joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41a150
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fd38
mov eax, dword fs:[0]
push eax
sub esp, 0x10c
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x114], ebx
push ebx
mov edi, ecx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push 0x45631c
mov ecx, esi
mov dword [ebp - 0x118], esi
mov word [esi], ax
call fcn.00403280
push 0xc6
lea edx, [ebp - 0xd6]
mov dword [ebp - 4], ebx
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0x114], 1
mov word [ebp - 0xd8], cx
call fcn.00422fb0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41a1df
mov edi, dword [edi]
push edi
push 0x63
lea eax, [ebp - 0xd8]
push eax
push 0x457090
push 0x4570cc
push str.root
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
xor ecx, ecx
lea eax, [ebp - 0xd8]
mov dword [ebp - 0xe0], 7
mov dword [ebp - 0xe4], ebx
mov word [ebp - 0xf4], cx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a220
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0xd8]
push edx
lea ecx, [ebp - 0xf4]
call fcn.00403280
push 1
push 0x456e5c
lea eax, [ebp - 0xf4]
push eax
xor eax, eax
mov dword [ebp - 4], 1
call fcn.00404e40
cmp eax, 0xffffffff
je 0x41a2a5
mov ecx, dword [ebp - 0xe4]
dec ecx
push ecx
inc eax
push eax
lea edx, [ebp - 0x110]
push edx
lea ecx, [ebp - 0xf4]
call fcn.00402520
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.004028d0
cmp dword [ebp - 0xfc], 8
jb 0x41a2b3
mov eax, dword [ebp - 0x110]
push eax
call fcn.004204e8
add esp, 4
jmp 0x41a2b3
push 1
push 0x457090
mov ecx, esi
call fcn.00403280
cmp dword [ebp - 0xe0], 8
jb 0x41a2cb
mov ecx, dword [ebp - 0xf4]
push ecx
call fcn.004204e8
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204f3
mov esp, ebp
pop ebp
ret
Function at 0x41a2f0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fc82
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xdc], ebx
push ebx
mov edi, ecx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push 0x45631c
mov ecx, esi
mov dword [ebp - 0xe0], esi
mov word [esi], ax
call fcn.00403280
push 0xc6
lea edx, [ebp - 0xd6]
mov dword [ebp - 4], ebx
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0xdc], 1
mov word [ebp - 0xd8], cx
call fcn.00422fb0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41a37f
mov edi, dword [edi]
push edi
push 0x63
lea eax, [ebp - 0xd8]
push eax
push str.1.15.0.1
push str.date
push str.root
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xd8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a3a7
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, esi
call fcn.00403280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204f3
mov esp, ebp
pop ebp
ret

Function at 0x41a3f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fcd2
mov eax, dword fs:[0]
push eax
sub esp, 0x334
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
mov dword [ebp - 0x33c], 0
push ecx
mov dword [ebp - 0x340], esi
mov word [ebp - 0x218], ax
call fcn.00422fb0
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], dx
lea eax, [ebp - 0x330]
push eax
push 0x20019
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersion
mov dword [ebp - 4], edx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x33c], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a511
lea ecx, [ebp - 0x338]
push ecx
mov ecx, dword [ebp - 0x330]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x334]
push eax
push 0
push 0x456bd4
push ecx
mov dword [ebp - 0x338], 0xff
mov dword [ebp - 0x334], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a511
lea edx, [ebp - 0x32c]
push edx
mov dword [ebp - 0x32c], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x41a511
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a4f3
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x218]
push eax
mov ecx, esi
call fcn.00403280
mov ecx, dword [ebp - 0x330]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204f3
mov esp, ebp
pop ebp
ret
Function at 0x41a540
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fc82
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xdc], ebx
push ebx
mov edi, ecx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push 0x45631c
mov ecx, esi
mov dword [ebp - 0xe0], esi
mov word [esi], ax
call fcn.00403280
push 0xc6
lea edx, [ebp - 0xd6]
mov dword [ebp - 4], ebx
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0xdc], 1
mov word [ebp - 0xd8], cx
call fcn.00422fb0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41a5cf
mov edi, dword [edi]
push edi
push 0x63
lea eax, [ebp - 0xd8]
push eax
push 0x457094
push str.instype
push str.root
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xd8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a5f7
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, esi
call fcn.00403280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204f3
mov esp, ebp
pop ebp
ret

