joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40185c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
call fcn.0040182e
xor ebx, ebx
test al, al
je 0x4018ed
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push 0x411200
push edi
call esi
push 0x4111e8
push edi
mov dword [ebp - 4], eax
call esi
push 0x4111d0
push edi
mov dword [ebp - 8], eax
call esi
mov esi, eax
cmp dword [ebp - 4], ebx
je 0x4018ed
cmp dword [ebp - 8], ebx
je 0x4018ed
cmp esi, ebx
je 0x4018ed
lea eax, [ebp - 0xc]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [ebp - 4]
test eax, eax
je 0x4018ed
lea eax, [ebp - 0x18]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [ebp - 8]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
call esi
call fcn.0040182e
push ebx
test al, al
je 0x4018fb
push 6
jmp 0x4018fd
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401961
Capabilities:
Delete directory
Delete file
Get common file path
Move file
Persist via lnk shortcut

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30c
lea eax, [ebp - 0x104]
push eax
push 1
push 0
push 0x17
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x401a40
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push edi
push dword [0x41511c]
lea eax, [ebp - 0x104]
push eax
push str._s_s_
mov edi, 0x104
push edi
push eax
call esi
push str.Uninstall_FreeWorkz.lnk
lea eax, [ebp - 0x104]
push eax
mov ebx, 0x4112c0
push ebx
lea eax, [ebp - 0x208]
push edi
push eax
call esi
push str.Play_FreeWorkz_Online.url
lea eax, [ebp - 0x104]
push eax
push ebx
lea eax, [ebp - 0x30c]
push edi
push eax
call esi
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x3c
lea eax, [ebp - 0x208]
push eax
call edi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x401a07
push 5
push 0
lea eax, [ebp - 0x208]
push eax
call esi
lea eax, [ebp - 0x30c]
push eax
call edi
test eax, eax
jne 0x401a20
push 5
push eax
lea eax, [ebp - 0x30c]
push eax
call esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x401a3d
push 5
push eax
lea eax, [ebp - 0x104]
push eax
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x402044
Capabilities:
Check if file exists
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
push esi
cmp dword [ebp + 8], ebx
jne 0x402058
push 0x66
pop eax
jmp 0x4020ac
push edi
push ebx
push 0x80
push 3
push ebx
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 0x14], edi
cmp edi, 0xffffffff
je 0x4020a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4020a8
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push edi
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, ebx
jne 0x4020b0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x66
pop eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [esi + 1]
push eax
push 8
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x4021b0
push ebx
lea ecx, [ebp - 8]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4021b0
mov eax, dword [ebp - 8]
cmp eax, ebx
jbe 0x4021b0
push str.edogkopmmbiomlflahmmpchnobahleib
push dword [ebp - 4]
mov dword [ebp + 8], eax
call fcn.00405bd0
pop ecx
pop ecx
cmp eax, ebx
je 0x402178
lea esi, [eax - 2]
jmp 0x402107
dec esi
movsx eax, byte [esi]
push eax
call fcn.00405b9e
pop ecx
test eax, eax
jne 0x402106
cmp byte [esi], 0x7b
jne 0x40211b
inc esi
push 0x7b
push esi
call fcn.00405960
pop ecx
pop ecx
cmp eax, ebx
je 0x402178
call fcn.00402006
mov edi, eax
cmp edi, ebx
je 0x402178
jmp 0x402137
inc edi
movsx eax, byte [edi]
push eax
call fcn.00405b9e
pop ecx
test eax, eax
jne 0x402136
cmp byte [edi], 0x7d
jne 0x40214b
dec edi
cmp byte [esi], 0x2c
jne 0x402156
cmp byte [edi], 0x2c
jne 0x402156
dec edi
mov eax, dword [ebp + 8]
inc edi
sub eax, edi
add eax, dword [ebp - 4]
push eax
push edi
push esi
call fcn.0040be90
mov eax, dword [ebp - 4]
sub esi, edi
add esp, 0xc
add dword [ebp + 8], esi
mov ecx, dword [ebp + 8]
mov byte [ecx + eax], bl
mov edi, dword [ebp - 0x14]
push ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x4021b0
mov esi, dword [ebp + 8]
push ebx
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0xc], ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4021b0
cmp esi, dword [ebp - 0xc]
jne 0x4021b0
push edi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push dword [ebp - 4]
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
jmp 0x4020aa
Function at 0x4021cb
Capabilities:
Delete directory
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_wnsprintfA]
push edi
push str.edogkopmmbiomlflahmmpchnobahleib
push dword [ebp + 8]
mov ebx, 0x4112c0
push ebx
mov edi, 0x104
lea eax, [ebp - 0x11c]
push edi
push eax
call esi
and dword [ebp - 8], 0
mov eax, str.freeworkzgc.js
add esp, 0x14
and dword [ebp - 4], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], str.npFreeWorkzGC.dll
mov dword [ebp - 0x10], str.manifest.json
mov dword [ebp - 0xc], str.background.html
push eax
