joyce8/EMBER2024-capa huggingface dataset:
Function at 0x72b3e4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x72b456
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
lea edx, [ebp - 8]
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_GetExeName_qqrv
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call sub.rtl120.bpl__Sysutils_ExtractFilePath_qqrx20System_UnicodeString
lea eax, [ebp - 4]
mov edx, 0x72b470
call sub.rtl120.bpl__System__UStrCat_qqrr20System_UnicodeStringx20System_UnicodeString
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__System__UStrToPWChar_qqrx20System_UnicodeString
push eax
push 0x72b498
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x72b45d
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x7366e0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov byte [ebp - 1], 0
lea edx, [ebp - 0xc]
push edx
push eax
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [ebp - 0xc], 0
je 0x73675d
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0x100411
call sub.kernel32.dll_OpenProcess
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x73674f
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
jne 0x736725
mov byte [ebp - 1], 0
push 0
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x736738
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x736756
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_CloseHandle
ret
movzx eax, byte [ebp - 1]
mov esp, ebp
pop ebp
ret

Function at 0x736bf0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
xor edx, edx
mov dword [ebp - 0x20c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x736c64
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x1a
lea eax, [ebp - 0x208]
push eax
mov eax, dword [0x7a2004]
push eax
call sub.shell32.dll_SHGetSpecialFolderPathW
lea eax, [ebp - 0x20c]
lea edx, [ebp - 0x208]
mov ecx, 0x104
call sub.rtl120.bpl__System__UStrFromWArray_qqrr20System_UnicodeStringpbi
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call sub.rtl120.bpl__Sysutils_IncludeTrailingPathDelimiter_qqrx20System_UnicodeString
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x736c6b
lea eax, [ebp - 0x20c]
call sub.rtl120.bpl__System__UStrClr_qqrpv
ret
Function at 0x75c18c
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff8
xor ebx, ebx
call fcn.00607510
test al, al
jne 0x75c1ec
call fcn.00607518
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0x75c174
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, eax
push 0xa
push esi
call sub.kernel32.dll_WaitForSingleObject
mov edi, eax
cmp edi, 0x102
jne 0x75c1de
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_ProcessMessages_qqrv
jmp 0x75c1be
push esi
call sub.kernel32.dll_CloseHandle
cmp dword [esp], 0
jne 0x75c1ec
mov bl, 1
mov eax, ebx
pop ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x75fafc
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x75fb04
push ecx
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x75fc95
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
sete al
mov ecx, 2
or edx, 0xffffffff
call sub.rtl120.bpl__Math_IfThen_qqroxixi
mov edx, eax
xor ecx, ecx
mov eax, esi
call fcn.007691f4
cmp ebx, dword [0x7a0108]
jne 0x75fb5c
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x7a0104]
cmp eax, 0x2710
jb 0x75fc6d
call sub.kernel32.dll_GetTickCount
mov dword [0x7a0104], eax
mov dword [0x7a0108], ebx
mov edx, dword [0x7a066c]
mov edx, dword [edx]
lea eax, [ebp - 4]
mov ecx, 0x75fcb0
call sub.rtl120.bpl__System__UStrCat3_qqrr20System_UnicodeStringx20System_UnicodeStringt2
mov eax, dword [ebp - 4]
call sub.rtl120.bpl__Sysutils_FileExists_qqrx20System_UnicodeString
test al, al
je 0x75fc6d
cmp ebx, 0xa
jle 0x75fb9b
mov ebx, 0xa
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x18], 0
mov eax, dword [0x7a066c]
push dword [eax]
push 0x75fcdc
push 0x75fcf8
lea eax, [ebp - 0x20]
mov edx, 3
call sub.rtl120.bpl__System__UStrCatN_qqrv
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x75fd10
call fcn.0040fdb0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x18], 0x11
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x1c]
mov ecx, 1
mov eax, 0x75fd30
call fcn.0040fdb0
xor eax, eax
push ebp
push 0x75fc34
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
xor ecx, ecx
xor edx, edx
mov eax, dword [ebp - 0xc]
call fcn.0040c0e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x75fc6d
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x75fc9c
lea eax, [ebp - 0x24]
mov edx, 2
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
lea eax, [ebp - 0xc]
mov edx, 3
call sub.rtl120.bpl__System__UStrArrayClr_qqrpvi
ret
Function at 0x7691f4
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
test bl, bl
je 0x76921b
call sub.kernel32.dll_GetTickCount
sub eax, dword [0x7a0130]
cmp eax, 0x12c
jb 0x7692eb
call sub.kernel32.dll_GetTickCount
mov dword [0x7a0130], eax
push ebp
call fcn.00769114
pop ecx
test bl, bl
je 0x7692c3
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x388]
mov eax, dword [esi + 0x5c]
cmp eax, 2
jge 0x769260
mov eax, esi
mov edx, 2
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov dword [0x7a0134], 1
jmp 0x7692eb
mov ebx, eax
mov eax, dword [esi + 0x4c]
call sub.vcl120.bpl__Imglist_TCustomImageList_GetCount_qqrv
dec eax
cmp dword [0x7a0134], 1
jne 0x76928c
mov edx, dword [0x7a0134]
add edx, ebx
cmp eax, edx
jge 0x76928c
mov dword [0x7a0134], 0xffffffff
jmp 0x7692ab
cmp dword [0x7a0134], 0xffffffff
jne 0x7692ab
mov eax, dword [0x7a0134]
add eax, ebx
cmp eax, 2
jge 0x7692ab
mov dword [0x7a0134], 1
mov edx, dword [0x7a0134]
add edx, ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x7692eb
inc esi
jne 0x7692d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x34]
jmp 0x7692eb
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x388]
mov edx, 1
mov ecx, dword [eax]
call dword [ecx + 0x34]
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x76c644
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, edx
mov dword [ebp - 4], eax
cmp dword [0x7a013c], 0
jg 0x76c7de
inc dword [0x7a013c]
mov eax, dword [ebp - 4]
cmp byte [eax + 0x64e], 0
jne 0x76c7de
mov eax, dword [ebp - 4]
call fcn.00755868
test al, al
jne 0x76c7de
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x64]
xor eax, eax
push ebp
push 0x76c7d7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x76c538]
call fcn.00779acc
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x7648b8]
call fcn.00779260
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x1c], eax
cmp bl, 1
cmc
sbb eax, eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 0x20]
push eax
push 0x76c618
push 0
push 0
call sub.kernel32.dll_CreateThread
mov esi, eax
push 0xa
push esi
call sub.kernel32.dll_WaitForSingleObject
mov ebx, eax
cmp ebx, 0x102
jne 0x76c71f
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
call sub.vcl120.bpl__Forms_TApplication_ProcessMessages_qqrv
jmp 0x76c6ff
push esi
call sub.kernel32.dll_CloseHandle
cmp dword [ebp - 0x14], 0
je 0x76c73b
push 0
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.0076aacc
xor eax, eax
mov dword [ebp - 0x20], eax
xor eax, eax
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x76c76c
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 8]
call fcn.00779a84
mov edx, dword [0x4133a8]
call sub.rtl120.bpl__System__Dispose_qqrpvt1
inc esi
dec ebx
jne 0x76c753
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax + 8]
dec ebx
test ebx, ebx
jl 0x76c793
inc ebx
xor esi, esi
mov edx, esi
mov eax, dword [ebp - 0xc]
call fcn.00779218
mov edx, dword [0x413314]
call sub.rtl120.bpl__System__Dispose_qqrpvt1
inc esi
dec ebx
jne 0x76c77a
lea eax, [ebp - 8]
call sub.rtl120.bpl__Sysutils_FreeAndNil_qqrpv
lea eax, [ebp - 0xc]
call sub.rtl120.bpl__Sysutils_FreeAndNil_qqrpv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x76c7de
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x520]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x524]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x64]
dec dword [0x7a013c]
ret
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x76d15c
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x76d1c0
call fcn.0040e0a4
test al, al
je 0x76d1b0
mov eax, dword [0x7a0994]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x76d1d8
call fcn.005714a8
push 0
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
mov byte [eax + 0x57], 0
mov eax, ebx
call fcn.00769430
mov dl, 1
mov eax, ebx
call fcn.0076c7e4
pop ebx
ret

Function at 0x76d204
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
mov eax, 0x76d268
call fcn.0040e0a4
test al, al
je 0x76d258
mov eax, dword [0x7a0994]
mov eax, dword [eax]
xor ecx, ecx
mov edx, 0x76d284
call fcn.005714a8
push 0
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
mov eax, dword [eax + 0x170]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [sym.imp.vcl120.bpl__Forms_Application]
mov eax, dword [eax]
mov byte [eax + 0x57], 0
mov eax, ebx
call fcn.00769430
mov dl, 1
mov eax, ebx
call fcn.0076c9a8
pop ebx
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x46f569e0
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43104e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x243a114a
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x431084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x404980
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [0x42b01c]
push edi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov edi, dword [ebp + 0x10]
lea eax, [edi + 1]
push eax
push 0
call 0x36903ca
nop
push eax
call 0x77f1296e
nop
mov ebx, eax
push 0x434fb0
mov dword [ebp - 4], ebx
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
mov byte [ebx + edi], 0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
xor edi, edi
cmp dword [ebp + 0x10], edi
jbe 0x404a9a
mov eax, dword [ebp + 8]
sub eax, ebx
mov dword [ebp - 8], eax
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov ecx, dword [ebp + 0xc]
push ecx
add ebx, edi
nop
call 0x6ff643d3
mov ecx, eax
xor edx, edx
mov eax, edi
div ecx
mov eax, dword [ebp + 0xc]
add esp, 4
push 0x434fb0
mov cl, byte [edx + eax]
mov edx, dword [ebp - 8]
xor cl, byte [edx + ebx]
mov byte [ebx], cl
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
mov ebx, dword [ebp - 4]
inc edi
cmp edi, dword [ebp + 0x10]
jb 0x404a26
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
push 0x434fb0
call esi
lea eax, [ebp - 0xc]
push eax
push 0x100
push 4
push ebx
mov dword [ebp - 0xc], 0
call 0x36903cf
nop
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43b648
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edi
push edx
pop edx
add edx, ecx
or ecx, edx
call fcn.0043b679
or edx, ecx
add ecx, 0xa0439104
add edx, ecx
xor dword [eax], edi
and edx, ecx
inc eax
add ecx, edx
cmp eax, esi
jne fcn.0043b648
or edx, edx
sub edx, edx
or ecx, ecx
ret
Function at 0x4011a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push edi
push str.Transmitting__d_bytes
push 0xcc
push str.tx_data
push 1
xor esi, esi
call fcn.00401cc0
mov ebx, dword [ebp + 8]
add esp, 0x14
cmp dword [0x429038], 1
jle 0x4011e1
mov eax, dword [0x429028]
push eax
push edi
push ebx
call fcn.00402540
add esp, 0xc
test edi, edi
je 0x401217
mov ecx, dword [0x429024]
mov eax, edi
sub eax, esi
cmp eax, ecx
jb 0x4011f5
mov eax, ecx
push 0
lea ecx, [ebp + 0xc]
push ecx
push eax
mov eax, dword [0x429004]
lea edx, [esi + ebx]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x401247
add esi, dword [ebp + 0xc]
cmp esi, edi
jb 0x4011e5
mov eax, dword [0x429008]
add eax, esi
push eax
push str.Total_bytes_sent_so_far:__d
push 0xec
push str.tx_data
push 1
mov dword [0x429008], eax
call fcn.00401cc0
add esp, 0x14
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
push str.Error_occurred_while_writing_to_COM_port
push 0xd6
push str.tx_data
push 0
call fcn.00401cc0
add esp, 0x10
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x402ba0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x402bdb
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x402bc2
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x402bd3
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x402bdd
inc edi
add eax, 0x28
cmp edi, esi
jb 0x402bb8
xor eax, eax
pop edi
pop esi
ret

Function at 0x405645
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42907c]
jne 0x40564f
repz ret
jmp fcn.00408b14

Function at 0x40670a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x406731
call fcn.00406648
mov dword [eax], esi
call fcn.00406635
push 0x16
pop esi
mov dword [eax], esi
call fcn.00409bbf
mov eax, esi
jmp 0x406786
test dword [ebp + 0xc], 0xfffffff9
jne 0x406717
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40675e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040665b
pop ecx
call fcn.00406635
mov eax, dword [eax]
jmp 0x406786
test al, 0x10
jne 0x406784
test al, 1
je 0x406784
test byte [ebp + 0xc], 2
je 0x406784
call fcn.00406648
mov dword [eax], 5
call fcn.00406635
mov dword [eax], 0xd
jmp 0x406755
xor eax, eax
pop esi
pop ebp
ret
Function at 0x417d2f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x42907c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040cd43
and dword [ebp - 0x14], 0
cmp dword [0x42b7bc], 0
mov dword [ebp - 0x18], eax
jne 0x417de2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x417e8a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x417e8a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42b7bc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42b7c0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42b7c4], eax
call edi
push eax
call esi
mov dword [0x42b7cc], eax
test eax, eax
je 0x417de2
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42b7c8], eax
mov eax, dword [0x42b7c8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x417e3b
cmp dword [0x42b7cc], ecx
je 0x417e3b
push eax
call esi
push dword [0x42b7cc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x417e3b
test ebx, ebx
je 0x417e3b
call edi
test eax, eax
je 0x417e32
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x417e32
test byte [ebp - 8], 1
jne 0x417e3b
or dword [ebp + 0x10], 0x200000
jmp 0x417e6e
mov eax, dword [0x42b7c0]
cmp eax, dword [ebp - 0x18]
je 0x417e6e
push eax
call esi
test eax, eax
je 0x417e6e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x417e6e
mov eax, dword [0x42b7c4]
cmp eax, dword [ebp - 0x18]
je 0x417e6e
push eax
call esi
test eax, eax
je 0x417e6e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42b7bc]
call esi
test eax, eax
je 0x417e8a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x417e8c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405645
leave
ret
Function at 0x4013d0
Capabilities:
Get number of processors

Disassembly:
mov ecx, 0x505828
jmp 0x4013c4
mov eax, 0x4c4e84
call fcn.00494414
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004014d6
mov eax, dword [0x5011f8]
lea ecx, [esi + 0xa0]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ecx], eax
mov eax, dword [0x5011f8]
mov dword [esi + 0xb0], eax
push 1
mov dword [esi], 0x4cc7cc
or dword [esi + 0x20], 0xffffffff
or dword [esi + 0x1c], 0xffffffff
pop edi
mov dword [esi + 0x28], ebx
push 0xa
mov dword [esi + 0x24], ebx
pop eax
mov byte [ebp - 4], 2
push 0x64
mov dword [esi + 0x58], eax
mov dword [esi + 0x60], eax
pop eax
push 0x505820
mov dword [esi + 0x2c], 2
mov dword [esi + 0x30], edi
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x4c], edi
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x90], eax
mov dword [esi + 0x94], eax
mov dword [esi + 0x98], ebx
mov dword [esi + 0x64], edi
mov dword [esi + 0x68], edi
mov dword [esi + 0x6c], 0x3e8
mov dword [esi + 0x70], edi
mov dword [esi + 0x74], edi
mov dword [esi + 0x78], edi
mov dword [esi + 0x7c], edi
mov dword [esi + 0x80], 0xc0
mov dword [esi + 0x84], 0x6c
mov dword [esi + 0x88], ebx
mov dword [esi + 0x8c], ebx
mov dword [esi + 0x9c], ebx
call fcn.004af72d
push 0x505820
lea ecx, [esi + 0xb0]
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], edi
mov dword [esi + 0xac], edi
call fcn.004af72d
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40ad42
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x4c5c4c
call fcn.00494414
sub esp, 0x22c
push ebx
push esi
mov dword [ebp - 0x2c], ecx
mov esi, 0x5058f8
push str.DataFile_Types
mov ecx, esi
call fcn.004c238c
xor ebx, ebx
mov dword [ebp - 0x18], eax
cmp eax, ebx
jne 0x40ad78
xor eax, eax
jmp 0x40aec0
mov eax, dword [0x5011f8]
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x38]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov byte [ebp - 4], 2
push eax
push ebx
push dword [ebp - 0x18]
mov dword [ebp - 0x24], 0x100
mov dword [ebp - 0x20], ebx
call edi
cmp eax, 0x103
je 0x40ae90
lea eax, [ebp - 0x238]
push eax
push str.DataFile_Types
lea eax, [ebp - 0x10]
push 0x4ebd94
push eax
call fcn.004acec7
add esp, 0x10
lea eax, [ebp - 0x28]
mov ecx, esi
push ebx
push str.Name
push dword [ebp - 0x10]
push eax
call fcn.004c243e
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004af6dd
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.004af596
push ebx
push str.Extension
push dword [ebp - 0x10]
lea eax, [ebp - 0x30]
mov ecx, esi
push eax
call fcn.004c243e
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
call fcn.004af6dd
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 2
call fcn.004af596
push 0xffffffffffffffff
push str.Icon
push dword [ebp - 0x10]
mov ecx, esi
call fcn.004c23d2
mov ecx, dword [ebp - 0x14]
cmp dword [ecx - 8], ebx
je 0x40ae69
mov edx, dword [ebp - 0x1c]
cmp dword [edx - 8], ebx
je 0x40ae69
cmp eax, 0xffffffff
je 0x40ae69
push eax
push edx
push ecx
mov ecx, dword [ebp - 0x2c]
call fcn.0040afad
lea eax, [ebp - 0x38]
inc dword [ebp - 0x20]
push eax
push ebx
push ebx
lea eax, [ebp - 0x24]
push ebx
push eax
lea eax, [ebp - 0x238]
mov dword [ebp - 0x24], 0x100
push eax
push dword [ebp - 0x20]
push dword [ebp - 0x18]
jmp 0x40adb4
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004af596
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], bl
call fcn.004af596
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004af596
push 1
pop eax
pop edi
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40c002
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2bc
push ebx
push esi
lea eax, [ebp - 4]
push edi
xor ebx, ebx
push eax
mov edi, 0x4ceae8
push ebx
push ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
mov esi, 0x2b4
lea eax, [ebp - 0x2bc]
push esi
push ebx
push eax
call fcn.00494440
lea eax, [ebp - 8]
add esp, 0xc
neg eax
sbb eax, eax
lea ecx, [ebp - 4]
and eax, ecx
xor ecx, ecx
cmp dword [ebp + 8], ebx
mov eax, dword [eax]
sete cl
or cx, 0x4008
push ecx
lea ecx, [ebp - 0x2bc]
push esi
push ecx
push ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
lea ecx, [ebp - 8]
mov esi, eax
neg ecx
sbb ecx, ecx
lea eax, [ebp - 4]
and ecx, eax
mov dword [ebp - 8], edi
call fcn.0040c376
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4