joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100d2e47
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc7
or edx, eax
mov dword [0x103a1cd7], edi
cmp edx, dword [0x103a1bde]
jno 0x100d2ebb
mov dword [ebp - 0x5c], esi
mov ecx, dword [ebp - 0xaa]
mov edi, dword [ebp - 0x82]
test ebx, 0xeed8d702
je 0x100d2eb8
mov dword [ebp - 0xbc], edi
mov dword [ebp - 0x40], esi
mov edx, edx
sub edx, dword [ebp - 0x5d]
movzx edi, al
mov dword [ebp - 0x82], edi
mov edi, dword [0x103a1b8e]
add dword [0x103a1791], esi
movzx edx, cl
mov dword [ebp - 0x84], ebx
mov dword [ebp - 0x3f], eax
mov esi, dword [ebp - 0x1f]
mov eax, 0x98ba
call sub.KERNEL32.dll_GetDiskFreeSpaceA
mov esi, dword [ebp - 9]
mov edi, ecx
mov ebx, dword [ebp - 0x21]
mov dword [ebp - 0x5f], esi
mov dword [ebp - 0x76], esi
mov ecx, ecx
sub edx, dword [ebp - 0x98]
lea ebx, [0x103a193c]
mov esi, esi
add edi, edi
add ecx, 0xabed
mov edi, dword [0x103a281c]
mov edx, 0x366f
mov esi, dword [ebp - 0x1d]
mov ebx, ecx
add byte [0x103a19ed], al
or eax, dword [0x103a2b8b]
lea ecx, [0x103a1236]
mov esi, dword [ebp - 0x92]
lea ecx, [ebp - 0x3e]
lea eax, [0x103a2334]
mov ebx, dword [0x103a1c9d]
xor ebx, dword [ebp - 0x7c]
sub edi, 0xa05e
mov cl, cl
mov eax, edx
mov eax, dword [ebp - 0x23]
mov esi, 0x3c8b
sub esi, dword [ebp - 0x92]
mov esi, dword [ebp - 0x58]
cmp ebx, 0x3e84c964
jns 0x100d2f36
push edi
mov esi, esi
add cx, word [ebp - 0xa5]
mov edi, 0xd08f
mov dword [ebp - 0x72], eax
pop esi
test dword [0x103a2286], edi
je 0x100d2f81
lea edi, [ebp - 0x9a]
test eax, eax
jb 0x100d2f5e
mov ebx, dword [ebp - 0x51]
mov dword [0x103a26ee], esi
mov eax, dword [0x103a2fdb]
movzx esi, dl
mov eax, esi
mov ebx, dword [0x103a17c7]
mov edx, 0xb06c
mov eax, dword [ebp - 0x1d]
mov eax, dword [ebp - 3]
add edi, ecx
mov ecx, esi
mov dword [0x103a29e9], edx
mov ebx, dword [ebp - 0x41]
test dword [0x103a1fab], edi
jb 0x100d2ff8
mov edi, 0xd6a9
cmp eax, dword [0x103a28ca]
js 0x100d2fb7
mov eax, dword [0x103a1bb1]
mov eax, dword [ebp - 0x6a]
sub ebx, dword [0x103a1417]
mov bl, byte [0x103a292c]
mov edi, ecx
mov ecx, ebx
mov ebx, dword [ebp - 0x71]
mov dword [ebp - 0x82], eax
mov edi, esi
mov esi, dword [ebp - 0xad]
mov edi, dword [str.jmz]
mov dl, byte [ebp - 0x15]
and eax, esi
mov di, 0x2cea
mov dword [ebp - 0x26], eax
mov esi, eax
mov esi, edx
mov di, word [0x103a114b]
mov di, word [ebp - 0x33]
mov esi, edi
mov dword [ebp - 7], ebx
mov eax, dword [ebp - 0x25]
mov eax, dword [ebp - 0x13]
mov edi, ecx
mov esi, edx
mov esi, 0xc7a2
mov edx, dword [0x103a314f]
mov edi, dword [0x103a2dd0]
mov edi, dword [ebp - 0x6d]
movzx eax, ah
mov ebx, dword [0x103a26c5]
mov dword [ebp - 8], ebx
leave
ret
Function at 0x100e366a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45
mov eax, dword [ebp - 1]
add esi, dword [0x103a2845]
mov ecx, dword [ebp - 0x20]
movzx edi, bh
sub edx, dword [0x103a2f24]
cmp edi, edx
js 0x100e368c
mov edi, dword [ebp - 0x37]
test dword [0x103a2bf8], esi
je 0x100e36a0
mov dword [ebp - 6], ecx
sub edi, dword [ebp - 0x2d]
mov ebx, dword [0x103a2afa]
cmp ecx, 0xaa3d3327
js 0x100e36ca
sub dword [0x103a2008], edx
mov edi, 0xf87c
add ebx, 0x90d8
