joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a1c4
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x413b40]
call fcn.0040e4da
mov edi, eax
test edi, edi
je 0x40a226
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x40a1ed
push dword [esp + 0xc]
push edi
call eax
jmp 0x40a226
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.0040f200
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.DLL_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.0040f320
pop esi
pop ebx
pop edi
ret 8

Function at 0x40a54f
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x130
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_GetVersionExA]
lea eax, [ebp - 0x1c]
push eax
mov ebx, 0xc8
mov dword [ebp - 0x1c], 0x94
call edi
test eax, eax
je 0x40a638
mov eax, dword [ebp - 0xc]
dec eax
je 0x40a61b
dec eax
jne 0x40a638
lea eax, [ebp - 0xb8]
push eax
xor esi, esi
mov dword [ebp - 0xb8], 0x9c
call edi
test eax, eax
je 0x40a5ae
cmp byte [ebp - 0x1e], 1
jne 0x40a5ae
inc esi
mov eax, dword [ebp - 0x18]
sub eax, 3
je 0x40a617
dec eax
je 0x40a613
dec eax
je 0x40a5f1
dec eax
jne 0x40a638
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x40a5e5
dec eax
je 0x40a5d9
dec eax
jne 0x40a638
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x5f]
jmp 0x40a638
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x55]
jmp 0x40a638
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x4b]
jmp 0x40a638
mov eax, dword [ebp - 0x14]
sub eax, 0
je 0x40a60f
dec eax
je 0x40a60b
dec eax
jne 0x40a638
neg esi
sbb esi, esi
and esi, 0xfffffffb
lea ebx, [esi + 0x41]
jmp 0x40a638
push 0x3c
jmp 0x40a637
push 0x32
jmp 0x40a637
push 0x14
jmp 0x40a637
push 5
jmp 0x40a637
cmp dword [ebp - 0x14], 0
je 0x40a635
cmp dword [ebp - 0x14], 0xa
je 0x40a631
cmp dword [ebp - 0x14], 0x5a
jne 0x40a638
push 0x28
jmp 0x40a637
push 0x1e
jmp 0x40a637
push 0xa
pop ebx
pop edi
pop esi
mov eax, ebx
pop ebx
add ebp, 0x78
leave
ret
Function at 0x40b5a1
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push esi
push edi
call dword [sym.imp.USER32.DLL_GetFocus]
mov esi, dword [sym.imp.USER32.DLL_GetKeyState]
mov edi, eax
mov bl, pe_nt_image_headers32
test edi, edi
je 0x40b61d
push 9
call esi
test bl, al
je 0x40b61d
push 0x11
call esi
test bl, al
jne 0x40b61d
push 0x10
call esi
test bl, al
jne 0x40b61d
push 0x12
call esi
test bl, al
jne 0x40b61d
push 5
lea eax, [esp + 0x14]
push eax
push edi
call dword [sym.imp.USER32.DLL_GetClassNameA]
push 4
lea eax, [esp + 0x14]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x40b61d
push eax
push eax
push 0x44e
push edi
call dword [sym.imp.USER32.DLL_SendMessageA]
test eax, 0x800
jne 0x40b61d
xor eax, eax
jmp 0x40b69f
push ebp
mov ebp, dword [esp + 0x20]
test ebp, ebp
je 0x40b646
push 0x11
call esi
test bl, al
jne 0x40b63e
push 0x10
call esi
test bl, al
jne 0x40b63e
push 0x12
call esi
test bl, al
je 0x40b646
push 1
push ebp
call fcn.0040b55a
mov esi, dword [sym.imp.USER32.DLL_GetPropA]
test edi, edi
je 0x40b65c
push str.PB_Hotkey
push edi
call esi
test eax, eax
jne 0x40b69c
push str.PB_WindowID
push ebp
call esi
mov esi, eax
test esi, esi
je 0x40b69c
lea eax, [esp + 0x10]
push eax
push ebp
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
test eax, eax
je 0x40b69c
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcessId]
cmp dword [esp + 0x10], eax
jne 0x40b69c
dec esi
push esi
push dword [0x413b48]
call fcn.0040e4da
test eax, eax
je 0x40b69c
mov eax, dword [eax + 8]
jmp 0x40b69e
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xc
ret 4

Function at 0x40b761
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
push edi
push str.msimg32.dll
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xor edi, edi
mov dword [0x413a1c], eax
cmp eax, edi
je 0x40b794
push str.AlphaBlend
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x413a20], eax
lea eax, [ebp - 0x1c]
push eax
mov dword [0x413a18], 1
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.DLL_GetVersionExA]
test eax, eax
je 0x40b7d2
cmp dword [ebp - 0xc], 1
je 0x40b7e3
cmp dword [ebp - 0xc], 2
jne 0x40b7d2
cmp dword [ebp - 0x18], 5
jb 0x40b7e3
jne 0x40b7d2
cmp dword [ebp - 0x14], edi
jne 0x40b7d2
mov dword [0x413a18], edi
cmp dword [0x413a18], edi
je 0x40b7e9
call fcn.0040b6a8
test eax, eax
jne 0x40b7e9
mov dword [0x413a18], edi
pop edi
add ebp, 0x78
leave
ret

Function at 0x40c48e
Capabilities:
Delete file
Set file attributes

Disassembly:
cmp dword [esp + 4], 0
je 0x40c4b7
test byte [esp + 8], 2
je 0x40c4ab
push pe_nt_image_headers32
push dword [esp + 8]
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesA]
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
jmp 0x40c4b9
xor eax, eax
ret 8
Function at 0x40c4ca
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
cmp dword [ebp + 8], 0
je 0x40c53a
push 0x104
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call sub.MSVCRT.dll_strncpy
lea eax, [ebp - 0x108]
push eax
mov byte [ebp - 4], 0
call sub.MSVCRT.dll_strlen
add esp, 0x10
lea eax, [ebp + eax - 0x108]
jmp 0x40c51c
mov dl, byte [eax - 1]
cmp dl, 0x20
je 0x40c51b
cmp dl, 0x5c
je 0x40c51b
cmp dl, 0x2f
jne 0x40c526
dec eax
lea ecx, [ebp - 0x108]
cmp eax, ecx
ja 0x40c509
mov byte [eax], 0
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
jmp 0x40c53c
xor eax, eax
leave
ret 4

Function at 0x40c610
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
xor eax, eax
mov dword [esp + 4], eax
cmp dword [esi + 0x14], eax
jne 0x40c645
mov ecx, dword [esi + 8]
sub ecx, dword [esi + 0xc]
mov edx, dword [esi + 4]
push eax
lea eax, [esp + 8]
push eax
mov eax, dword [esi]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov ecx, dword [esi + 8]
mov eax, dword [esp + 4]
mov dword [esi + 0xc], ecx
pop esi
pop ecx
ret 4

Function at 0x40c9f0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test esi, esi
je 0x40ca37
cmp byte [esi], al
je 0x40ca37
mov eax, dword [esp + 0xc]
mov ecx, dword [0x413be8]
push eax
push ecx
call fcn.0040e4da
test eax, eax
je 0x40ca65
cmp dword [eax + 4], 0
mov ecx, esi
push edi
lea edi, [ecx + 1]
je 0x40ca40
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40ca25
sub ecx, edi
push ecx
push esi
push eax
call fcn.0040cbb0
pop edi
pop esi
pop ecx
ret 8
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40ca40
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
sub ecx, edi
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 8
mov eax, dword [esp + 4]
pop esi
pop ecx
ret 8

Function at 0x40ca70
Capabilities:
Write file on windows

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0x10]
xor eax, eax
mov dword [esp + 4], eax
test edi, edi
je 0x40cac9
push esi
mov esi, dword [esp + 0x18]
test esi, esi
je 0x40cac8
mov eax, dword [esp + 0x10]
mov ecx, dword [0x413be8]
push eax
push ecx
call fcn.0040e4da
test eax, eax
je 0x40cac4
cmp dword [eax + 4], 0
je 0x40cab2
push esi
push edi
push eax
call fcn.0040cbb0
pop esi
pop edi
pop ecx
ret 0xc
mov eax, dword [eax]
push 0
lea edx, [esp + 0xc]
push edx
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret 0xc
Function at 0x40cad0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
mov ecx, dword [0x413be8]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0040e4da
mov esi, eax
test esi, esi
je 0x40cb97
mov ecx, dword [esp + 0x14]
push ebp
mov ebp, dword [sym.imp.KERNEL32.DLL_WriteFile]
test ecx, ecx
je 0x40cb4f
cmp byte [ecx], 0
je 0x40cb4f
cmp dword [esi + 4], 0
mov eax, ecx
push edi
lea edi, [eax + 1]
je 0x40cb37
nop
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40cb20
sub eax, edi
push eax
push ecx
push esi
call fcn.0040cbb0
mov dword [esp + 0xc], eax
jmp 0x40cb4e
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40cb37
push 0
lea edx, [esp + 0x10]
push edx
sub eax, edi
push eax
mov eax, dword [esi]
push ecx
push eax
call ebp
pop edi
cmp dword [esi + 4], 0
je 0x40cb72
push 2
push 0x411504
push esi
call fcn.0040cbb0
mov ecx, eax
mov eax, dword [esp + 8]
pop ebp
add eax, ecx
pop esi
add esp, 8
ret 8
mov edx, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 2
push 0x411504
push edx
call ebp
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 8]
pop ebp
add eax, ecx
pop esi
add esp, 8
ret 8
mov eax, dword [esp + 4]
pop esi
add esp, 8
ret 8

Function at 0x40cbb0
Capabilities:
Write file on windows

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0xc]
cmp dword [esi + 0x14], 1
push edi
mov dword [esp + 8], 0
jne 0x40cbe5
mov eax, dword [esi + 0xc]
mov ecx, dword [esi]
push 1
push 0
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0xc], edx
mov ecx, dword [esi + 0xc]
mov edi, dword [esp + 0x18]
cmp ecx, edi
jle 0x40cc5a
mov eax, dword [esi + 8]
add eax, dword [esi + 4]
sub eax, ecx
mov ecx, edi
dec ecx
je 0x40cc47
dec ecx
je 0x40cc32
sub ecx, 2
je 0x40cc1f
mov ecx, dword [esp + 0x14]
push edi
push ecx
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov ecx, dword [edx]
mov dword [eax], ecx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cx, word [edx]
mov word [eax], cx
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
mov edx, dword [esp + 0x14]
mov cl, byte [edx]
mov byte [eax], cl
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
push esi
call fcn.0040c610
mov eax, dword [esi + 8]
cmp edi, eax
jl 0x40cc87
mov eax, dword [esp + 0x14]
mov ecx, dword [esi]
push 0
lea edx, [esp + 0xc]
push edx
push edi
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
mov eax, dword [esp + 8]
pop edi
pop esi
pop ecx
ret 0xc
mov ecx, dword [esi + 4]
sub ecx, dword [esi + 0xc]
mov edx, dword [esp + 0x14]
push edi
push edx
add ecx, eax
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
sub dword [esi + 0xc], edi
mov eax, edi
pop edi
pop esi
pop ecx
ret 0xc
Function at 0x40d8d0
Capabilities:
Encode data using xor
Hash data with crc32
Read file on windows

Disassembly:
sub esp, 0x14
mov eax, dword [esp + 0x18]
push ebx
push esi
or esi, 0xffffffff
xor ebx, ebx
mov dword [esp + 8], 0x80000
test eax, eax
je 0x40dade
push edi
push ebx
push pe_nt_image_headers32
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
mov dword [esp + 0x1c], edi
cmp edi, 0xffffffff
je 0x40dadd
mov eax, dword [0x41343c]
push ebp
push 0x80000
push ebx
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x40dad5
cmp dword [esp + 0x30], ebx
jl 0x40d951
mov eax, dword [esp + 0x2c]
jg 0x40d942
test eax, eax
je 0x40d951
push 0
lea ecx, [esp + 0x34]
push ecx
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov edx, dword [esp + 0x34]
add edx, 0x80000
mov dword [esp + 0x28], edx
jmp 0x40d965
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub dword [esp + 0x28], 0x80000
add ebx, 0x80000
and eax, ecx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x40d99d
mov eax, ebx
cdq
cmp edx, ecx
jl 0x40d99d
jg 0x40d995
cmp eax, dword [esp + 0x34]
jbe 0x40d99d
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ebp
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
mov ebx, dword [esp + 0x18]
mov eax, ebp
mov edx, ebx
cmp ebx, 8
jb 0x40da9c
mov edi, ebx
shr edi, 3
jmp 0x40d9d0
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
mov dword [esp + 0x1c], ecx
mov ecx, esi
mov esi, dword [esp + 0x1c]
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 1]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 2]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 3]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 4]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 5]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 6]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 7]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
add eax, 8
sub edx, 8
dec edi
mov esi, ecx
jne 0x40d9d0
mov edi, dword [esp + 0x20]
test edx, edx
je 0x40dab9
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x411550]
inc eax
dec edx
jne 0x40daa0
cmp ebx, 0x80000
je 0x40d961
mov edx, dword [0x41343c]
push ebp
push 0
push edx
call dword [sym.imp.KERNEL32.DLL_HeapFree]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
pop edi
mov eax, esi
pop esi
not eax
pop ebx
add esp, 0x14
ret 0x14

Function at 0x40db10
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x2e33058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x2e331a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x2e3307e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2e3306a
add dl, dl
jne 0x2e33089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2e330dc
xor eax, eax
add dl, dl
jne 0x2e33096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x2e3317d
add dl, dl
jne 0x2e330a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2e330b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2e330bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2e330c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x2e330d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x2e33075
mov eax, 1
add dl, dl
jne 0x2e330ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x2e330f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2e330e1
sub eax, ebx
mov ebx, 1
jne 0x2e33128
mov ecx, 1
add dl, dl
jne 0x2e3310e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2e33119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2e33105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2e33075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x2e3313f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x2e3314a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x2e33136
cmp eax, 0x7d00
jae 0x2e3316d
cmp eax, 0x500
jb 0x2e33168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2e33075
cmp eax, 0x7f
ja 0x2e33170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x2e33075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x2e3319e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x2e33075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x4026e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push str.SOFTWAREMicrosoftInternet_ExplorerActiveX_Compatibility
mov edx, 0x7ffffffe
mov eax, 0x200
lea ecx, [ebp - 0x204]
call fcn.00401000
mov edx, 0x200
lea eax, [ebp - 0x204]
cmp byte [eax], 0
je 0x402723
inc eax
dec edx
jne 0x402718
jmp 0x40274b
test edx, edx
je 0x40274b
mov ecx, 0x200
sub ecx, edx
mov eax, 0x200
sub eax, ecx
push 0x4b17dc
lea ecx, [ebp + ecx - 0x204]
mov edx, 0x7fffffff
call fcn.00401000
mov eax, 0x200
lea ecx, [ebp - 0x204]
cmp byte [ecx], 0
je 0x402761
inc ecx
dec eax
jne 0x402756
jmp 0x402788
test eax, eax
je 0x402788
mov ecx, 0x200
sub ecx, eax
mov eax, dword [ebp + 8]
push eax
mov eax, 0x200
sub eax, ecx
lea ecx, [ebp + ecx - 0x204]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, dword [0x4c6444]
lea ecx, [ebp - 0x208]
push ecx
push edx
push 0
lea eax, [ebp - 0x204]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4027f2
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp - 0x208]
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x214]
push eax
push 0
push str.Compatibility_Flags
push ecx
mov dword [ebp - 0x210], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x402802
mov edx, dword [ebp - 0x208]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x208]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20c]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret

Function at 0x4029f0
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x1ff
lea eax, [ebp - 0x203]
push 0
push eax
mov byte [ebp - 0x204], 0
call fcn.004a3190
push 0x1ff
lea ecx, [ebp - 0x403]
push 0
push ecx
mov byte [ebp - 0x404], 0
call fcn.004a3190
mov eax, dword [0x4c78c4]
add esp, 0x18
push 0
push 0x1c
lea edx, [ebp - 0x204]
push edx
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
lea ecx, [ebp - 0x204]
push ecx
push str._sMicrosoftEdge
lea edx, [ebp - 0x404]
push 0x104
push edx
call fcn.00402830
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x402a9a
test al, 0x10
je 0x402a9a
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
Function at 0x404840
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x330
mov eax, dword [0x4c32cc]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x10
push str.UpdateCookieFile
push str.SoftwareBillP_StudiosWinPatrolOptions
lea ecx, [ebp - 0x14]
mov edx, 0x80000001
call fcn.0048e050
add esp, 0xc
test eax, eax
je 0x4049ae
lea eax, [ebp - 0x14]
push eax
call fcn.004a02f9
add esp, 4
test eax, eax
jle 0x4049ae
push 0x104
lea edx, [ebp - 0x330]
mov ecx, 0xb
call fcn.00499890
add esp, 4
push 0
lea ecx, [ebp - 0x330]
push ecx
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
jne 0x4049ae
lea ecx, [ebp - 0x120]
call fcn.00403450
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [ebp - 0x120]
mov edx, esi
push edx
call edi
cmp byte [eax + esi - 1], 0x5c
jne 0x4048e9
mov eax, esi
push eax
call edi
mov byte [eax + esi - 1], 0
lea ecx, [ebp - 0x120]
push ecx
mov edx, 0x7ffffffe
mov eax, 0x104
lea ecx, [ebp - 0x228]
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x120]
cmp byte [eax], 0
je 0x40491b
inc eax
dec edx
jne 0x404910
jmp 0x404943
test edx, edx
je 0x404943
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.cookies.txt
lea ecx, [ebp + ecx - 0x120]
mov edx, 0x7fffffff
call fcn.00401000
mov edx, 0x104
lea eax, [ebp - 0x228]
mov edi, edi
cmp byte [eax], 0
je 0x40495b
inc eax
dec edx
jne 0x404950
jmp 0x404983
test edx, edx
je 0x404983
mov ecx, 0x104
sub ecx, edx
mov eax, 0x104
sub eax, ecx
push str.cookiesnew.txt
lea ecx, [ebp + ecx - 0x228]
mov edx, 0x7fffffff
call fcn.00401000
push 0
lea edx, [ebp - 0x120]
push edx
lea eax, [ebp - 0x228]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a01d6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004a01d6
mov esp, ebp
pop ebp
ret

Function at 0x40bd10
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x40bd3d
push esi
push edi
jmp 0x40bd20
movzx esi, byte [edx]
movzx esi, byte [esi + 0x4b1fe0]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x40bd20
pop edi
pop esi
ret
Function at 0x40bda0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [esi*8]
push edi
mov edi, dword [ebp + 8]
cmp eax, 0x400
jbe 0x40bdc2
mov esi, 0x80
cmp esi, dword [edi]
jne 0x40bdcf
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [0x4d2bb0]
test eax, eax
je 0x40bdda
call eax
lea ecx, [esi*8]
push ecx
call fcn.00408240
mov esi, eax
mov eax, dword [0x4d2bb4]
add esp, 4
mov dword [ebp - 4], esi
test eax, eax
je 0x40bdfa
call eax
test esi, esi
je 0x40bdc6
mov edx, dword [edi + 0xc]
push edx
call fcn.00408510
add esp, 4
push esi
mov dword [edi + 0xc], esi
call dword [0x4c4958]
mov ebx, eax
shr ebx, 3
add esp, 4
lea eax, [ebx*8]
push eax
push 0
push esi
mov dword [ebp + 0xc], ebx
mov dword [edi], ebx
call fcn.004a3190
mov ecx, dword [edi + 8]
add esp, 0xc
mov dword [edi + 8], 0
test ecx, ecx
je 0x40bedf
mov edx, dword [ecx + 0x10]
mov esi, dword [ecx + 0xc]
xor eax, eax
test edx, edx
jle 0x40be73
movzx edi, byte [esi]
movzx edi, byte [edi + 0x4b1fe0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc esi
test edx, edx
jg 0x40be52
mov ebx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov edx, dword [ecx]
mov dword [ebp - 8], edx
xor edx, edx
div ebx
mov eax, dword [ebp - 4]
lea eax, [eax + edx*8]
test eax, eax
je 0x40bebb
mov esi, dword [eax]
test esi, esi
je 0x40be91
mov edx, dword [eax + 4]
jmp 0x40be93
xor edx, edx
inc esi
mov dword [eax], esi
mov dword [eax + 4], ecx
test edx, edx
je 0x40bebb
mov dword [ecx], edx
mov eax, dword [edx + 4]
mov dword [ecx + 4], eax
mov eax, dword [edx + 4]
test eax, eax
je 0x40beb3
mov dword [eax], ecx
mov dword [edx + 4], ecx
jmp 0x40bed4
mov dword [edi + 8], ecx
mov dword [edx + 4], ecx
jmp 0x40bed4
mov edx, dword [edi + 8]
mov dword [ecx], edx
mov eax, dword [edi + 8]
test eax, eax
je 0x40beca
mov dword [eax + 4], ecx
mov dword [ecx + 4], 0
mov dword [edi + 8], ecx
mov ecx, dword [ebp - 8]
test ecx, ecx
jne 0x40be46
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40bfe0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0xc], 0
je 0x40c025
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov edx, esi
test esi, esi
jle 0x40c01f
push ebx
lea esp, [esp]
movzx edi, byte [ecx]
movzx edi, byte [edi + 0x4b1fe0]
lea ebx, [eax*8]
xor edi, ebx
dec edx
xor eax, edi
inc ecx
test edx, edx
jg 0x40c000
mov edi, dword [ebp + 8]
pop ebx
xor edx, edx
div dword [edi]
jmp 0x40c027
xor edx, edx
mov eax, dword [ebp + 0xc]
push esi
push eax
mov eax, edi
call fcn.0040bef0
add esp, 8
pop edi
test eax, eax
je 0x40c040
mov eax, dword [eax + 8]
pop ebp
ret
xor eax, eax
pop ebp
ret