joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401208
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a8]
sub esp, 0x730
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp + 0x3a4], eax
mov eax, dword [ebp + 0x3b0]
push esi
push edi
mov dword [ebp + 0x68], eax
lea eax, [ebp + 0x80]
push eax
push 0x20019
xor edi, edi
push edi
mov esi, str.SystemCurrentControlSetControlKeyboard_Layouts
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401260
push esi
call fcn.00401f9e
pop ecx
xor eax, eax
jmp 0x4013d1
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp + 0x7c]
push eax
push edi
push edi
push edi
push dword [ebp + 0x80]
mov dword [ebp + 0x7c], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x401296
push esi
call fcn.00401f9e
pop ecx
push dword [ebp + 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401259
mov eax, 0xfa
cmp dword [ebp + 0x7c], eax
jbe 0x4012a3
mov dword [ebp + 0x7c], eax
xor esi, esi
cmp dword [ebp + 0x7c], edi
mov dword [ebp + 0x78], edi
jle 0x40131b
lea eax, [ebp + 0x60]
push eax
push edi
push edi
push edi
lea eax, [ebp + 0x74]
push eax
lea eax, [ebp + 0x214]
push eax
push esi
push dword [ebp + 0x80]
mov dword [ebp + 0x74], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
je 0x4012de
cmp eax, 0xea
jne 0x401315
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x214]
push 0x41c180
push eax
call fcn.00404fea
add esp, 0xc
test eax, eax
je 0x401315
mov eax, dword [ebp + 0x70]
movzx ecx, ax
cmp ecx, 0x804
jne 0x401315
mov ecx, dword [ebp + 0x78]
inc dword [ebp + 0x78]
mov dword [ebp + ecx*4 - 0x388], eax
inc esi
cmp esi, dword [ebp + 0x7c]
jl 0x4012ad
push ebx
xor ebx, ebx
cmp dword [ebp + 0x78], edi
mov dword [ebp + 0x74], edi
jle 0x4013c2
mov esi, dword [ebp + ebx*4 - 0x388]
push esi
push str._08x
lea eax, [ebp + 0x214]
push 0xc8
push eax
call fcn.004043d6
add esp, 0x10
lea eax, [ebp + 0x6c]
push eax
push 0xf003f
push edi
lea eax, [ebp + 0x214]
push eax
push dword [ebp + 0x80]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4013b8
lea eax, [ebp + 0x70]
push eax
lea eax, [ebp + 0x84]
push eax
push edi
push edi
push str.Ime_File
push dword [ebp + 0x6c]
mov dword [ebp + 0x70], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4013af
push dword [ebp + 0x68]
lea eax, [ebp + 0x84]
push eax
call fcn.00404583
test eax, eax
pop ecx
pop ecx
je 0x4013e8
cmp dword [ebp + 0x74], esi
jae 0x4013af
mov dword [ebp + 0x74], esi
push dword [ebp + 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, dword [ebp + 0x78]
jl 0x40132a
push dword [ebp + 0x80]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ebx
mov ecx, dword [ebp + 0x3a4]
pop edi
xor ecx, ebp
pop esi
call fcn.00404331
add ebp, 0x3a8
leave
ret
mov eax, esi
jmp 0x4013d0
Function at 0x4013ec
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f8
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, str.SystemCurrentControlSetControlKeyboard_Layouts_08X
lea eax, [ebp - 0x1f8]
push esi
push eax
call fcn.004020bb
add esp, 0xc
test eax, eax
jge 0x40142a
push edi
push esi
call fcn.00401f9e
pop ecx
pop ecx
mov eax, 0xfffffefb
jmp 0x40145c
lea eax, [ebp - 0x1f8]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x40145a
lea eax, [ebp - 0x1f8]
push eax
push str.HKEY_LOCAL_MACHINE_s
call fcn.00401f9e
pop ecx
pop ecx
mov eax, 0xfffffef3
jmp 0x40145c
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00404331
leave
ret
Function at 0x401951
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x98]
sub esp, 0x118
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp + 0x94], eax
push 0x110
lea eax, [ebp - 0x7c]
push 0
push eax
mov dword [ebp - 0x80], 0x114
call fcn.0040d0f0
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x401998
xor al, al
jmp 0x40199f
cmp dword [ebp - 0x7c], 5
seta al
mov ecx, dword [ebp + 0x94]
xor ecx, ebp
call fcn.00404331
add ebp, 0x98
leave
ret
Function at 0x401a1e
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x740
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x348], eax
lea eax, [ebp - 0x330]
push eax
push 0x20019
xor edi, edi
push edi
push str.SystemCurrentControlSetControlKeyboard_Layouts
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401c29
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x334]
push eax
push edi
push edi
push edi
push dword [ebp - 0x330]
mov dword [ebp - 0x334], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x401c1d
mov eax, 0xfa
cmp dword [ebp - 0x334], eax
jbe 0x401aa2
mov dword [ebp - 0x334], eax
xor esi, esi
cmp dword [ebp - 0x334], edi
mov dword [ebp - 0x338], edi
jle 0x401b40
lea eax, [ebp - 0x350]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x33c]
push eax
lea eax, [ebp - 0x19c]
push eax
push esi
push dword [ebp - 0x330]
mov dword [ebp - 0x33c], 0xc8
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, edi
je 0x401af0
cmp eax, 0xea
jne 0x401b33
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x19c]
push 0x41c180
push eax
call fcn.00404fea
add esp, 0xc
test eax, eax
je 0x401b33
mov eax, dword [ebp - 0x340]
movzx ecx, ax
cmp ecx, 0x804
jne 0x401b33
mov ecx, dword [ebp - 0x338]
inc dword [ebp - 0x338]
mov dword [ebp + ecx*4 - 0x73c], eax
inc esi
cmp esi, dword [ebp - 0x334]
jl 0x401ab6
xor ebx, ebx
cmp dword [ebp - 0x338], edi
mov dword [ebp - 0x33c], edi
jle 0x401c1d
mov esi, dword [ebp + ebx*4 - 0x73c]
push esi
push str._08x
lea eax, [ebp - 0x19c]
push 0xc8
push eax
call fcn.004043d6
add esp, 0x10
lea eax, [ebp - 0x344]
push eax
push 0xf003f
push edi
lea eax, [ebp - 0x19c]
push eax
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401c10
lea eax, [ebp - 0x340]
push eax
lea eax, [ebp - 0x32c]
push eax
push edi
push edi
push str.Ime_File
push dword [ebp - 0x344]
mov dword [ebp - 0x340], 0x190
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401c04
push 4
lea eax, [ebp - 0x32c]
push str.imsc
push eax
call fcn.004046fc
add esp, 0xc
test eax, eax
jne 0x401bf6
mov edx, dword [ebp - 0x348]
push edi
push esi
mov ecx, str.default_user
call fcn.004016d4
pop ecx
pop ecx
cmp dword [ebp - 0x33c], esi
jae 0x401c04
mov dword [ebp - 0x33c], esi
push dword [ebp - 0x344]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
cmp ebx, dword [ebp - 0x338]
jl 0x401b54
push dword [ebp - 0x330]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.00404331
leave
ret
Function at 0x401c3a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor esi, esi
push 0x206
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x212]
push esi
push eax
mov dword [ebp - 0x218], esi
mov word [ebp - 0x214], si
call fcn.0040d0f0
add esp, 0xc
push esi
push 0x28
lea eax, [ebp - 0x214]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x401d93
lea eax, [ebp - 0x214]
push 0x5c
push eax
call fcn.00404f4c
mov edi, eax
cmp edi, esi
pop ecx
pop ecx
je 0x401d93
inc edi
inc edi
call fcn.00401951
test al, al
mov eax, str.default
jne 0x401cc5
mov eax, str.Default_User
push eax
lea ecx, [ebp - 0x214]
mov eax, edi
sub eax, ecx
mov esi, 0x104
sar eax, 1
mov ecx, esi
sub ecx, eax
push ecx
push edi
call fcn.00405009
add esp, 0xc
push str.NTUSER.DAT
lea eax, [ebp - 0x214]
push esi
push eax
call fcn.00404a5d
add esp, 0xc
push 1
push str.SeRestorePrivilege
call fcn.004019b4
push 1
mov ebx, str.SeBackupPrivilege
push ebx
call fcn.004019b4
add esp, 0x10
lea eax, [ebp - 0x214]
push eax
mov esi, str.default_user
push esi
mov edi, 0x80000003
push edi
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
test eax, eax
jne 0x401d93
lea eax, [ebp - 0x218]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x401d74
mov edx, dword [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
mov ecx, esi
call fcn.004016d4
push dword [ebp - 0x218]
call fcn.00401a1e
add esp, 0xc
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
push 0
push str.SeRestorePrivilege
call fcn.004019b4
push 0
push ebx
call fcn.004019b4
add esp, 0x10
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404331
leave
ret
Function at 0x401de7
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x494]
sub esp, 0x514
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp + 0x490], eax
push ebx
push esi
push edi
xor esi, esi
push 0x7e
lea eax, [ebp + 0x392]
push esi
push eax
mov edi, ecx
mov ebx, edx
mov dword [ebp - 0x74], esi
