joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408980
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x49ab28
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
mov eax, dword [0x4be0a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
and dword [esp + 0x14], 0xfffffe00
xor eax, eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp + 0xc]
push eax
push ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x38], 1
call fcn.00408720
add esp, 8
test al, al
je 0x408a49
cmp byte [esp + 0x14], 7
jne 0x408a49
push str.value_bool
lea edx, [esp + 0x10]
push edx
mov ecx, 0x4a1966
call fcn.0046a0e5
mov ecx, eax
call fcn.0046a577
test al, al
je 0x408a49
push str.value_bool
lea eax, [esp + 0x10]
push eax
mov ecx, 0x4a1966
call fcn.0046a0e5
mov esi, eax
call fcn.00469704
mov edx, dword [esp + 0x3c]
cmp eax, 1
sete cl
lea esi, [esp + 0xc]
mov byte [edx], cl
mov dword [esp + 0x30], 0xffffffff
call fcn.0046941b
mov al, 1
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret
lea esi, [esp + 0xc]
mov dword [esp + 0x30], 0xffffffff
call fcn.0046941b
xor al, al
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x2c
ret

Function at 0x408b60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0xc]
push edx
push eax
push str.Softwareprojonepodlp_smprule_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 4
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x408baa
cmp dword [esp + 4], 4
jne 0x408baa
mov eax, dword [esp + 8]
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
add esp, 0xc
ret
xor eax, eax
xor ecx, ecx
test eax, eax
setne cl
mov al, cl
add esp, 0xc
ret

Function at 0x408f20
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
mov esi, eax
mov ecx, dword [esi + 0x4a0]
mov eax, dword [ecx]
mov edx, dword [eax + 0x24]
push edi
call edx
mov edi, dword [eax + 0x84]
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
test eax, eax
je 0x408f55
call fcn.00422a4a
test al, al
je 0x408fa7
mov eax, dword [esi]
mov edx, dword [eax + 4]
mov ecx, esi
call edx
test eax, eax
jne 0x408f6b
call fcn.004229cc
test al, al
je 0x408fa7
mov eax, dword [0x4c3154]
mov edx, dword [esi]
push esi
push eax
mov eax, dword [edx]
push 0
push edi
push SysReAllocString
push SysReAllocString
push SysReAllocString
push SysReAllocString
push 0x96000000
push 0
mov ecx, esi
call eax
push eax
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov dword [esi + 4], eax
mov edi, dword [esi + 4]
mov ebx, dword [sym.imp.USER32.dll_GetParent]
push edi
call ebx
test eax, eax
je 0x408fbc
push edi
call ebx
mov edi, eax
mov ecx, dword [esi + 4]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0x86
push edi
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x409430
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
sub esp, 0xb8
mov eax, dword [0x4be0a0]
xor eax, esp
mov dword [esp + 0xb4], eax
mov eax, dword [ecx]
mov edx, dword [eax + 0x2c]
push ebx
push ebp
mov ebp, dword [esp + 0xc4]
push esi
push edi
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], ecx
call edx
mov edx, dword [eax]
mov edx, dword [edx + 8]
lea ecx, [esp + 0x24]
push ecx
mov ecx, eax
call edx
mov eax, dword [eax]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x28]
