joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40bd10
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b7b1
mov eax, dword fs:[0]
push eax
sub esp, 0x3a4
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0
push 0x19
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x328]
call fcn.0040de30
lea eax, [ebp - 0x3b0]
mov dword [ebp - 4], 0
push 0x23
push eax
call fcn.0040e570
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040df60
push eax
push esi
lea eax, [ebp - 0x328]
push 0x41e384
push eax
call fcn.0040e3b0
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3b0]
call fcn.0040de80
lea ecx, [ebp - 0x2a0]
call fcn.0040de30
lea eax, [ebp - 0x3b0]
mov byte [ebp - 4], 2
push 0x26
push eax
call fcn.0040e570
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0040df60
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push str._s_s.lnk
push eax
call fcn.0040e3b0
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3b0]
call fcn.0040de80
lea ecx, [ebp - 0x2a0]
call fcn.0040df60
push eax
lea ecx, [ebp - 0x328]
call fcn.0040df60
push eax
call fcn.0040bf90
add esp, 8
lea ecx, [ebp - 0x2a0]
mov esi, eax
call fcn.0040de80
lea ecx, [ebp - 0x328]
call fcn.0040de80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret

Function at 0x40be50
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b811
mov eax, dword fs:[0]
push eax
sub esp, 0x3a4
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0
push 0x1a
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x328]
call fcn.0040de30
lea eax, [ebp - 0x3b0]
mov dword [ebp - 4], 0
push 0x23
push eax
call fcn.0040e570
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040df60
push eax
push esi
lea eax, [ebp - 0x328]
push 0x41e384
push eax
call fcn.0040e3b0
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x3b0]
call fcn.0040de80
lea ecx, [ebp - 0x2a0]
call fcn.0040de30
lea eax, [ebp - 0x3b0]
mov byte [ebp - 4], 2
push 0x26
push eax
call fcn.0040e570
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 3
call fcn.0040df60
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push str._sMicrosoftInternet_ExplorerQuick_Launch_s.lnk
push eax
call fcn.0040e3b0
add esp, 0x10
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x3b0]
call fcn.0040de80
lea ecx, [ebp - 0x2a0]
call fcn.0040df60
push eax
lea ecx, [ebp - 0x328]
call fcn.0040df60
push eax
call fcn.0040bf90
add esp, 8
lea ecx, [ebp - 0x2a0]
mov esi, eax
call fcn.0040de80
lea ecx, [ebp - 0x328]
call fcn.0040de80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret
Function at 0x40bf90
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x422438
push 1
push 0
push 0x425c98
mov dword [ebp - 8], 0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x40bff2
mov eax, dword [ebp - 4]
push dword [ebp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x423008
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
jns 0x40bffe
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
xor eax, eax
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 8]
push 2
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40c370
Capabilities:
Create process on windows
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b91b
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
push 0x16
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea ecx, [ebp - 0x2a0]
call fcn.0040de30
lea eax, [ebp - 0x328]
mov dword [ebp - 4], 0
push 0x26
push eax
call fcn.0040e570
add esp, 8
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040df60
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x2a0]
push str._s_s.lnk
push eax
call fcn.0040e3b0
add esp, 0x10
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x328]
call fcn.0040de80
push 1
push 0
push 0
lea ecx, [ebp - 0x2a0]
call fcn.0040df60
push eax
push str.taskbarpin
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x2a0]
call fcn.0040de80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret

Function at 0x40c450
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b965
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push ebx
push esi
push edi
mov eax, dword [0x42c0a4]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x18], 0x420abc
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
xor edi, edi
call fcn.0040e470
test eax, eax
jle 0x40c4b0
lea ecx, [ebp + 8]
call fcn.0040e470
mov edi, eax
lea ecx, [ebp + 8]
call fcn.0040e470
inc eax
lea ecx, [ebp - 0x18]
push eax
call fcn.0040c780
lea ecx, [ebp + 8]
call fcn.0040e470
lea ecx, [ebp + 8]
lea eax, [eax*2 + 2]
push eax
call fcn.0040df60
push eax
push dword [ebp - 0x10]
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.0040e470
mov esi, eax
lea ecx, [esi + 2]
push ecx
lea ecx, [ebp - 0x18]
call fcn.0040c780
mov ebx, dword [ebp - 0x10]
xor eax, eax
mov word [ebx + esi*2 + 2], ax
cmp edi, 0x104
jl 0x40c512
xor esi, esi
jmp 0x40c553
mov dword [ebp - 0x26], eax
mov eax, 0x414
mov word [ebp - 0x28], ax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 0x22], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x1e], 0
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x34], 3
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
neg eax
sbb esi, esi
inc esi
push ebx
call fcn.00418521
add esp, 4
lea ecx, [ebp + 8]
call fcn.0040de80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c580
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41b9b6
mov eax, dword fs:[0]
push eax
sub esp, 0x5d8
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x328]
mov esi, dword [ebp + 8]
mov dword [ebp - 0x5e0], eax
call fcn.0040de30
lea eax, [ebp - 0x2a0]
mov dword [ebp - 4], 0
push 0x23
push eax
call fcn.0040e570
add esp, 8
lea ecx, [ebp - 0x2a0]
mov byte [ebp - 4], 1
call fcn.0040df60
push eax
push esi
lea eax, [ebp - 0x328]
push 0x41e384
push eax
call fcn.0040e3b0
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [ebp - 0x5d8]
push 0x228
push 0
push eax
mov dword [ebp - 0x5e4], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x5dc], 0x22c
lea eax, [ebp - 0x5dc]
mov esi, 1
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x40c734
mov ebx, dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [ebp - 0x5b8]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0040e2c0
test eax, eax
jne 0x40c71a
push dword [ebp - 0x5d4]
push eax
push 0x411
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x40c71a
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push 0x104
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x328]
call fcn.0040e2c0
test eax, eax
jne 0x40c71a
test esi, esi
je 0x40c715
lea eax, [ebp - 0x3b0]
push 0x25
push eax
call fcn.0040e570
add esp, 8
push 0x34
push 0x420b4c
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.0040df60
push eax
push dword [ebp - 0x5e0]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x3b0]
mov byte [ebp - 4], 1
mov esi, eax
call fcn.0040de80
cmp esi, 6
jne 0x40c76d
xor esi, esi
push 0
push edi
call ebx
lea eax, [ebp - 0x5dc]
push eax
push dword [ebp - 0x5e4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x40c653
mov esi, 1
lea ecx, [ebp - 0x2a0]
call fcn.0040de80
lea ecx, [ebp - 0x328]
call fcn.0040de80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x40c739
Function at 0x40c820
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
test edi, edi
jne 0x40c83a
pop edi
mov esp, ebp
pop ebp
ret
push ebx
push esi
push 0x420a2c
push 0x74
push edi
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push edi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push ebx
push 0x80
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c8b1
mov edi, dword [ebp - 8]
lea eax, [ebp - 4]
push ebx
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 4], ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp edi, dword [ebp - 4]
push esi
sete bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop esi
mov eax, ebx
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40cfa0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0
push 0x26
push 0x42c560
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0x1a
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x4208d4
push 0x42c560
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x20c]
push eax
push 0x42c560
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov ecx, dword [ebp - 4]
mov eax, 0x42c560
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret

Function at 0x40d030
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bb23
mov eax, dword fs:[0]
push eax
sub esp, 0x298
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
push 0x4208d8
lea ecx, [ebp - 0x2a0]
mov dword [ebp - 4], 0
call fcn.0040de00
push 0x420934
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp + 8]
call fcn.0040dfa0
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 2
call fcn.0040dea0
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 1
call fcn.0040de80
lea eax, [ebp - 0x2a4]
push eax
push 0xf003f
push 0
lea ecx, [ebp - 0x2a0]
call fcn.0040df60
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d114
push 0x104
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x104
lea ecx, [ebp + 8]
call fcn.0040e460
push eax
push 1
push 0
push 0x42094c
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x2a4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x2a0]
call fcn.0040de80
lea ecx, [ebp + 8]
call fcn.0040de80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret
Function at 0x40d2c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
test esi, esi
je 0x40d38b
push dword [ebp + 0xc]
movzx ecx, word [ebp + 8]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40d38b
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push edi
mov ebx, eax
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x40d38b
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
push dword [ebp - 8]
push edi
push eax
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
push 0x10
call sub.gdiplus.dll_GdipAlloc
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x40d369
mov ecx, dword [ebp - 4]
lea eax, [esi + 4]
push eax
push ecx
mov dword [esi], vtable.Gdiplus::Image.0
mov dword [eax], 0
call sub.gdiplus.dll_GdipLoadImageFromStream
mov dword [esi + 8], eax
jmp 0x40d36b
xor esi, esi
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40d600
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bc2a
mov eax, dword fs:[0]
push eax
sub esp, 0x33c
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0xffffffffffffffff
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall_
lea ecx, [ebp - 0x340]
mov dword [ebp - 4], 1
call fcn.0040de00
push 0xffffffffffffffff
push 0x4209cc
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 2
mov dword [ebp - 0x344], 0
call fcn.0040de00
push 0xffffffffffffffff
push str.1.0.1
lea ecx, [ebp - 0x230]
mov byte [ebp - 4], 3
call fcn.0040de00
push 0xffffffffffffffff
push 0x42094c
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 4
call fcn.0040de00
push str.Uninstall.exe
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 5
push eax
lea ecx, [ebp + 8]
call fcn.0040dfa0
push str.Install.ico
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 6
push eax
lea ecx, [ebp + 0x90]
call fcn.0040dfa0
lea eax, [ebp - 0x348]
mov byte [ebp - 4], 7
push eax
lea eax, [ebp - 0x344]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x340]
call fcn.0040df60
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40d7be
push 0x104
lea ecx, [ebp - 0x2b8]
call fcn.0040e460
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
push 1
push 0
push str.Publisher
push dword [ebp - 0x344]
call esi
push 0x104
lea ecx, [ebp - 0x230]
call fcn.0040e460
push eax
push 1
push 0
push str.DisplayVersion
push dword [ebp - 0x344]
call esi
push 0x104
lea ecx, [ebp - 0x1a8]
call fcn.0040e460
push eax
push 1
push 0
push str.DisplayName
push dword [ebp - 0x344]
call esi
push 0x104
lea ecx, [ebp - 0x98]
call fcn.0040e460
push eax
push 1
push 0
push str.DisplayIcon
push dword [ebp - 0x344]
call esi
push 0x104
lea ecx, [ebp - 0x120]
call fcn.0040e460
push eax
push 1
push 0
push str.UninstallString
push dword [ebp - 0x344]
call esi
push dword [ebp - 0x344]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x98]
call fcn.0040de80
lea ecx, [ebp - 0x120]
call fcn.0040de80
lea ecx, [ebp - 0x1a8]
call fcn.0040de80
lea ecx, [ebp - 0x230]
call fcn.0040de80
lea ecx, [ebp - 0x2b8]
call fcn.0040de80
lea ecx, [ebp - 0x340]
call fcn.0040de80
lea ecx, [ebp + 8]
call fcn.0040de80
lea ecx, [ebp + 0x90]
call fcn.0040de80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret
Function at 0x4101a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bf86
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x98]
call fcn.0040de30
lea eax, [ebp - 0x1a8]
mov dword [ebp - 4], 0
push 0x23
push eax
call fcn.0040e570
mov edi, eax
lea eax, [ebp - 0x120]
mov byte [ebp - 4], 1
push eax
call fcn.0040b540
add esp, 0xc
mov esi, eax
mov ecx, edi
mov byte [ebp - 4], 2
call fcn.0040df60
push eax
mov ecx, esi
call fcn.0040df60
push eax
lea eax, [ebp - 0x98]
push 0x41e384
push eax
call fcn.0040e3b0
add esp, 0x10
lea ecx, [ebp - 0x120]
call fcn.0040de80
lea ecx, [ebp - 0x1a8]
mov byte [ebp - 4], 0
call fcn.0040de80
push 1
push 0
push 0
lea ecx, [ebp - 0x98]
call fcn.0040df60
push eax
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x98]
call fcn.0040de80
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret
Function at 0x4112a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c11b
mov eax, dword fs:[0]
push eax
sub esp, 0x31c
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
push 0xd
push dword [esi + 0x14]
call dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x328]
push eax
call fcn.0040b540
add esp, 4
lea ecx, [ebp - 0x218]
mov dword [ebp - 4], 0
push ecx
mov ecx, eax
call fcn.0040df20
lea ecx, [ebp - 0x328]
movzx esi, al
mov dword [ebp - 4], 0xffffffff
call fcn.0040de80
test esi, esi
je 0x41136d
push 0xffffffffffffffff
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x2a0]
call fcn.0040de00
lea eax, [ebp - 0x2a0]
mov dword [ebp - 4], 1
push eax
call fcn.0040b660
add esp, 4
lea ecx, [ebp - 0x2a0]
call fcn.0040de80
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret
Function at 0x412180
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
push ebx
push dword [ebp + 0xc]
lea ecx, [esi + 0x24]
push edi
call fcn.00416fd0
test eax, eax
je 0x4121b0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp edi, 0x201
ja 0x412290
je 0x412229
mov eax, edi
sub eax, 2
je 0x412200
sub eax, 0x10f
jne 0x4122bb
cmp dword [ebp + 0xc], 0x7e
jne 0x4122bb
push ebx
push 0x7e
push 0x111
push dword [esi + 4]
mov dword [esi + 0x18], eax
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [esi + 0x18]
test eax, eax
je 0x4122bb
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.0040e9f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
movsx eax, bx
lea ecx, [esi + 0x24]
mov dword [ebp + 0x10], eax
mov eax, ebx
shr eax, 0x10
cwde
mov dword [ebp + 8], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
call fcn.00416a50
mov edx, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x10]
cmp ecx, edx
jl 0x412286
mov eax, dword [ebp - 8]
add eax, edx
cmp ecx, eax
jge 0x412286
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp + 8]
cmp edx, ecx
jl 0x412286
mov eax, dword [ebp - 4]
add eax, ecx
cmp edx, eax
jl 0x4122bb
push ebx
push 2
push 0xa1
jmp 0x4122ab
mov eax, edi
sub eax, 0x47b
je 0x4122d0
sub eax, 1
jne 0x4122bb
cmp dword [ebp + 0xc], 0x1f40
jne 0x4122bb
push eax
push eax
push 0x10
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetParent]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push ebx
push dword [ebp + 0xc]
mov ecx, esi
push edi
call fcn.0040e9f0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov ecx, dword [esi + 0x14]
push 0
push ebx
call fcn.00414f50
push dword [ebp + 0xc]
mov ecx, dword [esi + 0x14]
call fcn.00414f30
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x412300
Capabilities:
Create directory
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41c292
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x42c0a4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x420c84
push 0x67
call fcn.0040d2c0
push 0x420c84
push 0x93
mov dword [edi + 0x1c], eax
call fcn.0040d2c0
add esp, 0x10
mov dword [edi + 0x20], eax
call fcn.0040b570
test eax, eax
je 0x412396
lea eax, [ebp - 0xa8]
push eax
call fcn.0040b540
add esp, 4
push 0
mov ecx, eax
mov dword [ebp - 4], 0
call fcn.0040df60
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea ecx, [ebp - 0xa8]
mov dword [ebp - 4], 0xffffffff
call fcn.0040de80
lea eax, [ebp - 0x20]
push eax
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 0x34
call fcn.004188a2
add esp, 4
mov dword [ebp - 0xb0], eax
mov dword [ebp - 4], 1
test eax, eax
je 0x4123c9
mov ecx, eax
call fcn.00414b40
mov ecx, eax
jmp 0x4123cb
xor ecx, ecx
movaps xmm0, xmmword [0x420f70]
sub esp, 0x10
mov eax, esp
mov dword [ebp - 4], 0xffffffff
mov dword [edi + 0x14], ecx
push dword [edi + 4]
movups xmmword [eax], xmm0
call fcn.00414c40
lea eax, [ebp - 0xac]
mov dword [ebp - 0xac], 0
push eax
push 0
push dword [edi + 4]
push 0x412480
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x420c84
push 0x78
mov dword [edi + 0x18], eax
call fcn.0040d2c0
add esp, 8
lea ecx, [edi + 0x24]
push eax
call fcn.004175f0
push 0x1b
push 0x25
push 0
push 0x21f
lea ecx, [edi + 0x24]
call fcn.00417800
push 0
lea ecx, [edi + 0x24]
call fcn.00417770
push dword [edi + 4]
lea ecx, [edi + 0x24]
call fcn.00417580
push 0x1f40
lea ecx, [edi + 0x24]
call fcn.004174e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00418138
mov esp, ebp
pop ebp
ret