and edx, edi
lea eax, [ebp - 0x32]
mov word [ebp - 0x23], cx
mov dword [ebp - 0x1f], edi
call sub.KERNEL32.dll_GetPrivateProfileSectionNamesW
sub eax, edx
mov esi, dword [ebp - 0x3e]
sub esi, dword [0x103a17a2]
sub ecx, dword [ebp - 0x1c]
cmp ecx, 0xead804dc
jb 0x100e36e0
sub edx, dword [0x103a2f04]
mov ebx, dword [ebp - 4]
mov eax, dword [ebp - 0xe]
mov ebx, dword [ebp - 0x3c]
movzx edx, cl
mov ebx, dword [0x103a2d09]
mov edi, dword [0x103a1f96]
mov dword [ebp - 0x39], esi
mov si, 0xbd98
add dword [ebp - 0x29], eax
test eax, eax
je 0x100e374a
mov esi, dword [ebp - 0x32]
add eax, dword [ebp - 0x19]
mov ebx, 0xab79
and dword [0x103a3151], edx
lea esi, [ebp - 0xf]
mov ecx, 0x8e70
movzx ecx, byte [ebp - 0x26]
mov eax, eax
movzx ecx, si
add edx, 0x5481
mov edi, ebx
mov edi, dword [0x103a16f9]
mov esi, dword [ebp - 2]
mov esi, dword [ebp - 0x13]
mov esi, dword [ebp - 0x21]
mov edi, dword [ebp - 0x2d]
and ebx, ebx
mov ebx, 0x3cd0
mov eax, dword [0x103a2642]
mov ecx, ebx
lea edi, [0x103a2033]
mov dword [0x103a2e64], esi
mov ecx, dword [0x103a2848]
mov dword [ebp - 0x3f], eax
mov di, word [ebp - 0x3f]
mov ecx, dword [ebp - 0x15]
cmp edx, 0x45a86579
jae 0x100e37e2
mov esi, dword [ebp - 0x2f]
sub eax, 0xf29a
and dword [ebp - 0x2d], edi
and esi, dword [ebp - 0x17]
mov esi, 0x31ba
mov dword [0x103a1139], ebx
add edi, dword [ebp - 6]
mov eax, edi
mov edi, dword [ebp - 0x2b]
mov dword [0x103a1bc9], ebx
cmp ebx, dword [0x103a237d]
jne 0x100e37c7
mov ebx, dword [ebp - 0x14]
or eax, dword [0x103a30fa]
mov esi, dword [0x103a1b42]
mov eax, dword [ebp - 0x17]
mov ebx, eax
mov word [ebp - 0x33], cx
mov edx, dword [0x103a17c5]
sub ecx, ecx
mov ecx, dword [0x103a158e]
sub bx, word [ebp - 0x43]
or esi, 0xdf89
lea edx, [0x103a12cc]
movzx edi, dh
leave
ret
Function at 0x100e6a98
Capabilities:
Connect pipe
Read pipe
Write pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov ecx, dword [0x103a1b37]
add ebx, 0x9144
sub eax, dword [ebp - 0x67]
cmp edx, dword [0x103a13ce]
js 0x100e6b23
mov dword [ebp - 0x67], edx
mov esi, eax
mov ecx, dword [0x103a2335]
sub edx, eax
or edx, ecx
and ebx, 0xad62
sub edx, dword [ebp - 0x43]
mov dword [ebp - 0x45], eax
movzx edi, ah
mov edi, dword [0x103a1d98]
movzx esi, byte [ebp - 0x32]
mov dword [ebp - 0xd], eax
mov al, dh
mov esi, esi
add eax, 0x7e88
mov dword [0x103a2b3e], eax
mov ebx, dword [0x103a1387]
mov esi, dword [0x103a1f88]
lea esi, [0x103a1d5b]
mov ch, byte [ebp - 0x46]
movzx edi, cl
add esi, ecx
mov eax, dword [0x103a16b2]
mov ebx, dword [ebp - 0x17]
xor eax, dword [ebp - 0x34]
add ebx, eax
mov edx, dword [0x103a2f87]
mov edi, dword [ebp - 0x50]
mov edx, ebx
and dword [ebp - 0x28], ecx
test edx, eax
jb 0x100e6b27
and eax, esi
mov bh, byte [ebp - 0x3e]
mov dword [ebp - 0x37], eax
test ecx, eax
jne 0x100e6b5d
mov eax, dword [ebp - 7]
mov dword [0x103a2984], ebx
cmp ebx, edi
js 0x100e6b5d
mov ecx, dword [0x103a28bc]
mov ebx, dword [0x103a1f80]
mov ecx, 0xedc4
mov ecx, dword [ebp - 0x50]
mov ebx, dword [ebp - 0x5d]
or ecx, dword [ebp - 0x5a]
mov ebx, dword [ebp - 0x56]
add dword [ebp - 0x21], edi
movzx ecx, bl
or edx, dword [0x103a174a]
mov ebx, dword [ebp - 0x2d]
sub dword [0x103a1322], esi
or ebx, dword [0x103a1324]
or esi, edi
xor esi, dword [ebp - 0x17]
lea ebx, [ebp - 0x54]
mov esi, dword [ebp - 0x66]
sub eax, 0x5ee5
cmp edx, edi
jns 0x100e6b8c
cmp edi, eax
js 0x100e6b90
cmp ax, word [0x103a18d0]
jo 0x100e6bde
lea ebx, [ebp - 0x4d]
mov ecx, dword [0x103a18f1]
mov esi, dword [ebp - 0x54]
mov ecx, 0xcd4b
movzx edi, bl
sub ebx, dword [0x103a2bec]
mov edi, dword [ebp - 0x2e]
mov edi, dword [ebp - 0x16]
mov dword [ebp - 0x28], ecx
mov eax, dword [ebp - 0x3e]
or edi, dword [0x103a1e42]
mov ebx, dword [ebp - 0x4a]
mov ecx, dword [0x103a1bd6]
call sub.KERNEL32.dll_CallNamedPipeW
sub eax, 0x435b
movzx edi, bl
movzx eax, ch
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x403161
lcall 0x5de5, 0x8b10c483
jmp loc.00791034

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4047d0
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x3efc]
test eax, eax
je 0x404817
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x4048d0
mov ecx, dword [esi + 0x3efc]
lea eax, [esi + 0x4ff4]
push eax
push ecx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov edx, dword [esi + 0x3efc]
push 5
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x10
ret
lea eax, [esp + 4]
push 0
push eax
mov ecx, esi
call fcn.00404450
mov edx, dword [0x5dc944]
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push 0
push edx
mov edx, dword [esi + 4]
sub eax, ecx
push 0
push edx
mov edx, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x18]
sub edx, eax
push edx
push ecx
push eax
push 0x44000080
push 0x559900
push str.edit
push 0x20
call dword [sym.imp.USER32.dll_CreateWindowExW]
push 0xfffffffffffffffc
push eax
mov dword [esi + 0x3efc], eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov dword [esi + 0x3ef4], eax
mov eax, dword [esi + 0x3efc]
push esi
push str.CLASSPROC
push eax
call dword [sym.imp.USER32.dll_SetPropW]
mov ecx, dword [esi + 0x3efc]
push 0x403d00
push 0xfffffffffffffffc
push ecx
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, esi
call fcn.00404ba0
mov ecx, esi
call fcn.00404a80
mov eax, dword [esi + 0x3efc]
lea edx, [esi + 0x4ff4]
push edx
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x3efc]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
add esp, 0x10
ret

Function at 0x406703
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 8
push esi
mov esi, ecx
push 2
call fcn.004ff490
mov eax, dword [esp + 0x14]
push 1
movsx ecx, ax
shr eax, 0x10
movsx edx, ax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], edx
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x406757
mov eax, dword [esi + 0x7084]
cmp eax, 0xffffffff
je 0x406757
cmp eax, dword [esp + 4]
jne 0x406750
mov eax, dword [esi + 0x7088]
mov ecx, dword [esp + 8]
cmp eax, ecx
je 0x406757
mov ecx, esi
call fcn.00407ae0
mov ecx, esi
call fcn.00406450
mov edx, dword [esi + 0x3ef8]
mov ecx, 0x20
cmp edx, ecx
jne 0x40677d
test eax, eax
je 0x406790
mov dword [esi + 0x3ef8], 0x10
jmp 0x406787
test eax, eax
jne 0x406790
mov dword [esi + 0x3ef8], ecx
push 1
mov ecx, esi
call fcn.00407390
lea ecx, [esp + 4]
push ecx
mov ecx, esi
call fcn.004065a0
test eax, eax
je 0x4067a7
push 0x7f01