cmp eax, ecx
je 0x409487
push eax
call fcn.0047db14
add esp, 4
mov esi, dword [ebp + 0x4ec]
add ebp, 0x4e0
cmp esi, dword [ebp + 0x10]
jbe 0x40949d
call fcn.0047db04
mov edi, dword [ebp]
mov ebx, esi
mov esi, dword [ebp + 0x10]
cmp dword [ebp + 0xc], esi
jbe 0x4094af
call fcn.0047db04
mov eax, dword [ebp]
test edi, edi
je 0x4094ba
cmp edi, eax
je 0x4094bf
call fcn.0047db04
cmp ebx, esi
je 0x4095fd
test edi, edi
jne 0x4094ec
call fcn.0047db04
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x4094dc
call fcn.0047db04
mov eax, dword [ebx]
add eax, 0x24
cmp dword [eax + 0x18], 8
jb 0x4094f0
mov eax, dword [eax + 4]
jmp 0x4094f3
mov eax, dword [edi]
jmp 0x4094d2
add eax, 4
push eax
push str.parent__s
lea esi, [esp + 0xb0]
call fcn.0045e820
mov eax, dword [esp + 0xc8]
mov ecx, dword [esp + 0xb4]
add esp, 8
cmp eax, 8
jb 0x40951f
test ecx, ecx
je 0x40954f
mov edx, dword [esp + 0x1c]
test edx, edx
je 0x40954f
cmp eax, 8
mov eax, ecx
jae 0x409535
lea eax, [esp + 0xac]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x40957e
mov eax, dword [esp + 0xc0]
mov ecx, dword [esp + 0xac]
cmp eax, 8
jb 0x40955d
push ecx
call fcn.0047d710
add esp, 4
test edi, edi
jne 0x40957a
call fcn.0047db04
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x409572
call fcn.0047db04
add ebx, 4
jmp 0x4094a2
mov eax, dword [edi]
jmp 0x409568
test edi, edi
jne 0x4095a3
call fcn.0047db04
xor eax, eax
cmp ebx, dword [eax + 0x10]
jb 0x409593
call fcn.0047db04
mov eax, dword [ebx]
add eax, 0x5c
cmp dword [eax + 0x18], 8
jb 0x4095a7
mov esi, dword [eax + 4]
jmp 0x4095aa
mov eax, dword [edi]
jmp 0x409589
lea esi, [eax + 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4095c0
push 2
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4095d6
test al, 1
je 0x4095cf
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebx
push edi
lea edi, [esp + 0x24]
mov esi, ebp
call fcn.00411840
cmp dword [esp + 0xc0], 8
jb 0x4095fd
mov edx, dword [esp + 0xac]
push edx
call fcn.0047d710
add esp, 4
mov edi, dword [esp + 0x18]
mov eax, dword [edi + 0x4ac]
mov ecx, dword [esp + 0x14]
mov esi, dword [eax + 0x658]
mov edx, dword [ecx]
mov eax, dword [edx + 0x2c]
push 0
add esi, 0x1c
call eax
mov ecx, dword [edi + 0x4ac]
mov edx, dword [esi]
push eax
add ecx, 0x658
call edx
mov ecx, edi
call fcn.0040d4c0
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0047d444
add esp, 0xb8
ret 4
Function at 0x40a6b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 0xffffffffffffffff
push 0x49bf38
mov eax, dword fs:[0]
push eax
sub esp, 0x74
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4be0a0]
xor eax, esp
push eax
lea eax, [esp + 0x88]
mov dword fs:[0], eax
mov eax, dword [esp + 0x9c]
cmp eax, 1
jne 0x40a91b
push 6
xor ebx, ebx
mov ebp, 0xf
push str.common
lea ecx, [esp + 0x58]
mov byte [esp + 0x20], al
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
call fcn.00404770
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x54]
mov dword [esp + 0x94], ebx
call fcn.004084f0
add esp, 4
mov esi, 0x10
mov byte [esp + 0x90], 2
cmp dword [esp + 0x68], esi
jb 0x40a749
mov ecx, dword [esp + 0x54]
push ecx
call fcn.0047d710
add esp, 4
push 0xe
push str.AddCustomTools
lea ecx, [esp + 0x74]
mov dword [esp + 0x70], ebp
mov dword [esp + 0x6c], ebx
mov byte [esp + 0x5c], bl
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
call fcn.00404770
lea edx, [esp + 0x9c]
push edx
lea eax, [esp + 0x70]
mov byte [esp + 0x94], 3
push eax
lea ecx, [esp + 0x3c]
mov byte [esp + 0xa4], bl
call fcn.00408980
add esp, 8
test al, al
je 0x40a7b3
cmp byte [esp + 0x9c], bl
je 0x40a7b3
mov eax, 1
jmp 0x40a7b5
xor eax, eax
cmp al, bl
sete byte [esp + 0x9c]
mov byte [esp + 0x90], 2
cmp dword [esp + 0x84], esi
jb 0x40a7dd
mov ecx, dword [esp + 0x70]
push ecx
call fcn.0047d710
add esp, 4
cmp byte [esp + 0x9c], bl
je 0x40a7ef
mov byte [esp + 0x18], bl
jmp 0x40a8a7
and dword [esp + 0x24], 0xfffffe00
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
mov byte [esp + 0x90], 5
push 0xb
push str.CustomTools
lea ecx, [esp + 0x74]
mov dword [esp + 0x8c], ebp
mov dword [esp + 0x88], ebx
mov byte [esp + 0x78], bl
call fcn.00404770
lea edx, [esp + 0x6c]
push edx
lea edi, [esp + 0x20]
lea ecx, [esp + 0x38]
mov byte [esp + 0x94], 6
call fcn.00408a70
add esp, 4
test al, al
sete byte [esp + 0x9c]
cmp dword [esp + 0x84], esi
jb 0x40a86a
mov eax, dword [esp + 0x70]
push eax
call fcn.0047d710
add esp, 4
mov dword [esp + 0x84], ebp
mov dword [esp + 0x80], ebx
mov byte [esp + 0x70], bl
cmp byte [esp + 0x9c], bl
jne 0x40a892
lea eax, [esp + 0x1c]
call fcn.00469dde
test eax, eax
jne 0x40a896
mov byte [esp + 0x18], bl
lea esi, [esp + 0x1c]
mov byte [esp + 0x90], 2
call fcn.0046941b
mov esi, dword [esp + 0x98]
push 1
push str.btnRuleTools
add esi, 0x35c
push esi
call fcn.004235d1
mov ecx, dword [esp + 0x18]
mov edx, dword [eax]
mov edx, dword [edx + 0xe0]
push ecx
mov ecx, eax
call edx
push 1
push str.btnCustomTools
push esi
call fcn.004235d1
mov edi, eax
mov esi, dword [edi]
push str.HideManualTools
add esi, 0xe0
call fcn.00408b60
mov edx, dword [esi]
add esp, 4
test al, al
sete al
movzx ecx, al
push ecx
mov ecx, edi
call edx
lea esi, [esp + 0x34]
mov dword [esp + 0x90], 0xffffffff
call fcn.0046941b
jmp 0x40a92d
cmp eax, 2
jne 0x40a92d
mov eax, dword [esp + 0x98]
push eax
call fcn.00410440
xor eax, eax
mov ecx, dword [esp + 0x88]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x80
ret 8
Function at 0x40bd60
Capabilities:
Set registry value

Disassembly:
sub esp, 0x24
mov eax, dword [0x4be0a0]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
mov ebx, dword [esp + 0x2c]
push esi
push edi
mov edi, ecx
push 1
push 0x4a2074
lea esi, [edi + 0x35c]
push esi
mov byte [edi + 0x14], 0
call fcn.004235d1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xec]
push 1
call eax
push 1
push str.btnRuleTools
push esi
call fcn.004235d1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xec]
push 1
call eax
push 1
push str.btnCustomTools
push esi
call fcn.004235d1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xec]
push 1
call eax
mov eax, ebx
sub eax, 0
je 0x40be3d
sub eax, 1
je 0x40be2a
sub eax, 1
jne 0x40be4a
push edi
mov byte [edi + 0x14], 1
call fcn.0040cc20
mov eax, str.btnCustomTools
push 1
push eax
push esi
call fcn.004235d1
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0xec]
push 0
call eax
push ebx
push 0x4a18c8
lea esi, [esp + 0x18]
call fcn.0045e820
mov edi, 8
add esp, 8
cmp dword [eax + 0x18], edi
jb 0x40be61
mov esi, dword [eax + 4]
jmp 0x40be64
push edi
call fcn.0040f1e0
push edi
call fcn.0040cb00
mov eax, str.btnRuleTools
jmp 0x40bdf2
push edi
call fcn.0040c730
mov eax, 0x4a2074
jmp 0x40bdf2
test ebx, ebx
jne 0x40be55
mov eax, 0x4a2074
jmp 0x40bdf2
cmp ebx, 1
jne 0x40bded
mov eax, str.btnRuleTools
jmp 0x40bdf2
lea esi, [eax + 4]
test esi, esi
je 0x40be71
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
jmp 0x40be73
xor eax, eax
lea ecx, [eax + eax + 2]
push ecx
push esi
push 1
push str._onecli_lastSel
push str.Softwareprojonepodlp_smpcache_
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [esp + 0x28], edi
jb 0x40bea3
mov edx, dword [esp + 0x14]
push edx
call fcn.0047d710
add esp, 4
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047d444
add esp, 0x24
ret 4

Function at 0x40bec0
Capabilities:
Create process on windows

Disassembly:
push esi
push edi
mov edi, eax
cmp dword [edi], 0
mov esi, ecx
mov edx, str.Runas
jne 0x40bed5
mov edx, 0x4a21f8
cmp dword [edi + 0xac], 8
jb 0x40bee6
mov ecx, dword [edi + 0x98]
jmp 0x40beec
lea ecx, [edi + 0x98]
cmp dword [edi + 0x58], 8
jb 0x40bef7
mov eax, dword [edi + 0x44]
jmp 0x40befa
lea eax, [edi + 0x44]
push 1
push 0
push ecx
push eax
push edx
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jge 0x40bf30
cmp dword [edi + 0x58], 8
jb 0x40bf18
mov edi, dword [edi + 0x44]
jmp 0x40bf1b
add edi, 0x44
push edi
push 0x4a2204
push 0x10
mov edi, 0x4a1488
call fcn.0045d104
add esp, 0xc
pop edi
pop esi
ret
Function at 0x412310
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x498118
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push edi
mov eax, dword [0x4be0a0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x3c]
xor edi, edi
push 0xffffffffffffffff
xor eax, eax
push edi
mov word [esp + 0x1c], ax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
call fcn.00402830
mov eax, ebx
mov dword [esp + 0x34], edi
lea edx, [eax + 2]
jmp 0x412370
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x412370
sub eax, edx
sar eax, 1
push eax
push ebx
lea eax, [esp + 0x18]
call fcn.00406c40
push 0xffffffffffffffff
push edi
xor edx, edx
push eax
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
mov eax, esi
mov word [esi + 4], dx
call fcn.00402830
cmp dword [esp + 0x28], 8
jb 0x4123b9
mov eax, dword [esp + 0x14]
push eax
call fcn.0047d710
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
add esp, 0x2c
ret
Function at 0x413790
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x49814b
mov eax, dword fs:[0]
push eax
sub esp, 0x450
mov eax, dword [0x4be0a0]
xor eax, esp
mov dword [esp + 0x44c], eax
push ebx
push ebp
push esi
mov eax, dword [0x4be0a0]
xor eax, esp
push eax
lea eax, [esp + 0x460]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x470]
xor eax, eax
cmp dword [edi + 0x14], 0xc8
mov dword [esp + 0x10], eax
jbe 0x4137fb
xor ecx, ecx
push eax
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x14], eax
mov word [ebx + 4], cx
push 0x4a11bc
jmp 0x413955
push 0x40e
push eax
lea eax, [esp + 0x56]
xor edx, edx
push eax
mov word [esp + 0x58], dx
call fcn.0047f8f0
add esp, 0xc
push 0x208
lea ecx, [esp + 0x50]
push ecx
push str.cachekvstore
xor ecx, ecx
call fcn.0045cf79
push edi
lea ecx, [esp + 0x34]
call fcn.00403040
mov esi, 8
add esp, 4
cmp dword [eax + 0x18], esi
jb 0x413847
mov eax, dword [eax + 4]
jmp 0x41384a
add eax, 4
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push eax
lea edx, [esp + 0x50]
push edx
call ebp
cmp dword [esp + 0x48], esi
jb 0x41386b
mov eax, dword [esp + 0x34]
push eax
call fcn.0047d710
add esp, 4
lea ecx, [esp + 0x4c]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413921
mov eax, 2
lea esi, [esp + 0x30]
call fcn.004130a0
mov dword [esp + 0x468], 0
cmp dword [esp + 0x44], 0
mov esi, 8
je 0x413903
mov eax, dword [esp + 0x34]
cmp dword [esp + 0x48], esi
jae 0x4138b1
lea eax, [esp + 0x34]
push 0x208
push eax
lea edx, [esp + 0x54]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push str.cachekvstore
lea eax, [esp + 0x50]
push eax
call ebp
push edi
lea ecx, [esp + 0x18]
call fcn.00403040
add esp, 4
cmp dword [eax + 0x18], esi
jb 0x4138e5
mov eax, dword [eax + 4]
jmp 0x4138e8
add eax, 4
push eax
lea ecx, [esp + 0x50]
push ecx
call ebp
cmp dword [esp + 0x2c], esi
jb 0x413903
mov edx, dword [esp + 0x18]
push edx
call fcn.0047d710
add esp, 4
mov dword [esp + 0x468], 0xffffffff
cmp dword [esp + 0x48], esi
jb 0x413921
mov eax, dword [esp + 0x34]
push eax
call fcn.0047d710
add esp, 4
xor ecx, ecx
lea eax, [esp + 0x4c]
mov dword [ebx + 0x18], 7
mov dword [ebx + 0x14], 0
mov word [ebx + 4], cx
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x413940
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 0x50]
push edx
mov esi, ebx
call fcn.004028e0
mov eax, ebx
mov ecx, dword [esp + 0x460]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x44c]
xor ecx, esp
call fcn.0047d444
add esp, 0x45c
ret
Function at 0x413990
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x498838
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x4be0a0]
xor eax, esp
mov dword [esp + 0x24], eax
push ebx
push esi
push edi
mov eax, dword [0x4be0a0]
xor eax, esp
push eax
lea eax, [esp + 0x38]
mov dword fs:[0], eax
mov edi, edx
xor ebx, ebx
cmp dword [edi + 0x14], 0xc8
mov esi, ecx
mov dword [esp + 0x14], ebx
jbe 0x4139ee
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x4a16c8
mov byte [esi + 4], bl
call fcn.00404770
jmp 0x413a6a
lea eax, [esp + 0x18]
push eax
call fcn.00413790
add esp, 4
mov dword [esp + 0x40], ebx
mov eax, dword [esp + 0x1c]
mov edi, 8
cmp dword [esp + 0x30], edi
jae 0x413a12
lea eax, [esp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413a44
push ebx
mov dword [esi + 0x18], 0xf
mov dword [esi + 0x14], ebx
push 0x4a16c8
mov ecx, esi
mov byte [esi + 4], bl
call fcn.00404770
cmp dword [esp + 0x30], edi
jb 0x413a6a
mov ecx, dword [esp + 0x1c]
push ecx
jmp 0x413a62
mov ecx, dword [esp + 0x1c]
cmp dword [esp + 0x30], edi
jae 0x413a52
lea ecx, [esp + 0x1c]
call fcn.00413770
cmp dword [esp + 0x30], edi
jb 0x413a6a
mov edx, dword [esp + 0x1c]
push edx
call fcn.0047d710
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x38]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0047d444
add esp, 0x34
ret
Function at 0x413da0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x230
mov eax, dword [0x4be0a0]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetForegroundWindow]
push esi
push edi
mov edi, ecx
push edi
call ebx
mov esi, eax
call fcn.00413bc0
add esp, 4
test eax, eax
je 0x413f4f
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x32]
push ecx
mov word [esp + 0x34], ax
call fcn.0047f8f0
add esp, 0xc
push 0x104
lea edx, [esp + 0x2c]
push edx
push str.wfchost.exe
xor ecx, ecx
call fcn.0045cf79
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413e40
push 0x10
push 0x4a1488
push str.gb0R
call ebx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.0047d444
add esp, 0x230
ret
test edi, edi
jne 0x413e4b
mov eax, str._encrypt
jmp 0x413ec6
cmp edi, 1
jne 0x413e6f
push str.DecryptNeedToApprove
call fcn.00408b60
add esp, 4
test al, al
je 0x413e68
mov eax, str._decrypt
jmp 0x413ec6
mov eax, str._decryptNoReq
jmp 0x413ec6
cmp edi, 2
jne 0x413e7b
mov eax, str._addDocwm
jmp 0x413ec6
cmp edi, 3
jne 0x413e9f
push str.DocwmManualRemoveNeedToApprove
call fcn.00408b60
add esp, 4
test al, al
je 0x413e98
mov eax, str._removeDocwmReq
jmp 0x413ec6
mov eax, str._removeDocwm
jmp 0x413ec6
cmp edi, 4
jne 0x413eab
mov eax, str._usbWriteReq
jmp 0x413ec6
cmp edi, 5
jne 0x413eb7
mov eax, str._burnReq
jmp 0x413ec6
mov eax, str._decMailReq
cmp edi, 6
je 0x413ec6
mov eax, 0x4a11bc
push eax
lea ecx, [esp + 0x2c]
push ecx
push str.__s___s
lea esi, [esp + 0x18]
call fcn.0045e820
mov edi, 8
add esp, 0xc
cmp dword [eax + 0x18], edi
jb 0x413eec
mov eax, dword [eax + 4]
jmp 0x413eef
add eax, 4
push eax
call fcn.0045de99
mov esi, eax
cmp dword [esp + 0x24], edi
jb 0x413f0a
mov edx, dword [esp + 0x10]
push edx
call fcn.0047d710
add esp, 4
xor eax, eax
mov dword [esp + 0x24], 7
mov dword [esp + 0x20], 0
mov word [esp + 0x10], ax
test esi, esi
je 0x413f2a
cmp esi, 0xffffffff
jne 0x413f44
push 0x10
push 0x4a1488
push 0x4a453c
call ebx
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp esi, 0xffffffff
je 0x413f4f
test esi, esi
je 0x413f4f
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047d444
add esp, 0x230
ret
Function at 0x413f80
Capabilities:
Set registry value

Disassembly:
push ecx
push str.AllowSwitchToPersonalMode
call fcn.00408b60
add esp, 4
test al, al
jne 0x413fad
push 0x10
push 0x4a1488
push str.Veu
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop ecx
ret
push esi
push edi
push str.PersonMode
call fcn.00408b60
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
mov esi, dword [sym.imp.USER32.dll_GetForegroundWindow]
add esp, 4
test al, al
jne 0x41400e
push str.PersonalModeNeedToApprove
call fcn.00408b60
add esp, 4
test al, al
je 0x413ff8
push 0x4a45b4
mov edx, str._personmode
mov ecx, str.wfchost.exe
call fcn.004149e0
add esp, 4
pop edi
pop esi
pop ecx
ret
push 0x24
push 0x4a2800
push 0x4a45c8
call esi
push eax
call edi
cmp eax, 6
jne 0x414078
push str.PersonMode
call fcn.00408b60
add esp, 4
push 4
xor ecx, ecx
lea edx, [esp + 0xc]
push edx
test al, al
push 4
sete cl
push str.PersonMode
push str.Softwareprojonepodlp_smprule_
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], ecx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 0
push 0
push 0x503
call esi
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
push str.PersonMode
call fcn.00408b60
add esp, 4
test al, al
jne 0x414078
push 0
push 0x4a23e4
push 0x4a463c
call esi
push eax
call edi
pop edi
pop esi
pop ecx
ret

Function at 0x4149e0
Capabilities:
Check if file exists

Disassembly:
sub esp, 0x228
mov eax, dword [0x4be0a0]
xor eax, esp
mov dword [esp + 0x224], eax
push ebx
mov ebx, dword [esp + 0x230]
push esi
push edi
xor eax, eax
push 0x206
mov esi, ecx
push eax
lea ecx, [esp + 0x32]
push ecx
mov edi, edx
mov word [esp + 0x34], ax
call fcn.0047f8f0
add esp, 0xc
push 0x104
lea edx, [esp + 0x2c]
push edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, eax
call fcn.0045cf79
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x414a7a
push ebx
push str.gb0R_
push 0x10
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, 0x4a1488
mov esi, eax
call fcn.0045d104
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x224]
xor ecx, esp
call fcn.0047d444
add esp, 0x228
ret
test edi, edi
jne 0x414a83
mov edi, 0x4a11bc
push edi
lea ecx, [esp + 0x2c]
push ecx
push str.__s___s
lea esi, [esp + 0x18]
call fcn.0045e820
mov eax, dword [esp + 0x1c]
add esp, 0xc
cmp dword [esp + 0x24], 8
jae 0x414aa9
lea eax, [esp + 0x10]
push eax
call fcn.0045de99
test eax, eax
jne 0x414ad0
push ebx
push 0x4a48fc
push 0x10
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, 0x4a1488
mov esi, eax
call fcn.0045d104
add esp, 0xc
cmp dword [esp + 0x24], 8
jb 0x414ae4
mov edx, dword [esp + 0x10]
push edx
call fcn.0047d710
add esp, 4
mov ecx, dword [esp + 0x230]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047d444
add esp, 0x228
ret
Function at 0x4185e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x497709
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4be0a0]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebx, dword [esp + 0x3c]
mov esi, dword [esp + 0x38]
xor edi, edi
mov dword [esp + 0x30], edi
push esi
mov dword [esp + 0x40], edi
call fcn.00416a60
mov dword [esp + 0x30], edi
mov edi, dword [ebx + 0x10]
mov dword [esp + 0x3c], 1
cmp dword [ebx + 0xc], edi
jbe 0x418638
call fcn.0047db04
mov ebp, dword [ebx + 0xc]
cmp ebp, dword [ebx + 0x10]
jbe 0x418645
call fcn.0047db04
mov eax, dword [esi + 0x18]
mov eax, dword [eax]
mov ecx, dword [esi]
mov edx, eax
mov byte [esp + 0x18], 0
mov eax, dword [esp + 0x18]
push eax
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x44]
push eax
sub esp, 0xc
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], ecx
lea ecx, [esp + 0x34]
mov dword [eax + 8], edx
push edi
push ecx
mov eax, ebp
call fcn.00418740
add esp, 0x20
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret

Function at 0x4189d0
Capabilities:
Create thread

Disassembly:
push esi
mov esi, eax
test edi, edi
je 0x418a2e
test esi, esi
jne 0x4189e4
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov esi, eax
push 8
call fcn.0047dbf1
add esp, 4
push 0
push 0
push eax
push 0x418ac0
push 0
push 0
mov dword [eax + 4], edi
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
test esi, esi
je 0x418a1e
cmp esi, 0xffffffff
je 0x418a2e
push 0x1f4
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp esi, 0xffffffff
je 0x418a2e
test esi, esi
je 0x418a2e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret