joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
push 1
mov dword [esp + 0xc], 3
mov dword [esp + 8], 0x2c
call fcn.00407ad0
add esp, 4
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push 1
push ebx
push str.SoftwareMijenixPowerDeskVersion3.0PDFind
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x407ca9
mov eax, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x14]
push 0x41d068
push edx
push ebx
push str.Global_Settings
push eax
call esi
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0x41d7d8
push edx
push ebx
mov edi, 4
push str.Save_Settings_On_Exit
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call esi
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0x41eb24
push edx
push ebx
push str.Show_Path
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call esi
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push 0x41d7b8
push edx
push ebx
push str.Drives
push eax
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
call esi
mov eax, dword [0x41d7b8]
cmp eax, ebx
jne 0x407c75
mov eax, edi
mov dword [0x41d7b8], eax
pop edi
xor ecx, ecx
pop esi
mov edx, 1
shl edx, cl
test eax, edx
je 0x407c8d
mov byte [ecx + 0x41d098], 1
jmp 0x407c93
mov byte [ecx + 0x41d098], bl
inc ecx
cmp ecx, 0x1a
jl 0x407c79
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00407e10
mov dword [0x41d08c], ebx
mov dword [0x41d068], ebx
pop ebx
add esp, 0xc
ret
Function at 0x4084b0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x318
push ebx
push ebp
push esi
lea eax, [esp + 0x10]
push edi
xor ebx, ebx
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push eax
push ebx
push ebx
lea ecx, [esp + 0x1c]
push ebx
lea edx, [esp + 0x2c]
push ecx
push edx
push ebx
push 0x80000000
xor esi, esi
mov dword [esp + 0x30], 0x104
mov dword [0x41ea5c], ebx
call ebp
test eax, eax
jne 0x408631
mov eax, dword [0x41ea5c]
cmp eax, 0xc8
jge 0x408636
cmp byte [esp + 0x1c], 0x2e
jne 0x408606
lea eax, [esp + 0x1c]
push eax
push ebx
push 0x80000000
call fcn.00407940
add esp, 0xc
test eax, eax
je 0x408606
lea ecx, [esp + 0x224]
push ecx
push ebx
call fcn.00407a90
add esp, 8
test eax, eax
je 0x408601
lea edx, [esp + 0x224]
push edx
push ebx
push 0x80000000
call fcn.00407940
add esp, 0xc
test eax, eax
je 0x408601
lea eax, [esp + 0x120]
push eax
push ebx
call fcn.00407a90
add esp, 8
test eax, eax
je 0x408601
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x408601
push 0x50
call fcn.00412b14
mov ecx, dword [0x41ea5c]
add esp, 4
cmp eax, ebx
mov dword [ecx*4 + 0x422760], eax
je 0x408601
lea edx, [esp + 0x1c]
push 0xa
push edx
push eax
call fcn.004132c0
mov eax, dword [0x41ea5c]
lea edx, [esp + 0x12c]
push 0x46
push edx
mov ecx, dword [eax*4 + 0x422760]
mov byte [ecx + 9], bl
mov eax, dword [0x41ea5c]
mov ecx, dword [eax*4 + 0x422760]
add ecx, 0xa
push ecx
call fcn.004132c0
mov edx, dword [0x41ea5c]
add esp, 0x18
mov eax, dword [edx*4 + 0x422760]
mov byte [eax + 0x4f], bl
mov eax, dword [0x41ea5c]
inc eax
mov dword [0x41ea5c], eax
call fcn.00407890
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push ebx
push ebx
push ebx
lea eax, [esp + 0x2c]
inc esi
push edx
push eax
push esi
push 0x80000000
mov dword [esp + 0x30], 0x104
call ebp
test eax, eax
je 0x4084f4
mov eax, dword [0x41ea5c]
pop edi
pop esi
pop ebp
cmp eax, ebx
pop ebx
jle 0x408653
push 0x408660
push 4
push eax
push 0x422760
call fcn.004133f8
add esp, 0x10
add esp, 0x318
ret
Function at 0x40b080
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x41eb18]
test eax, eax
jne 0x40b0ba
mov eax, dword [0x41eaf4]
push 1
push eax
mov dword [0x41eb18], 1
call dword [sym.imp.USER32.dll_ShowWindow]
call fcn.00408b20
push 0
call fcn.00408aa0
add esp, 4
call fcn.00408b70
jmp fcn.00409130
ret