lea eax, [ebp - 0x11c]
push eax
push ebx
lea eax, [ebp - 0x220]
push edi
push eax
call esi
add esp, 0x14
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x402259
push 5
push eax
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
inc dword [ebp - 4]
mov eax, dword [ebp - 4]
mov eax, dword [ebp + eax*4 - 0x18]
test eax, eax
jne 0x402222
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x40228b
push 5
push eax
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x64
pop eax
leave
ret
Function at 0x403176
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [ebp - 8], 0x104
mov dword [ebp - 0xc], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProgramFilesDir
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
leave
ret
Function at 0x40325a
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
push ebx
push esi
push edi
mov esi, 0x103
push esi
xor edi, edi
lea eax, [ebp - 0x20f]
push edi
push eax
mov byte [ebp - 1], 0
mov byte [ebp - 0x210], 0
call fcn.0040a870
push esi
lea eax, [ebp - 0x313]
push edi
push eax
mov byte [ebp - 0x314], 0
call fcn.0040a870
push esi
lea eax, [ebp - 0x51b]
push edi
push eax
mov byte [ebp - 0x51c], 0
call fcn.0040a870
push esi
lea eax, [ebp - 0x10b]
push edi
push eax
mov byte [ebp - 0x10c], 0
call fcn.0040a870
push esi
lea eax, [ebp - 0x417]
push edi
push eax
mov byte [ebp - 0x418], 0
call fcn.0040a870
add esp, 0x3c
lea ebx, [esi + 1]
cmp dword [ebp + 0xc], edi
je 0x403417
push dword [ebp + 0xc]
lea eax, [ebp - 0x10c]
push 0x410d88
push ebx
push eax
call fcn.004058c6
add esp, 0x10
push str.MozillaFirefox_
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00405a52
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.004058e4
push 0x411504
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00405a52
push str.files
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00405a52
push str..ini
lea eax, [ebp - 0x210]
push ebx
push eax
call fcn.00405a52
add esp, 0x3c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x40343b
push str.GetPrivateProfileStringA
push str.kernel32.dll
mov dword [ebp + 0xc], edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
cmp eax, edi
je 0x40347c
push dword [ebp + 0xc]
lea eax, [ebp - 0x314]
push str.Profile_d
push 0x14
push eax
call fcn.004058c6
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x51c]
push eax
mov esi, 0x410d6f
push esi
push str.Path
lea eax, [ebp - 0x314]
push eax
call dword [ebp - 8]
test eax, eax
je 0x40347c
lea eax, [ebp - 0x210]
push eax
push ebx
lea eax, [ebp - 0x418]
push eax
push esi
push str.Name
lea eax, [ebp - 0x314]
push eax
call dword [ebp - 8]
push 8
mov edi, str.default
lea esi, [ebp - 0x418]
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40343f
inc dword [ebp + 0xc]
jmp 0x40339a
call dword [sym.imp.KERNEL32.dll_GetLastError]
lea eax, [ebp - 0x10c]
push eax
push edi
push edi
push 0x801a
push edi
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
cmp eax, 1
jne 0x403301
xor al, al
jmp 0x40347f
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x10c]
push ebx
push eax
mov byte [ebp - 1], 1
call fcn.00405a52
push 0x4112c8
lea eax, [ebp - 0x10c]
push ebx
push eax
call fcn.00405a52
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp + 8]
call fcn.004058e4
add esp, 0x24
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40352a
Capabilities:
Get cpu information
Get disk information
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x1a4
push ebx
push esi
xor ebx, ebx
push 0x63
lea eax, [ebp - 0x12f]
push ebx
push eax
mov byte [ebp - 0x130], bl
call fcn.0040a870
add esp, 0xc
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
cmp esi, ebx
je 0x4036b8
push edi
push str.GetComputerNameA
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x64
pop edi
cmp eax, ebx
je 0x40358a
lea ecx, [ebp + 0x60]
push ecx
lea ecx, [ebp - 0x130]
push ecx
mov dword [ebp + 0x60], edi
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp + 0x64]
push eax
push ebx
push ebx
push 0x411578
mov dword [ebp + 0x64], ebx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
push 0x63
lea eax, [ebp - 0x67]
push ebx
push eax
mov dword [ebp + 0x68], 1
mov byte [ebp - 0x68], bl
call fcn.0040a870
add esp, 0xc
lea eax, [ebp + 0x70]
push eax
push str.HARDWAREDESCRIPTIONSystemBIOS
push 0x80000002
mov dword [ebp + 0x6c], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp + 0x68]
push eax
push ebx
push str.BaseBoardProduct
push dword [ebp + 0x70]
call esi
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x63
lea eax, [ebp - 3]
push ebx
push eax
mov byte [ebp - 4], bl
call fcn.0040a870
push 0x63
lea eax, [ebp - 0xcb]
push ebx
push eax
mov byte [ebp - 0xcc], bl
call fcn.0040a870
add esp, 0x18
lea eax, [ebp + 0x70]
push eax
push str.HARDWAREDESCRIPTIONSystemCentralProcessor0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 0x68]
push eax
push ebx
push str.Identifier
push dword [ebp + 0x70]
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], 1
call esi
lea eax, [ebp + 0x6c]
push eax
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp + 0x68]
push eax
push ebx
push str.ProcessorNameString
push dword [ebp + 0x70]
mov dword [ebp + 0x6c], edi
mov dword [ebp + 0x68], 1
call esi
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0xcc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp + 0x64]
push str._x_s_s_s_s
push 0x200
push dword [ebp + 0x7c]
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x20
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x4047b2
Capabilities:
Delete file
Delete registry key
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
lea eax, [ebp - 0x210]
push eax
push 0
call fcn.0040321e
push 0x4112c8
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00405a52
push str.FreeWorkzIE.dll
lea eax, [ebp - 0x210]
push esi
push eax
call fcn.00405a52
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
add esp, 0x18
lea eax, [ebp - 0x210]
push eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DllUnregisterServer
push eax
mov dword [ebp - 4], eax
call ebx
test eax, eax
je 0x40481e
call eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 4
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x314]
push eax
push 0
call fcn.0040321e
push 0x4112c8
lea eax, [ebp - 0x314]
push esi
push eax
call fcn.00405a52
push str.FreeWorkzFrame.dll
lea eax, [ebp - 0x314]
push esi
push eax
call fcn.00405a52
add esp, 0x18
lea eax, [ebp - 0x314]
push eax
call edi
push str.DllUnregisterServer
push eax
mov dword [ebp - 4], eax
call ebx
test eax, eax
je 0x404887
call eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 4
push 0
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
push 0x103
lea eax, [ebp - 0x10b]
push 0
push eax
mov byte [ebp - 0x10c], 0
call fcn.0040a870
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
push 0
call fcn.0040321e
push 0x4112c8
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.00405a52
push str.FreeWorkzPE.dll
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.00405a52
add esp, 0x18
lea eax, [ebp - 0x10c]
push eax
call edi
mov esi, eax
push str.DllUnregisterServer
push esi
call ebx
test eax, eax
je 0x40490c
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 4
push 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 8]
push eax
push str.Software
mov edi, 0x80000001
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push str.FreeWorkzSettings
push dword [ebp - 8]
call esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SoftwareAppDataLowFreeWorkzSettings
push edi
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40495f
Capabilities:
Create process on windows
Delete directory
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00404128
pop ecx
call fcn.004047b2
call fcn.00402290
call fcn.004043b0
push dword [ebp + 8]
call fcn.00403712
pop ecx
call fcn.00401961
call fcn.00402e2c
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x163]
push ebx
push eax
mov byte [ebp - 0x164], bl
call fcn.0040a870
add esp, 0xc
lea eax, [ebp - 0x164]
push eax
push ebx
call fcn.0040321e
lea eax, [ebp - 0x164]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [ebp - 0x164]
push eax
call fcn.0040177d
pop ecx
cmp byte [ebp + 8], bl
je 0x404a50
mov esi, 0x104
push esi
lea eax, [ebp - 0x26c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x44
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.0040a870
xor eax, eax
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
lea eax, [ebp - 0x26c]
push eax
push str.cmd.exe__c__ping_127.0.0.1__n_6__del___s___F__Q__
lea eax, [ebp - 0x374]
push esi
push eax
mov dword [ebp - 0x5c], 0x44
call dword [sym.imp.SHLWAPI.dll_wnsprintfA]
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push ebx
push ebx
push 0x8000000
push 1
push ebx
push ebx
lea eax, [ebp - 0x374]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40558b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push ebx
push esi
push edi
push 0x103
xor esi, esi
lea eax, [ebp - 0x13f]
push esi
push eax
mov byte [ebp - 0x140], 0
call fcn.0040a870
add esp, 0xc
push 0x104
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x3c
pop ebx
push ebx
lea eax, [ebp - 0x3c]
push esi
push eax
call fcn.0040a870
lea eax, [ebp - 0x140]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x34], esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov edi, str.runas
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], 0x440
call esi
cmp dword [ebp - 0x1c], 0x20
jge 0x405658
push ebx
lea eax, [ebp - 0x3c]
push 0
push eax
call fcn.0040a870
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x140]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
add esp, 0xc
lea eax, [ebp - 0x3c]
push eax
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x20], 9
