joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40136b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, dword [ebp + 8]
push edi
push 0x13
pop ecx
push 5
mov esi, str.SOFTWARETencent_bugReportQQExternal
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
pop ecx
mov esi, str.QQExternal
lea edi, [ebp - 0x1c]
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0x288], eax
lea eax, [ebp - 0x278]
push eax
push 0x20019
movsw word es:[edi], word [esi]
xor esi, esi
push esi
lea eax, [ebp - 0x68]
push eax
push 0x80000001
mov dword [ebp - 0x278], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4014e7
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ebx
push 4
pop ebx
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x284]
push eax
lea eax, [ebp - 0x274]
push eax
push esi
push str.auto
push dword [ebp - 0x278]
mov dword [ebp - 0x284], esi
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x274], esi
call edi
test eax, eax
jne 0x4014da
cmp dword [ebp - 0x274], ebx
jne 0x4014da
cmp dword [ebp - 0x284], 1
jne 0x4014da
lea eax, [ebp - 0x27c]
push eax
lea eax, [ebp - 0x280]
push eax
lea eax, [ebp - 0x274]
push eax
push esi
push str.version
push dword [ebp - 0x278]
mov dword [ebp - 0x280], esi
mov dword [ebp - 0x27c], ebx
mov dword [ebp - 0x274], esi
call edi
push 0x206
lea eax, [ebp - 0x26e]
push esi
push eax
mov word [ebp - 0x270], si
call sub.MSVCR80.dll_memset
add esp, 0xc
push 0x104
lea eax, [ebp - 0x270]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0xffffffffffffffff
call dword [sym.imp.Common.dll_unsigned_long_int___cdecl_TXLog::GetSession_void_]
push eax
call dword [sym.imp.Common.dll_unsigned_long_int___cdecl_NLS::GetLCID_void_]
push eax
push 1
push 1
push dword [ebp - 0x280]
lea eax, [ebp - 0x270]
push esi
push esi
push dword [ebp - 0x288]
push eax
lea eax, [ebp - 0x1c]
push eax
push eax
call dword [sym.imp.Common.dll_void___cdecl_TXBugReport::InitBugReport_wchar_t_const___wchar_t_const___wchar_t_const___wchar_t_const___unsigned_short_int__unsigned_short_int__unsigned_long_int__int__int__unsigned_long_int__unsigned_long_int__int____stdcall___struct_TXBugReport::tagBugReportInfo___char_const___char_const___wchar_t_const___wchar_t_const___void____unsigned_long_int___void___]
push 3
call dword [sym.imp.Common.dll_int___cdecl_TXBugReport::SetBugReportFlag_unsigned_long_int_]
add esp, 0x34
call dword [sym.imp.Common.dll_void___cdecl_TXBugReport::ValidateBugReport_void_]
push dword [ebp - 0x278]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
inc eax
pop esi
call fcn.00401f15
leave
ret

Function at 0x401f15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x401f1f
repz ret
jmp fcn.004022d8
Function at 0x401154
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegDisablePredefinedCacheEx]
xor esi, esi
call edi
add byte [esi + 0x4228d0], 0x23
call edi
add byte [esi + 0x4228d0], 0xf
call edi
xor byte [esi + 0x4228d0], 0x4f
call edi
add byte [esi + 0x4228d0], 0xfb
call edi
add byte [esi + 0x4228d0], 0x72
call edi
add byte [esi + 0x4228d0], 0x42
call edi
add byte [esi + 0x4228d0], 0x83
call edi
xor byte [esi + 0x4228d0], 0xcb
call edi
add byte [esi + 0x4228d0], 0xd1
call edi
add byte [esi + 0x4228d0], 0x16
call edi
xor byte [esi + 0x4228d0], 0x82
call edi
add byte [esi + 0x4228d0], 0x1e
call edi
add byte [esi + 0x4228d0], 0xec
call edi
add byte [esi + 0x4228d0], 0xfe
call edi
add byte [esi + 0x4228d0], 0xaf
call edi
add byte [esi + 0x4228d0], 0x41
call edi
xor byte [esi + 0x4228d0], 0x93
call edi
add byte [esi + 0x4228d0], 7
call edi
add byte [esi + 0x4228d0], 0xe7
call edi
add byte [esi + 0x4228d0], 0xf7
call edi
add byte [esi + 0x4228d0], 0x38
call edi
add byte [esi + 0x4228d0], 0xa4
call edi
add byte [esi + 0x4228d0], 0x59
call edi
add byte [esi + 0x4228d0], 0xcb
call edi
add byte [esi + 0x4228d0], 0xc4
call edi
xor byte [esi + 0x4228d0], 0xe
call edi
add byte [esi + 0x4228d0], 0xc7
call edi
add byte [esi + 0x4228d0], 0x2d
call edi
add byte [esi + 0x4228d0], 0x8f
call edi
add byte [esi + 0x4228d0], 0x28
call edi
add byte [esi + 0x4228d0], 0xac
call edi
xor byte [esi + 0x4228d0], 0x6f
call edi
xor byte [esi + 0x4228d0], 0xb2
call edi
xor byte [esi + 0x4228d0], 0x67
call edi
add byte [esi + 0x4228d0], 0x3f
call edi
add byte [esi + 0x4228d0], 0x68
call edi
xor byte [esi + 0x4228d0], 0xe4
call edi
add byte [esi + 0x4228d0], 0xcb
call edi
add byte [esi + 0x4228d0], 0x53
call edi
xor byte [esi + 0x4228d0], 6
call edi
add byte [esi + 0x4228d0], 0x86
call edi
xor byte [esi + 0x4228d0], 0xc1
call edi
add byte [esi + 0x4228d0], 0xdf
call edi
xor byte [esi + 0x4228d0], 0xdf
call edi
add byte [esi + 0x4228d0], 0x51
call edi
xor byte [esi + 0x4228d0], 0xd2
call edi
add byte [esi + 0x4228d0], 0xc0
call edi
add byte [esi + 0x4228d0], 0xe9
call edi
add byte [esi + 0x4228d0], 0x9f
inc esi
cmp esi, 0x2b800
jb 0x40115e
pop edi
pop esi
ret
Function at 0x4035f2
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
sub esp, 0x120
lea ebp, [esp - 4]
mov eax, dword [0x420450]
xor eax, ebp
mov dword [ebp + 0x120], eax
push 0x20
mov eax, 0x41a6f5
call fcn.0040ed07
mov edi, dword [ebp + 0x12c]
mov esi, 0x104
xor ebx, ebx
push esi
lea eax, [ebp + 0x1c]
push ebx
push eax
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], esi
call fcn.0040e3c0
add esp, 0xc
push ebx
lea ecx, [ebp]
mov byte [ebp - 0xd], 1
mov dword [ebp + 0x18], 0xf
call fcn.004024db
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov dword [ebp - 4], ebx
jmp 0x4036d0
cmp byte [ebp - 0xd], bl
je 0x40368a
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.004033b6
mov byte [ebp - 0xd], bl
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
cmp eax, 1
jne 0x4036b5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x1c]
push eax
lea ecx, [ebp]
call fcn.004033b6
inc dword [ebp - 0x14]
lea eax, [ebp - 0x20]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x1c]
push eax
push dword [ebp - 0x14]
mov dword [ebp - 0x18], esi
push dword [ebp - 0x24]
call edi
test eax, eax
je 0x40366a
mov eax, dword [ebp - 0x14]
cmp dword [0x42176c], eax
jne 0x4036f7
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
jae 0x4036ed
lea eax, [ebp + 4]
push eax
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebx
push 1
lea ecx, [ebp]
call fcn.00402ed1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x120]
xor ecx, ebp
call fcn.0040e43a
add ebp, 0x124
leave
ret 4
Function at 0x4062e6
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
ret 8

Function at 0x406334
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
mov ebx, ecx
test esi, esi
jne 0x406345
push 0xd
pop eax
jmp 0x40636f
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x406348
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x4066b4
Capabilities:
Create thread

Disassembly:
cmp byte [0x4217c2], 1
jne 0x406701
push edi
xor edi, edi
cmp dword [0x4217c4], edi
jne 0x406700
push esi
push 0x4217c4
push edi
push edi
push 0x4064f9
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
cmp esi, edi
jne 0x4066eb
mov dword [0x4217c4], edi
jmp 0x4066ff
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x4066ff
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop edi
ret

Function at 0x406fd1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
push eax
xor esi, esi
push 1
push esi
push str.SoftwareIntelDisplayigfxcuiigfxcfg
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40702c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.DCRotationCaps
push dword [ebp - 4]
mov dword [ebp - 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0xc], 1
pop esi
sete al
leave
ret
Function at 0x4073da
Capabilities:
Get geographical location
Identify system language via api
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push esi
movzx eax, ax
push esi
push 3
push eax
mov dword [ebp - 0xc], eax
call edi
mov ebx, eax
lea eax, [ebx + 1]
push eax
call fcn.0040c6a9
pop ecx
push ebx
push eax
push 3
push dword [ebp - 0xc]
mov dword [ebp - 8], eax
call edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push str.SoftwareIntelDisplayigfxcuihkcmd_resources
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40745f
push ebx
push dword [ebp - 8]
push 1
push esi
push str.UserLangID
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 8], esi
pop edi
pop esi
pop ebx
je 0x407470
push dword [ebp - 8]
call fcn.0040c910
pop ecx
leave
ret

Function at 0x4078eb
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x9c]
sub esp, 0x11c
mov eax, dword [0x420450]
xor eax, ebp
mov dword [ebp + 0x98], eax
mov eax, dword [ebp + 0xa4]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x70]
mov dword [ebp - 0x78], eax
mov dword [ebp - 0x70], esi
mov dword [ebp - 0x6c], esi
call fcn.004062a5
mov ebx, eax
cmp ebx, esi
je 0x40795b
lea ecx, [ebp - 0x70]
call fcn.00406230
mov eax, ebx
mov ecx, dword [ebp + 0x98]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040e43a
add ebp, 0x9c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x407973
lea eax, [ebp - 0x68]
push eax
lea ecx, [ebp - 0x70]
call fcn.004078eb
cmp eax, esi
jne 0x4079a5
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x68]
push eax
push esi
push dword [ebp - 0x70]
mov dword [ebp - 0x74], 0x100
call ebx
test eax, eax
je 0x407963
lea ecx, [ebp - 0x70]
call fcn.00406230
push dword [ebp - 0x78]
mov ecx, edi
call fcn.004061d5
lea ecx, [ebp - 0x70]
mov esi, eax
call fcn.00406230
mov eax, esi
jmp 0x407941
Function at 0x40ae40
Capabilities:
Check os version

Disassembly:
push 0xa0
mov eax, 0x41abdb
call fcn.0040ed70
mov ebx, dword [ebp + 8]
and dword [ebp - 0xa8], 0
mov dword [ebp - 0xac], ebx
xor edi, edi
lea eax, [ebp + 0xc]
inc edi
push eax
mov ecx, ebx
mov dword [ebp - 4], edi
call fcn.00403373
push 0x94
lea eax, [ebp - 0xa4]
push 0
push eax
mov dword [ebp - 0xa8], edi
call fcn.0040e3c0
add esp, 0xc
lea eax, [ebp - 0xa4]
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x94], 2
jne 0x40aed0
cmp dword [ebp - 0xa0], 5
jne 0x40aed0
push str.Global_
mov ecx, ebx
call fcn.004033b6
push 0xffffffffffffffff
push 0
lea eax, [ebp + 0xc]
push eax
mov ecx, ebx
call fcn.004030b9
push 0
push edi
lea ecx, [ebp + 0xc]
call fcn.00402ed1
mov eax, ebx
call fcn.0040edba
ret

Function at 0x40b1bb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
mov byte [ebp - 1], 1
cmp dword [0x4217d0], ebx
jne 0x40b1f8
push 0x4217d0
push ebx
push ebx
push 0x40aee3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
jne 0x40b1f1
mov dword [0x4217d0], ebx
mov byte [ebp - 1], bl
jmp 0x40b1f8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, byte [ebp - 1]
pop ebx
leave
ret
Function at 0x40e43a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x420450]
jne 0x40e444
repz ret
jmp fcn.004103c1

Function at 0x415d30
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0041135c
and dword [ebp - 4], 0
cmp dword [0x4222c0], 0
mov ebx, eax
jne 0x415de1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x415e92
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x415e92
push eax
call fcn.004112ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4222c0], eax
call esi
push eax
call fcn.004112ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4222c4], eax
call esi
push eax
call fcn.004112ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4222c8], eax
call esi
push eax
call fcn.004112ea
pop ecx
mov dword [0x4222d0], eax
test eax, eax
je 0x415de1
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004112ea
pop ecx
mov dword [0x4222cc], eax
mov eax, dword [0x4222cc]
cmp eax, ebx
je 0x415e39
cmp dword [0x4222d0], ebx
je 0x415e39
push eax
call fcn.00411365
push dword [0x4222d0]
mov esi, eax
call fcn.00411365
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x415e39
test edi, edi
je 0x415e39
call esi
test eax, eax
je 0x415e30
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x415e30
test byte [ebp - 0xc], 1
jne 0x415e39
or dword [ebp + 0x10], 0x200000
jmp 0x415e72
mov eax, dword [0x4222c4]
cmp eax, ebx
je 0x415e72
push eax
call fcn.00411365
pop ecx
test eax, eax
je 0x415e72
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x415e72
mov eax, dword [0x4222c8]
cmp eax, ebx
je 0x415e72
push eax
call fcn.00411365
pop ecx
test eax, eax
je 0x415e72
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4222c0]
call fcn.00411365
pop ecx
test eax, eax
je 0x415e92
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x415e94
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41f74d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x218
push ebx
push esi
push edi
mov esi, ecx
push fcn.004171c0
push 0x401210
push 5
lea eax, [esi + 0x1f38]
push 4
push eax
mov dword [esp + 0x34], esi
call fcn.00408a8a
mov ecx, dword [0x4285b4]
lea edi, [esi + 0x1f4c]
mov dword [esp + 0x22c], 0
mov dword [edi], ecx
mov edx, dword [0x4285b4]
lea ebx, [esi + 0x1f50]
mov dword [ebx], edx
lea eax, [esp + 0x124]
mov byte [esp + 0x22c], 2
push eax
push 0xff
mov dword [esi], 0x4217c4
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x1a]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x16]
and edx, 0xffff
push edx
mov edx, dword [esp + 0x18]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x14]
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x1a]
push edx
mov edx, dword [esp + 0x22]
and eax, 0xffff
and ecx, 0xffff
push eax
and edx, 0xffff
push ecx
push edx
lea eax, [esp + 0x40]
push str._02d_02d_04d__02d_02d_02d_03d.BMP
push eax
call fcn.00408a38
add esp, 0x24
lea ecx, [esp + 0x124]
push ecx
mov ecx, edi
call fcn.004172fd
lea edx, [esp + 0x24]
mov ecx, edi
push edx
call fcn.004174dc
mov eax, dword [esp + 0x1a]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x16]
and eax, 0xffff
and ecx, 0xffff
push eax
mov eax, dword [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
and edx, 0xffff
and eax, 0xffff
push edx
mov edx, dword [esp + 0x1a]
and ecx, 0xffff
push eax
push ecx
mov eax, dword [esp + 0x26]
and edx, 0xffff
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x40]
push str._02d_02d_04d__02d_02d_02d_03d.JPG
push ecx
call fcn.00408a38
add esp, 0x24
lea edx, [esp + 0x124]
mov ecx, ebx
push edx
call fcn.004172fd
lea eax, [esp + 0x24]
mov ecx, ebx
push eax
call fcn.004174dc
push 0
push 0
push 1
push 0
mov dword [esi + 0x1f58], 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push 0x1f2c
mov dword [esi + 0x1f54], eax
call fcn.00417668
mov ecx, dword [esp + 0x23c]
mov dword [esi + 4], eax
mov eax, dword [esp + 0x238]
add esp, 4
test eax, eax
mov dword [esi + 0x1f5c], eax
mov dword [esi + 0x1f60], ecx
mov dword [esi + 0x1f64], 0x3c
mov dword [esi + 8], 0
je 0x4011e5
push ecx
mov ecx, esi
call fcn.00403590
mov ecx, dword [esp + 0x224]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x224
ret 8
Function at 0x401240
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x41f794
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov dword [esp + 0x10], esi
mov dword [esi], 0x4217c4
mov ecx, dword [esi + 8]
mov dword [esp + 0x1c], 2
test ecx, ecx
je 0x401282
mov eax, dword [ecx]
push 1
call dword [eax]
mov dword [esi + 8], 0
mov eax, dword [esi + 0x1f4c]
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edi, [esi + 0x1f4c]
push eax
call ebx
mov eax, dword [esi + 0x1f50]
lea ebp, [esi + 0x1f50]
push eax
call ebx
mov ecx, ebp
mov byte [esp + 0x1c], 1
call fcn.004171c0
mov ecx, edi
mov byte [esp + 0x1c], 0
call fcn.004171c0
push fcn.004171c0
push 5
add esi, 0x1f38
push 4
push esi
mov dword [esp + 0x2c], 0xffffffff
call fcn.0040895a
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x403390
Capabilities:
Capture webcam image

Disassembly:
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x1f54]
push eax
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0
push 0
push 0
push 0
push esi
push 0x4034f0
call fcn.004177df
mov eax, dword [esi + 0x1f58]
test eax, eax
jne 0x4033d9
push 0
push 0
push 1
push 1
push 0
push 0
push 0
push 0
call sub.AVICAP32.dll_capCreateCaptureWindowA
mov dword [esi + 0x1f58], eax
mov ecx, dword [esi + 0x1f58]
push ebx
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
push ecx
call ebx
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x40345c
mov edx, dword [esi + 0x1f58]
push 0
push 0
push 0x40a
push edx
call edi
test eax, eax
je 0x40345c
mov eax, dword [esi + 0x1f58]
push eax
call ebx
test eax, eax
je 0x403428
mov ecx, dword [esi + 0x1f58]
push 0
push 0
push 0x43d
push ecx
call edi
mov edx, dword [esi + 0x1f58]
push edx
call ebx
test eax, eax
je 0x403451
lea ecx, [esi + 0x1f4c]
call fcn.004175b2
push eax
mov eax, dword [esi + 0x1f58]
push 0
push 0x419
push eax
call edi
lea ecx, [esi + 0x1f4c]
call fcn.004175c4
mov ecx, dword [esi + 0x1f58]
push ecx
call ebx
test eax, eax
pop ebx
je 0x403492
mov edx, dword [esi + 0x1f58]
push 0
push 0
push 0x40b
push edx
call edi
mov edi, eax
mov eax, dword [esi + 0x1f54]
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, edi
pop edi
pop esi
ret 4
mov eax, dword [esi + 0x1f54]
xor edi, edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, edi
pop edi
pop esi
ret 4
Function at 0x403710
Capabilities:
Accept command line arguments
Get common file path

Disassembly:
sub esp, 0x304
push ebx
push ebp
push esi
mov esi, dword [esp + 0x314]
mov ebp, ecx
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
mov dword [ebp], 0x421858
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
call fcn.00417668
mov ebx, dword [esp + 0x320]
mov dword [0x429ed0], eax
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
call fcn.00417668
mov dword [0x429ed4], eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [0x429ed0]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [0x429ed0]
push ecx
call fcn.0041640b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [0x429ed4]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [0x429ed4]
push eax
call fcn.0041640b
mov ecx, dword [esp + 0x330]
add esp, 0x10
lea edx, [esp + 0x114]
xor ebx, ebx
push 0xff
push edx
mov dword [0x428130], ecx
push ebx
mov dword [ebp + 0xc], ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [esp + 0x14]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov byte [esp + ecx + 0x13], bl
lea ecx, [esp + 0x114]
push 0x5c
push ecx
call fcn.00409300
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
lea esi, [esp + 0x21c]
lea edi, [edx + 1]
mov dword [esp + 0x18], esi
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x18]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x21c]
mov byte [edx], bl
push ecx
call fcn.0041640b
add esp, 0xc
push str.flash
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.00409280
add esp, 8
lea edx, [esp + 0x14]
push edx
call fcn.00403f70
cmp eax, 0x20
jg 0x403888
mov ecx, ebp
mov dword [ebp + 0xc], 1
call fcn.00403a50
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x304
ret 0xc
Function at 0x403a50
Capabilities:
Get common file path

Disassembly:
sub esp, 0x38
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov ebx, eax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x18], 0x30
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], 0x4039c0
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], esi
mov dword [esp + 0x34], esi
mov dword [esp + 0x38], esi
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], str.AStuckWnd
mov dword [esp + 0x44], esi
call dword [sym.imp.USER32.dll_RegisterClassExA]
push esi
push ebx
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x42816c
push str.AStuckWnd
push esi
call dword [sym.imp.USER32.dll_CreateWindowExA]
cmp eax, esi
mov dword [edi + 4], eax
jne 0x403ad4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x38
ret
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 1
push ecx
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x403b2d
push str.Shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
cmp ebx, esi
je 0x403b2d
push str.SHChangeNotifyRegister
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [edi + 4]
lea edx, [esp + 0xc]
push edx
push 1
push 0x458
push 0x100
push 2
push ecx
call eax
push ebx
mov dword [edi + 8], eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [edi + 8]
xor eax, eax
cmp ecx, esi
pop edi
pop esi
pop ebx
setne al
add esp, 0x38
ret