joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x10048def
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cwde
sub al, bh
mov dword [esp], edi
lahf
push ebx
rcl ah, cl
test ah, dh
clc
aaa
push edx
sub al, 0xd2
mov eax, dword [ebp + 8]
cmc
cmp bp, dx
test eax, eax
pushal
pushal
pushfd
lea esp, [esp + 0x44]
je 0x10068dbe
jmp 0x1006444c
test bh, ah
mov esi, dword [eax + 0x3c]
shr dx, 7
shr dh, 1
add dl, ch
add esi, eax
lea edx, [esp - 0x2e7f2852]
mov edx, dword [esi + 0x78]
stc
stc
pushal
test edx, edx
jmp 0x10064547
jmp 0x10047ec5
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x1eb90bc0
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x25c447c0
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
mov esi, 0x4c290146
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x792c1599
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x433002
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
jmp 0x431219

Function at 0x401200
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [ebp - 0x48], 3
mov dword [ebp - 0x44], 0x4010c0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], 0
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 6
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], str.Window
lea ecx, [ebp - 0x48]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassW]
push 0
mov edx, dword [ebp + 8]
push edx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x410b40
push str.Window
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [ebp - 4], eax
push 0xa
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0
push 0
lea edx, [ebp - 0x20]
push edx
call dword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x4012d0
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea ecx, [ebp - 0x20]
push ecx
call dword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x4012a6
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a180
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x38], 0x51
mov dword [ebp - 0x60], 0x4f
mov dword [ebp - 0x48], 0x61
mov dword [ebp - 0x58], 0x1a
mov dword [ebp - 0x64], 0x62
mov dword [ebp - 0x14], 0x29
mov dword [ebp - 0x50], 0x3e
mov dword [ebp - 0x20], 0x57
mov dword [ebp - 0x68], 0x39
mov dword [ebp - 0x6c], 0x4f
mov dword [ebp - 0x40], 0xb
mov dword [ebp - 0x70], 0x60
mov dword [ebp - 0x10], 0x40
mov dword [ebp - 0x54], 0x20
mov dword [ebp - 0x5c], 0x12
mov dword [ebp - 0x74], 0x1c
mov dword [ebp - 0x24], 0x22
mov dword [ebp - 0x28], 0x30
mov dword [ebp - 0x44], 0x3b
mov dword [ebp - 0x4c], 0x2f
mov dword [ebp - 0x2c], 0x44
mov dword [ebp - 0x3c], 0x59
mov dword [ebp - 0x34], 2
mov dword [ebp - 0x78], 0x13
mov eax, dword [ebp - 0x38]
imul eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x3c]
jge 0x40a243
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 4], 0
jmp 0x40a255
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x21
cmp dword [ebp - 4], eax
jge 0x40a2a9
mov ecx, dword [ebp - 0x40]
add ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jge 0x40a274
mov dword [ebp - 0x18], 1
jmp 0x40a27b
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x2c]
add edx, dword [ebp + 8]
cmp edx, dword [ebp - 0x4c]
jge 0x40a28f
mov dword [ebp - 0x1c], 1
jmp 0x40a296
mov dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
je 0x40a2a7
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x40a24c
mov dword [ebp - 8], 0
jmp 0x40a2bb
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0x50]
sub eax, 0x3d
cmp dword [ebp - 8], eax
jge 0x40a2d1
mov ecx, dword [ebp - 0x20]
add ecx, 1
mov dword [ebp - 0x20], ecx
jmp 0x40a2b2
mov dword [ebp - 0xc], 0
jmp 0x40a2e3
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0x24]
sub eax, 0x186c2
cmp dword [ebp - 0xc], eax
jge 0x40a34b
mov ecx, dword [ebp - 0x28]
cmp ecx, dword [ebp - 0x54]
jge 0x40a301
mov dword [ebp - 0x30], 1
jmp 0x40a308
mov dword [ebp - 0x30], 0
mov edx, dword [ebp - 0x10]
and edx, dword [ebp - 0x2c]
and edx, dword [ebp - 0x58]
and edx, dword [ebp - 0x30]
or edx, dword [ebp - 0x5c]
je 0x40a349
push 0xd5bc
push 0xd6f7
push 0x146fd
push 0xfa83
push 0xb6f1
push 0x426b
call dword [sym.imp.KERNEL32.dll_ReadFile]
add esp, 0x18
mov eax, dword [ebp - 0x34]
sub eax, 1
mov dword [ebp - 0x34], eax
jmp 0x40a2da
mov esp, ebp
pop ebp
ret
Function at 0x40b650
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov dword [ebp - 0x5c], 0x63
mov dword [ebp - 0x60], 0x44
mov dword [ebp - 0x64], 0x22
mov dword [ebp - 0x18], 0x4d
mov dword [ebp - 0x38], 0x64
mov dword [ebp - 0x50], 0x44
mov dword [ebp - 0x68], 0x41
mov dword [ebp - 0x54], 0x55
mov dword [ebp - 0x30], 0x64
mov dword [ebp - 0x34], 4
mov dword [ebp - 0x6c], 0x2e
mov dword [ebp - 0x70], 0x49
mov dword [ebp - 0x20], 0x48
mov dword [ebp - 0x4c], 0x59
mov dword [ebp - 0x14], 0x1e
mov dword [ebp - 0x40], 0x1f
mov dword [ebp - 0x3c], 0x55
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x24], 0x62
mov dword [ebp - 0x1c], 3
mov dword [ebp - 0x78], 0x46
mov dword [ebp - 0x7c], 0x22
mov dword [ebp - 4], 0x2c
mov dword [ebp - 0x58], 0x35
mov dword [ebp - 0x80], 0x38
mov dword [ebp - 8], 0
jmp 0x40b71a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x24]
sub ecx, 0x18702
cmp dword [ebp - 8], ecx
jge 0x40b74e
mov edx, dword [ebp - 0x34]
cmp edx, dword [ebp - 4]
jge 0x40b74c
mov eax, dword [ebp - 0x1c]
sub eax, 1
mov dword [ebp - 0x1c], eax
push 0xd49
push 0xd863
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
add esp, 8
jmp 0x40b711
mov dword [ebp - 0xc], 0
jmp 0x40b760
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x38]
sub edx, 0x63
cmp dword [ebp - 0xc], edx
jge 0x40b776
mov eax, dword [ebp - 0x20]
add eax, 1
mov dword [ebp - 0x20], eax
jmp 0x40b757
mov dword [ebp - 0x10], 0
jmp 0x40b788
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x3c]
sub edx, 0x54
cmp dword [ebp - 0x10], edx
jge 0x40b7f6
mov eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x24]
jge 0x40b7a4
mov dword [ebp - 0x28], 1
jmp 0x40b7ab
mov dword [ebp - 0x28], 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 4]
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 4]
sub eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x44]
cmp ecx, dword [ebp - 0x48]
jge 0x40b7d1
mov dword [ebp - 0x2c], 1
jmp 0x40b7d8
mov dword [ebp - 0x2c], 0
mov edx, dword [ebp - 0x28]
and edx, dword [ebp - 0x2c]
je 0x40b7f4
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x30]
cmp eax, dword [ebp - 0x4c]
jge 0x40b7f4
mov ecx, dword [ebp - 0x14]
sub ecx, 1
mov dword [ebp - 0x14], ecx
jmp 0x40b77f
mov edx, dword [ebp - 0x34]
add edx, 0x18
push edx
mov eax, dword [ebp - 0x50]
sub eax, 0x11
push eax
mov ecx, dword [ebp - 0x54]
sub ecx, 0x4d
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x33
push edx
mov eax, dword [ebp - 0x58]
push eax
mov ecx, dword [ebp - 4]
add ecx, 0x1f
push ecx
call fcn.0041e5b0
add esp, 0x18
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
mov esp, ebp
pop ebp
ret
Function at 0x40c5f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x78
mov dword [ebp - 0x3c], 3
mov dword [ebp - 0x50], 0x23
mov dword [ebp - 8], 0xe
mov dword [ebp - 0x14], 0x2a
mov dword [ebp - 0x54], 0x1c
mov dword [ebp - 0x58], 0x4e
mov dword [ebp - 0x5c], 0x19
mov dword [ebp - 0x60], 0x54
mov dword [ebp - 0x44], 0x5d
mov dword [ebp - 0x64], 0x14
mov dword [ebp - 0x4c], 0x60
mov dword [ebp - 0x68], 0x63
mov dword [ebp - 0x48], 0xf
mov dword [ebp - 0x6c], 0x25
mov dword [ebp - 0x2c], 0x1b
mov dword [ebp - 0x70], 0x22
mov dword [ebp - 0x74], 0x4a
mov dword [ebp - 0x78], 0x12
mov dword [ebp - 0x40], 0x44
mov dword [ebp - 0x1c], 0x25
mov dword [ebp - 0x30], 0x24
mov dword [ebp - 0x34], 0x52
mov dword [ebp - 0x38], 3
mov dword [ebp - 0x10], 0x1f
mov eax, dword [ebp - 0x14]
add eax, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0
jmp 0x40c6b9
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x34]
sub edx, 0x186f2
cmp dword [ebp - 4], edx
jge 0x40c725
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp + 0xc]
jge 0x40c6d8
mov dword [ebp - 0x18], 1
jmp 0x40c6df
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
and edx, dword [ebp + 0x14]
or edx, dword [ebp - 0x18]
je 0x40c723
push 0x122da
push 0x9089
push 0x147ec
push 0x14cf4
push 0x1574b
push 0xb7b9
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x18
mov eax, dword [ebp - 0x1c]
add eax, 1
mov dword [ebp - 0x1c], eax
jmp 0x40c6b0
mov dword [ebp - 0xc], 0
jmp 0x40c737
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0x38]
sub edx, 2
cmp dword [ebp - 0xc], edx
jge 0x40c7a6
mov eax, dword [ebp - 0x3c]
sub eax, dword [ebp - 0x40]
cmp eax, dword [ebp - 0x10]
jge 0x40c756
mov dword [ebp - 0x20], 1
jmp 0x40c75d
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x44]
add ecx, dword [ebp - 0x48]
cmp ecx, dword [ebp + 0xc]
jge 0x40c771
mov dword [ebp - 0x24], 1
jmp 0x40c778
mov dword [ebp - 0x24], 0
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x4c]
jge 0x40c789
mov dword [ebp - 0x28], 1
jmp 0x40c790
mov dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x20]
and eax, dword [ebp - 0x24]
or eax, dword [ebp - 0x28]
je 0x40c7a4
mov ecx, dword [ebp - 0x2c]
add ecx, 1
mov dword [ebp - 0x2c], ecx
jmp 0x40c72e
mov edx, dword [ebp - 0x30]
sub edx, 1
mov dword [ebp - 0x30], edx
mov esp, ebp
pop ebp
ret
Function at 0x40f460
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov dword [ebp - 0xc], 0x1e
mov dword [ebp - 0x40], 0x2c
mov dword [ebp - 0x44], 0x5c
mov dword [ebp - 0x48], 0x4f
mov dword [ebp - 0x28], 0x53
mov dword [ebp - 0x4c], 0x30
mov dword [ebp - 0x50], 0x5a
mov dword [ebp - 0x3c], 0x20
mov dword [ebp - 0x14], 0x2c
mov dword [ebp - 0x30], 0x55
mov dword [ebp - 4], 2
mov dword [ebp - 0x54], 0x23
mov dword [ebp - 0x1c], 0x33
mov dword [ebp - 0x58], 0x13
mov dword [ebp - 0x5c], 0x58
mov dword [ebp - 0x38], 0xd
mov dword [ebp - 0x2c], 0x44
mov dword [ebp - 0x60], 0x35
mov dword [ebp - 0x18], 0x4d
mov dword [ebp - 0x64], 0x5b
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x10], 0x4c
mov dword [ebp - 0x34], 0x34
mov dword [ebp - 0x24], 0x5c
mov dword [ebp - 0x68], 0x46
mov eax, dword [ebp - 0x28]
add eax, 5
push eax
mov ecx, dword [ebp - 0x18]
add ecx, 0x13
push ecx
mov edx, dword [ebp - 0x2c]
sub edx, 0x41
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x21
push eax
mov ecx, dword [ebp + 0x18]
sub ecx, 7
push ecx
mov edx, dword [ebp - 0x30]
add edx, 2
push edx
call fcn.0041d3d0
add esp, 0x18
mov dword [ebp - 8], 0
jmp 0x40f559
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x186ec
cmp dword [ebp - 8], ecx
jge 0x40f599
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
push 0x1752d
push 0x4a12
push 0x13a36
push 0x15cea
push 0x3df0
push 0xeb60
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
add esp, 0x18
jmp 0x40f550
mov eax, dword [ebp - 0x24]
sub eax, 0x13
push eax
mov ecx, dword [ebp - 0x10]
sub ecx, 0x44
push ecx
mov edx, dword [ebp - 0x14]
add edx, 0x2b
push edx
mov eax, dword [ebp - 0x34]
sub eax, 5
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x25
push ecx
mov edx, dword [ebp + 0x10]
add edx, 0x39
push edx
mov eax, dword [ebp - 0x38]
add eax, 0x15
push eax
mov ecx, dword [ebp + 8]
add ecx, 0x11
push ecx
mov edx, dword [ebp - 0x18]
sub edx, 0x47
push edx
mov eax, dword [ebp + 0xc]
add eax, 0x2b
push eax
call fcn.0040b240
add esp, 0x28
mov ecx, dword [ebp - 0x3c]
add ecx, 0x29
push ecx
mov edx, dword [ebp - 0x20]
add edx, 6
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x39
push eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 4
push ecx
mov edx, dword [ebp + 0xc]
add edx, 0x51
push edx
mov eax, dword [ebp - 0xc]
add eax, 0x38
push eax
mov ecx, dword [ebp - 0x20]
add ecx, 0x20
push ecx
mov edx, dword [ebp - 0xc]
add edx, 0x1f
push edx
mov eax, dword [ebp - 0x24]
sub eax, 0x56
push eax
mov ecx, dword [ebp - 0x40]
add ecx, 6
push ecx
call fcn.0040b240
add esp, 0x28
mov edx, dword [ebp - 4]
add edx, 1
mov dword [ebp - 4], edx
mov esp, ebp
pop ebp
ret
Function at 0x414a80
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x38], 0x1b
mov dword [ebp - 0xc], 0x20
mov dword [ebp - 0x3c], 0xa
mov dword [ebp - 0x40], 0x23
mov dword [ebp - 0x14], 0x4b
mov dword [ebp - 0x20], 0x37
mov dword [ebp - 0x44], 0x60
mov dword [ebp - 0x2c], 0x13
mov dword [ebp - 0x28], 0x33
mov dword [ebp - 0x48], 0x5b
mov dword [ebp - 0x4c], 0x63
mov dword [ebp - 0x50], 0x2a
mov dword [ebp - 0x54], 0x1a
mov dword [ebp - 0x58], 0x40
mov dword [ebp - 0x5c], 0x1d
mov dword [ebp - 0x60], 0x17
