edi
push 0
push str.ShowCancelButton
push ebx
mov dword [edx + 0x10c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x20]
xor ecx, ecx
cmp eax, 1
pop edi
sete cl
pop esi
mov dword [edx + 0x110], ecx
mov eax, 1
pop ebx
add esp, 0x2000
ret 4

Function at 0x406390
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2000
call fcn.0044c0a0
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [esi]
test edi, edi
je 0x4063c5
mov ebx, dword [esp + 0x2010]
test ebx, ebx
je 0x4063c5
lea eax, [esp + 0xc]
test eax, eax
jne 0x4063d3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2000
ret 4
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
push 0
push str.PageState
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0xc], 0
jne 0x4063f8
xor eax, eax
jmp 0x406453
push 0x20
lea edx, [esp + 0x10]
push str.Hide
push edx
call fcn.0044c0cf
add esp, 0xc
test eax, eax
jne 0x406417
mov eax, 1
jmp 0x406453
push 0x20
lea eax, [esp + 0x10]
push str.Minimized
push eax
call fcn.0044c0cf
add esp, 0xc
test eax, eax
jne 0x406436
mov eax, 2
jmp 0x406453
push 0x20
lea ecx, [esp + 0x10]
push str.Smart
push ecx
call fcn.0044c0cf
add esp, 0xc
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
mov edx, dword [esi + 0x20]
push edi
push 0
push str.ShowCancelButton
push ebx
mov dword [edx + 0x114], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x20]
xor ecx, ecx
cmp eax, 1
sete cl
mov dword [edx + 0x118], ecx
mov esi, dword [esi + 0x20]
cmp dword [esi + 0x114], 1
jne 0x406492
mov dword [esi + 0x114], 2
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x2000
ret 4
Function at 0x4064b0
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2000
call fcn.0044c0a0
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0xc]
rep stosd dword es:[edi], eax
mov edi, dword [esi]
test edi, edi
je 0x4064e5
mov ebx, dword [esp + 0x2010]
test ebx, ebx
je 0x4064e5
lea eax, [esp + 0xc]
test eax, eax
jne 0x4064f3
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x2000
ret 4
push edi
lea ecx, [esp + 0x10]
push 0x1000
push ecx
push 0
push str.PageState
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [esp + 0xc], 0
jne 0x406518
xor eax, eax
jmp 0x406573
push 0x20
lea edx, [esp + 0x10]
push str.Hide
push edx
call fcn.0044c0cf
add esp, 0xc
test eax, eax
jne 0x406537
mov eax, 1
jmp 0x406573
push 0x20
lea eax, [esp + 0x10]
push str.Minimized
push eax
call fcn.0044c0cf
add esp, 0xc
test eax, eax
jne 0x406556
mov eax, 2
jmp 0x406573
push 0x20
lea ecx, [esp + 0x10]
push str.Smart
push ecx
call fcn.0044c0cf
add esp, 0xc
neg eax
sbb eax, eax
and al, 0xfd
add eax, 3
mov edx, dword [esi + 0x20]
push edi
push 0
push str.ShowCancelButton
push ebx
mov dword [edx + 0x11c], eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edx, dword [esi + 0x20]
xor ecx, ecx
cmp eax, 1
pop edi
sete cl
pop esi
mov dword [edx + 0x120], ecx
mov eax, 1
pop ebx
add esp, 0x2000
ret 4
Function at 0x407250
Capabilities:
Get file version info

Disassembly:
mov eax, 0x200c
call fcn.0044c0a0
push ebx
push ebp
push esi
mov esi, dword [esp + 0x201c]
test esi, esi
push edi
je 0x407343
mov ebx, dword [esp + 0x2024]
test ebx, ebx
je 0x407343
mov ebp, dword [esp + 0x2028]
cmp ebp, 0x80
jl 0x407343
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x1c]
mov dword [esp + 0x14], 0
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push eax
push esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
test eax, eax
je 0x407343
cmp eax, 0x1fff
ja 0x407343
lea ecx, [esp + 0x1c]
push ecx
push eax
push 0
push esi
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x407343
lea edx, [esp + 0x18]
lea eax, [esp + 0x10]
push edx
push eax
lea ecx, [esp + 0x24]
push 0x4886c0
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x407343
mov ecx, ebp
xor eax, eax
mov edx, ecx
mov edi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edx, dword [eax + 0xc]
mov cx, word [eax + 0xc]
shr edx, 0x10
push ecx
push edx
mov edx, dword [eax + 8]
xor ecx, ecx
mov cx, word [eax + 8]
shr edx, 0x10
push ecx
push edx
push str._d._d._d._d
push ebx
call fcn.0044b699
add esp, 0x18
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x200c
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x200c
ret
Function at 0x407b80
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x2004
call fcn.0044c0a0
push ebp
mov ebp, ecx
push esi
push edi
mov esi, dword [ebp]
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x10]
test esi, esi
mov dword [esp + 0xc], ebp
rep stosd dword es:[edi], eax
je 0x407bba
mov edi, dword [esp + 0x2014]
test edi, edi
je 0x407bba
lea eax, [esp + 0x10]
test eax, eax
jne 0x407bc8
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x2004
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push esi
lea ecx, [esp + 0x18]
push 0x1000
push ecx
push 0
push str.FixedProduct
push edi
call ebx
cmp word [esp + 0x14], 0
je 0x407c23
lea edx, [esp + 0x14]
push edx
call fcn.0044b1a8
mov ebp, eax
mov ax, word [0x4918b0]
push eax
lea ecx, [esp + 0x1c]
push 0x2c
push ecx
call fcn.0041ce00
mov ecx, dword [esp + 0x20]
add esp, 0x10
lea edx, [esp + 0x14]
push 1
push ebp
push edx
call fcn.00406ba0
mov ebp, dword [esp + 0x10]
push esi
lea eax, [esp + 0x18]
push 0x1000
push eax
push 0
push 0x488b44
push edi
call ebx
cmp word [esp + 0x14], 0
pop ebx
je 0x407c73
lea ecx, [esp + 0x10]
push ecx
call fcn.0044b1a8
mov dx, word [0x4918b0]
mov esi, eax
push edx
lea eax, [esp + 0x18]
push 0x2c
push eax
call fcn.0041ce00
add esp, 0x10
lea ecx, [esp + 0x10]
push 0
push esi
push ecx
mov ecx, ebp
call fcn.00406ba0
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x2004
ret 4
Function at 0x408480
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 8]
cmp ebx, eax
je 0x408650
push ebp
mov ebp, dword [esp + 0x14]
push esi
push edi
lea esi, [ebp + 0x14]
lea edi, [ebx + 0x14]
cmp esi, 0x14
je 0x408623
mov eax, dword [ebx]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x4084bf
mov dword [ebp], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4084d1
mov eax, dword [0x4881a0]
mov dword [ebp], eax
mov ecx, dword [ebx]
push ecx
mov ecx, ebp
call fcn.00402c90
lea edx, [edi - 0x10]
lea ecx, [esi - 0x10]
push edx
call fcn.00409360
push edi
mov ecx, esi
call fcn.00402ba0
lea eax, [edi + 4]
lea ecx, [esi + 4]
push eax
call fcn.00402ba0
lea ecx, [edi + 8]
push ecx
lea ecx, [esi + 8]
call fcn.00402ba0
lea edx, [edi + 0xc]
lea ecx, [esi + 0xc]
push edx
call fcn.00402ba0
lea eax, [edi + 0x10]
lea ecx, [esi + 0x10]
push eax
call fcn.00402ba0
mov ecx, dword [edi + 0x14]
lea edx, [edi + 0x18]
mov dword [esi + 0x14], ecx
push edx
lea ecx, [esi + 0x18]
call fcn.00402ba0
lea eax, [edi + 0x1c]
lea ecx, [esi + 0x1c]
push eax
call fcn.00402ba0
lea ecx, [edi + 0x20]
push ecx
lea ecx, [esi + 0x20]
call fcn.00402ba0
lea edx, [edi + 0x24]
lea ecx, [esi + 0x24]
push edx
call fcn.00402ba0
lea eax, [edi + 0x28]
lea ecx, [esi + 0x28]
push eax
call fcn.00402ba0
lea ecx, [edi + 0x2c]
push ecx
lea ecx, [esi + 0x2c]
call fcn.00402ba0
lea edx, [edi + 0x30]
lea ecx, [esi + 0x30]
push edx
call fcn.00402ba0
lea eax, [edi + 0x34]
lea ecx, [esi + 0x34]
push eax
call fcn.00402ba0
lea ecx, [edi + 0x38]
push ecx
lea ecx, [esi + 0x38]
call fcn.00402ba0
lea edx, [edi + 0x3c]
lea ecx, [esi + 0x3c]
push edx
call fcn.00402ba0
lea eax, [edi + 0x40]
lea ecx, [esi + 0x40]
push eax
call fcn.00402ba0
lea ecx, [edi + 0x44]
push ecx
lea ecx, [esi + 0x44]
call fcn.00409470
mov edx, dword [edi + 0x54]
mov dword [esi + 0x54], edx
mov eax, dword [edi + 0x58]
mov dword [esi + 0x58], eax
mov ecx, dword [edi + 0x5c]
mov dword [esi + 0x5c], ecx
mov edx, dword [edi + 0x60]
mov dword [esi + 0x60], edx
mov eax, dword [edi + 0x64]
mov dword [esi + 0x64], eax
mov ecx, dword [edi + 0x68]
mov dword [esi + 0x68], ecx
mov edx, dword [edi + 0x6c]
mov dword [esi + 0x6c], edx
mov eax, dword [edi + 0x70]
mov dword [esi + 0x70], eax
mov ecx, dword [edi + 0x74]
mov dword [esi + 0x74], ecx
mov edx, dword [edi + 0x78]
lea ecx, [edi + 0x80]
mov dword [esi + 0x78], edx
mov eax, dword [edi + 0x7c]
push ecx
lea ecx, [esi + 0x80]
mov dword [esi + 0x7c], eax
call fcn.00402ba0
mov edx, dword [edi + 0x84]
mov dword [esi + 0x84], edx
mov eax, dword [edi + 0x88]
mov dword [esi + 0x88], eax
mov ecx, dword [edi + 0x8c]
mov dword [esi + 0x8c], ecx
mov eax, dword [esp + 0x18]
add ebx, 0xa4
add ebp, 0xa4
add esi, 0xa4
add edi, 0xa4
cmp ebx, eax
jne 0x40849e
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
ret 0xc
mov eax, dword [esp + 0x10]
pop ebx
ret 0xc
Function at 0x408660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [esp + 8]
test eax, eax
jbe 0x408829
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea esi, [ebx + 0x14]
mov ebp, eax
cmp esi, 0x14
je 0x408812
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jl 0x40869d
mov dword [ebx], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4086ae
mov eax, dword [0x4881a0]
mov dword [ebx], eax
mov ecx, dword [edi]
push ecx
mov ecx, ebx
call fcn.00402c90
lea edx, [edi + 4]
lea ecx, [esi - 0x10]
push edx
call fcn.00409360
lea eax, [edi + 0x14]
mov ecx, esi
push eax
call fcn.00402ba0
lea ecx, [edi + 0x18]
push ecx
lea ecx, [esi + 4]
call fcn.00402ba0
lea edx, [edi + 0x1c]
lea ecx, [esi + 8]
push edx
call fcn.00402ba0
lea eax, [edi + 0x20]
lea ecx, [esi + 0xc]
push eax
call fcn.00402ba0
lea ecx, [edi + 0x24]
push ecx
lea ecx, [esi + 0x10]
call fcn.00402ba0
mov edx, dword [edi + 0x28]
lea eax, [edi + 0x2c]
push eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x14], edx
call fcn.00402ba0
lea ecx, [edi + 0x30]
push ecx
lea ecx, [esi + 0x1c]
call fcn.00402ba0
lea edx, [edi + 0x34]
lea ecx, [esi + 0x20]
push edx
call fcn.00402ba0
lea eax, [edi + 0x38]
lea ecx, [esi + 0x24]
push eax
call fcn.00402ba0
lea ecx, [edi + 0x3c]
push ecx
lea ecx, [esi + 0x28]
call fcn.00402ba0
lea edx, [edi + 0x40]
lea ecx, [esi + 0x2c]
push edx
call fcn.00402ba0
lea eax, [edi + 0x44]
lea ecx, [esi + 0x30]
push eax
call fcn.00402ba0
lea ecx, [edi + 0x48]
push ecx
lea ecx, [esi + 0x34]
call fcn.00402ba0
lea edx, [edi + 0x4c]
lea ecx, [esi + 0x38]
push edx
call fcn.00402ba0
lea eax, [edi + 0x50]
lea ecx, [esi + 0x3c]
push eax
call fcn.00402ba0
lea ecx, [edi + 0x54]
push ecx
lea ecx, [esi + 0x40]
call fcn.00402ba0
lea edx, [edi + 0x58]
lea ecx, [esi + 0x44]
push edx
call fcn.00409470
mov eax, dword [edi + 0x68]
mov dword [esi + 0x54], eax
mov ecx, dword [edi + 0x6c]
mov dword [esi + 0x58], ecx
mov edx, dword [edi + 0x70]
mov dword [esi + 0x5c], edx
mov eax, dword [edi + 0x74]
mov dword [esi + 0x60], eax
mov ecx, dword [edi + 0x78]
mov dword [esi + 0x64], ecx
mov edx, dword [edi + 0x7c]
mov dword [esi + 0x68], edx
mov eax, dword [edi + 0x80]
mov dword [esi + 0x6c], eax
mov ecx, dword [edi + 0x84]
mov dword [esi + 0x70], ecx
mov edx, dword [edi + 0x88]
mov dword [esi + 0x74], edx
mov eax, dword [edi + 0x8c]
mov dword [esi + 0x78], eax
mov ecx, dword [edi + 0x90]
lea edx, [edi + 0x94]
mov dword [esi + 0x7c], ecx
push edx
lea ecx, [esi + 0x80]
call fcn.00402ba0
mov eax, dword [edi + 0x98]
mov dword [esi + 0x84], eax
mov ecx, dword [edi + 0x9c]
mov dword [esi + 0x88], ecx
mov edx, dword [edi + 0xa0]
mov dword [esi + 0x8c], edx
add ebx, 0xa4
add esi, 0xa4
dec ebp
jne 0x40867d
pop edi
pop esi
pop ebp
pop ebx
ret 0xc
Function at 0x409fe0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov ecx, 0xf
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
lea edx, [esp + 4]
mov dword [esp + 4], 0x3c
push edx
mov dword [esp + 0xc], 0x40
mov dword [esp + 0x14], str.open
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 0
mov dword [esp + 0x24], 5
mov dword [esp + 0x1c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov ecx, dword [esp + 0x3c]
pop edi
neg eax
sbb eax, eax
and eax, ecx
add esp, 0x3c
ret 8

Function at 0x40a130
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x2420
call fcn.0044c0a0
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x1c], ecx
call fcn.0040a0f0
mov esi, eax
mov ecx, 0x800
xor eax, eax
lea edi, [esp + 0x430]
rep stosd dword es:[edi], eax
mov ebx, 1
lea eax, [esp + 0x14]
lea ecx, [esp + 0x430]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0x1000
push eax
mov eax, dword [esi + 0x30]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [esi + 0x28]
push eax
push ecx
push edx
mov dword [esp + 0x30], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
cmp dword [esp + 0x10], ebx
jne 0x40a22b
cmp word [esp + 0x430], 0
je 0x40a22b
mov eax, dword [esp + 0x14]
test eax, eax
jbe 0x40a22b
lea eax, [esp + 0x430]
lea ebx, [esi + 0x24]
test eax, eax
jne 0x40a1c5
xor ebp, ebp
jmp 0x40a1d5
lea ecx, [esp + 0x430]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebp, eax
mov eax, dword [ebx]
cmp dword [eax - 0xc], 1
jg 0x40a1e2
cmp ebp, dword [eax - 4]
jle 0x40a1f5
mov ecx, ebx
call fcn.004039a0
push ebp
mov ecx, ebx
call fcn.004036b0
test eax, eax
je 0x40a22b
lea eax, [ebp + ebp]
lea edx, [ebp + ebp + 2]
cmp edx, eax
jb 0x40a21e
mov edi, dword [ebx]
mov ecx, eax
mov edx, ecx
lea esi, [esp + 0x430]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [esp + 0x18]
mov ecx, dword [ebx]
mov dword [ecx - 8], ebp
mov edx, dword [ebx]
mov word [edx + eax], 0
mov eax, dword [esi + 0x34]
mov ecx, dword [esi + 0x24]
push eax
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov eax, dword [esi + 0x50]
lea ecx, [esp + 0x20]
push eax
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00409fe0
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2420
ret
Function at 0x40a5e0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
jne 0x40a5ee
or eax, 0xffffffff
pop esi
ret
push 0
push 0
push 3
push 0
push 1
push 8
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a60c
or eax, eax
pop esi
ret
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret

Function at 0x40a680
Capabilities:
Terminate process

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x94]
test eax, eax
jne 0x40a691
pop esi
pop ecx
ret
lea ecx, [esp + 4]
mov dword [esp + 4], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 4], 0x103
jne 0x40a6c8
mov edx, dword [esi + 0x94]
push 2
push edx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [esi + 0x90], 3
mov eax, 1
pop esi
pop ecx
ret
Function at 0x40aae0
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x40ab2f
cmp dword [esp + 0x10], 0x104
jl 0x40ab2f
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push eax
push ecx
push 0
mov dword [esp + 0x18], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x40ab2f
mov edx, dword [esp + 0xc]
push esi
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov eax, 1
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x40b8c0
Capabilities:
Link many functions at runtime

Disassembly:
push esi
mov esi, ecx
call fcn.0040b9a0
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
mov dword [esi + 0x34], eax
jne 0x40b8e0
xor al, al
pop esi
ret 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.HttpCreateDownloadObj
push eax
call edi
mov ecx, dword [esi + 0x34]
push str.HttpDeleteDownloadObj
push ecx
mov dword [esi + 4], eax
call edi
mov edx, dword [esi + 0x34]
push str.HttpInitDownPara
push edx
mov dword [esi + 8], eax
call edi
mov dword [esi + 0xc], eax
mov eax, dword [esi + 0x34]
push str.HttpDownload
push eax
call edi
mov ecx, dword [esi + 0x34]
push str.HttpCancel
push ecx
mov dword [esi + 0x10], eax
call edi
mov edx, dword [esi + 0x34]
push str.HttpWait
push edx
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0x18], eax
mov eax, dword [esi + 0x34]
push str.HttpResetAll
push eax
call edi
mov ecx, dword [esi + 0x34]
push str.HttpGetState
push ecx
mov dword [esi + 0x1c], eax
call edi
mov edx, dword [esi + 0x34]
push str.HttpGetConnectState
push edx
mov dword [esi + 0x20], eax
call edi
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x34]
push str.HttpGetContentLength
push eax
call edi
mov ecx, dword [esi + 0x34]
push str.HttpGetReceivedLength
push ecx
mov dword [esi + 0x28], eax
call edi
mov edx, dword [esi + 0x34]
push str.HttpGetLastError
push edx
mov dword [esi + 0x2c], eax
call edi
mov dword [esi + 0x30], eax
pop edi
mov al, 1
pop esi
ret 4
Function at 0x40b9e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x476470
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x170
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov esi, dword [ebp + 8]
test esi, esi
je 0x40bb68
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40bb68
call dword [ebx + 4]
mov dword [ebp - 0x14c], eax
mov ecx, 0x4e
xor eax, eax
lea edi, [ebp - 0x148]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x140], 1
mov dword [ebp - 0x18], eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0044c0a0
mov esi, esp
mov byte [esi], 0
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x144], esi
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea edi, [eax + eax + 2]
mov eax, edi
add eax, 3
and al, 0xfc
call fcn.0044c0a0
mov esi, esp
mov byte [esi], 0
push 0
push 0
push edi
push esi
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov dword [ebp - 0x148], esi
xor eax, eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x130], eax
push eax
lea eax, [ebp - 0x148]
push eax
mov esi, dword [ebp - 0x14c]
push esi
call dword [ebx + 0x10]
add esp, 0xc
mov byte [ebp - 0x154], 0
mov edi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call edi
mov dword [ebp - 0x150], eax
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 0x10], 0xffffffff
je 0x40bb07
call edi
sub eax, dword [ebp - 0x150]
cmp eax, dword [ebp + 0x10]
ja 0x40bb28
lea ecx, [ebp - 0x168]
push ecx
lea edx, [ebp - 0x170]
push edx
push esi
call dword [ebx + 0x20]
add esp, 0xc
cmp eax, 4
jne 0x40baec
mov byte [ebp - 0x154], 1
mov dword [ebp - 4], 0
mov al, byte [ebp - 0x154]
test al, al
jne 0x40bb41
push 0
call dword [ebx + 0x14]
add esp, 4
push 0
call dword [ebx + 0x18]
push 0
call dword [ebx + 8]
add esp, 8
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x154]
and eax, 0xff
jmp 0x40bb6a
xor eax, eax
lea esp, [ebp - 0x188]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c1a0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
test eax, eax
push edi
mov esi, ecx
jne 0x40c301
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x20]
cmp edi, 0x111
jne 0x40c1f7
cmp bx, 0x7e
jne 0x40c1dd
call fcn.0040cc80
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp bx, 0x85
jne 0x40c226
mov ecx, esi
call fcn.0040cd00
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
cmp edi, 1
jne 0x40c226
push edi
mov ecx, esi
call fcn.0040a6e0
push ebp
mov ecx, esi
call fcn.0040c310
mov ecx, dword [esp + 0x24]
mov dword [ecx], eax
mov ecx, esi
call fcn.0040a6d0
test eax, eax
je 0x40c226
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
cmp edi, 5
lea eax, [esi + 0x80]
jne 0x40c2a4
test eax, eax
je 0x40c23a
lea esi, [eax - 0x80]
jmp 0x40c23c
xor esi, esi
mov cl, byte [eax + 0x1c]
test cl, cl
je 0x40c271
mov edx, dword [esi + 4]
push 0xe801
push edx
call dword [sym.imp.USER32.dll_GetDlgItem]
cmp ebx, 2
jne 0x40c262
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c276
test ebx, ebx
jne 0x40c271
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x40c276
cmp ebx, 1
je 0x40c2c4
mov eax, ebp
shr eax, 0x10
movsx ecx, ax
movsx edx, bp
push ecx
push edx
lea ecx, [esi + 0x80]
call fcn.0041c8a0
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
cmp edi, 0x24
jne 0x40c2da
mov edx, dword [eax + 0x14]
or ecx, 0xffffffff
cmp edx, ecx
je 0x40c2c4
cmp dword [eax + 0x18], ecx
je 0x40c2c4
mov ecx, dword [eax + 0x14]
mov dword [ebp + 0x18], ecx
mov edx, dword [eax + 0x18]
mov dword [ebp + 0x1c], edx
mov eax, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword [eax], 0
mov eax, 1
pop ebx
ret 0x18
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x14]
push 0
push ecx
push ebp
push ebx
push edi
push edx
lea ecx, [esi + 0x20]
call fcn.00420570
test eax, eax
je 0x40c301
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 0x18
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0x18
Function at 0x40cda0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
call dword [sym.imp.KERNEL32.dll_GetVersion]
call fcn.00404a00
test eax, eax
jne 0x40cdbb
call fcn.00404a30
test eax, eax
je 0x40ce11
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 6
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x14
ret