Function at 0x40b200
Capabilities:
Get file system object information

Disassembly:
mov eax, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x160
lea ecx, [esp]
push eax
push 0x160
push ecx
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov eax, dword [esp + 4]
add esp, 0x160
ret

Function at 0x40b770
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x228
mov ecx, 8
xor eax, eax
lea edx, [esp + 0x20]
push ebx
push esi
push edi
mov edi, dword [esp + 0x238]
rep stosd dword es:[edi], eax
mov ecx, 0xb
mov esi, str.SoftwareMijenixPowerDeskVersion3.0PDFind
lea edi, [esp + 0x2c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov edi, 0x41d78c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x2c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x23c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0xc]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
lea ecx, [esp + 0x34]
push 0
push ecx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b88a
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, 8
push esi
lea edx, [esp + 0x1c]
push 0x41d9ec
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x10]
lea ecx, [esp + 0x130]
lea edx, [esp + 0x14]
push eax
push ecx
mov ecx, dword [esp + 0x14]
push edx
lea eax, [esp + 0x24]
push 0
push eax
push ecx
mov dword [esp + 0x28], 0x104
call ebx
test eax, eax
jne 0x40b876
mov eax, dword [esp + 0x238]
lea edx, [esp + 0x130]
push edx
push eax
call fcn.0040b6a0
add esp, 8
dec esi
test esi, esi
jg 0x40b822
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40b88a
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
add esp, 0x228
ret
Function at 0x40ba70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x10], edx
mov dword [esp + 8], ecx
mov ecx, dword [0x422ba0]
lea edx, [esp]
xor eax, eax
push edx
mov dword [esp + 4], 0x3c
mov dword [esp + 8], eax
mov dword [esp + 0x10], str.print
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
add esp, 0x3c
ret
Function at 0x40e3e0
Capabilities:
Get common file path

Disassembly:
push ecx
mov eax, dword [0x41ed80]
test eax, eax
jne 0x40e3fd
push 0x41ed80
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jge 0x40e3fd
xor eax, eax
pop ecx
ret
mov ecx, dword [0x41eae8]
lea eax, [esp]
push eax
push 9
push ecx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov eax, dword [0x41ed84]
test eax, eax
jne 0x40e425
push 0x41ed84
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov edx, dword [esp]
mov eax, dword [0x41ed84]
push esi
push 1
push 0x41ed88
push edx
push eax
mov dword [0x41ed7c], 0x34bc
mov dword [0x41ed78], 0x14
call fcn.0040dee0
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x40e48c
mov eax, dword [0x41ed84]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [0x41ed80]
mov ecx, dword [esp + 4]
mov dword [0x41ed84], esi
push ecx
mov edx, dword [eax]
push eax
call dword [edx + 0x14]
mov eax, dword [0x41ed80]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov dword [0x41ed80], esi
mov eax, esi
pop esi
pop ecx
ret