jmp 0x4067b7
mov ecx, esi
call fcn.00406530
test eax, eax
je 0x4067c6
push 0x7f89
push 0
call dword [sym.imp.USER32.dll_LoadCursorW]
push eax
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, esi
call fcn.004073c0
pop esi
add esp, 8
ret 8
Function at 0x407a20
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, ecx
push 0
mov dword [esi + 0x1e4c], 0
mov dword [esi + 0x1e50], 0
call fcn.00407990
push 1
push 0
mov ecx, esi
call fcn.00407310
mov eax, dword [esi + 0x3efc]
push 0x559900
push eax
mov dword [esi + 0x1e58], 1
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ecx, dword [esi + 0x3efc]
push 0
push ecx
mov dword [esi + 0x1e58], 0
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
mov ecx, esi
call fcn.00407bf0
push 0x559900
mov ecx, esi
call fcn.004062b0
push eax
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x407aae
mov edx, dword [esi + 4]
push 1
push eax
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
pop esi
ret

Function at 0x408fc0
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x2090
call fcn.0050c9c0
mov eax, dword [0x55a3c0]
push edi
test eax, eax
mov edi, ecx
je 0x408fe3
mov eax, 0x55a3c4
pop edi
add esp, 0x2090
ret
push ebx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
add edi, 0x64
push 0x5c
push edi
mov esi, eax
call dword [sym.imp.MSVCRT.dll_wcsrchr]
add esp, 8
mov edi, eax
lea eax, [esp + 0x10]
push esi
push 0x528430
push 0x1047
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ebx, dword [sym.imp.SHLWAPI.dll_StrStrIW]
add esp, 0x10
lea ecx, [esp + 0x10]
push edi
push ecx
call ebx
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
mov esi, eax
test esi, esi
je 0x40903f
push edi
call ebp
lea esi, [esi + eax*2]
add esp, 4
test esi, esi
jne 0x40905d
lea esi, [edi + 2]
lea edx, [esp + 0x10]
push esi
push edx
call ebx
mov edi, eax
test edi, edi
je 0x4090cc
push esi
call ebp
lea esi, [edi + eax*2]
add esp, 4
test esi, esi
je 0x4090cc
push 0x528654
push esi
call ebx
test eax, eax
je 0x40906e
lea esi, [eax + 4]
jmp 0x409086
push 2
push 0x52864c
push esi
call dword [sym.imp.MSVCRT.dll_wcsncmp]
add esp, 0xc
test eax, eax
jne 0x409086
add esi, 4
cmp word [esi], 0
je 0x4090cc
push esi
push 0x528430
push 0x1047
push 0x55a3c4
call dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x55a3c4
mov word [0x55c452], 0
call fcn.004b6920
push 0x55a3c4
call fcn.004b7020
push 0x55a3c4
call fcn.004b6920
add esp, 0x1c
pop esi
pop ebp
pop ebx
mov dword [0x55a3c0], 1
mov eax, 0x55a3c4
pop edi
add esp, 0x2090
ret
Function at 0x409210
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x20c
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [esp + 0x10]
lea eax, [esi + 0x64]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_wcscpy]
lea edx, [esp + 0x18]
push edx
call fcn.0043bcd0
lea eax, [esp + 0x1c]
push eax
call fcn.004b69f0
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
test eax, eax
mov dword [esi + 0xc], eax
je 0x4093b4
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4093b4
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, 1
mov ecx, esi
call fcn.004090f0
test eax, eax
mov dword [0x5d7584], eax
jne 0x4092a0
push 0x64
call ebx
mov edx, edi
inc edi
cmp edx, 0x14
jb 0x409277
mov eax, dword [0x5d7584]
test eax, eax
je 0x4093b4
mov eax, dword [esi + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc], 0
mov edx, dword [0x5d7584]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], 0
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov edi, dword [esp + 0x21c]
cmp word [edi], 0
jne 0x409329
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x409303
push str.PhoenixStudioTaiHang_Simple_Message
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 1
push eax
mov dword [esi + 0x2c], eax
call fcn.004b9660
add esp, 8
mov ecx, dword [esi + 0x2c]
mov edx, dword [0x5d7584]
push 0
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push 0x528674
push edi
call dword [sym.imp.MSVCRT.dll_wcscmp]
add esp, 8
test eax, eax
jne 0x409385
mov eax, dword [esi + 0x2c]
test eax, eax
jne 0x40935c
push str.PhoenixStudioTaiHang_Simple_Message
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push 1
push eax
mov dword [esi + 0x2c], eax
call fcn.004b9660
add esp, 8
mov eax, dword [esi + 0x2c]
mov ecx, dword [0x5d7584]
push 0x1e0000
push 0xffffffffffffffff
push eax
push ecx
call dword [sym.imp.USER32.dll_PostMessageW]
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
push edi
mov ecx, esi
call fcn.0040abf0
test eax, eax
je 0x4093a3
mov edx, dword [0x5d7584]
push edi
push 0
push edx
call fcn.0044ccd0
add esp, 0xc
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x20c
ret 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x20c
ret 4
Function at 0x4096c0
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x410
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x212]
mov word [esp + 0x210], si
push 0x103
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x420]
stosw word es:[edi], ax
lea eax, [esp + 0x214]
push eax
push 0x5286d0
push ecx
call fcn.0044c1d0
add esp, 0x10
test eax, eax
je 0x40976e
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], si
rep stosd dword es:[edi], eax
lea edx, [esp + 8]
push edx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x527a58
push 0x559b94
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea eax, [esp + 8]
push 1
push eax
push 0x55998c
call esi
push 2
lea ecx, [esp + 0x214]
push 0x55998c
push ecx
call esi
lea edx, [esp + 8]
push 1
push edx
call fcn.004b7f10
add esp, 8
pop edi
pop esi
add esp, 0x410
ret 4

Function at 0x409780
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x208
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xa]
mov word [esp + 8], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
lea eax, [esp + 8]
push 0x103
push eax
push 0x5286d0
push esi
call fcn.0044c1d0
add esp, 0x10
test eax, eax
je 0x409809
cmp word [esp + 8], 0
je 0x409809
push 0
push 0x5286ec
push esi
call fcn.0044c140
add esp, 0xc
cmp eax, 1
jne 0x4097f8
lea ecx, [esp + 8]
push eax
push ecx
call fcn.0043c5a0
add esp, 8
pop edi
pop esi
add esp, 0x208
ret 4
lea edx, [esp + 8]
push edx
call fcn.00404a10
mov ecx, eax
call fcn.0042ca10
pop edi
pop esi
add esp, 0x208
ret 4
Function at 0x409820
Capabilities:
Set registry value

Disassembly:
sub esp, 0x41c
push esi
mov edx, ecx
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], si
rep stosd dword es:[edi], eax
mov ecx, edx
stosw word es:[edi], ax
call fcn.0040a360
push eax
lea eax, [esp + 0x18]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov cx, word [0x559900]
xor eax, eax
mov word [esp + 0x228], cx
mov ecx, 0x81
lea edi, [esp + 0x22a]
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
push edx
mov dword [esp + 0x1c], esi
stosw word es:[edi], ax
call dword [sym.imp.MSVCRT.dll_time]
lea eax, [esp + 0x24]
push esi
lea ecx, [esp + 0x1c]
push eax
push ecx
mov dword [esp + 0x24], esi
call fcn.00491690
mov eax, dword [esp + 0x24]
add esp, 0x1c
cmp eax, esi
je 0x4098eb
lea edx, [esp + 0x21c]
push 0x103
push edx
push 0x5287a8
push str.Main
push eax
call fcn.00491ed0
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x1c]
push eax
push str.UsedTime
push str.Main
push ecx
call fcn.004920c0
lea edx, [esp + 0x2c]
push esi
push edx
call fcn.00491880
add esp, 0x2c
mov edi, dword [esp + 0x428]
mov eax, dword [0x5d6c30]
cmp edi, esi
je 0x40990f
cmp eax, esi
je 0x40992a
cmp dword [esp + 0x42c], esi
je 0x40992a
call fcn.004b9ca0
jmp 0x40992a
cmp eax, esi
je 0x409921
cmp dword [esp + 0x42c], esi
jne 0x409921
call fcn.004b9cb0
push esi
call fcn.00421b80
add esp, 4
cmp dword [0x5d6c3c], esi
je 0x409958
cmp edi, esi
je 0x409958
lea eax, [esp + 0x10]
push 4
push eax
push 4
push str.160A
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_SettingsZones3
push SysReAllocStringLen
mov dword [esp + 0x28], esi
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop edi
pop esi
add esp, 0x41c
ret 8

Function at 0x409e40
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
mov dword [esi + 0x60], 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0x5c], eax
lea eax, [esp + 4]
push eax
push 0
push 0
push 0x409ce0
push 0
push 0
mov dword [esp + 0x1c], 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x409e82
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xc]
push ecx
mov ecx, esi
call fcn.00409f50
pop esi
pop ecx
ret 4

Function at 0x409f00
Capabilities:
Create thread

Disassembly:
push ecx
push esi
push 0
push 0
push 1
mov esi, ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
test eax, eax
mov dword [esi + 4], eax
je 0x409f46
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push esi
push 0x409ea0
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x409f46
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x40a0b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x470
push ebx
push esi
xor ebx, ebx
mov esi, ecx
xor eax, eax
push ebx
mov dword [esp + 0x20], eax
push ebx
lea ecx, [esp + 0x20]
push 1
mov dword [esp + 0x2c], eax
push ecx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x30], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
cmp eax, ebx
mov dword [esi + 0x20], eax
je 0x40a1d1
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x6e]
mov word [esp + 0x6c], bx
mov word [esp + 0x274], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x276]
lea edx, [esp + 0x6c]
rep stosd dword es:[edi], eax
push 0x103
push edx
push ebx
stosw word es:[edi], ax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
