joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c410
Capabilities:
Get common file path
Get program files directory

Disassembly:
push 0xffffffffffffffff
push 0x419660
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call sub.MFC42.DLL_CString::CString_1
push 0
lea eax, [esp + 0x18]
push 0x26
mov ebx, 1
push eax
push 0
mov dword [esp + 0x130], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40c501
lea ecx, [esp + 0x14]
lea edx, [esp + 0x10]
push ecx
push 0x4229d0
push edx
call fcn.00402d40
add esp, 0xc
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 2
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x120], bl
call sub.MFC42.DLL_CString::CString
push 0x422a90
push 0x422a8c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace
test eax, eax
je 0x40c4ca
push 0x422a90
push 0x422a8c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace
test eax, eax
jne 0x40c4b3
mov eax, dword [esp + 0x12c]
test eax, eax
je 0x40c4e8
push 0x4242c0
push str.__x86_
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace
mov esi, dword [esp + 0x128]
lea eax, [esp + 8]
push eax
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], ebx
jmp 0x40c518
mov esi, dword [esp + 0x128]
push 0x4242c0
mov ecx, esi
call fcn.004048f8
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret

Function at 0x40c550
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4196a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x110
push ebx
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call sub.MFC42.DLL_CString::CString_1
push 0
lea eax, [esp + 0x18]
push 0x1c
mov ebx, 1
push eax
push 0
mov dword [esp + 0x130], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40c638
mov ecx, dword [esp + 0x12c]
lea edx, [esp + 0x14]
push ecx
push edx
lea eax, [esp + 0x18]
push str._s_s_
push eax
call fcn.00402d40
add esp, 0x10
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x124], 2
call sub.MFC42.DLL_CString::operator
lea ecx, [esp + 0x10]
mov byte [esp + 0x120], bl
call sub.MFC42.DLL_CString::CString
push 0x422a90
push 0x422a8c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace
test eax, eax
je 0x40c612
push 0x422a90
push 0x422a8c
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Replace
test eax, eax
jne 0x40c5fb
mov ecx, dword [esp + 8]
push ecx
call fcn.0040bbc0
mov esi, dword [esp + 0x12c]
add esp, 4
lea edx, [esp + 8]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], ebx
jmp 0x40c64f
mov esi, dword [esp + 0x128]
push 0x4242c0
mov ecx, esi
call fcn.004048f8
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x120], 0
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x118]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x11c
ret
Function at 0x40c680
Capabilities:
Get session information
Get session user name

Disassembly:
push 0xffffffffffffffff
push 0x4196cf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
xor ebx, ebx
push esi
lea ecx, [esp + 0xc]
mov dword [esp + 0x14], ebx
call sub.MFC42.DLL_CString::CString_1
lea eax, [esp + 0x10]
lea ecx, [esp + 8]
push eax
push ecx
push 5
push 0xffffffffffffffff
push ebx
mov dword [esp + 0x34], 1
mov dword [esp + 0x24], ebx
mov dword [esp + 0x1c], ebx
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
mov edx, dword [esp + 8]
lea ecx, [esp + 0xc]
push edx
call sub.MFC42.DLL_CString::operator_1
mov eax, dword [esp + 8]
push eax
call sub.WTSAPI32.dll_WTSFreeMemory
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0x14], 1
lea ecx, [esp + 0xc]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x40ca70
Capabilities:
Encode data using xor

Disassembly:
push ecx
push esi
mov esi, dword [esp + 0x14]
xor ecx, ecx
xor eax, eax
cmp esi, ecx
mov dword [esp + 4], ecx
jle 0x40cab0
push ebx
push edi
mov edi, dword [esp + 0x18]
mov ebx, eax
xor edx, edx
mov dl, byte [ecx + edi]
and ebx, 0xffff
shr ebx, 8
xor edx, ebx
xor ebx, ebx
mov bh, al
mov ax, word [edx*2 + 0x41baf8]
xor ax, bx
inc ecx
cmp ecx, esi
jl 0x40ca88
pop edi
pop ebx
mov esi, dword [esp + 0xc]
and eax, 0xffff
push eax
push str._.4x
push esi
call fcn.00402d40
add esp, 0xc
mov eax, esi
pop esi
pop ecx
ret

Function at 0x40cd20
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4197c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov eax, dword [esp + 0x28]
push esi
lea edx, [esp + 8]
xor esi, esi
push eax
push edx
mov dword [esp + 0xc], esi
call fcn.0040ce00
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x20], esi
mov esi, dword [esp + 0x28]
push ecx
push eax
push esi
call fcn.0040cad0
mov edx, dword [esp + 0x18]
push edx
call sub.MFC42.DLL_operatordelete
mov ecx, dword [esp + 0x28]
add esp, 0x10
mov eax, esi
mov dword fs:[0], ecx
pop esi
add esp, 0x20
ret 0xc
Function at 0x40f573
Capabilities:
Set file attributes

Disassembly:
mov eax, 0x419ad4
call fcn.004180f0
sub esp, 0x120
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [esi + 0xe4], 0xff
jne 0x40f68a
xor ebx, ebx
push 1
cmp byte [ebp + 0xc], bl
pop edi
jne 0x40f649
cmp dword [esi + 0x60], ebx
jne 0x40f5c3
call fcn.0040f339
mov ecx, dword [esi + 0x68]
cmp ecx, dword [eax + 0x14]
je 0x40f5c6
push 0xffffffffffffff9a
mov ecx, esi
call fcn.0040f00b
jmp 0x40f5c6
or edi, 0xffffffff
mov ecx, esi
call fcn.0040f339
cmp word [eax + 0xe], 8
jne 0x40f5dd
lea eax, [esi + 0x28]
push eax
call fcn.004127c0
cmp dword [ebp + 8], ebx
je 0x40f649
lea eax, [ebp + 0xc]
mov dword [ebp - 4], ebx
push eax
call sub.MFC42.DLL_CTime::GetTickCount
mov eax, dword [eax]
mov ecx, esi
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x12c], eax
lea eax, [ebp + 0xc]
mov byte [ebp - 0x11c], bl
push eax
call fcn.0040f339
mov ecx, eax
call fcn.00410541
mov eax, dword [eax]
mov dword [ebp - 0x128], eax
lea eax, [ebp - 0x12c]
push eax
push dword [ebp + 8]
call sub.MFC42.DLL_CFile::SetStatus
mov ecx, esi
call fcn.0040f339
push dword [eax + 0x24]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x40f645
push 0xfffffffffffffffe
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [esi + 0xe8]
call fcn.00411bf1
lea ecx, [esi + 0x6c]
mov byte [esi + 0xe4], bl
call fcn.00411562
mov ecx, esi
call fcn.004100f2
mov eax, edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
xor eax, eax
jmp 0x40f66b

Function at 0x40f890
Capabilities:
Create directory

Disassembly:
mov eax, 0x419b94
call fcn.004180f0
push ecx
push ebx
lea ecx, [ebp + 8]
push dword [ebp + 8]
call fcn.004048f8
and dword [ebp - 4], 0
push 0x422a90
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::TrimRight
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0040f68e
push dword [ebp + 8]
mov eax, dword [eax]
mov byte [ebp - 4], 1
push eax
call dword [sym.imp.MSVCRT.dll__mbscmp]
add esp, 0x10
test eax, eax
je 0x40f8f2
push dword [ebp + 8]
call fcn.0040f966
cmp eax, 0xffffffff
pop ecx
sete al
test al, al
jne 0x40f8f2
xor bl, bl
jmp 0x40f8f4
mov bl, 1
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call sub.MFC42.DLL_CString::CString
test bl, bl
jne 0x40f949
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0040f68e
push dword [eax]
mov byte [ebp - 4], 2
call fcn.0040f890
mov bl, al
add esp, 0xc
neg bl
sbb bl, bl
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
inc bl
call sub.MFC42.DLL_CString::CString
test bl, bl
je 0x40f93a
xor bl, bl
jmp 0x40f94b
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x40f936
mov bl, 1
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov al, bl
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40fdf1
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 8]
push dword [ebp + 8]
push eax
call fcn.0040fe1e
pop ecx
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 2
lea ecx, [ebp + 8]
sete bl
call sub.MFC42.DLL_CString::CString
mov al, bl
pop ebx
pop ebp
ret

Function at 0x40fefe
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push esi
mov esi, ecx
push dword [esp + 8]
push dword [esi + 0x14]
call fcn.00410011
mov dword [esi + 0x14], eax
and eax, 0xff
add eax, dword [esi + 0x18]
mov ecx, esi
imul eax, eax, 0x8088405
inc eax
mov dword [esi + 0x18], eax
shr eax, 0x18
mov byte [esp + 8], al
push dword [esp + 8]
push dword [esi + 0x1c]
call fcn.00410011
mov dword [esi + 0x1c], eax
pop esi
ret 4

Function at 0x412df0
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x412dff
xor eax, eax
pop esi
ret 0xc
mov eax, dword [0x422e08]
test eax, eax
je 0x412e0d
call fcn.00412d90
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
cmp edx, 8
push ebx
not eax
jb 0x412f0f
push edi
mov edi, edx
shr edi, 3
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [ecx*4 + 0x424800]
sub edx, 8
xor eax, ebx
inc esi
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x424800]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x424800]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x424800]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x424800]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov ecx, dword [ecx*4 + 0x424800]
shr eax, 8
xor ecx, eax
inc esi
mov eax, ecx
and eax, 0xff
xor eax, ebx
xor ebx, ebx
mov bl, byte [esi + 1]
mov eax, dword [eax*4 + 0x424800]
shr ecx, 8
xor eax, ecx
inc esi
mov ecx, eax
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x424800]
xor eax, ecx
inc esi
dec edi
jne 0x412e27
pop edi
test edx, edx
je 0x412f31
mov ecx, eax
xor ebx, ebx
mov bl, byte [esi]
and ecx, 0xff
xor ecx, ebx
shr eax, 8
mov ecx, dword [ecx*4 + 0x424800]
xor eax, ecx
inc esi
dec edx
jne 0x412f13
pop ebx
pop esi
not eax
ret 0xc
Function at 0x859058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x8591a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x85907e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85906a
add dl, dl
jne 0x859089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x8590dc
xor eax, eax
add dl, dl
jne 0x859096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x85917d
add dl, dl
jne 0x8590a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8590b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8590bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8590c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x8590d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x859075
mov eax, 1
add dl, dl
jne 0x8590ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x8590f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x8590e1
sub eax, ebx
mov ebx, 1
jne 0x859128
mov ecx, 1
add dl, dl
jne 0x85910e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x859119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x859105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x859075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x85913f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x85914a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x859136
cmp eax, 0x7d00
jae 0x85916d
cmp eax, 0x500
jb 0x859168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x859075
cmp eax, 0x7f
ja 0x859170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x859075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x85919e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x859075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401467
Capabilities:
Hide graphical window

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x74
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0x401000
mov dword [esp + 0x5c], 0
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadIconA]
push edi
push edi
mov dword [esp + 0x60], eax
mov dword [esp + 4], 0x7f00
mov dword [esp], 0
call dword [sym.imp.USER32.dll_LoadCursorA]
push ebp
push ebp
mov dword [esp + 0x64], eax
mov dword [esp + 0x68], 6
mov dword [esp + 0x70], str.imgdlgclass
mov dword [esp + 0x6c], 0
mov dword [esp + 0x54], 0
mov dword [esp + 0x58], 0
lea eax, [esp + 0x4c]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_RegisterClassA]
push eax
mov dword [0x462010], 0
mov dword [0x46200c], 0
mov dword [0x462018], 0xbf
mov dword [0x462014], 0x1fa
mov dword [esp + 8], 0
mov dword [esp + 4], 0x80000000
mov dword [esp], 0x46200c
call dword [sym.imp.USER32.dll_AdjustWindowRect]
sub esp, 0xc
mov esi, dword [0x462014]
sub esi, dword [0x46200c]
mov edi, dword [0x462018]
sub edi, dword [0x462010]
mov dword [esp], 0
mov ebp, dword [sym.imp.USER32.dll_GetSystemMetrics]
call ebp
push edx
sub eax, esi
mov ebx, eax
mov dword [esp], 1
call ebp
push ecx
sub eax, edi
mov ecx, eax
xor ebp, ebp
cmp ebx, 0xffffffff
jl 0x401587
mov ebp, 2
mov eax, ebx
cdq
idiv ebp
mov ebp, eax
xor eax, eax
cmp ecx, 0xffffffff
jl 0x401598
mov ebx, 2
mov eax, ecx
cdq
idiv ebx
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], ebp
mov dword [esp + 0xc], 0x80000000
mov dword [esp + 8], 0
mov eax, dword [esp + 0x70]
mov dword [esp + 4], eax
mov dword [esp], 8
call dword [sym.imp.USER32.dll_CreateWindowExA]
sub esp, 0x30
mov ebx, eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push esi
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_UpdateWindow]
push edx
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
lea ebx, [esp + 0x30]
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_GetMessageA]
sub esp, 0x10
test eax, eax
je 0x401650
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_DispatchMessageA]
push ecx
mov dword [esp], ebx
call dword [sym.imp.USER32.dll_TranslateMessage]
jmp 0x40160e
mov dword [esp + 4], 0
mov eax, dword [esp + 0x70]
mov dword [esp], eax
call dword [sym.imp.USER32.dll_UnregisterClassA]
push eax
push eax
add esp, 0x74
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40610d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x40611c
pop dword [ebp - 0x40]
mov eax, 0x40611c
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x112d77c0
add dword [ebp - 0x50], 0x3d24cd8b
mov dword [ebp - 0x4c], 0x429c6c9c
sub dword [ebp - 0x4c], 0x10692057
mov dword [ebp - 0x48], 0x81077283
sub dword [ebp - 0x48], 0x34bb2e55
mov dword [ebp - 0x44], 0xf309974b
add dword [ebp - 0x44], 0xcf668b5
lea eax, [ebp - 0x50]
push eax
mov eax, 0x12f360f5
add eax, 0xed4d0f6b
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x1191725
sub dword [ebp - 0x50], 0x8ca6adcf
mov dword [ebp - 0x4c], 0xe48a76b9
add dword [ebp - 0x4c], 0x5ce1eabc
mov dword [ebp - 0x48], 0x3d083265
add dword [ebp - 0x48], 0x26673a07
mov dword [ebp - 0x44], 0x9f85cb5e
sub dword [ebp - 0x44], 0x9f85cb5e
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x3c187
push 0
call eax
mov ecx, 0x5df3
xor ebx, ebx
add ebx, eax
mov edx, 0x410000
add edx, dword [ebp - 0x40]
mov edi, 0x7fe9321
add edi, 0x947a8870
xor dword [ebp - 8], ebx
mov esi, dword [edx]
xor dword [ebp - 4], edi
add esi, edi
mov dword [ebp - 8], 0x9c361be
mov dword [ebx], esi
sub dword [ebp - 0x30], esi
add ebx, 0x46012cd1
add ebx, 0xb9fed333
add edx, 0x5af127cc
sub edx, 0x5af127c8
loop 0x40622a
add eax, 0xe5b21d93
sub eax, 0xe5b0b2f4
xor ebx, ebx
add ebx, eax
add eax, 0xbcfc0ff2
add eax, 0x4303f013
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x4065b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40c17c]
jne 0x4065ba
repz ret
jmp fcn.00406941
Function at 0x4023d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4562ec
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x46c5a0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
lea edi, [esi + 0x30]
mov dword [esp + 0x14], 3
mov ecx, dword [edi + 0x10]
test ecx, ecx
je 0x40241f
mov eax, dword [ecx]
mov eax, dword [eax + 0xc]
cmp ecx, edi
setne dl
movzx edx, dl
push edx
call eax
mov dword [edi + 0x10], 0
mov byte [esp + 0x14], 2
mov eax, dword [esi + 0x24]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402443
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x14], 1
mov eax, dword [esi + 0x20]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x402467
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov byte [esp + 0x14], 0
mov eax, dword [esi + 0x1c]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40248b
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov dword [esp + 0x14], 0xffffffff
mov eax, dword [esi + 0x18]
sub eax, 0x10
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x4024b2
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x403df0
Capabilities:
Create process on windows
Terminate process

Disassembly:
sub esp, 0x144
mov eax, dword [0x46c5a0]
xor eax, esp
mov dword [esp + 0x140], eax
push ebx
push ebp
mov ebp, dword [esp + 0x150]
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [esp + 0x51]
push ebx
push eax
mov esi, ecx
mov edi, edx
mov byte [esp + 0x58], bl
call fcn.004323a0
push 0x38
lea ecx, [esp + 0x24]
push ebx
push ecx
call fcn.004323a0
push str.auto
push str.auto
mov dword [esp + 0x30], 0x3c
mov dword [esp + 0x34], 0x40
mov dword [esp + 0x38], ebx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x40], esi
mov dword [esp + 0x44], edi
mov dword [esp + 0x4c], 1
mov dword [esp + 0x50], ebx
mov dword [esp + 0x48], ebx
call fcn.0042f7f0
add esp, 0x20
test eax, eax
jne 0x403ebe
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsRelativeA]
test eax, eax
jne 0x403ec6
push 0x5c
push esi
call fcn.0042d7ca
add esp, 8
test eax, eax
je 0x403ec6
push 0x5c
push esi
call fcn.0042d7ca
sub eax, esi
push eax
push esi
lea edx, [esp + 0x5c]
push 0x104
push edx
call fcn.0042f6ac
lea eax, [esp + 0x64]
add esp, 0x18
mov dword [esp + 0x28], eax
jmp 0x403ec6
mov dword [esp + 0x28], str.auto
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
cmp eax, 1
je 0x403efb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 3
push str.WinExecAndWait32__ShellExecuteEx__u__n
mov esi, 0xc84
mov edi, str.e:_svngsmw_branchesgdca_client_sm2_20120618_application_exedowntoolcodeinc_saturnwin32_util.h
call fcn.0040ecf0
add esp, 0xc
or eax, 0xffffffff
jmp 0x403f34
mov edx, dword [esp + 0x48]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x403f22
mov eax, dword [esp + 0x48]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, 0xfffffff6
jmp 0x403f34
cmp ebp, ebx
je 0x403f32
mov ecx, dword [esp + 0x48]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
xor eax, eax
mov ecx, dword [esp + 0x150]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0042d034
add esp, 0x144
ret

Function at 0x404050
Capabilities:
Get mac address on windows

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
lea eax, [esp + 0xc]
xor ebx, ebx
push eax
push ebx
mov dword [esp + 0x14], ebx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, ebx
je 0x404072
cmp eax, 0x6f
jne 0x4040e1
mov ecx, dword [esp + 0xc]
push ecx
call fcn.0042db60
add esp, 4
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x4040e1
cmp esi, ebx
je 0x4040e1
push edi
xor edi, edi
cmp dword [esi + 0x190], edi
jle 0x4040c6
nop
movzx eax, byte [esi + edi + 0x194]
push eax
lea ecx, [ebx + ebp]
push str._02X
push ecx
call fcn.0042d2e0
inc edi
add esp, 0xc
add ebx, 2
cmp edi, dword [esi + 0x190]
jl 0x4040a0
mov byte [ebx + ebp], 0x7c
mov esi, dword [esi]
inc ebx
test esi, esi
jne 0x404095
pop edi
test ebx, ebx
jle 0x4040e1
pop esi
mov byte [ebx + ebp], 0
pop ebp
mov eax, ebx
pop ebx
pop ecx
ret
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
pop ecx
ret
Function at 0x4044a0
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x456468
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push ebp
push esi
push edi
mov eax, dword [0x46c5a0]
xor eax, esp
push eax
lea eax, [esp + 0x34]
mov dword fs:[0], eax
xor ebx, ebx
xor esi, esi
xor ebp, ebp
mov dword [esp + 0x18], ebx
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebp
mov dword [esp + 0x28], ebx
mov byte [esp + 0x2c], bl
mov edx, dword [esp + 0x48]
lea eax, [esp + 0x18]
push eax
mov eax, dword [esp + 0x48]
push ebx
lea ecx, [esp + 0x24]
push ecx
push ebx
mov dword [esp + 0x4c], ebx
mov ecx, dword [eax]
push edx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x404518
push ebx
call fcn.0042dc2a
add esp, 4
lea eax, [ebx - 0x14]
jmp 0x4045ee
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x40454c
push eax
push 3
push str.RegQueryValueEx_Wrong_type:_u_n
mov esi, 0x20e
mov edi, str.e:_svngsmw_branchesgdca_client_sm2_20120618_application_exedowntoolcodeinc_saturnwin32_util.h
call fcn.0040ecf0
add esp, 0xc
push ebx
call fcn.0042dc2a
add esp, 4
or eax, 0xffffffff
jmp 0x4045ee
mov edi, dword [esp + 0x18]
add edi, 4
cmp edi, ebx
jbe 0x404579
push ebx
call fcn.0042dc2a
add esp, 4
mov ebp, edi
push edi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebp
call fcn.0042db60
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov ecx, dword [esp + 0x48]
lea edx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x48]
push esi
lea eax, [esp + 0x24]
push eax
mov eax, dword [edx]
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x4045ab
push esi
call fcn.0042dc2a
add esp, 4
mov eax, 0xffffffec
jmp 0x4045ee
mov eax, dword [esp + 0x18]
cmp eax, ebp
ja 0x4045b7
mov dword [esp + 0x28], eax
lea esi, [esp + 0x20]
call fcn.00404450
mov ecx, eax
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x4045c5
sub ecx, esi
push ecx
mov ecx, dword [esp + 0x50]
push eax
call fcn.00404d70
cmp byte [esp + 0x2c], bl
jne 0x4045ec
mov ecx, dword [esp + 0x20]
push ecx
call fcn.0042dc2a
add esp, 4
xor eax, eax
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret 0xc