Function at 0x40ea80
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x404
add eax, 0x2c
lea edx, [esp + 4]
push ebx
push ebp
push esi
push edi
push eax
push ecx
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [esp + 0x14]
push 0
push 0x8000080
push 3
push 0
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40eb85
mov edi, dword [esp + 0x420]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, ecx
jne 0x40eafe
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x404
ret
cmp edi, 0x400
jg 0x40eb7e
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
xor esi, esi
cmp esi, edi
jl 0x40eb50
mov ecx, dword [esp + 0x424]
mov eax, dword [esp + 0x420]
push ecx
lea edx, [esp + 0x18]
push esi
push edx
push eax
call fcn.0040eba0
add esp, 0x10
test eax, eax
jne 0x40eae7
lea ecx, [edi - 1]
test ecx, ecx
jle 0x40eb4e
mov edx, eax
sub edx, edi
add edx, esi
inc eax
cmp eax, ecx
mov dl, byte [esp + edx + 0x15]
mov byte [esp + eax + 0x13], dl
jl 0x40eb3b
mov esi, ecx
mov ecx, 0x400
lea eax, [esp + 0x10]
push 0
sub ecx, esi
push eax
lea edx, [esp + esi + 0x1c]
push ecx
push edx
push ebp
call ebx
test eax, eax
je 0x40eb7e
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40eb7e
add esi, eax
mov eax, dword [0x41da68]
test eax, eax
je 0x40eb0e
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x404
ret
Function at 0x410280
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x264
lea eax, [esp]
push esi
push edi
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4001
lea ecx, [esp + 0x110]
push 0x160
push ecx
lea edx, [esp + 0x14]
push 0
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x410303
mov esi, dword [esp + 0x270]
test esi, esi
je 0x410303
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 0
push 0x1109
push esi
call edi
push 0x422070
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x410303
push 0xffff0000
push 0
push 0x1101
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x264
ret
pop edi
xor eax, eax
pop esi
add esp, 0x264
ret
Function at 0x410b30
Capabilities:
Get common file path

Disassembly:
sub esp, 8
mov ecx, dword [0x41eae8]
lea eax, [esp + 4]
push eax
push 0x12
push ecx
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x410baf
lea edx, [esp]
push esi
push edx
call dword [sym.imp.SHELL32.dll_SHGetDesktopFolder]
mov edx, dword [esp + 8]
mov eax, dword [esp + 4]
push edx
mov edx, dword [esp + 0x14]
mov ecx, dword [eax]
push edx
push 0
push eax
call dword [ecx + 0x1c]
mov esi, eax
mov eax, dword [esp + 4]
test eax, eax
je 0x410b8d
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x410ba1
mov eax, dword [0x422070]
push ecx
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
test esi, esi
pop esi
jne 0x410baf
mov eax, 1
add esp, 8
ret
xor eax, eax
add esp, 8
ret

Function at 0x410dc0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0xf4
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push 2
call esi
push 3
mov edi, eax
call esi
mov ecx, dword [0x422ba0]
mov ebx, dword [esp + 0x108]
push 0
push ecx
push 0x9c64
push ebx
mov ebp, dword [sym.imp.USER32.dll_CreateWindowExA]
push eax
push edi
push 0
push 0
push 0x50800040
push 0
push str.BUTTON
push 8
call ebp
mov esi, eax
push 0
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x422ba0]
push 0x72
push edx
call dword [sym.imp.USER32.dll_LoadIconA]
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push eax
push 1
push 0xf7
push esi
call edi
mov eax, dword [0x422ba0]
push 0
push eax
push 0
push ebx
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 1
push 0
push str.tooltips_class32
push 0
call ebp
lea ecx, [esp + 0x3c]
mov ebx, eax
mov eax, dword [0x422ba0]
push 0xc8
push ecx
push 0xa43b
push eax
mov dword [esp + 0x20], 0x2c
mov dword [esp + 0x24], 0x11
mov dword [esp + 0x28], esi
mov dword [esp + 0x40], eax
mov dword [esp + 0x2c], esi
call dword [sym.imp.USER32.dll_LoadStringA]
lea eax, [esp + 0x10]
lea edx, [esp + 0x3c]
push eax
push 0
push 0x404
push ebx
mov dword [esp + 0x44], edx
call edi
push 0
push 1
push 0x401
push ebx
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret

Function at 0x411b90
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x140
mov ecx, dword [0x41eae8]
lea edx, [esp + 0x3c]
xor eax, eax
mov dword [esp + 0x14], edx
mov dword [esp + 4], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x144]
lea edx, [esp + 0x3c]
mov dword [esp + 8], ecx
mov ecx, dword [0x422ba0]
push 0x104
push edx
push eax
mov dword [esp + 0xc], 0x3c
mov dword [esp + 0x1c], 0x4223ac
mov dword [esp + 0x28], 1
mov dword [esp + 0x2c], ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea ecx, [esp]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
add esp, 0x140
ret
Function at 0x411c20
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x140
mov eax, dword [0x41eae8]
mov edx, dword [0x422ba0]
lea ecx, [esp + 0x3c]
mov dword [esp + 8], eax
push esi
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 0x148]
lea eax, [esp + 0x40]
push 0x104
xor esi, esi
push eax
push ecx
mov dword [esp + 0x10], 0x3c
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], 1
mov dword [esp + 0x30], edx
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], esi
mov dword [esp + 0x48], esi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea edx, [esp + 4]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
je 0x411cba
mov eax, dword [0x41eae8]
push esi
push 0x9c56
push 0x111
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
add esp, 0x140
ret

Function at 0x4123d0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x41eaf8]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_IsWindow]
push eax
call edi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
test eax, eax
je 0x412417
mov ecx, dword [0x41eb04]
push ecx
call edi
test eax, eax
je 0x412417
mov edx, dword [0x41eaf8]
push 0
push 0
push 0x7e9
push edx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [0x41eb04]
push 0
push eax
call esi
mov ecx, dword [0x41eafc]
push ecx
call edi
test eax, eax
je 0x41243f
call dword [0x422084]
mov edx, dword [0x41eafc]
push 0
push edx
mov dword [0x41eb08], 0
call esi
mov eax, dword [0x41eb04]
mov ecx, dword [0x41eaf8]
push eax
push ecx
call fcn.00410f10
mov edx, dword [0x41eb00]
add esp, 8
push 0
push edx
call esi
mov al, byte [0x41ea28]
pop edi
mov byte [0x42208c], al
pop esi
ret
Function at 0x4126f0
Capabilities:
Check if file exists
Get file attributes
Hide graphical window

Disassembly:
mov eax, dword [0x41eaf8]
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x412814
mov ebx, dword [esp + 0x11c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp byte [ebx], 0
jne 0x412791
call fcn.004123d0
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, 0x42208c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004053b0
add esp, 4
test eax, eax
je 0x4127ca
mov edx, dword [0x41eae8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push ebx
push edx
mov dword [esp + 0x20], 0
call fcn.00405260
add esp, 0x10
lea eax, [esp + 0x14]
push eax
call ebp
test al, 0x10
je 0x4127a9
call fcn.004123d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
push ebx
call ebp
cmp eax, 0xffffffff
jne 0x412725
call fcn.004123d0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x41eb00]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 1
push eax
call esi
mov eax, dword [0x41eb08]
test eax, eax
je 0x4127e8
push 0
push eax
call esi
mov eax, dword [0x41eafc]
test eax, eax
je 0x4127f6
push 0
push eax
call esi
mov ecx, dword [esp + 0x120]
mov edx, dword [0x41eb04]
mov eax, dword [0x41eaf8]
push ecx
push ebx
push edx
push eax
call fcn.004125c0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x4175c4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0041732d
push esi
mov ch, 0xb7
inc edx
lea eax, [ebp - 0x58]
push eax
call fcn.0041733d
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.004172f2
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x41761b
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0041732d
salc
or eax, 0x458de6ac
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x417f67
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x50f], 0x79
mov byte [ebp - 0x50e], 0x68
mov byte [ebp - 0x50d], 0x5a
mov byte [ebp - 0x50c], 0x75
mov byte [ebp - 0x50b], 0x70
mov byte [ebp - 0x50a], 0x79
mov byte [ebp - 0x509], 0x4f
mov byte [ebp - 0x508], 0x75
invalid
test ecx, edi
cli
invalid

Function at 0x418287
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
Function at 0x401400
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x10], 0x441030
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
call sub.msvcrt.dll_rand
mov edx, eax
mov eax, edx
sar eax, 0x1f
shr eax, 0x1f
lea eax, [edx + eax]
sar eax, 1
add eax, eax
sub edx, eax
mov eax, edx
add eax, 5
mov dword [esp], eax
call sym.ZX_jmWHy
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x43d000
mov dword [esp], 0x441030
call sub.msvcrt.dll_strcat
leave
ret

Function at 0x4015c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov eax, dword [ebp + 8]
mov dword [esp + 8], eax
mov dword [esp + 4], str.open
mov dword [esp], 0
call sub.SHELL32.DLL_ShellExecuteA
sub esp, 0x18
leave
ret
Function at 0x401d36
Capabilities:
Create directory
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x28c
mov dword [ebp - 0x23c], sym.WFBS_P_Cg7_PWyXJXA_1WXrXXFW9W7h
mov dword [ebp - 0x238], 0x43c046
lea eax, [ebp - 0x234]
lea edx, [ebp - 0x18]
mov dword [eax], edx
mov edx, 0x401f6a
mov dword [eax + 4], edx
mov dword [eax + 8], esp
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d0f0
add dword [0x441018], 0xfffffff9
adc dword [0x44101c], 0xffffffff
mov dword [esp + 0x10], 0x4410b0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x23
mov dword [esp], 0
mov dword [ebp - 0x250], 0xffffffff
call sub.SHELL32.DLL_SHGetFolderPathA
sub esp, 0x14
mov dword [esp + 4], 0x43e005
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], str.Saaaalamm
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0
mov dword [esp], 0x4410b0
call sub.KERNEL32.DLL_CreateDirectoryA
sub esp, 8
mov dword [esp + 4], str.Mira.h
mov dword [esp], 0x4410b0
call sub.msvcrt.dll_strcat
mov dword [esp + 4], 0x10
mov dword [esp], 4
call sym.t_ZW_jsWHy
mov dword [esp + 8], eax
mov dword [esp + 4], 0x4410b0
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.Gx_ZW_jWy
mov dword [esp + 4], 8
mov dword [esp], 4
call sym.t_ZW_jsWHy
mov dword [esp + 8], eax
mov dword [esp + 4], 0x43d040
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym.Gx_ZW_jWy
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 0
mov eax, dword [ebp - 0x220]
mov edx, dword [ebp - 0x21c]
mov dword [ebp - 0x260], eax
mov dword [ebp - 0x25c], edx
mov edx, dword [ebp - 0x25c]
cmp edx, dword [0x44101c]
jg 0x401f2b
mov eax, dword [ebp - 0x25c]
cmp eax, dword [0x44101c]
jl 0x401ed0
mov edx, dword [ebp - 0x260]
cmp edx, dword [0x441018]
jae 0x401f2b
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call fcn.00424f30
mov dword [esp + 8], 1
mov dword [esp + 4], 0x441020
lea eax, [ebp - 0x118]
add eax, 8
mov dword [esp], eax
call sym.WFBS_P_g7_PWyXJXA_WXrX_17gX_d9W_RB
lea eax, [ebp - 0x220]
add dword [eax], 1
adc dword [eax + 4], 0
jmp 0x401e8e
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 1
call sym.eY_WHeYXA_BFg7__WWW:Zo_W_ZW_juWHy
lea eax, [ebp - 0x118]
mov dword [esp], eax
call sym.eY_WHeYXA_BFg7__WWW:Zo_W_ZW_juWHy
mov dword [esp + 4], 2
mov dword [esp], 0x4410b0
call sub.KERNEL32.DLL_SetFileAttributesA
sub esp, 8
jmp 0x401fb6
lea eax, [ebp - 0x218]
mov dword [esp], eax
mov dword [ebp - 0x250], 2
call sym._gXsXydXJ_BWQW9WS_P_g7_PWyX7XA_W
jmp 0x402018
lea eax, [ebp - 0x118]
mov dword [esp], eax
mov dword [ebp - 0x250], 0xffffffff
call sym._gXsXydXJ_BWQW9WS_P_g7_PWyX7XA_W
lea eax, [ebp - 0x254]
mov dword [esp], eax
call fcn.0040d1d0
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret