joyce8/EMBER2024-capa huggingface dataset:
Function at 0xd48f90
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
push ebp
push esi
push edi
xor edi, edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
mov esi, dword [esp + 0x21c]
mov ebp, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0xd48ffb
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xd49035
lea edx, [esp + 0x10]
push esi
push edx
push SysStringLen
call fcn.00d48e00
add esp, 0xc
lea eax, [esp + 0x10]
inc edi
push 0x104
push eax
push edi
push SysStringLen
call ebx
test eax, eax
je 0xd48fc5
mov edi, 0xd638b0
mov ecx, dword [esi + 8]
push 0
push ecx
call ebp
test eax, eax
je 0xd49035
mov edx, dword [edi]
push esi
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00d48e00
add edi, 4
add esp, 0xc
cmp edi, 0xd638c0
jb 0xd49000
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
add esp, 0x208
ret
pop edi
pop esi
pop ebp
xor al, al
pop ebx
add esp, 0x208
ret

Function at 0xd49070
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x250
push esi
push edi
mov edi, dword [esp + 0x25c]
push 0x5c
push edi
call fcn.00d4f082
mov esi, eax
add esp, 8
test esi, esi
je 0xd49107
lea eax, [esp + 8]
mov word [esi], 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0xd49102
push ebx
lea ebx, [esi + 2]
push ebp
lea ecx, [esp + 0x3c]
push ebx
push ecx
call fcn.00d4e946
add esp, 8
test eax, eax
je 0xd490e3
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea edx, [esp + 0x10]
push edx
push edi
call ebp
test eax, eax
je 0xd490e8
lea eax, [esp + 0x3c]
push ebx
push eax
call fcn.00d4e946
add esp, 8
test eax, eax
jne 0xd490c5
mov word [esi], 0x5c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp word [esi], 0
pop ebp
pop ebx
je 0xd49102
pop edi
mov al, 1
pop esi
add esp, 0x250
ret
mov word [esi], 0x5c
pop edi
xor al, al
pop esi
add esp, 0x250
ret
Function at 0xd49f10
Capabilities:
Get disk information

Disassembly:
push 0xffffffffffffffff
push 0xd5e9fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, dword [esp + 0x2c]
xor ebp, ebp
mov dword [esp + 0x10], eax
xor ebx, ebx
mov eax, 1
mov ecx, ebx
shl eax, cl
mov ecx, dword [esp + 0x10]
test ecx, eax
je 0xd4a002
lea edx, [ebx + 0x41]
lea eax, [esp + 0x14]
push edx
push str._c:_
push eax
call fcn.00d4ddff
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
jne 0xd4a002
lea edx, [esp + 0x14]
push edx
push str.Mounting__s_n
call fcn.00d456e0
lea eax, [esp + 0x1c]
lea edi, [esi + 0x1048]
push eax
push edi
mov word [esp + 0x28], bp
call fcn.00d4e20b
push 0x10
call fcn.00d4e1d3
add esp, 0x14
mov dword [esp + 0x2c], eax
cmp eax, ebp
mov dword [esp + 0x24], ebp
je 0xd49fc5
mov cx, word [edi]
push ecx
mov ecx, eax
call fcn.00d3a1c0
jmp 0xd49fc7
xor eax, eax
push esi
mov dword [esp + 0x28], 0xffffffff
mov dword [esi], eax
call fcn.00d49b80
mov edi, dword [esi]
add esp, 4
cmp edi, ebp
je 0xd49ff0
mov ecx, edi
call fcn.00d3a2c0
push edi
call fcn.00d4e1c8
add esp, 4
mov edx, dword [esi + 0x1024]
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0xd4a021
inc ebx
cmp ebx, 0x20
jb 0xd49f3e
pop edi
pop esi
pop ebp
mov al, 1
pop ebx
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
pop ebp
xor al, al
pop ebx
mov dword fs:[0], ecx
add esp, 0x18
ret
Function at 0xd4b250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0xd5f808
push 0xd4f288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0xd4b329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0xd4b329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.00d4e1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0xd4b329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0xd4b329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0xd4b32c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00d4b351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xd4bd20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd4bd58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xd4bd60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xd4bd94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xd4bd94
push eax
push esi
call fcn.00d4e20b
add esp, 8
pop esi
ret 0x10

Function at 0xd4bda0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd4be22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xd4be15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd64320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d4ddff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xd4bdda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xd4be30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xd4bec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xd4beb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd64320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00d4ddff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xd4beab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xd4be6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xd4c000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xd4c131
push esi
call fcn.00d4f145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00d3e080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xd4c131
push 0
push ebp
call fcn.00d3e3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00d3e260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xd4c08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00d3e2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xd4c121
push 0xd64918
push edi
call fcn.00d4d3f0
push eax
push ebx
push esi
call fcn.00d4bf60
push 0xd648f8
push edi
call fcn.00d4d3f0
push eax
push ebx
push esi
call fcn.00d4bf60
push 0xd648d8
push edi
call fcn.00d4d3f0
push eax
push ebx
push esi
call fcn.00d4bf60
push 0xd648c0
push edi
call fcn.00d4d3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00d4bf60
push 0xd648a0
push edi
call fcn.00d4d3f0
push eax
push ebx
push esi
call fcn.00d4bf60
push 0xd64888
push edi
call fcn.00d4d3f0
push eax
push ebx
push esi
call fcn.00d4bf60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xd4d1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00d4d140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00d4d140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00d4d140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00d4d140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xd4dbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xd4dc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd5f87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xd4dc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xd4dc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x41741b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4215e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040ce79
and dword [ebp - 0x14], 0
cmp dword [0x423914], 0
mov dword [ebp - 0x18], eax
jne 0x4174ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417576
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x417576
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x423914], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x423918], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42391c], eax
call edi
push eax
call esi
mov dword [0x423924], eax
test eax, eax
je 0x4174ce
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x423920], eax
mov eax, dword [0x423920]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417527
cmp dword [0x423924], ecx
je 0x417527
push eax
call esi
push dword [0x423924]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417527
test ebx, ebx
je 0x417527
call edi
test eax, eax
je 0x41751e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x41751e
test byte [ebp - 8], 1
jne 0x417527
or dword [ebp + 0x10], 0x200000
jmp 0x41755a
mov eax, dword [0x423918]
cmp eax, dword [ebp - 0x18]
je 0x41755a
push eax
call esi
test eax, eax
je 0x41755a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x41755a
mov eax, dword [0x42391c]
cmp eax, dword [ebp - 0x18]
je 0x41755a
push eax
call esi
test eax, eax
je 0x41755a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x423914]
call esi
test eax, eax
je 0x417576
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417578
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00408f0f
leave
ret

Function at 0x433001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x73982dff
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
mov ecx, 0x4a195741
nop
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0xcd8f64
Capabilities:
Execute anti-debugging instructions

Disassembly:
add edx, 0x4d4bad3e
jmp 0xcd912a
add edx, 0x191c0dba
jmp 0xcd9154
jmp 0xcd8f4b
mov ah, al
lea esp, [esp + 4]
xor bl, 0x62
sub esp, 6
jg 0xcd8f1d
and dh, ah
call fcn.00cd8f66
mov dword [eax], ebp
dec ebx
and dh, ah
mov eax, 0x51abd15f
lea esp, [esp]
mov dh, 0x54
push cx
jmp 0xcd901e
jmp 0xcd8f33
mov ah, 0x87
jmp 0xcd905d
ror bl, 0
shl ax, cl
jae 0xcd9008
mov ah, 0x87
mov ah, 0x49
bswap edx
jmp 0xcd9061
mov eax, edi
lea eax, reloc.RASAPI32.dll_RasGetConnectStatusA
mov eax, edx
jmp 0xcd9065
mov ah, 0x49
bswap edx
mov edx, ebx
jmp 0xcd9047
shl edx, 2
push edx
mov ah, 0x6d
bsf ax, bx
jmp 0xcd9296
jmp 0xcd7b4b
mov word [esp + 1], ax
mov eax, ebp
mov ah, byte [esp + 0xc]
jmp 0xcd7b66
lea eax, [eax*4]
bsf eax, edi
jmp 0xcd90e9
bsf ax, dx
lea eax, [eax*4]
bsf eax, edi
mov edx, dword [edx - reloc.RASAPI32.dll_RasGetConnectStatusA]
sub esp, 0x10
jmp 0xcd910e
mov ah, byte [esp + 0xc]
jmp 0xcd7b66
js 0xcd90ac
mov word [esp + 1], ax
mov eax, ebp
jmp 0xcd90f4
inc ax
jle 0xcd90db
bsf ax, dx
jmp 0xcd90c2
push dx
not ah
jmp 0xcd9182
not ah
lea eax, [eax + esi]
lea esp, [esp + 2]
jmp 0xcd9189
bsf eax, edi
jge 0xcd9134
push dx
jmp 0xcd913e
ror ax, cl
jnp 0xcd923f
setge al
mov ah, dl
mov ah, 0xc3
jmp 0xcd91f4
lea eax, [eax + esi]
lea esp, [esp + 2]
mov esp, edi
jmp 0xcd915d
mov ah, 0xc3
push edx
ret
setge al
mov ah, dl
jmp 0xcd91f2
jge 0xcd9075
jl 0xcd7b4b
lea esp, [esp + 2]
jmp 0xcd92c7
ror bl, 0
jmp 0xcd9350
mov dx, ax
lea eax, [eax + ebx]
stc
rdtsc
inc bl
mov ah, 0xb2
jmp 0xcd92fe
mov ah, 0x1b
lea eax, [ebp*4]
call fcn.00cd9338
jl 0xcd9309
add byte [eax], al
add byte [ebx + edi*8 + 0x6b], bh
push cs
std
imul ecx, dword [esi], reloc.RASAPI32.dll_RasGetConnectStatusA
inc esp
push edx
fdiv qword [edx + 0x15]
in al, 0x57
test eax, 0x3d826bc8
stc
rdtsc
jmp 0xcd92d9
jne 0xcd92d0
mov dx, ax
lea eax, [eax + ebx]
jmp 0xcd931d
Function at 0xdb835e
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00db803a
bsf di, di
push esp
setp dh
neg edx
mov di, 0x9235
jmp 0xdb80e3
mov edi, dword [esp]
std
mov edi, esi
sub esp, 6
mov di, word [esp + 4]
mov dh, 0xfe
jmp 0xdb80a5
neg edi
push bx
sub esp, 0x13
std
bsf edx, ebx
lea esp, [esp + 0x1b]
jmp 0xdb81ea
mov edi, 0x5bb7acd6
mov dx, bx
xchg byte [esp + 2], dh
xchg dword [esp + 4], edi
mov di, word [esp + 2]
neg di
jmp 0xdb80cd
mov di, si
bsr edx, ecx
xchg word [esp], dx
mov dl, byte [esp]
add esp, 1
and dx, 0x979d
jmp 0xdb80bb
push eax
mov di, word [esp + 0xf]
lea edx, [esi*4]
pushfd
mov dword [esp], esi
mov edi, ebx
jmp 0xdb816c
mov edi, edx
mov edx, dword [esp + 9]
xchg dword [esp + 2], edx
lea edx, [edi + 0x7d]
bswap edi
bswap edx
jmp 0xdb8122
mov dh, byte [esp]
mov dx, si
bswap edx
mov edx, ecx
sub esp, 0
jmp 0xdb81b7
bsr edx, ecx
not edi
mov edi, ebx
shr dh, cl
mov edi, dword [esp + 0x18]
setge dl
jmp 0xdb8156
mov dl, byte [esp + 0xb]
dec dx
mov dx, 0xefbc
pop dword [esp + 7]
sub esp, 0
pop dword [esp + 9]
jmp 0xdb8143
lea esp, [esp + 4]
jmp 0xdb81c9
lea edx, reloc.RASAPI32.dll_RasGetConnectStatusA
std
mov edx, dword [esp + 0x1f]
lea esp, [esp + 0x28]
popfd
jmp 0xdb81a1
push esp
mov dword [esp], eax
push esp
push word [esp + 2]
mov dword [esp], edi
jmp 0xdb8227
lea edi, [eax*4]
mov dword [esp], edi
sub esp, 0x12
mov dl, ah
mov edx, 0x20083bc3
lea edx, reloc.RASAPI32.dll_RasGetConnectStatusA
jmp 0xdb818a
push word [esp + 2]
call fcn.00db8207
mov dword [esp], edi
push dword [esp + 3]
push word [esp + 2]
push ax
mov dword [esp + 0x18], ebx
pushal
jmp 0xdb8265
lea esp, [esp + 6]
pop dword [esp + 0x11]
pop word [esp + 0xa]
call fcn.00db824f
out dx, al
adc dword [ebx], 0x76
test dword [edx - 0x2c], ebp
inc esp
fidivr dword [ebp + 0x7071eb4c]
jae 0xdb82f1
mov byte [esp + 0x20], bl
mov word [esp + 0x1a], dx
lea esp, [esp + 0x19]
push dword [esp]
lea esp, [esp + 1]
mov dword [esp + 0x10], edx
call fcn.00db824d
push word [esp + 8]
pop dword [esp + 0x12]
push dword [esp + 6]
pop dword [esp + 8]
lea esp, [esp + 0xd]
lea esp, [esp + 3]
jmp 0xdb82f6
lea esp, [esp + 0x48]
jmp 0xdb833f
push cs
jb 0xdb8361
jl 0xdb8345
mov dword [esp + 0x2c], esi
pushal
push ecx
pop word [esp + 0x18]
lea esp, [esp + 2]
mov dword [esp + 0x48], edi
jmp 0xdb82e0
mov edx, dword [esp + 4]
pop edx
mov dh, byte [esp + 0x11]
add esp, 0x11
bt dx, bx
xchg word [esp], di
jmp 0xdb810b
mov eax, dword [eax]
jmp 0xdb837b
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0xdb8329
pop edx
mov dl, byte [esp + 0x12]
and al, 0x12
jmp 0xdb8310
push eax
jmp 0xdb8035
mov eax, dword [eax + 8]
jmp 0xdb8365
Function at 0x403bec
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x403ce7
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x403c40
push 0x105
lea eax, [ebp - 0x10d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x10d]
mov eax, esi
call fcn.00401b34
jmp 0x403cce
call sub.kernel32.dll_GetCommandLineA
mov dword [edi], eax
mov eax, dword [edi]
call fcn.00403b74
mov dword [edi], eax
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [edi]
call fcn.00403b9c
mov dword [edi], eax
test ebx, ebx
je 0x403c6e
dec ebx
test ebx, ebx
jl 0x403c6e
mov eax, dword [edi]
cmp eax, dword [ebp - 8]
jne 0x403c47
push esi
lea eax, [ebp - 0x114]
mov edx, dword [ebp - 8]
call fcn.00401c1c
mov eax, dword [ebp - 0x114]
mov ecx, dword [edi]
sub ecx, dword [ebp - 8]
mov edx, 1
call fcn.00401ef4
mov eax, dword [esi]
call fcn.00401ca0
cmp eax, 2
jl 0x403cce
mov eax, dword [esi]
cmp byte [eax], 0x22
jne 0x403cce
mov eax, dword [esi]
call fcn.00401ca0
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x22
jne 0x403cce
push esi
mov eax, dword [esi]
call fcn.00401ca0
mov ecx, eax
sub ecx, 2
mov eax, dword [esi]
mov edx, 2
call fcn.00401ef4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403cee
lea eax, [ebp - 0x114]
call fcn.00401a48
ret
Function at 0x403d48
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x403e9c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00401a48
lea eax, [ebp - 4]
mov edx, esi
call fcn.00401ae0
jmp 0x403e37
lea ecx, [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x403eb4
call fcn.004039ac
cmp dword [ebx], 0
je 0x403db6
mov eax, ebx
mov edx, 0x403eb4
call fcn.00401ca8
cmp dword [ebx], 0
jne 0x403ddd
mov eax, dword [ebp - 8]
call fcn.00401ca0
cmp eax, 2
jne 0x403ddd
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x403ddd
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00401a9c
jmp 0x403e37
push 0x200
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov edx, dword [ebx]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 8]
call fcn.00401cec
mov eax, dword [ebp - 0x16c]
call fcn.00401e98
push eax
call sub.shell32.dll_SHGetFileInfoA
cmp byte [ebp - 0x15c], 0
je 0x403e2d
lea eax, [ebp - 8]
lea edx, [ebp - 0x15c]
mov ecx, 0x104
call fcn.00401c88
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00401ca8
cmp dword [ebp - 4], 0
jne 0x403d95
lea edx, [ebp - 0x170]
mov eax, dword [ebx]
call fcn.00404084
cmp dword [ebp - 0x170], 0
jne 0x403e71
lea edx, [ebp - 0x174]
mov eax, esi
call fcn.00404084
mov edx, dword [ebp - 0x174]
mov eax, ebx
call fcn.00401ca8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ea3
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00401a6c
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401a6c
ret

Function at 0x4041c4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40422e
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00401c1c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00403ffc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404235
lea eax, [ebp - 0x10c]
call fcn.00401a48
ret

Function at 0x40423c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4042a6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00401c1c
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00403ffc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4042ad
lea eax, [ebp - 0x10c]
call fcn.00401a48
ret

Function at 0x4042b4
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00401c1c
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00403ffc
ret