joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407464
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov dword [ebp - 0x130], 0
push 0
push 0
push 0x1009
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4074aa
push dword [ebp + 0xc]
push 0x8001
push 0x1102
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
push dword [ebp + 8]
push ebp
add dword [esp], 0xfffffefc
call fcn.00401bb4
push 0x4217a8
push ebp
add dword [esp], 0xfffffefc
call fcn.00401b87
push 0x41a010
push ebp
add dword [esp], 0xfffffefc
call sub.KERNEL32.dll_FindFirstFileA
mov dword [0x41de9c], eax
mov eax, dword [0x41a010]
test eax, 2
jne 0x407562
test eax, 0x10
je 0x407542
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x407562
mov eax, dword [0x41a03c]
and eax, 0xffffff
cmp eax, 0x2e2e
je 0x407540
cmp ax, 0x2e
je 0x407540
push 0x41a03c
push ebp
add dword [esp], 0xfffffefc
call fcn.0040912a
push eax
push 0xffffffffffffffff
push 0x41a03c
push dword [ebp + 0xc]
push dword [0x41a674]
call fcn.00407794
jmp 0x407562
push 0x41a010
push dword [ebp + 0xc]
push 0x41a03c
push ebp
add dword [esp], 0xfffffefc
call fcn.00407630
add dword [ebp - 0x130], edx
push 0x41a010
push dword [0x41de9c]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4074e3
push dword [0x41de9c]
call sub.KERNEL32.dll_FindClose
mov dword [0x41de9c], 0
push dword [ebp + 0xc]
push 4
push 0x110a
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
test eax, eax
jne 0x4075e9
mov dword [ebp - 0x12c], 0x44
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 1
push ebp
add dword [esp], 0xfffffed4
push 0
push 0x110d
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
push 0x4217ab
push ebp
add dword [esp], 0xfffffdd0
call fcn.00401bb4
push ebp
add dword [esp], 0xfffffdde
push dword [ebp - 0x130]
call fcn.00401f41
push ebp
add dword [esp], 0xfffffdd0
push 1
push 0x401
push dword [0x41a66c]
call sub.USER32.dll_SendMessageA
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x407630
Capabilities:
Get file system object information

Disassembly:
push ebp
push edi
push ebx
mov ebp, esp
sub esp, 0x300
mov dword [ebp - 0x190], 0
push dword [ebp + 0x10]
push ebp
add dword [esp], 0xfffffefc
call fcn.00401bb4
push ebp
add dword [esp], 0xfffffefc
call fcn.00401b1b
lea eax, [ebp + eax - 0x105]
push dword [ebp + 0x14]
push eax
call fcn.00401bb4
push 0x4400
push 0x160
push ebp
add dword [esp], 0xfffffd00
push 0
push ebp
add dword [esp], 0xfffffefc
call sub.SHELL32.dll_SHGetFileInfo
cmp dword [0x41a708], 0
je 0x4076ad
push ebp
add dword [esp], 0xfffffefc
push 0
push 0
call fcn.004013b6
mov dword [ebp - 0x190], eax
mov ebx, dword [ebp + 0x1c]
mov eax, ebx
add eax, 0x14
push ebp
add dword [esp], 0xfffffe60
push eax
call sub.KERNEL32.dll_FileTimeToSystemTime
push 0x40
push ebp
add dword [esp], 0xfffffebc
push dword [0x41e340]
push ebp
add dword [esp], 0xfffffe60
push 0
push 0x800
call sub.KERNEL32.dll_GetDateFormatA
push 0x40
push ebp
add dword [esp], 0xfffffe7c
push dword [0x41e344]
push ebp
add dword [esp], 0xfffffe60
push 0
push 0x800
call sub.KERNEL32.dll_GetTimeFormatA
push ebp
add dword [esp], 0xfffffebc
push 0x41de00
call fcn.00401bb4
push 0x4217ba
push 0x41de00
call fcn.00401b87
push ebp
add dword [esp], 0xfffffe7c
push 0x41de00
call fcn.00401b87
push 0x41de40
push dword [ebx + 0x20]
call fcn.00401f41
push 0x4217bc
push 0x41de40
call fcn.00401b87
push dword [ebp - 0x190]
push dword [ebp + 0x18]
push ebp
add dword [esp], 0xfffffe10
push 0x41de00
push 0x41de40
push dword [ebp + 0x14]
push dword [ebp - 0x2fc]
call fcn.00407868
mov edx, dword [ebx + 0x20]
mov esp, ebp
pop ebx
pop edi
pop ebp
ret 0x10

Function at 0x407c35
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push 0
push 0
push 0x1009
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
push ebp
add dword [esp], 0xfffffffc
push 0
push 0x41dea0
push 0x407c8f
push 0
push 0
call sub.KERNEL32.dll_CreateThread
mov dword [0x41deb0], eax
push 1
push eax
call sub.KERNEL32.dll_SetThreadPriority
push dword [0x41deb0]
call sub.KERNEL32.dll_CloseHandle
mov dword [0x41deb0], 0
mov esp, ebp
pop ebp
ret
Function at 0x408e41
Capabilities:
Get file attributes

Disassembly:
push ebp
push edi
push esi
push ebx
mov ebp, esp
sub esp, 0x230
cmp dword [0x41e358], 1
je 0x408e6d
push dword [ebp + 0x14]
call sub.KERNEL32.dll_GetFileAttributesA
test eax, eax
jns 0x408e6d
xor eax, eax
mov esp, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 4
push dword [ebp + 0x14]
push ebp
add dword [esp], 0xfffffefc
call fcn.00401bb4
xor ebx, ebx
push 0x4218c1
push ebp
add dword [esp], 0xfffffefc
call fcn.00401c15
push eax
push 0
call fcn.00408f2a
test eax, eax
je 0x408f1f
mov ebx, eax
push 0x4218c3
push 0
call fcn.00401c15
mov esi, eax
push esi
call fcn.00401b1b
test eax, eax
je 0x408f1f
push esi
push ebx
call fcn.00408f2a
test eax, eax
jne 0x408ea1
push ebp
add dword [esp], 0xfffffdf8
push ebx
call fcn.00408c7e
mov dword [ebp - 0x230], 4
mov dword [ebp - 0x22c], ebx
push ebp
add dword [esp], 0xfffffdd0
push 0
push 0x110c
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
push dword [ebp - 0x20c]
push ebx
push ebp
add dword [esp], 0xfffffdf8
call fcn.00408fe1
push esi
push ebx
call fcn.00408f2a
test eax, eax
jne 0x408ea1
xor ebx, ebx
mov eax, ebx
mov esp, ebp
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x408fe1
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x409009
push dword [ebp + 0xc]
push 0x8001
push 0x1102
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
push dword [ebp + 8]
push ebp
add dword [esp], 0xfffffefc
call fcn.00401bb4
push 0x4218c5
push ebp
add dword [esp], 0xfffffefc
call fcn.00401b87
push 0x41a010
push ebp
add dword [esp], 0xfffffefc
call sub.KERNEL32.dll_FindFirstFileA
mov dword [0x41de9c], eax
mov eax, dword [0x41a010]
test eax, 2
jne 0x40909f
test eax, 0x10
je 0x40909f
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x40909f
mov eax, dword [0x41a03c]
and eax, 0xffffff
cmp eax, 0x2e2e
je 0x40909f
cmp ax, 0x2e
je 0x40909f
push 0x41a03c
push ebp
add dword [esp], 0xfffffefc
call fcn.0040912a
push eax
push 0xffffffffffffffff
push 0x41a03c
push dword [ebp + 0xc]
push dword [0x41a674]
call fcn.00407794
push 0x41a010
push dword [0x41de9c]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x409042
push dword [0x41de9c]
call sub.KERNEL32.dll_FindClose
mov dword [0x41de9c], 0
push dword [ebp + 0xc]
push 4
push 0x110a
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
test eax, eax
jne 0x409122
mov dword [ebp - 0x12c], 0x44
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x128], eax
mov dword [ebp - 0x10c], 0
mov dword [ebp - 0x108], 1
push ebp
add dword [esp], 0xfffffed4
push 0
push 0x110d
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40912a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
push dword [ebp + 8]
push ebp
add dword [esp], 0xfffffefc
call fcn.00401bb4
push ebp
add dword [esp], 0xfffffefc
call fcn.00401b1b
lea eax, [ebp + eax - 0x105]
push dword [ebp + 0xc]
push eax
call fcn.00401bb4
push 0x4218c8
push ebp
add dword [esp], 0xfffffefc
call fcn.00401b87
push 0x800
push 0x160
push ebp
add dword [esp], 0xfffffd9c
push 0
push ebp
add dword [esp], 0xfffffefc
call sub.SHELL32.dll_SHGetFileInfo
xor eax, eax
mov ecx, dword [ebp - 0x25c]
and ecx, 0x80000000
je 0x4091a4
inc eax
mov esp, ebp
pop ebp
ret 8

Function at 0x40944d
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
push edi
mov ebp, esp
sub esp, 4
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x40953e
push dword [ebp + 0xc]
push 0x41dbf8
call fcn.00401bb4
push 0x4218f3
push 0x41dbf8
call fcn.00401b87
push 0x41a010
push 0x41dbf8
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp - 4], eax
test eax, eax
js 0x40953e
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
test eax, eax
je 0x409536
mov eax, dword [0x41a010]
test eax, 0x10
je 0x409521
mov eax, dword [0x41a010]
test eax, 2
jne 0x409521
mov eax, dword [0x41a03c]
and eax, 0xffffff
cmp eax, 0x2e2e
je 0x409521
cmp ax, 0x2e
je 0x409521
push 0x41dbf8
call fcn.00401b1b
mov ecx, eax
lea edi, [eax + 0x41dbf8]
std
mov al, 0x5c
repne scasb al, byte es:[edi]
cld
add edi, 2
push edi
push 0x41a03c
push edi
call fcn.00401bb4
push dword [ebp + 0x10]
push 0x41dbf8
call fcn.00409545
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 0x41dbf8
call fcn.0040944d
pop edi
mov word [edi], 0x2a
push 0x41a010
push dword [ebp - 4]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x409497
push dword [ebp - 4]
call sub.KERNEL32.dll_FindClose
mov esp, ebp
pop edi
pop ebp
ret 0xc

Function at 0x409545
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
push edi
mov ebp, esp
sub esp, 0x274
push dword [ebp + 0xc]
call fcn.00408e41
mov dword [ebp - 0x108], eax
test eax, eax
jne 0x409568
mov esp, ebp
pop edi
pop ebp
ret 8
push dword [ebp + 0xc]
push ebp
add dword [esp], 0xfffffefc
call fcn.00401bb4
push dword [ebp + 0x10]
push ebp
add dword [esp], 0xfffffefc
call fcn.00401b87
push ebp
add dword [esp], 0xfffffd90
push ebp
add dword [esp], 0xfffffefc
call sub.KERNEL32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x40961a
mov dword [ebp - 0x274], eax
mov eax, dword [ebp - 0x270]
test eax, 0x10
jne 0x4095f8
push ebp
add dword [esp], 0xfffffefc
call fcn.00401b1b
mov ecx, eax
lea edi, [ebp + eax - 0x104]
std
mov al, 0x5c
repne scasb al, byte es:[edi]
cld
mov byte [edi + 3], 0
push ebp
add dword [esp], 0xfffffd90
push dword [ebp - 0x108]
push ebp
add dword [esp], 0xfffffdbc
push ebp
add dword [esp], 0xfffffefc
call fcn.00407630
push ebp
add dword [esp], 0xfffffd90
push dword [ebp - 0x274]
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4095a8
push dword [ebp - 0x274]
call sub.KERNEL32.dll_FindClose
mov esp, ebp
pop edi
pop ebp
ret 8
Function at 0x4096d3
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov dword [ebp - 0x25c], 0
mov dword [ebp - 0x44], 0x44
push ebp
add dword [esp], 0xffffffbc
call sub.KERNEL32.dll_GetStartupInfoA
mov eax, dword [0x41a710]
test eax, eax
je 0x40977b
mov byte [ebp - 0x158], 0x22
push 0x104
push ebp
add dword [esp], 0xfffffea8
call sub.KERNEL32.dll_GetWindowsDirectoryA
push 0x4218f6
push ebp
add dword [esp], 0xfffffea8
call fcn.00401b87
push dword [ebp + 8]
push ebp
add dword [esp], 0xfffffea8
call fcn.00401b87
push 0x421908
push ebp
add dword [esp], 0xfffffea8
call fcn.00401b87
push ebp
add dword [esp], 0xffffffac
push ebp
add dword [esp], 0xffffffbc
push 0
push 0
push 0
push 1
push 0
push 0
push ebp
add dword [esp], 0xfffffea8
push 0
call sub.KERNEL32.dll_CreateProcessA
jmp 0x4097fe
push 0x104
push ebp
add dword [esp], 0xfffffea8
call sub.KERNEL32.dll_GetSystemDirectoryA
push 0x42190a
push ebp
add dword [esp], 0xfffffea8
call fcn.00401b87
push 0x421913
push ebp
add dword [esp], 0xfffffda4
call fcn.00401bb4
push dword [ebp + 8]
push ebp
add dword [esp], 0xfffffda4
call fcn.00401b87
push 0x421918
push ebp
add dword [esp], 0xfffffda4
call fcn.00401b87
push ebp
add dword [esp], 0xffffffac
push ebp
add dword [esp], 0xffffffbc
push 0
push 0
push 0
push 1
push 0
push 0
push ebp
add dword [esp], 0xfffffda4
push ebp
add dword [esp], 0xfffffea8
call sub.KERNEL32.dll_CreateProcessA
push dword [ebp - 0x54]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0x50]
call sub.KERNEL32.dll_CloseHandle
mov esp, ebp
pop ebp
ret 4
Function at 0x4098aa
Capabilities:
Check for unmoving mouse cursor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb8
call sub.USER32.dll_ReleaseCapture
call sub.USER32.dll_GetDesktopWindow
push eax
call sub.COMCTL32.dll_ImageList_DragLeave
call sub.COMCTL32.dll_ImageList_EndDrag
push dword [0x41dec0]
call sub.COMCTL32.dll_ImageList_Destroy
push ebp
add dword [esp], 0xffffff98
call sub.USER32.dll_GetCursorPos
push ebp
add dword [esp], 0xffffff98
push dword [0x41a668]
call sub.USER32.dll_ScreenToClient
push dword [ebp - 0x64]
push dword [ebp - 0x68]
push dword [0x41a668]
call sub.USER32.dll_ChildWindowFromPoint
cmp eax, dword [0x41a674]
jne 0x409a27
push ebp
add dword [esp], 0xffffffa0
call sub.USER32.dll_GetCursorPos
push ebp
add dword [esp], 0xffffffa0
push dword [0x41a674]
call sub.USER32.dll_ScreenToClient
push ebp
add dword [esp], 0xffffffa0
push 0
push 0x1111
push dword [0x41a674]
call sub.USER32.dll_SendMessageA
mov eax, dword [ebp - 0x58]
test eax, 0x46
je 0x409a27
push 0x41d8ec
push dword [ebp - 0x54]
call fcn.00408c7e
mov dword [ebp - 0x28], 5
mov eax, dword [0x41debc]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
lea eax, [ebp - 0xb8]
inc eax
mov byte [ebp - 0xb8], 0x5c
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], 0x104
push ebp
add dword [esp], 0xffffffd8
push 0
push 0x1005
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
push 0x41d9f0
push dword [ebp - 8]
call fcn.00408c7e
push ebp
add dword [esp], 0xffffff48
push 0x41d9f0
call fcn.00401b87
push ebp
add dword [esp], 0xffffff48
push 0x41d8ec
call fcn.00401b87
push 0x41d9f0
push 0x41d8ec
call fcn.00401c6c
je 0x409a27
push dword [ebp + 8]
push 0x41d8ec
push 0x41d9f0
call fcn.00409a37
cmp dword [ebp + 8], 1
jne 0x409a27
push 0
push dword [0x41debc]
push 0x1008
push dword [0x41a678]
call sub.USER32.dll_SendMessageA
push 0
push 0
push dword [0x41a678]
call sub.USER32.dll_InvalidateRect
push dword [0x41a678]
call sub.USER32.dll_UpdateWindow
call fcn.00407c35
mov eax, dword [0x41debc]
mov esp, ebp
pop ebp
ret 4

Function at 0x409f51
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
push edi
mov ebp, esp
sub esp, 0x14
push 0
push 0
push 3
push 0
push 0
push 0x80000000
push dword [ebp + 0xc]
call sub.KERNEL32.dll_CreateFileA
mov dword [ebp - 0x10], eax
test eax, eax
js 0x409fe9
push ebp
add dword [esp], 0xffffffec
push eax
call sub.KERNEL32.dll_GetFileSize
mov dword [ebp - 0xc], eax
test eax, eax
js 0x409fe1
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.KERNEL32.dll_VirtualAlloc
test eax, eax
je 0x409fe1
mov dword [ebp - 8], eax
push 0
push ebp
add dword [esp], 0xffffffec
push dword [ebp - 0xc]
push eax
push dword [ebp - 0x10]
call sub.KERNEL32.dll_ReadFile
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CloseHandle
push dword [ebp - 0xc]
push dword [ebp - 8]
call fcn.00401915
mov dword [ebp - 4], eax
push eax
push 0x8000
push 0
push dword [ebp - 8]
call sub.KERNEL32.dll_VirtualFree
pop eax
mov esp, ebp
pop edi
pop ebp
ret 4
push dword [ebp - 0x10]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov esp, ebp
pop edi
pop ebp
ret 4
Function at 0x40a827
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
push 0
push 0xe
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
add eax, 4
and eax, 0xfffffffc
mov dword [ebp - 8], eax
push dword [ebp + 8]
call sub.USER32.dll_OpenClipboard
test eax, eax
je 0x40a8ad
call sub.USER32.dll_EmptyClipboard
push dword [ebp - 8]
push 0x42
call sub.KERNEL32.dll_GlobalAlloc
mov dword [0x41df28], eax
push dword [0x41df28]
call sub.KERNEL32.dll_GlobalLock
mov dword [ebp - 4], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 0xd
push dword [ebp + 0xc]
push dword [ebp + 8]
call sub.USER32.dll_SendDlgItemMessageA
push dword [0x41df28]
call sub.KERNEL32.dll_GlobalUnlock
push dword [0x41df28]
push 1
call sub.USER32.dll_SetClipboardData
call sub.USER32.dll_CloseClipboard
xor eax, eax
mov esp, ebp
pop ebp
ret 8
xor eax, eax
dec eax
mov esp, ebp
pop ebp
ret 8

Function at 0x40b438
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.KERNEL32.dll_CreateFileA
mov dword [0x41df2c], eax
test eax, eax
jns 0x40b45f
pop ebp
ret 4
push 0
push 0
push 0
push 2
push 0
push dword [0x41df2c]
call sub.KERNEL32.dll_CreateFileMappingA
mov dword [0x41df30], eax
push 0
call sub.KERNEL32.dll_SetLastError
push 0
push 0
push 0
push 4
push dword [0x41df30]
call sub.KERNEL32.dll_MapViewOfFile
mov dword [0x41df34], eax
call sub.KERNEL32.dll_GetLastError
or eax, eax
je 0x40b4be
push dword [0x41df30]
call sub.KERNEL32.dll_CloseHandle
push dword [0x41df2c]
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
dec eax
pop ebp
ret 4
xor eax, eax
pop ebp
ret 4
Function at 0x40c14a
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
push ebx
push esi
mov ebp, esp
sub esp, 0x108
xor ebx, ebx
xor esi, esi
push ebp
add dword [esp], 0xfffffffc
push 0x4001f
push 0
push dword [ebp + 0x14]
push 0x80000000
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
jne 0x40c1d0
mov dword [ebp - 0x108], 0x100
push 0
push 0
push 0
push 0
push ebp
add dword [esp], 0xfffffef8
push ebp
add dword [esp], 0xfffffefc
push ebx
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
jne 0x40c1c8
inc esi
push ebp
add dword [esp], 0xfffffefc
push 0
push 0x143
push dword [ebp + 0x10]
call sub.USER32.dll_SendMessageA
inc ebx
jmp 0x40c17a
push dword [ebp - 4]
call sub.ADVAPI32.dll_RegCloseKey
mov eax, esi
mov esp, ebp
pop esi
pop ebx
pop ebp
ret 8

Function at 0x40cbef
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov dword [ebp - 0x10c], 0x104
push ebp
add dword [esp], 0xfffffef4
push ebp
add dword [esp], 0xfffffef8
push ebp
add dword [esp], 0xfffffffc
push 0
push 0x4226b3
push 0x80000000
call sub.SHLWAPI.dll_SHGetValueA
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebp
add dword [esp], 0xfffffef8
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
mov edi, dword [ebp + 8]
mov ecx, eax
mov al, 0x25
repne scasb al, byte es:[edi]
mov byte [edi - 1], 0
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00401b87
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40df4d
Capabilities:
Check for time delay via queryperformancecounter
Execute anti-debugging instructions

Disassembly:
push ebp
push ebx
push edi
push esi
mov ebp, esp
sub esp, 0x28
push 4
call fcn.0040dec3
test eax, eax
je 0x40e040
call sub.KERNEL32.dll_GetCurrentProcess
mov dword [ebp - 4], eax
call sub.KERNEL32.dll_GetCurrentThread
mov dword [ebp - 8], eax
push dword [ebp - 4]
call sub.KERNEL32.dll_GetPriorityClass
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
call sub.KERNEL32.dll_GetThreadPriority
mov dword [ebp - 0x10], eax
push ebp
add dword [esp], 0xffffffd8
call sub.KERNEL32.dll_QueryPerformanceFrequency
or eax, eax
jne 0x40dfab
push 0x15
call sub.KERNEL32.dll_SetLastError
xor edx, edx
xor eax, eax
mov esp, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
push 0x100
push dword [ebp - 4]
call sub.KERNEL32.dll_SetPriorityClass
push 0xf
push dword [ebp - 8]
call sub.KERNEL32.dll_SetThreadPriority
push 0
call sub.KERNEL32.dll_Sleep
push ebp
add dword [esp], 0xffffffe0
call sub.KERNEL32.dll_QueryPerformanceCounter
mov ebx, dword [ebp - 0x20]
push ebp
add dword [esp], 0xffffffe0
call sub.KERNEL32.dll_QueryPerformanceCounter
mov eax, dword [ebp - 0x20]
cmp ebx, eax
je 0x40dfdc
add esi, eax
adc edi, dword [ebp - 0x1c]
nop
nop
rdtsc
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push ebp
add dword [esp], 0xffffffe0
call sub.KERNEL32.dll_QueryPerformanceCounter
cmp edi, dword [ebp - 0x1c]
ja 0x40dffc
cmp esi, dword [ebp - 0x20]
ja 0x40dffc
rdtsc
sub eax, dword [ebp - 0x18]
sbb edx, dword [ebp - 0x14]
push eax
push edx
push dword [ebp - 0x10]
push dword [ebp - 8]
call sub.KERNEL32.dll_SetThreadPriority
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.KERNEL32.dll_SetPriorityClass
push 0
call sub.KERNEL32.dll_SetLastError
pop edx
pop eax
mov esp, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
xor edx, edx
mov esp, ebp
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x40e04b
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov dword [ebp - 0x94], 0x94
push ebp
add dword [esp], 0xffffff6c
call sub.KERNEL32.dll_GetVersionExA
cmp dword [ebp - 0x90], 4
jne 0x40e11c
cmp dword [ebp - 0x8c], 0
jne 0x40e0c8
cmp dword [ebp - 0x84], 1
jne 0x40e0a9
push ebp
add dword [esp], 0xffffff80
push 0x41ab70
push 0x41ab84
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x40e1fc
push ebp
add dword [esp], 0xffffff80
push 0x41ab70
push 0x41ab9f
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x40e1fc
cmp dword [ebp - 0x8c], 0xa
jne 0x40e0f0
push ebp
add dword [esp], 0xffffff80
push 0x41ab70
push 0x41ab8d
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x40e1fc
cmp dword [ebp - 0x8c], 0x5a
jne 0x40e1d6
push ebp
add dword [esp], 0xffffff80
push 0x41ab70
push 0x41ab96
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x40e1fc
cmp dword [ebp - 0x90], 5
jne 0x40e1a1
cmp dword [ebp - 0x8c], 0
jne 0x40e151
push ebp
add dword [esp], 0xffffff80
push 0x41ab70
push 0x41aba9
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x40e1fc
cmp dword [ebp - 0x8c], 1
jne 0x40e179
push ebp
add dword [esp], 0xffffff80
push 0x41ab70
push 0x41abb4
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x40e1fc
cmp dword [ebp - 0x8c], 2
jne 0x40e1d6
push ebp
add dword [esp], 0xffffff80
push 0x41ab70
push 0x41abbd
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x40e1fc
cmp dword [ebp - 0x90], 6
jne 0x40e1d6
cmp dword [ebp - 0x8c], 0
jne 0x40e1d6
push ebp
add dword [esp], 0xffffff80
push 0x41ab70
push 0x41abc8
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x10
jmp 0x40e1fc
push ebp
add dword [esp], 0xffffff80
push dword [ebp - 0x8c]
push dword [ebp - 0x90]
push 0x41ab70
push 0x41ab78
push dword [ebp + 8]
call sub.USER32.dll_wsprintfA
add esp, 0x18
mov esp, ebp
pop ebp
ret 4