mov eax, dword [esi + 0x20]
push 0x5286e4
push eax
push 0x5286d0
push 0xc
lea ecx, [esp + 0x80]
push str._tp:
push ecx
push str._s__s_d__s_d__s_d
lea edx, [esp + 0x294]
push 0x103
push edx
call dword [sym.imp.MSVCRT.dll__snwprintf]
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x54]
add esp, 0x28
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
lea edx, [esp + 0x28]
push ecx
mov dword [esp + 0x14], eax
push edx
push ebx
mov dword [esp + 0x20], eax
push ebx
push ebx
mov dword [esp + 0x2c], eax
push 1
push ebx
lea eax, [esp + 0x290]
push ebx
push eax
push ebx
mov dword [esp + 0x50], 0x44
mov dword [esp + 0x7c], 0x80
mov dword [esp + 0x34], ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x40a1d1
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop esi
pop ebx
add esp, 0x470
ret

Function at 0x40a1e0
Capabilities:
Create thread

Disassembly:
push ecx
push esi
mov esi, ecx
call fcn.0040be20
test eax, eax
je 0x40a21a
lea eax, [esp + 4]
mov dword [esp + 4], 0
push eax
push 0
push esi
push 0x40bc30
push 0
push 0
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x40a21a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ecx
ret
Function at 0x40a250
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x5d6c28]
sub esp, 0x28
push esi
push edi
xor edi, edi
mov esi, ecx
cmp eax, edi
jne 0x40a26a
pop edi
xor eax, eax
pop esi
add esp, 0x28
ret
push edi
mov dword [esp + 0x24], 0x4df0c730
mov word [esp + 0x28], 0xdf9d
mov word [esp + 0x2a], 0x4ae3
mov byte [esp + 0x2c], 0x91
mov byte [esp + 0x2d], 0x53
mov byte [esp + 0x2e], 0xaa
mov byte [esp + 0x2f], 0x6b
mov byte [esp + 0x30], 0x82
mov byte [esp + 0x31], 0xe9
mov byte [esp + 0x32], 0x79
mov byte [esp + 0x33], 0x5a
mov dword [esp + 0x14], 0x8be2d872
mov word [esp + 0x18], 0x86aa
mov word [esp + 0x1a], 0x4d47
mov byte [esp + 0x1c], 0xb7
mov byte [esp + 0x1d], 0x76
mov byte [esp + 0x1e], 0x32
mov byte [esp + 0x1f], 0xcc
mov byte [esp + 0x20], 0xa4
mov byte [esp + 0x21], 0xc
mov byte [esp + 0x22], 0x70
mov byte [esp + 0x23], 0x18
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [esp + 8]
lea ecx, [esp + 0x10]
push eax
push ecx
push 3
lea edx, [esp + 0x2c]
push edi
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x40a34e
mov eax, dword [esp + 8]
cmp eax, edi
je 0x40a34e
lea edx, [esp + 0xc]
add esi, 0x26c
push edx
mov dword [esp + 0x10], edi
mov ecx, dword [eax]
push 1
push esi
push eax
call dword [ecx + 0x28]
test eax, eax
jne 0x40a344
mov eax, dword [esp + 0xc]
cmp eax, edi
je 0x40a344
mov ecx, dword [eax]
push eax
mov edi, 1
call dword [ecx + 8]
mov eax, dword [esp + 8]
push eax
mov edx, dword [eax]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop esi
add esp, 0x28
ret

Function at 0x40a360
Capabilities:
Set file attributes

Disassembly:
cmp word [0x55d4a0], 0
jne 0x40a3be
push 0x103
push 0x55d4a0
call fcn.0040b790
push 0
push 0x55d4a0
mov dword [0x6029d0], eax
call fcn.0043bab0
add esp, 8
test eax, eax
je 0x40a3a7
push 0x80
push 0x55d4a0
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, 0x55d4a0
ret
push 0x55d4a0
call fcn.0043bec0
push 0x55d4a0
call fcn.0044dee0
add esp, 8
mov eax, 0x55d4a0
ret