Function at 0x41a640
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fc82
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xdc], ebx
push ebx
mov edi, ecx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push 0x45631c
mov ecx, esi
mov dword [ebp - 0xe0], esi
mov word [esi], ax
call fcn.00403280
push 0xc6
lea edx, [ebp - 0xd6]
mov dword [ebp - 4], ebx
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0xdc], 1
mov word [ebp - 0xd8], cx
call fcn.00422fb0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41a6cf
mov edi, dword [edi]
push edi
push 0x63
lea eax, [ebp - 0xd8]
push eax
push str.2000_01_01
push str.setupdate
push str.root
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xd8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a6f7
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, esi
call fcn.00403280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204f3
mov esp, ebp
pop ebp
ret
Function at 0x41a740
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fc82
mov eax, dword fs:[0]
push eax
sub esp, 0xd4
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0xdc], ebx
push ebx
mov edi, ecx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
push 0x45631c
mov ecx, esi
mov dword [ebp - 0xe0], esi
mov word [esi], ax
call fcn.00403280
push 0xc6
lea edx, [ebp - 0xd6]
mov dword [ebp - 4], ebx
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0xdc], 1
mov word [ebp - 0xd8], cx
call fcn.00422fb0
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x41a7cf
mov edi, dword [edi]
push edi
push 0x63
lea eax, [ebp - 0xd8]
push eax
push 0x457090
push str.cpaid
push str.root
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0xd8]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x41a7f7
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0xd8]
push ecx
mov ecx, esi
call fcn.00403280
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204f3
mov esp, ebp
pop ebp
ret

Function at 0x41a840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fc32
mov eax, dword fs:[0]
push eax
sub esp, 0x220
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x216]
mov dword [ebp - 0x224], 0
push ecx
mov dword [ebp - 0x22c], esi
mov word [ebp - 0x218], ax
call fcn.00422fb0
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
add esp, 0xc
mov word [esi], dx
lea eax, [ebp - 0x21c]
push eax
push 0x20019
push edx
push str.SoftwareSta
mov dword [ebp - 4], edx
push SysReAllocString
mov dword [ebp - 0x224], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41a942
lea ecx, [ebp - 0x220]
push ecx
mov ecx, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x228]
push eax
push 0
push str.data
push ecx
mov dword [ebp - 0x220], 0xff
mov dword [ebp - 0x228], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41a942
lea eax, [ebp - 0x218]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x41a924
sub eax, edx
sar eax, 1
push eax
lea edx, [ebp - 0x218]
push edx
mov ecx, esi
call fcn.00403280
mov eax, dword [ebp - 0x21c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004204f3
mov esp, ebp
pop ebp
ret
Function at 0x41dbb0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x44d288
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x460adc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x460294]
cmp eax, 0xffffffff
jne 0x41dbe5
xor ebx, ebx
jmp 0x41dbee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], 0
test ebx, ebx
je 0x41dc31
mov edi, edi
cmp dword [ebx + 0x18], 0
jne 0x41dc77
cmp dword [ebx + 0xc], 0
jne 0x41dc80
push 0x41d750
push 0x4631c4
call fcn.0041d9a0
mov eax, dword [0x460294]
add esp, 8
cmp eax, 0xffffffff
je 0x41dc31
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x24], 0xffffffff
test ebx, ebx
je 0x41dc63
lea edx, [ebx + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x41dc63
mov edx, dword [ebx]
mov eax, dword [edx]
push 0
mov ecx, ebx
call eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp dword [ebx + 0xc], 0
je 0x41dcc8
lea ecx, [ecx]
mov edi, dword [ebx + 0xc]
mov eax, dword [edi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x41dcb2
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi]
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebx + 0xc], 0
jne 0x41dc80
mov ebp, dword [ebx + 0x14]
mov esi, dword [ebp]
cmp esi, ebp
je 0x41dc00
cmp byte [esi + 0x1d], 0
mov edi, esi
jne 0x41dd18
mov eax, dword [esi + 8]
cmp byte [eax + 0x1d], 0
jne 0x41dcfd
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x1d], 0
jne 0x41dd18
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x1d], 0
je 0x41dcf1
jmp 0x41dd18
mov eax, dword [esi + 4]
cmp byte [eax + 0x1d], 0
jne 0x41dd16
cmp esi, dword [eax + 8]
jne 0x41dd16
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x1d], 0
je 0x41dd06
mov esi, eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x41dd2e
mov eax, dword [edi + 0x18]
test eax, eax
je 0x41dd2e
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [ebx + 0x10]
call fcn.00407090
cmp esi, ebp
jne 0x41dcd6
jmp 0x41dc00
jmp 0x41dbb0
Function at 0x41dd50
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x44d288
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x460adc]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x460294]
cmp eax, 0xffffffff
jne 0x41dbe5
xor ebx, ebx
jmp 0x41dbee
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [esp + 0x14], ebx
mov dword [esp + 0x24], 0
test ebx, ebx
je 0x41dc31
mov edi, edi
cmp dword [ebx + 0x18], 0
jne 0x41dc77
cmp dword [ebx + 0xc], 0
jne 0x41dc80
push 0x41d750
push 0x4631c4
call fcn.0041d9a0
mov eax, dword [0x460294]
add esp, 8
cmp eax, 0xffffffff
je 0x41dc31
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x24], 0xffffffff
test ebx, ebx
je 0x41dc63
lea edx, [ebx + 4]
or eax, 0xffffffff
lock xadd dword [edx], eax
jne 0x41dc63
mov edx, dword [ebx]
mov eax, dword [edx]
push 0
mov ecx, ebx
call eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp dword [ebx + 0xc], 0
je 0x41dcc8
lea ecx, [ecx]
mov edi, dword [ebx + 0xc]
mov eax, dword [edi + 4]
mov dword [ebx + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x41dcb2
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov esi, dword [edi]
mov edx, dword [esi]
mov eax, dword [edx]
push 0
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebx + 0xc], 0
jne 0x41dc80
mov ebp, dword [ebx + 0x14]
mov esi, dword [ebp]
cmp esi, ebp
je 0x41dc00
cmp byte [esi + 0x1d], 0
mov edi, esi
jne 0x41dd18
mov eax, dword [esi + 8]
cmp byte [eax + 0x1d], 0
jne 0x41dcfd
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x1d], 0
jne 0x41dd18
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x1d], 0
je 0x41dcf1
jmp 0x41dd18
mov eax, dword [esi + 4]
cmp byte [eax + 0x1d], 0
jne 0x41dd16
cmp esi, dword [eax + 8]
jne 0x41dd16
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x1d], 0
je 0x41dd06
mov esi, eax
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x41dd2e
mov eax, dword [edi + 0x18]
test eax, eax
je 0x41dd2e
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
push edi
lea ecx, [esp + 0x1c]
push ecx
lea ecx, [ebx + 0x10]
call fcn.00407090
cmp esi, ebp
jne 0x41dcd6
jmp 0x41dc00
jmp 0x41dbb0

Function at 0x4204f3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x460adc]
jne 0x4204fd
repz ret
jmp fcn.0042680a
Function at 0x43245f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x460adc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00427976
and dword [ebp - 0x14], 0
cmp dword [0x46406c], 0
mov dword [ebp - 0x18], eax
jne 0x432512
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4325ba
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x455098
push ebx
call edi
test eax, eax
je 0x4325ba
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46406c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x464070], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x464074], eax
call edi
push eax
call esi
mov dword [0x46407c], eax
test eax, eax
je 0x432512
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x464078], eax
mov eax, dword [0x464078]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x43256b
cmp dword [0x46407c], ecx
je 0x43256b
push eax
call esi
push dword [0x46407c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x43256b
test ebx, ebx
je 0x43256b
call edi
test eax, eax
je 0x432562
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x432562
test byte [ebp - 8], 1
jne 0x43256b
or dword [ebp + 0x10], 0x200000
jmp 0x43259e
mov eax, dword [0x464070]
cmp eax, dword [ebp - 0x18]
je 0x43259e
push eax
call esi
test eax, eax
je 0x43259e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43259e
mov eax, dword [0x464074]
cmp eax, dword [ebp - 0x18]
je 0x43259e
push eax
call esi
test eax, eax
je 0x43259e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46406c]
call esi
test eax, eax
je 0x4325ba
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4325bc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004204f3
leave
ret
Function at 0x4399b0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0xffffffffffffffff
push 0x44d9f0
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x460adc]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x460adc]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov edi, dword [esp + 0x54]
cmp dword [edi + 0x14], 8
mov esi, dword [esp + 0x58]
mov ebp, dword [esp + 0x50]
mov dword [esp + 0x1c], esi
jb 0x4399fc
mov eax, dword [edi]
jmp 0x4399fe
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x439a1c
push esi
push edi
push ebp
call fcn.00439710
add esp, 0xc
jmp 0x439b6f
test ebx, 0x400
je 0x439b2b
cmp dword [edi + 0x14], 8
jb 0x439a32
mov edx, dword [edi]
jmp 0x439a34
mov edx, edi
xor eax, eax
mov word [esp + 0x20], ax
mov eax, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x439a50
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.00403280
cmp dword [esp + 0x34], 8
mov eax, dword [esp + 0x20]
mov dword [esp + 0x48], 0
jae 0x439a81
lea eax, [esp + 0x20]
push 0
push 0x2000000
push 3
push 0
push 7
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [esp + 0x14], esi
cmp dword [esp + 0x34], 8
mov byte [esp + 0x48], 2
jb 0x439ab6
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004204e8
add esp, 4
xor edx, edx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], 0
mov word [esp + 0x20], dx
cmp esi, 0xffffffff
jne 0x439ae6
mov eax, dword [esp + 0x1c]
push eax
push edi
push ebp
call fcn.00439710
add esp, 0xc
jmp 0x439b6f
push edi
call fcn.004388c0
add esp, 4
test al, al
jne 0x439b18
push ebx
push edi
call fcn.00438d80
add esp, 8
push esi
mov dword [ebp], 9
mov dword [ebp + 4], eax
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x439b6f
push esi
mov dword [esp + 0x4c], 0xffffffff
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x1c]
test esi, esi
je 0x439b3d
mov dword [esi], 0
call fcn.0041deb0
mov dword [esi + 4], eax
push ebx
push edi
mov dword [esp + 0x1c], 3
test bl, 0x10
jne 0x439b54
mov dword [esp + 0x1c], 2
call fcn.00438d80
mov dword [esp + 0x20], eax
lea eax, [esp + 0x1c]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
add esp, 8
mov dword [ebp], ecx
mov dword [ebp + 4], edx
mov eax, ebp
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.004204f3
add esp, 0x38
ret
Function at 0x43a070
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44da80
mov eax, dword fs:[0]
push eax
sub esp, 0x28
push esi
mov eax, dword [0x460adc]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi + 4], 0
push 0x456ac4
lea ecx, [esp + 0x10]
mov dword [esp + 0x3c], 0
mov dword [esi], vtable.std::codecvt_wchar_t__char__int_.0
call fcn.004078d0
mov byte [esp + 0x38], 1
call fcn.0041c40c
lea ecx, [esp + 0xc]
mov dword [esi + 8], eax
mov dword [esi + 0xc], edx
mov byte [esp + 0x38], 0
call fcn.00407980
mov dword [esi], vtable.windows_file_codecvt.0
mov eax, esi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x34
ret
Function at 0x4011a0
Capabilities:
Hide graphical window

Disassembly:
push esi
push 0
push eax
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push 0x5f3d10
push 0x5f3e00
push 0
mov dword [0x5f3d74], eax
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x4011da
pop esi
ret
push 2
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push 0x6e
push 0x111
push esi
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, 1
pop esi
ret

Function at 0x401410
Capabilities:
Check os version
Get disk information

Disassembly:
mov eax, 0x100a8
call fcn.0040bc80
mov eax, dword [0x4120fc]
xor eax, esp
mov dword [esp + 0x100a4], eax
push ebx
push esi
push edi
push 0x100
push 0
push 0x5f3c10
call fcn.00407820
add esp, 0xc
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x401517
cmp dword [esp + 0x20], 2
jne 0x401517
push 0xffff
lea ecx, [esp + 0xb4]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x4014fd
xor edi, edi
lea esi, [esp + 0xb0]
lea esp, [esp]
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401495
sub eax, edx
cmp eax, 3
jle 0x4014d2
push 3
push 0x410df0
push esi
call fcn.00403b00
add esp, 0xc
test eax, eax
jne 0x4014d2
lea edx, [esi + 3]
push edx
call fcn.00402d54
add esp, 4
inc ebx
cmp eax, 0x100
jge 0x4014d2
mov byte [eax + 0x5f3c10], 1
cmp byte [esi], 0
je 0x4014eb
jmp 0x4014e0
inc edi
cmp byte [esp + edi + 0xb0], 0
jne 0x4014e0
inc edi
cmp byte [esp + edi + 0xb0], 0
lea esi, [esp + edi + 0xb0]
jne 0x401490
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [esp + 0x100a4]
xor ecx, esp
call fcn.00402b2d
add esp, 0x100a8
ret
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, 1
nop
push esi
lea eax, [esp + 0xac]
push str..COM_d
push eax
call fcn.00402b3c
add esp, 0xc
push 0
push 0
push 3
push 0
push 0
push 0xc0000000
lea ecx, [esp + 0xc0]
push ecx
call edi
cmp eax, 0xffffffff
jne 0x40156d
call ebp
cmp eax, 5
jne 0x401583
jmp 0x401570
push eax
call ebx
inc dword [esp + 0x10]
cmp esi, 0x100
jge 0x401583
mov byte [esi + 0x5f3c10], 1
inc esi
cmp esi, 0x100
jb 0x401530
mov ecx, dword [esp + 0x100b4]
mov eax, dword [esp + 0x10]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00402b2d
add esp, 0x100a8
ret