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], 0x440
call esi
cmp dword [ebp - 0x1c], 0x20
jl 0x40565c
push 0x64
jmp 0x40565e
push 0x66
pop eax
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x4056b0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
lea eax, [ebp - 0x94]
push eax
mov dword [ebp - 0x94], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4056f8
xor eax, eax
cmp dword [ebp - 0x84], 2
sete al
test eax, eax
je 0x4056f8
cmp dword [ebp - 0x90], 5
jne 0x4056f8
xor eax, eax
inc eax
cmp dword [ebp - 0x8c], eax
je 0x4056fa
xor al, al
leave
ret

Function at 0x40a7ba
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x414a40]
jne 0x40a7c4
repz ret
jmp fcn.0040d78f
Function at 0x40c71c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004065ca
and dword [ebp - 4], 0
cmp dword [0x4158d0], 0
mov ebx, eax
jne 0x40c7cd
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x40c87e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x410c3c
push edi
call esi
test eax, eax
je 0x40c87e
push eax
call fcn.00406558
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4158d0], eax
call esi
push eax
call fcn.00406558
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4158d4], eax
call esi
push eax
call fcn.00406558
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4158d8], eax
call esi
push eax
call fcn.00406558
pop ecx
mov dword [0x4158e0], eax
test eax, eax
je 0x40c7cd
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00406558
pop ecx
mov dword [0x4158dc], eax
mov eax, dword [0x4158dc]
cmp eax, ebx
je 0x40c825
cmp dword [0x4158e0], ebx
je 0x40c825
push eax
call fcn.004065d3
push dword [0x4158e0]
mov esi, eax
call fcn.004065d3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x40c825
test edi, edi
je 0x40c825
call esi
test eax, eax
je 0x40c81c
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40c81c
test byte [ebp - 0xc], 1
jne 0x40c825
or dword [ebp + 0x10], 0x200000
jmp 0x40c85e
mov eax, dword [0x4158d4]
cmp eax, ebx
je 0x40c85e
push eax
call fcn.004065d3
pop ecx
test eax, eax
je 0x40c85e
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x40c85e
mov eax, dword [0x4158d8]
cmp eax, ebx
je 0x40c85e
push eax
call fcn.004065d3
pop ecx
test eax, eax
je 0x40c85e
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4158d0]
call fcn.004065d3
pop ecx
test eax, eax
je 0x40c87e
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40c880
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x432072
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x6ed90b83
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4320d2
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x7d524023
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x412e68
push eax
call fcn.00401ebe
add esp, 8
test eax, eax
jne 0x40103f
push eax
push str.QuickLook.WoW64HookHelper
push str.This_executable_is_not_designed_to_launch_directly.
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push str.QuickLook.Native32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.GetCurrentSelection
push eax
mov dword [0x4163e0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.WM_QUICKLOOK_HOOK_NOTIFY_MSG
mov dword [0x4163dc], eax
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
xorps xmm0, xmm0
mov dword [0x4163d4], eax
lea eax, [esp + 0x30]
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x50], xmm0
push eax
movaps xmmword [esp + 0x44], xmm0
mov dword [esp + 0x38], 0x401120
mov dword [esp + 0x58], str.QUICKLOOK_WOW64HOOKHELPER_MSG_CLASS
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x401035
push 0
push 0
push 0
push 0xfffffffffffffffd
push 0
push 0
push 0
push 0
push 0
push 0
push str.QUICKLOOK_WOW64HOOKHELPER_MSG_CLASS
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [0x4163d8], eax
test eax, eax
je 0x401035
mov esi, dword [sym.imp.USER32.dll_GetMessageW]
lea eax, [esp + 0x14]
push 0
push 0
push 0
push eax
call esi
test eax, eax
jle 0x401113
mov edi, dword [sym.imp.USER32.dll_TranslateMessage]
nop
lea eax, [esp + 0x14]
push eax
call edi
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
call esi
test eax, eax
jg 0x4010f0
mov eax, dword [esp + 0x1c]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40157f
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x4015b4
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x4015b1
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x4015bd
add edx, 0x28
cmp edx, esi
jne 0x40159f
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x4015ba

Function at 0x401a32
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401a71
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401a71
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401a71
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401a71
cmp dword [ecx + 0x74], 0xe
jbe 0x401a71
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret