joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4199c4
Capabilities:
Set registry value

Disassembly:
push 0x50
mov eax, 0x437f2e
call fcn.00425694
xor ebx, ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
push 4
call fcn.00405497
pop ecx
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 2
cmp eax, ebx
je 0x4199f4
push eax
call fcn.00412190
jmp 0x4199f6
xor eax, eax
mov byte [ebp - 4], 1
mov dword [0x452378], eax
push dword [eax]
call fcn.00406b99
pop ecx
mov dword [ebp - 4], ebx
jmp 0x419a18
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea esi, [ebp + 8]
call fcn.0041bfdd
push eax
push 1
push str.DisplayIcon
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAdvanced_System_Repair_Pro
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, str.NotifUpdate
call fcn.00403204
mov byte [ebp - 4], 4
push dword [0x452378]
mov byte [ebp - 4], bl
call fcn.00409963
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, str.FirstScanDone
call fcn.00403204
mov byte [ebp - 4], 5
push dword [0x452378]
mov byte [ebp - 4], bl
call fcn.00409963
push ebx
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push eax
mov ecx, str.LastDriverFix
call fcn.00403204
mov byte [ebp - 4], 6
push dword [0x452378]
mov byte [ebp - 4], bl
call fcn.00409963
mov byte [ebp - 4], 7
cmp byte [ebp + 0xc], bl
je 0x419b41
lea eax, [ebp - 0x5c]
push eax
call fcn.00409138
mov byte [ebp - 4], 8
push 0x27
lea eax, [ebp - 0x14]
push eax
call fcn.00414708
mov esi, eax
mov byte [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
call fcn.00409138
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x2c]
push eax
call fcn.00409138
mov byte [ebp - 4], 0xb
mov esi, dword [esi]
push 0xf003f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
je 0x419b0e
push eax
push esi
call fcn.004027e9
pop ecx
pop ecx
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x2c]
push eax
call fcn.0041a8b4
mov byte [ebp - 4], 9
lea eax, [ebp - 0x44]
push eax
call fcn.0041a8b4
mov byte [ebp - 4], 8
lea ecx, [ebp - 0x14]
call fcn.00411213
mov byte [ebp - 4], 7
lea eax, [ebp - 0x5c]
push eax
call fcn.0041a8b4
mov dword [ebp - 4], ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00411213
call fcn.00425739
ret
Function at 0x41d119
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x437ff6
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x44dd60]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
xor ebx, ebx
xor esi, esi
inc ebx
mov dword [esp + 0x10], esi
cmp dword [ebp + 0xc], esi
je 0x41d158
mov ecx, dword [ebp + 0xc]
jmp 0x41d16d
lea eax, [esp + 0x18]
push eax
call fcn.0040fbd7
pop ecx
mov dword [esp + 0x30], esi
mov ecx, dword [eax]
mov dword [esp + 0x10], ebx
lea eax, [esp + 0x14]
push eax
call fcn.00403204
mov dword [esp + 0x30], 2
test byte [esp + 0x10], bl
je 0x41d193
and dword [esp + 0x10], 0xfffffffe
lea ecx, [esp + 0x18]
call fcn.00411213
cmp byte [ebp + 8], 0
je 0x41d23e
push dword [esp + 0x14]
push dword [ebp + 8]
call fcn.00418b17
pop ecx
pop ecx
test al, al
jne 0x41d249
lea eax, [esp + 0x20]
push eax
mov ecx, 0x441fa4
call fcn.00403204
mov byte [esp + 0x30], 3
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
push ecx
mov esi, eax
call fcn.0041e1f3
mov byte [esp + 0x38], 4
lea ecx, [esp + 0x20]
push str.___minimize
push ecx
mov esi, eax
call fcn.004039e0
add esp, 0x10
mov byte [esp + 0x30], 6
lea ecx, [esp + 0x1c]
call fcn.00411213
mov byte [esp + 0x30], 7
lea ecx, [esp + 0x20]
call fcn.00411213
mov ecx, dword [esp + 0x18]
mov eax, dword [ecx - 0xc]
add eax, eax
push eax
push ecx
push ebx
push 0x441bb4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
call fcn.00411213
jmp 0x41d26b
push dword [ebp + 0xc]
push esi
call fcn.00418b17
pop ecx
pop ecx
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edi, 0x441bb4
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push esi
push SysReAllocString
call ebx
push edi
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call ebx
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00411213
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41dd57
Capabilities:
Get token privileges

Disassembly:
push 0x20
mov eax, 0x436882
call fcn.00425661
lea eax, [ebp - 0x10]
push eax
xor edi, edi
push 0x28
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41de17
lea eax, [ebp - 0x2c]
push eax
call fcn.004035f1
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
jne 0x41dd9c
call fcn.00424448
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
sub eax, esi
push eax
push esi
push 3
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x41dde3
xor ecx, ecx
cmp dword [esi], edi
jbe 0x41ddd3
lea eax, [esi + 0xc]
mov dword [eax], 2
inc ecx
add eax, 0xc
cmp ecx, dword [esi]
jb 0x41ddc5
push edi
push edi
push dword [ebp - 0x14]
push esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 1
cmp dword [ebp - 0x20], edi
je 0x41de01
push dword [ebp - 0x20]
call fcn.00412549
pop ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.00407cad
call fcn.00425739
ret
Function at 0x420a2b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [esi + 0x2c]
push edi
mov edi, dword [esi + 0x3c]
sub edi, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub edi, eax
lea ecx, [ebx + ecx - 0x106]
mov dword [ebp - 8], edi
cmp eax, ecx
jb 0x420aba
mov eax, dword [esi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00423b50
mov eax, dword [esi + 0x4c]
mov ecx, dword [esi + 0x44]
sub dword [esi + 0x70], ebx
sub dword [esi + 0x6c], ebx
add esp, 0xc
sub dword [esi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x420a7a
mov eax, dword [esi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x420a9c
add edi, ebx
mov dword [ebp - 8], edi
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x420b78
mov eax, dword [esi + 0x74]
add eax, dword [esi + 0x6c]
mov ecx, dword [edi + 4]
add eax, dword [esi + 0x38]
mov edx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], ecx
cmp ecx, edx
jbe 0x420ae2
mov dword [ebp - 4], edx
mov edx, dword [ebp - 4]
test edx, edx
jne 0x420aed
xor eax, eax
jmp 0x420b39
sub ecx, edx
mov dword [edi + 4], ecx
mov ecx, dword [edi + 0x1c]
mov ecx, dword [ecx + 0x18]
cmp ecx, 1
jne 0x420b0a
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.0042137b
jmp 0x420b1a
cmp ecx, 2
jne 0x420b23
push edx
push dword [edi]
push dword [edi + 0x30]
call fcn.00422cad
mov dword [edi + 0x30], eax
mov eax, dword [ebp - 0xc]
add esp, 0xc
push dword [ebp - 4]
push dword [edi]
push eax
call fcn.00423b50
mov eax, dword [ebp - 4]
add dword [edi], eax
add esp, 0xc
add dword [edi + 8], eax
add dword [esi + 0x74], eax
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x420b64
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [esi + 0x58]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x420b78
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x420a38
pop edi
pop ebx
leave
ret
Function at 0x423088
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x44dd60]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x423120
push 0x43ed64
push 4
push eax
call fcn.00424724
push eax
call fcn.0040ce5d
add esp, 0x10
push ebx
push edi
call fcn.004257ec
mov edi, dword [eax]
call fcn.004257ec
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00425789
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004257ec
cmp dword [eax], ebx
je 0x423137
call fcn.004257ec
push dword [eax]
call fcn.004030d0
pop ecx
jmp 0x42313e
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x4230cb
jmp 0x4231c5
call fcn.004257ec
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x4231c1
cmp dword [ebp - 0x234], esi
jae 0x4231c1
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.00423ad0
add esp, 0xc
push 0x43e974
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x4231b0
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x4231b0
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x4231b0
push ebx
push ebx
push esi
jmp 0x4231b9
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x4231c3
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00405be1
leave
ret
Function at 0x430062
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00428113
and dword [ebp - 4], 0
cmp dword [0x451fe0], 0
mov ebx, eax
jne 0x430113
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4301c4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4301c4
push eax
call fcn.004280a1
mov dword [esp], 0x44035c
push edi
mov dword [0x451fe0], eax
call esi
push eax
call fcn.004280a1
mov dword [esp], 0x440348
push edi
mov dword [0x451fe4], eax
call esi
push eax
call fcn.004280a1
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x451fe8], eax
call esi
push eax
call fcn.004280a1
pop ecx
mov dword [0x451ff0], eax
test eax, eax
je 0x430113
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004280a1
pop ecx
mov dword [0x451fec], eax
mov eax, dword [0x451fec]
cmp eax, ebx
je 0x43016b
cmp dword [0x451ff0], ebx
je 0x43016b
push eax
call fcn.0042811c
push dword [0x451ff0]
mov esi, eax
call fcn.0042811c
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43016b
test edi, edi
je 0x43016b
call esi
test eax, eax
je 0x430162
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x430162
test byte [ebp - 0xc], 1
jne 0x43016b
or dword [ebp + 0x10], 0x200000
jmp 0x4301a4
mov eax, dword [0x451fe4]
cmp eax, ebx
je 0x4301a4
push eax
call fcn.0042811c
pop ecx
test eax, eax
je 0x4301a4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4301a4
mov eax, dword [0x451fe8]
cmp eax, ebx
je 0x4301a4
push eax
call fcn.0042811c
pop ecx
test eax, eax
je 0x4301a4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x451fe0]
call fcn.0042811c
pop ecx
test eax, eax
je 0x4301c4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4301c6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4012f4
Capabilities:
Encode data using xor

Disassembly:
push 0x40264c
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
jne 0x401358
xchg ebp, eax
sub eax, 0x46e0f45a
mov ebx, 0xaabc2d44
mov ebx, 0xc978
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov ecx, 0x31ccb3a4
add byte [eax], al
add byte [eax], al
add byte [eax], al
add bh, bh
int3
dec eax
mov edi, 0x241c714c
test byte [edx], bh
pop esp
cmp cl, byte [edi - 0x53]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
adc al, 0x12
add byte [eax], al
xchg ebp, eax
pop es
add byte [eax], al
add byte [0x726f4600], al
insd dword es:[edi], dx
xor dword [eax], eax
or eax, 0xb6000d01
loopne 0x40136c
stosb byte es:[edi], al
sub eax, 0xdecfdece
xlatb
aam 0xb6
scasd eax, dword es:[edi]
add byte [ebx], al
sar bh, 0xc0
add byte [ecx], bl
add dword [eax], eax
inc edx
add byte [esi], bl
adc byte [eax], al
add byte [eax + 0x73e23], al
add byte [esp + esi*2], ch
add byte [esi], dh
pop es
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add eax, dword [eax]
and byte [eax], ah
add al, byte [eax]
add byte [eax], al
add byte [eax], al
xor byte [ecx], al
add byte [eax], al
add byte ss:[eax], al
add byte [eax], ah
and byte [eax], cl
add byte [eax], al
add byte [eax], al
add al, ch
add al, byte [eax]
add byte [esi + 1], ah
add byte [eax], al
and byte [eax], ah
adc byte [eax], al
add byte [eax], al
add byte [eax], al
call 0x4e401409
add al, 0
add byte [eax], ch
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
add dword [eax], eax
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
invalid
Function at 0x41c998
Capabilities:
Hash data with md5
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
push 0xf0000000
push 1
push 0
push 0
push ebx
call sub.ADVAPI32.DLL_CryptAcquireContextA
add esp, 0xc
test eax, eax
je 0x41c9d4
sub esp, 0xc
lea eax, [ebx + 4]
push eax
push 0
push 0
push 0x8003
push dword [ebx]
call sub.ADVAPI32.DLL_CryptCreateHash
add esp, 0xc
mov ebx, dword [ebp - 4]
leave
ret

Function at 0x401750
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
enter 0xfffffffffffffa0d, 0xffffffffffffffc0
inc eax
add byte [eax - 0x7d], dl
rol dword [eax + 0x68], 0xf9
rol byte [eax - 0x4a], cl
push ecx
call dword [sym.imp.WSOCK32.dll_select]
push ebp
lodsb al, byte [esi]
add dh, byte [edi + 0xcc48300]
test eax, eax
stosd dword es:[edi], eax
invalid

Function at 0x403e34
Capabilities:
Encode data using xor

Disassembly:
pop esi
push esi
xor dword [esi], ebx
lodsd eax, dword [esi]
add ebx, eax
test eax, eax
jne 0x403e36
ret
Function at 0x401370
Capabilities:
Clear file content
Write file on windows

Disassembly:
sub esp, 8
cmp dword [0x442328], 0
push esi
je 0x401387
mov eax, 1
pop esi
add esp, 8
ret
cmp dword [0x442344], 8
mov esi, dword [0x442330]
jae 0x40139b
mov esi, 0x442330
call fcn.00401e40
mov dword [0x442328], eax
mov eax, dword [0x442308]
cmp eax, 0xffffffff
je 0x4013c5
call fcn.00401ea0
mov eax, dword [0x442308]
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [0x442308]
mov byte [esp + 4], 0xff
mov byte [esp + 5], 0xfe
cmp eax, 0xffffffff
je 0x4013f1
push 0
lea ecx, [esp + 0xc]
push ecx
push 2
lea edx, [esp + 0x10]
push edx
push eax
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x442328]
pop esi
add esp, 8
ret

Function at 0x401400
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4338b0
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x43fdf0]
xor eax, esp
mov dword [esp + 0x4c], eax
push ebx
push esi
mov eax, dword [0x43fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x60]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov esi, ecx
mov dword [esp + 0x54], 7
mov dword [esp + 0x50], ebx
mov word [esp + 0x40], ax
lea ecx, [esp + 0x10]
push ecx
mov dword [esp + 0x6c], ebx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x1c]
movzx eax, word [esp + 0x1a]
movzx ecx, word [esp + 0x18]
push esi
push edx
movzx edx, word [esp + 0x1e]
push eax
movzx eax, word [esp + 0x1e]
push ecx
movzx ecx, word [esp + 0x20]
push edx
push eax
push ecx
push str.__4d__.2d__.2d__.2d:_.2d:_.2d___s_r_n
lea esi, [esp + 0x40]
call fcn.00401ff0
add esp, 0x20
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [esp + 0x48]
mov byte [esp + 0x74], 1
call fcn.00401580
mov esi, 8
mov byte [esp + 0x68], bl
cmp dword [esp + 0x38], esi
jb 0x4014c0
mov edx, dword [esp + 0x24]
push edx
call fcn.00422a1a
add esp, 4
call fcn.00401370
test eax, eax
je 0x4014fa
mov ecx, dword [esp + 0x40]
cmp dword [esp + 0x54], esi
jae 0x4014d7
lea ecx, [esp + 0x40]
mov eax, dword [0x442308]
cmp eax, 0xffffffff
je 0x4014fa
push ebx
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x58]
add edx, edx
push edx
push ecx
push eax
mov dword [esp + 0x20], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [esp + 0x54], esi
jb 0x40150d
mov eax, dword [esp + 0x40]
push eax
call fcn.00422a1a
add esp, 4
mov ecx, dword [esp + 0x60]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x4c]
xor ecx, esp
call fcn.00422e00
mov esp, ebp
pop ebp
ret
Function at 0x401900
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x433878
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x43fdf0]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.00401580
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x401960
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00401a30
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00401580
cmp dword [esp + 0x28], 8
jb 0x4019ad
mov eax, dword [esp + 0x14]
push eax
call fcn.00422a1a
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret

Function at 0x403e80
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0xc], ecx
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00403200
push eax
lea ecx, [ebp - 4]
call fcn.00403cb0
push 1
push 0xf060
lea ecx, [ebp - 4]
call fcn.00403d00
push 0
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00403280
cmp dword [ebp - 0xc], 0
je 0x403ecc
mov eax, dword [ebp - 0xc]
add eax, 4
mov dword [ebp - 0x10], eax
jmp 0x403ed3
mov dword [ebp - 0x10], 0
push 1
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00411290
add esp, 8
push 0x80
mov ecx, 0x441214
call fcn.004031d0
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x28], eax
push 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [eax + 0x28]
push ecx
mov ecx, dword [ebp - 0xc]
add ecx, 4
call fcn.00403250
push 0
push 0
mov edx, dword [ebp - 0xc]
mov eax, dword [edx + 4]
push eax
push 0x4042a0
push 0
push 0
call fcn.00422f9d
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword [ecx + 0x24], eax
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x4411fc], eax
mov dword [ebp - 8], 1
lea ecx, [ebp - 4]
call fcn.00403cd0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404120
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x54], ecx
push 0
mov ecx, dword [ebp - 0x54]
add ecx, 4
call fcn.004048f0
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040ddb0
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x28]
call fcn.00404bb0
cmp eax, 1
jne 0x404196
mov ecx, dword [0x441200]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 4]
push edx
push 0x4042a0
push 0
push 0
call fcn.00422f9d
add esp, 0x18
mov ecx, dword [ebp - 0x54]
mov dword [ecx + 0x24], eax
jmp 0x404210
lea ecx, [ebp - 0x4c]
call fcn.0040d910
push 0
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
lea ecx, [ebp - 0x4c]
call fcn.00404dd0
cmp eax, 1
jne 0x4041cc
push 0
push 0
push 0x404
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x404208
mov ecx, dword [0x441200]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x54]
mov eax, dword [edx + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0
mov ecx, dword [ebp - 0x54]
mov edx, dword [ecx + 4]
push edx
push 0x4042a0
push 0
push 0
call fcn.00422f9d
add esp, 0x18
mov ecx, dword [ebp - 0x54]
mov dword [ecx + 0x24], eax
lea ecx, [ebp - 0x4c]
call fcn.0040d930
mov dword [ebp - 0x50], 0
lea ecx, [ebp - 0x28]
call fcn.0040dde0
mov eax, dword [ebp - 0x50]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x404350
Capabilities:
Check if file exists
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x43fdf0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x434810]
mov dword [ebp - 0x10], eax
mov ecx, dword [0x434814]
mov dword [ebp - 0xc], ecx
mov dx, word [0x434818]
mov word [ebp - 8], dx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x404391
mov al, 1
jmp 0x404475
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0x14]
call fcn.00404910
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x14]
call fcn.004049b0
lea ecx, [ebp - 0x14]
call fcn.00403550
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00405b40
add esp, 8
test eax, eax
je 0x404418
mov dword [ebp - 0x18], 0
jmp 0x4043d4
mov ecx, dword [ebp - 0x18]
add ecx, 1
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0x64
jge 0x404418
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 0x14]
call fcn.00403550
push eax
call fcn.004059c0
add esp, 8
lea ecx, [ebp - 0x14]
call fcn.00403550
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00405b40
add esp, 8
test eax, eax
jne 0x40440a
jmp 0x404418
lea ecx, [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x14]
call fcn.004049b0
jmp 0x4043cb
push 0
mov edx, dword [ebp + 8]
push edx
lea ecx, [ebp - 0x14]
call fcn.00403550
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x404466
lea ecx, [ebp - 0x14]
call fcn.00403550
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x404455
mov byte [ebp - 0x19], 1
lea ecx, [ebp - 0x14]
call fcn.00403180
mov al, byte [ebp - 0x19]
jmp 0x404475
mov byte [ebp - 0x1a], 0
lea ecx, [ebp - 0x14]
call fcn.00403180
mov al, byte [ebp - 0x1a]
jmp 0x404475
mov byte [ebp - 0x1b], 1
lea ecx, [ebp - 0x14]
call fcn.00403180
mov al, byte [ebp - 0x1b]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00422e00
mov esp, ebp
pop ebp
ret