mov word [ebp + 0x390], si
call fcn.0040d0f0
push edi
lea eax, [ebp + 0x390]
push str._08X
push eax
call fcn.00404340
add esp, 0x18
lea eax, [ebp - 0x74]
push eax
push 0xf003f
push esi
push str.Keyboard_LayoutPreload
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401f2e
mov ebx, 0x3fe
push ebx
lea eax, [ebp - 0x6e]
push esi
push eax
mov dword [ebp - 0x78], esi
mov word [ebp - 0x70], si
call fcn.0040d0f0
push 0x7e
lea eax, [ebp + 0x412]
push esi
push eax
mov dword [ebp - 0x80], 0x200
mov word [ebp + 0x410], si
call fcn.0040d0f0
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x410]
push eax
push esi
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
jmp 0x401f0f
lea eax, [ebp + 0x410]
push eax
lea eax, [ebp + 0x390]
push eax
call fcn.00404583
test eax, eax
pop ecx
pop ecx
je 0x401f21
inc dword [ebp - 0x78]
push ebx
lea eax, [ebp - 0x6e]
push esi
push eax
mov word [ebp - 0x70], si
call fcn.0040d0f0
push 0x7e
lea eax, [ebp + 0x412]
push esi
push eax
mov dword [ebp - 0x80], 0x200
mov word [ebp + 0x410], si
call fcn.0040d0f0
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x410]
push eax
push esi
push esi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x78]
push dword [ebp - 0x74]
mov dword [ebp - 0x7c], 0x40
call edi
test eax, eax
je 0x401eac
jmp 0x401f2e
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp + 0x490]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404331
add ebp, 0x494
leave
ret

Function at 0x404331
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41f060]
jne 0x40433b
repz ret
jmp fcn.00406ce5
Function at 0x40ab29
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x41f800]
je 0x40ab44
inc edi
cmp edi, 0x17
jb 0x40ab35
cmp edi, 0x17
jae 0x40acc4
push ebp
push 3
call fcn.0041160e
cmp eax, 1
pop ecx
je 0x40ac90
push 3
call fcn.0041160e
test eax, eax
pop ecx
jne 0x40ab78
cmp dword [0x41f030], 1
je 0x40ac90
cmp ebx, 0xfc
je 0x40acc3
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x420720
push ebp
call fcn.0040de10
add esp, 0xc
test eax, eax
je 0x40abae
push esi
push esi
push esi
push esi
push esi
call fcn.00405f20
add esp, 0x14
push 0x104
mov esi, 0x420739
push esi
push 0
mov byte [0x42083d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40abf2
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.0040de10
add esp, 0xc
test eax, eax
je 0x40abf2
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.00405f20
add esp, 0x14
push esi
call fcn.004067e0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x40ac37
push esi
call fcn.004067e0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x420a34
push 0x4189d4
sub ecx, eax
push ecx
push eax
call fcn.004102f6
add esp, 0x14
test eax, eax
je 0x40ac37
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.00405f20
add esp, 0x14
jmp 0x40ac39
xor esi, esi
push 0x4189d0
push ebx
push ebp
call fcn.0041023d
add esp, 0xc
test eax, eax
je 0x40ac59
push esi
push esi
push esi
push esi
push esi
call fcn.00405f20
add esp, 0x14
push dword [edi*8 + 0x41f804]
push ebx
push ebp
call fcn.0041023d
add esp, 0xc
test eax, eax
je 0x40ac7b
push esi
push esi
push esi
push esi
push esi
call fcn.00405f20
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.00411451
add esp, 0xc
jmp 0x40acc3
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x40acc3
cmp ebp, 0xffffffff
je 0x40acc3
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x41f804]
push dword [esi]
call fcn.004067e0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x411451
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004083bf
xor ebx, ebx
cmp dword [0x420db4], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x411527
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x411607
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x411607
push eax
call fcn.00408351
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x420db4], eax
call esi
push eax
call fcn.00408351
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x420db8], eax
call esi
push eax
call fcn.00408351
mov dword [0x420dbc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040a8b6
test eax, eax
pop ecx
pop ecx
je 0x4114f5
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405f20
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x411527
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00408351
cmp eax, ebx
pop ecx
mov dword [0x420dc4], eax
je 0x411527
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00408351
pop ecx
mov dword [0x420dc0], eax
mov eax, dword [0x420dc0]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x4115ac
cmp dword [0x420dc4], ecx
je 0x4115ac
push eax
call fcn.004083c8
push dword [0x420dc4]
mov esi, eax
call fcn.004083c8
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x4115ac
cmp edi, ebx
je 0x4115ac
call esi
cmp eax, ebx
je 0x411579
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x411579
test byte [ebp - 0x18], 1
jne 0x4115ac
lea eax, [ebp - 0x10]
push eax
call fcn.0040a8ed
test eax, eax
pop ecx
je 0x411594
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00405f20
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x4115a3
or dword [ebp + 0x10], 0x200000
jmp 0x4115e7
or dword [ebp + 0x10], 0x40000
jmp 0x4115e7
mov eax, dword [0x420db8]
cmp eax, dword [ebp - 8]
je 0x4115e7
push eax
call fcn.004083c8
cmp eax, ebx
pop ecx
je 0x4115e7
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x4115e7
mov eax, dword [0x420dbc]
cmp eax, dword [ebp - 8]
je 0x4115e7
push eax
call fcn.004083c8
cmp eax, ebx
pop ecx
je 0x4115e7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x420db4]
call fcn.004083c8
cmp eax, ebx
pop ecx
je 0x411607
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x411609
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x414ff0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4150c9
cmp dword [ebp + 0x14], 0
je 0x415042
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx]
test edx, edx
jne 0x41507b
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004146e0
push eax
push 0x41a574
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00416250
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.00402110
jmp 0x415163
mov ecx, dword [ebp + 0x14]
push ecx
push 0x41a594
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004146e0
push eax
push 0x41a584
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp + 8]
call fcn.00416250
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.00402110
jmp 0x415163
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 0x18]
je 0x41515b
cmp dword [ebp + 0x14], 0
je 0x4150e5
mov ecx, dword [ebp + 0x14]
movzx edx, word [ecx]
test edx, edx
jne 0x415110
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004146e0
push eax
push 0x41a598
mov ecx, dword [ebp + 8]
call fcn.00402130
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.00402110
jmp 0x415163
mov eax, dword [ebp + 0x14]
push eax
push 0x41a5c8
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.004146e0
push eax
push 0x41a5b0
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00416250
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.00402110
jmp 0x415163
mov ecx, dword [ebp + 8]
call fcn.00402120
mov esp, ebp
pop ebp
ret 0x14
Function at 0x415860
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41772d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x41f060]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp - 0x24]
call fcn.004153e0
movzx eax, al
test eax, eax
jne 0x4158cf
mov ecx, dword [ebp - 0x24]
call fcn.00415460
movzx ecx, al
test ecx, ecx
jne 0x4158cf
mov ecx, dword [ebp - 0x24]
call fcn.004146e0
push eax
push str.b_rN0R
mov ecx, dword [ebp + 8]
call fcn.00402130
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.00402110
jmp 0x4159a9
lea ecx, [ebp - 0x1c]
call fcn.00414930
mov dword [ebp - 4], 0
mov edx, dword [ebp + 0xc]
push edx
push 0x41b668
mov ecx, dword [ebp - 0x24]
call fcn.004146e0
push eax
push 0x22
lea ecx, [ebp - 0x1c]
call fcn.00414b20
mov ecx, eax
call fcn.00414a90
mov ecx, eax
call fcn.00414a90
mov ecx, eax
call fcn.00414a90
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
push 0
push 0
mov edx, dword [ebp + 0x10]
push edx
push 0
push 0
push 0
lea ecx, [ebp - 0x1c]
call fcn.00414730
push eax
lea ecx, [ebp - 0x1c]
call fcn.004148d0
push eax
mov ecx, dword [ebp - 0x24]
call fcn.004146b0
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x415984
lea ecx, [ebp - 0x1c]
call fcn.00414b60
push 0x41b670
mov ecx, dword [ebp + 8]
call fcn.00416210
mov ecx, eax
call fcn.004160e0
mov ecx, eax
call fcn.00402110
mov byte [ebp - 0x1d], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00414770
mov al, byte [ebp - 0x1d]
jmp 0x4159a9
lea ecx, [ebp - 0x1c]
call fcn.00414b60
mov ecx, dword [ebp + 8]
call fcn.00402120
mov byte [ebp - 0x1e], al
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.00414770
mov al, byte [ebp - 0x1e]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x416660
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x10], ecx
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
mov eax, dword [ebp - 0x10]
add eax, 0x80
push eax
call fcn.004022b0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
add ecx, 0x80
mov dword [ebp - 0x14], ecx
mov edx, dword [ebp - 0x14]
add edx, 2
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
mov cx, word [eax]
mov word [ebp - 0x1a], cx
add dword [ebp - 0x14], 2
cmp word [ebp - 0x1a], 0
jne 0x4166a4
mov edx, dword [ebp - 0x14]
sub edx, dword [ebp - 0x18]
sar edx, 1
mov dword [ebp - 0x20], edx
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], 0
jmp 0x4166dc
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 8]
jge 0x41670b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov dx, word [ecx + eax*2 + 0x80]
push edx
call fcn.004053f9
add esp, 4
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
mov word [edx + ecx*2 + 0x288], ax
jmp 0x4166d3
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov word [ecx + eax*2 + 0x288], 0
mov ecx, dword [ebp + 8]
call fcn.00402120
mov esp, ebp
pop ebp
ret 4

Function at 0x416cc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push 0x1a
push 0x104
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.004154f0
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
cmp eax, 1
je 0x416d0a
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.00402150
push 0x41bbb4
mov ecx, dword [ebp + 8]
call fcn.00402130
mov ecx, eax
call fcn.00402110
jmp 0x416d1d
mov ecx, dword [ebp - 4]
add ecx, 0x28
call fcn.00415660
mov ecx, dword [ebp + 8]
call fcn.00402120
mov esp, ebp
pop ebp
ret 4
Function at 0x416d30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x41f060]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x228], ecx
mov word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.0040d0f0
add esp, 0xc
lea ecx, [ebp - 0x210]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x416db1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x214], eax
mov edx, dword [ebp - 0x214]
push edx
push 0x41bb34
mov ecx, dword [ebp + 8]
call fcn.00402130
mov ecx, eax
call fcn.00416100
mov ecx, eax
call fcn.00402110
jmp 0x416eb8
lea eax, [ebp - 0x210]
mov dword [ebp - 0x22c], eax
mov ecx, dword [ebp - 0x22c]
add ecx, 2
mov dword [ebp - 0x230], ecx
mov edx, dword [ebp - 0x22c]
mov ax, word [edx]
mov word [ebp - 0x232], ax
add dword [ebp - 0x22c], 2
cmp word [ebp - 0x232], 0
jne 0x416dcc
mov ecx, dword [ebp - 0x22c]
sub ecx, dword [ebp - 0x230]
sar ecx, 1
mov dword [ebp - 0x238], ecx
mov edx, dword [ebp - 0x238]
movzx eax, word [ebp + edx*2 - 0x212]
cmp eax, 0x5c
jne 0x416e74
lea ecx, [ebp - 0x210]
mov dword [ebp - 0x23c], ecx
mov edx, dword [ebp - 0x23c]
add edx, 2
mov dword [ebp - 0x240], edx
mov eax, dword [ebp - 0x23c]
mov cx, word [eax]
mov word [ebp - 0x242], cx
add dword [ebp - 0x23c], 2
cmp word [ebp - 0x242], 0
jne 0x416e2f
mov edx, dword [ebp - 0x23c]
sub edx, dword [ebp - 0x240]
sar edx, 1
mov dword [ebp - 0x248], edx
mov eax, dword [ebp - 0x248]
mov word [ebp + eax*2 - 0x212], 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
lea ecx, [ebp - 0x224]
call fcn.004156e0
lea edx, [ebp - 0x224]
push edx
mov ecx, dword [ebp - 0x228]
add ecx, 0x18
call fcn.004155a0
lea ecx, [ebp - 0x224]
call fcn.004154d0
mov ecx, dword [ebp + 8]
call fcn.00402120
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00404331
mov esp, ebp
pop ebp
ret 4