mov dword [ebp - 0x64], 0x5a
mov dword [ebp - 0x68], 0x16
mov dword [ebp - 0x6c], 0x33
mov dword [ebp - 0x24], 0x3b
mov dword [ebp - 0x10], 2
mov dword [ebp - 0x70], 0x4a
mov dword [ebp - 4], 0
jmp 0x414b32
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 0x20]
sub ecx, 0x186d7
cmp dword [ebp - 4], ecx
jge 0x414b68
push 0x27e5
push 0xd1be
push 0x4ed7
push 0x13e6b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
add esp, 0x10
mov edx, dword [ebp - 0x14]
add edx, 1
mov dword [ebp - 0x14], edx
jmp 0x414b29
mov dword [ebp - 8], 0
jmp 0x414b7a
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 0x1e
cmp dword [ebp - 8], ecx
jge 0x414bef
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jge 0x414ba2
mov dword [ebp - 0x18], 1
jmp 0x414ba9
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x34], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x30]
cmp ecx, dword [ebp - 0x34]
jge 0x414bcf
mov dword [ebp - 0x1c], 1
jmp 0x414bd6
mov dword [ebp - 0x1c], 0
mov edx, dword [ebp + 0x24]
sub edx, dword [ebp + 0x18]
and edx, dword [ebp - 0x18]
or edx, dword [ebp - 0x1c]
je 0x414bed
mov eax, dword [ebp + 0x1c]
sub eax, 1
mov dword [ebp + 0x1c], eax
jmp 0x414b71
mov esp, ebp
pop ebp
ret
Function at 0x4157b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov dword [ebp - 0x38], 0x46
mov dword [ebp - 0x3c], 0x5f
mov dword [ebp - 0x14], 0x41
mov dword [ebp - 0x40], 0x40
mov dword [ebp - 0x44], 0x19
mov dword [ebp - 0x48], 0xb
mov dword [ebp - 4], 0x27
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x24], 0x5c
mov dword [ebp - 0x20], 0x58
mov dword [ebp - 0x4c], 2
mov dword [ebp - 0x50], 0x2c
mov dword [ebp - 0x54], 0x25
mov dword [ebp - 0x58], 0x32
mov dword [ebp - 0x1c], 0x55
mov dword [ebp - 0x5c], 0x52
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x60], 0x56
mov dword [ebp - 0x64], 0x33
mov dword [ebp - 0x10], 0x35
mov dword [ebp - 0x68], 0x49
mov dword [ebp - 0x6c], 0x48
mov dword [ebp - 0x70], 0x48
mov dword [ebp - 0x28], 0x4d
mov dword [ebp - 8], 0
jmp 0x415870
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x1c]
sub ecx, 0x186f5
cmp dword [ebp - 8], ecx
jge 0x4158df
mov edx, dword [ebp + 0x24]
cmp edx, dword [ebp - 0x20]
jge 0x4158dd
mov eax, dword [ebp - 0x24]
imul eax, dword [ebp + 0x14]
cmp eax, dword [ebp - 0x28]
jge 0x41589b
mov dword [ebp - 0xc], 1
jmp 0x4158a2
mov dword [ebp - 0xc], 0
mov ecx, dword [ebp + 0x18]
and ecx, dword [ebp - 4]
or ecx, dword [ebp - 0xc]
je 0x4158dd
push 0x13f7a
push 0x17286
push 0xe676
push 0x1545b
push 0xa432
push 0x16f13
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0x18
mov edx, dword [ebp - 4]
sub edx, 1
mov dword [ebp - 4], edx
jmp 0x415867
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x30], ecx
mov edx, dword [ebp + 0x10]
add edx, 1
mov dword [ebp + 0x10], edx
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x30]
jge 0x415905
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 0x2b
push edx
mov eax, dword [ebp - 0x14]
add eax, 0x15
push eax
mov ecx, dword [ebp - 0x14]
add ecx, 0x10
push ecx
mov edx, dword [ebp - 0x34]
add edx, 0x2a
push edx
mov eax, dword [ebp + 0x18]
sub eax, 0x4c
push eax
mov ecx, dword [ebp + 8]
add ecx, 0xe
push ecx
mov edx, dword [ebp - 4]
sub edx, 0x11
push edx
call fcn.00418870
add esp, 0x1c
mov eax, dword [ebp - 0x18]
add eax, 0x18
push eax
mov ecx, dword [ebp + 0x18]
sub ecx, 0x38
push ecx
mov edx, dword [ebp - 0x18]
add edx, 0x37
push edx
call fcn.00416650
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x41b590
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov dword [ebp - 0x14], 0x56
mov dword [ebp - 0xc], 0x1f
mov dword [ebp - 0x4c], 0x26
mov dword [ebp - 0x50], 0x48
mov dword [ebp - 0x54], 0x35
mov dword [ebp - 0x58], 5
mov dword [ebp - 0x5c], 0x26
mov dword [ebp - 0x60], 0x18
mov dword [ebp - 0x48], 0x32
mov dword [ebp - 0x64], 4
mov dword [ebp - 0x34], 0x43
mov dword [ebp - 0x3c], 0x59
mov dword [ebp - 0x40], 0xd
mov dword [ebp - 0x68], 0x51
mov dword [ebp - 0x6c], 0x53
mov dword [ebp - 0x70], 3
mov dword [ebp - 0x44], 0x5d
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x20], 0x17
mov dword [ebp - 4], 0x40
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x74], 0x30
mov dword [ebp - 0x10], 0x3f
mov dword [ebp - 0x30], 0x61
mov dword [ebp - 8], 0
jmp 0x41b650
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x2c]
sub ecx, 0x186b8
cmp dword [ebp - 8], ecx
jge 0x41b70e
mov edx, dword [ebp - 0xc]
sub edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
and eax, dword [ebp - 0x20]
and eax, dword [ebp + 8]
xor eax, dword [ebp - 0x30]
je 0x41b709
mov ecx, dword [ebp - 0x10]
sub ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
cmp edx, dword [ebp - 0x20]
jge 0x41b697
mov dword [ebp - 0x24], 1
jmp 0x41b69e
mov dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x14]
sub eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x34]
sub ecx, dword [ebp - 0x14]
cmp ecx, dword [ebp - 4]
jge 0x41b6bb
mov dword [ebp - 0x28], 1
jmp 0x41b6c2
mov dword [ebp - 0x28], 0
mov edx, dword [ebp - 0x24]
and edx, dword [ebp - 0x28]
je 0x41b709
push 0xe14f
push 0x11c42
push 0x1718f
push 0x161db
push 0x2daf
push 0xf1e5
push 0x8ff4
push 0x56d1
push 0x3460
call dword [sym.imp.USER32.dll_SetWindowTextA]
add esp, 0x24
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x41b647
mov ecx, dword [ebp - 0x38]
add ecx, 0x29
push ecx
mov edx, dword [ebp - 0x3c]
sub edx, 0x25
push edx
mov eax, dword [ebp - 0x40]
add eax, 0x44
push eax
call fcn.0041ac40
add esp, 0xc
mov dword [ebp - 0x18], 0
jmp 0x41b73d
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x44]
sub edx, 0x186fd
cmp dword [ebp - 0x18], edx
jge 0x41b75c
call dword [sym.imp.CRYPT32.dll_CertCloseStore]
mov eax, dword [ebp + 8]
add eax, 1
mov dword [ebp + 8], eax
jmp 0x41b734
mov dword [ebp - 0x1c], 0
jmp 0x41b76e
mov ecx, dword [ebp - 0x1c]
add ecx, 1
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x48]
sub edx, 0x186d2
cmp dword [ebp - 0x1c], edx
jge 0x41b7b3
push 0x446f
push 0xa05f
push 0xca6a
push 0x1017d
push 0x5bc9
push 0x12268
push 0x6db1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add esp, 0x1c
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x41b765
mov esp, ebp
pop ebp
ret