joyce8/EMBER2024-capa huggingface dataset:
Function at 0x451bd0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
push ebx
test edx, edx
push esi
je 0x451c49
mov esi, dword [esp + 0x14]
test esi, esi
je 0x451c49
mov ecx, dword [esp + 0x10]
test ecx, ecx
jle 0x451c49
mov ebx, dword [esp + 0x18]
test ebx, ebx
jle 0x451c49
push ebp
mov ebp, ecx
push edi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, ebp
and ecx, 3
test ebx, ebx
rep stosb byte es:[edi], al
jle 0x451c42
mov ecx, dword [esp + 0x24]
sub esi, edx
mov edi, ebx
mov al, byte [esi + edx]
xor ebx, ebx
mov bl, ch
xor al, bl
mov byte [edx], al
movzx ax, al
add eax, ecx
lea ecx, [eax + eax*2]
shl ecx, 4
sub ecx, eax
lea ecx, [ecx + ecx*2]
lea ecx, [ecx + ecx*4]
lea ecx, [ecx + ecx*8]
lea eax, [eax + ecx*2]
mov ecx, 0x58bf
sub ecx, eax
inc edx
dec edi
jne 0x451c12
pop edi
pop ebp
pop esi
xor eax, eax
pop ebx
ret
pop esi
or eax, 0xffffffff
pop ebx
ret

Function at 0x4544a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e3a8
push 0x1000e318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor eax, eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x1c], 1
mov edi, 0x1000000
mov dword [ebp - 0x1c], edi
mov ebx, dword [ebp + 0xc]
push ebx
mov eax, dword [ebp + 8]
push eax
call fcn.00454970
add esp, 8
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x45459a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], 0x100
mov dword [ebp - 0x1c], 0x101
mov edi, 0x1010000
mov dword [ebp - 0x1c], edi
push ebx
call dword [0x1001e264]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x454537
call dword [0x1001e0ec]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 2
jne 0x45459a
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x1c], 0x101
mov dword [ebp - 0x1c], 0x102
Function at 0x454d10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edx, dword [0x10023a88]
mov dword [ecx], edx
mov eax, dword [0x10023a8c]
mov dword [ecx + 4], eax
mov edx, dword [0x10023a90]
mov dword [ecx + 8], edx
mov eax, dword [0x10023a94]
jmp 0x4554c1
mov dword [ecx + 0xc], eax
push 1
call fcn.004546f0
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
test edi, edi
je 0x4555a2
mov byte [ebp - 0x1b8], 0x53
mov byte [ebp - 0x1b7], 0x74
mov byte [ebp - 0x1b6], 0x65
mov byte [ebp - 0x1b5], 0x70
mov byte [ebp - 0x1b4], 0x28
mov byte [ebp - 0x1b3], 0x25
mov byte [ebp - 0x1b2], 0x78
mov byte [ebp - 0x1b1], 0x29
mov byte [ebp - 0x1b0], 0x2c
mov byte [ebp - 0x1af], 0x20
mov byte [ebp - 0x1ae], 0x45
mov byte [ebp - 0x1ad], 0x72
mov byte [ebp - 0x1ac], 0x72
mov byte [ebp - 0x1ab], 0x28
mov byte [ebp - 0x1aa], 0x30
mov byte [ebp - 0x1a9], 0x78
mov byte [ebp - 0x1a8], 0x25
mov byte [ebp - 0x1a7], 0x78
mov byte [ebp - 0x1a6], 0x29
mov byte [ebp - 0x1a5], 0
push edi
push ebx
lea ecx, [ebp - 0x1b8]
push ecx
sub esp, 0x10
mov edx, esp
mov eax, dword [0x100239e8]
mov dword [edx], eax
mov ecx, dword [0x100239ec]
mov dword [edx + 4], ecx
mov eax, dword [0x100239f0]
mov dword [edx + 8], eax
mov ecx, dword [0x100239f4]
mov dword [edx + 0xc], ecx
push 1
call fcn.004546f0
add esp, 0x20
mov eax, dword [ebp - 0x134]
test eax, eax
je 0x4555b7
push eax
mov esi, dword [0x1001e268]
call esi
jmp 0x4555bd
mov esi, dword [0x1001e268]
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x4555c7
push eax
call esi
mov eax, dword [ebp - 0x148]
test eax, eax
je 0x4555d4
push eax
call esi
mov eax, edi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c66ca
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
cld
mov dl, 0x80
movsb byte es:[edi], byte [esi]
call fcn.100c6749
jae 0x100c66d6
xor ecx, ecx
call fcn.100c6749
jae 0x100c6700
xor eax, eax
call fcn.100c6749
jae 0x100c6711
mov al, 0x10
call fcn.100c6749
adc al, al
jae 0x100c66f2
jne 0x100c673e
stosb byte es:[edi], al
jmp 0x100c66d7
call fcn.100c6755
dec ecx
loop 0x100c671d
mov eax, ebp
call fcn.100c6753
jmp 0x100c673f
lodsb al, byte [esi]
shr eax, 1
je 0x100c6765
adc ecx, 2
mov ebp, eax
jmp 0x100c673f
xchg ecx, eax
dec eax
shl eax, 8
lodsb al, byte [esi]
mov ebp, eax
call fcn.100c6753
cmp eax, 0x7d00
jae 0x100c673d
cmp eax, 0x500
jae 0x100c673e
cmp eax, 0x7f
ja 0x100c673f
inc ecx
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x100c66d7
pop ebp
ret 8

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x403c30
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x114], ecx
mov esi, edx
mov ebx, eax
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x403d2b
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
jne 0x403c84
push 0x105
lea eax, [ebp - 0x10d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [ebp - 0x10d]
mov eax, esi
call fcn.00401b3c
jmp 0x403d12
call sub.kernel32.dll_GetCommandLineA
mov dword [edi], eax
mov eax, dword [edi]
call fcn.00403bb8
mov dword [edi], eax
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov eax, dword [edi]
call fcn.00403be0
mov dword [edi], eax
test ebx, ebx
je 0x403cb2
dec ebx
test ebx, ebx
jl 0x403cb2
mov eax, dword [edi]
cmp eax, dword [ebp - 8]
jne 0x403c8b
push esi
lea eax, [ebp - 0x114]
mov edx, dword [ebp - 8]
call fcn.00401b94
mov eax, dword [ebp - 0x114]
mov ecx, dword [edi]
sub ecx, dword [ebp - 8]
mov edx, 1
call fcn.00401e30
mov eax, dword [esi]
call fcn.00401bdc
cmp eax, 2
jl 0x403d12
mov eax, dword [esi]
cmp byte [eax], 0x22
jne 0x403d12
mov eax, dword [esi]
call fcn.00401bdc
mov edx, dword [esi]
cmp byte [edx + eax - 1], 0x22
jne 0x403d12
push esi
mov eax, dword [esi]
call fcn.00401bdc
mov ecx, eax
sub ecx, 2
mov eax, dword [esi]
mov edx, 2
call fcn.00401e30
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403d32
lea eax, [ebp - 0x114]
call fcn.00401a50
ret
Function at 0x403d8c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe8c
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x174], ecx
mov dword [ebp - 0x170], ecx
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 8], ecx
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x403ee0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00401a50
lea eax, [ebp - 4]
mov edx, esi
call fcn.00401ae8
jmp 0x403e7b
lea ecx, [ebp - 8]
lea eax, [ebp - 4]
mov edx, 0x403ef8
call fcn.004039f0
cmp dword [ebx], 0
je 0x403dfa
mov eax, ebx
mov edx, 0x403ef8
call fcn.00401be4
cmp dword [ebx], 0
jne 0x403e21
mov eax, dword [ebp - 8]
call fcn.00401bdc
cmp eax, 2
jne 0x403e21
mov eax, dword [ebp - 8]
cmp byte [eax + 1], 0x3a
jne 0x403e21
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00401aa4
jmp 0x403e7b
push 0x200
push 0x160
lea eax, [ebp - 0x168]
push eax
push 0
mov edx, dword [ebx]
lea eax, [ebp - 0x16c]
mov ecx, dword [ebp - 8]
call fcn.00401c28
mov eax, dword [ebp - 0x16c]
call fcn.00401dd4
push eax
call sub.shell32.dll_SHGetFileInfoA
cmp byte [ebp - 0x15c], 0
je 0x403e71
lea eax, [ebp - 8]
lea edx, [ebp - 0x15c]
mov ecx, 0x104
call fcn.00401bc4
mov eax, ebx
mov edx, dword [ebp - 8]
call fcn.00401be4
cmp dword [ebp - 4], 0
jne 0x403dd9
lea edx, [ebp - 0x170]
mov eax, dword [ebx]
call fcn.004040c8
cmp dword [ebp - 0x170], 0
jne 0x403eb5
lea edx, [ebp - 0x174]
mov eax, esi
call fcn.004040c8
mov edx, dword [ebp - 0x174]
mov eax, ebx
call fcn.00401be4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403ee7
lea eax, [ebp - 0x174]
mov edx, 3
call fcn.00401a74
lea eax, [ebp - 8]
mov edx, 2
call fcn.00401a74
ret

Function at 0x404208
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x404272
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00401b94
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404040
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404279
lea eax, [ebp - 0x10c]
call fcn.00401a50
ret

Function at 0x404280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4042ea
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x10c]
lea edx, [ebp - 0x105]
call fcn.00401b94
mov eax, dword [ebp - 0x10c]
mov edx, ebx
call fcn.00404040
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4042f1
lea eax, [ebp - 0x10c]
call fcn.00401a50
ret

Function at 0x4042f8
Capabilities:
Get common file path

Disassembly:
push eax
sub esp, 0x108
push esp
push 0x105
call sub.kernel32.dll_GetTempPathA
mov edx, esp
mov eax, dword [esp + 0x108]
call fcn.00401b94
add esp, 0x108
pop edx
mov eax, dword [edx]
call fcn.00404040
ret
Function at 0x404328
Capabilities:
Get disk size

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff44
mov edi, edx
mov esi, eax
xor ebx, ebx
mov dword [esp + 0x20], 0x94
lea eax, [esp + 0x20]
push eax
call sub.kernel32.dll_GetVersionExA
xor eax, eax
mov edx, dword [esp + 0x30]
cmp edx, 2
jne 0x40435e
cmp dword [esp + 0x24], 4
setae al
jmp 0x40438c
cmp edx, 1
jne 0x40438c
mov edx, dword [esp + 0x24]
cmp edx, 4
seta al
test al, al
jne 0x40438c
cmp edx, 4
jne 0x40438c
cmp dword [esp + 0x28], 0
seta al
test al, al
jne 0x40438c
cmp word [esp + 0x2c], 0x1111
setae al
test al, al
je 0x4043a9
push 0x404418
call sub.kernel32.dll_GetModuleHandleA_1
mov ebx, eax
push 0x404424
push ebx
call sub.kernel32.dll_GetProcAddress
mov ebx, eax
test ebx, ebx
je 0x4043c4
push edi
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x18]
push eax
mov eax, esi
call fcn.00401dd4
push eax
call ebx
jmp 0x40440c
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0xc]
push eax
mov eax, esi
call fcn.00401dd4
push eax
call sub.kernel32.dll_GetDiskFreeSpaceA
lea ecx, [esp + 0xb4]
mov eax, dword [esp]
imul dword [esp + 4]
xor edx, edx
call fcn.00403780
lea eax, [esp + 0xb4]
mov ecx, edi
mov edx, dword [esp + 8]
call fcn.00408e64
add esp, 0xbc
pop edi
pop esi
pop ebx
ret

Function at 0x4049a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff4
mov esi, edx
mov ebx, eax
mov dword [esp + 8], 4
xor eax, eax
mov dword [esp], eax
test ebx, ebx
je 0x4049e8
lea eax, [esp + 8]
push eax
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
push 0
mov eax, esi
call fcn.00401dd4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4049e8
cmp dword [esp + 4], 4
je 0x4049ed
xor eax, eax
mov dword [esp], eax
mov eax, dword [esp]
add esp, 0xc
pop esi
pop ebx
ret

Function at 0x4049f8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
add eax, 0xfffffff8
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x14]
push eax
mov eax, dword [ebp + 8]
add eax, 0xfffffffc
push eax
push 0
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0x10]
call fcn.00401dd4
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete al
pop ebp
ret
Function at 0x404a34
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0xc], eax
mov eax, ebx
call fcn.00401a50
cmp dword [ebp - 0xc], 0
je 0x404ada
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 0x14], eax
push ebp
call fcn.004049f8
pop ecx
test al, al
je 0x404ada
cmp dword [ebp - 4], 1
je 0x404a77
cmp dword [ebp - 4], 2
jne 0x404ada
mov eax, dword [ebp - 8]
call fcn.00401154
mov dword [ebp - 0x14], eax
push ebp
call fcn.004049f8
pop ecx
test al, al
je 0x404ad2
cmp dword [ebp - 4], 2
jne 0x404ac8
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov edi, eax
mov eax, edi
call fcn.00401154
mov esi, eax
push edi
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_ExpandEnvironmentStringsA
mov eax, ebx
mov edx, esi
call fcn.00401b94
mov eax, esi
call fcn.0040116c
jmp 0x404ad2
mov eax, ebx
mov edx, dword [ebp - 0x14]
call fcn.00401b94
mov eax, dword [ebp - 0x14]
call fcn.0040116c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404b68
Capabilities:
Query or enumerate registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov esi, edx
mov ebx, eax
test ebx, ebx
je 0x404b95
lea eax, [esp + 4]
push eax
push 0
lea eax, [esp + 8]
push eax
push 0
mov eax, esi
call fcn.00401dd4
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404b99
xor eax, eax
jmp 0x404b9b
mov al, 1
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x404bd8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x404c98
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.0040b408
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push 0
push edi
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x404c82
cmp dword [ebp - 8], 0
jbe 0x404c80
mov eax, dword [ebp - 8]
inc eax
call fcn.00401154
mov ebx, eax
xor esi, esi
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
jmp 0x404c5e
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00401b94
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040b3f8
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
inc esi
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
push ebx
push esi
push edi
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
jne 0x404c41
mov eax, ebx
call fcn.0040116c
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c9f
lea eax, [ebp - 0x10]
call fcn.00401a50
ret
Function at 0x4054d4
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffffc
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
cmp byte [ebx + 0x18], 0
jne 0x405550
mov byte [ebp - 0x1004], 0
mov eax, dword [ebx + 0x19]
call fcn.00401dd4
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
mov eax, esi
call fcn.00401dd4
push eax
mov eax, dword [ebp - 4]
call fcn.00401dd4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401dd4
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
test eax, eax
je 0x405547
mov eax, edi
lea edx, [ebp - 0x1004]
mov ecx, 0x1000
call fcn.00401bc4
jmp 0x405581
mov eax, edi
call fcn.00401a50
jmp 0x405581
mov eax, edi
mov edx, esi
call fcn.00401aa4
mov eax, dword [ebx + 0x19]
call fcn.00401dd4
push eax
mov eax, esi
call fcn.00401dd4
push eax
mov eax, dword [ebp - 4]
call fcn.00401dd4
push eax
mov eax, dword [ebx + 0x1d]
call fcn.00401dd4
push eax
call sub.kernel32.dll_WritePrivateProfileStringA
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4091e8
Capabilities:
Get file attributes

Disassembly:
call fcn.00403288
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x4091fc
dec eax
and al, 0x10
sete al
ret

Function at 0x40926c
Capabilities:
Get file attributes

Disassembly:
push ebx
push eax
push 0x8001
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x409287
dec eax
and al, 0x10
setne al
xchg ebx, eax
push eax
call sub.kernel32.dll_SetErrorMode
xchg ebx, eax
pop ebx
ret

Function at 0x40a7cc
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x37], 0xef
test dl, dl
je 0x40a7d8
or byte [eax + 0x37], 0x10
mov byte [eax + 0x52], dl
mov ecx, dword [eax + 0x28]
jecxz 0x40a7f4
push eax
je 0x40a7f5
call dword [0x418110]
pop eax
push 5
push dword [eax + 0x28]
call sub.user32.dll_ShowWindow
ret
mov byte [eax + 0x177], dl
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x418110]
ret

Function at 0x40bcbc
Capabilities:
Capture screenshot

Disassembly:
push ebx
mov ebx, eax
call fcn.0040bbb8
je 0x40bcee
mov eax, ebx
push edx
call fcn.004078d0
pop edx
cmp eax, edx
je 0x40bcee
test edx, edx
mov eax, ebx
jne 0x40bce0
pop ebx
inc edx
jmp fcn.004078c0
mov byte [ebx + 0x49], dl
xor edx, edx
call fcn.004078c0
xchg ebx, eax
cmp eax, 0
pop ebx
jne fcn.0040bd0c
ret
Function at 0x40cb6c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov word [ebp - 2], cx
mov edi, edx
mov esi, eax
push 0
push 0x8000080
push 3
push 0
push 1
push 0xc0000000
push esi
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40cba0
xor eax, eax
jmp 0x40cbf1
lea eax, [ebp - 0xc]
push eax
mov ax, word [ebp - 2]
push eax
push edi
call sub.kernel32.dll_DosDateTimeToFileTime
test eax, eax
je 0x40cbd4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_LocalFileTimeToFileTime
test eax, eax
je 0x40cbd4
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
push ebx
call sub.kernel32.dll_CloseHandle
mov ax, word [ebp + 8]
and ax, 0x27
movzx eax, ax
push eax
push esi
call sub.kernel32.dll_SetFileAttributesA
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40de94
Capabilities:
Identify system language via api

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], eax
mov edx, dword [0x418698]
mov edx, dword [edx]
mov eax, dword [esp]
mov eax, dword [eax + 0x18]
call fcn.0040a770
mov ebp, 0xff
mov eax, 0x1a
call fcn.00414994
mov esi, eax
dec esi
test esi, esi
jl 0x40df06
inc esi
xor ebx, ebx
mov edi, ebx
shl edi, 2
mov eax, dword [0x418634]
mov eax, dword [eax]
mov edx, dword [eax + edi*4]
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
call fcn.0040b060
mov eax, dword [0x418634]
mov eax, dword [eax]
mov eax, dword [eax + edi*4 + 4]
call fcn.00408fe4
push eax
call sub.kernel32.dll_GetUserDefaultLangID
movzx eax, ax
pop edx
cmp edx, eax
jne 0x40df02
mov ebp, ebx
inc ebx
dec esi
jne 0x40dec8
cmp ebp, 0xff
jne 0x40df46
mov eax, 0x1a
call fcn.00414994
mov esi, eax
dec esi
test esi, esi
jl 0x40df46
inc esi
xor ebx, ebx
mov eax, ebx
shl eax, 2
mov edx, dword [0x418634]
mov edx, dword [edx]
mov eax, dword [edx + eax*4]
mov edx, 0x40df6c
call fcn.00401d20
jne 0x40df42
mov ebp, ebx
jmp 0x40df46
inc ebx
dec esi
jne 0x40df22
cmp ebp, 0xff
jne 0x40df50
xor ebp, ebp
mov eax, dword [esp]
mov eax, dword [eax + 0x24]
mov edx, ebp
call fcn.0040b304
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x40fc10
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebx
add esp, 0xfffffefc
mov ebx, edx
mov dword [esp], pe_nt_image_headers32
test al, al
je 0x40fc31
push esp
lea eax, [esp + 8]
push eax
call sub.advapi32.dll_GetUserNameA
jmp 0x40fc3c
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov eax, ebx
lea edx, [esp + 4]
mov ecx, pe_nt_image_headers32
call fcn.00401bc4
add esp, 0x104
pop ebx
ret

Function at 0x40fc54
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffc10
mov ebx, edx
push esp
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, dword [esp]
push eax
call sub.ole32.dll_CoTaskMemFree
mov eax, ebx
lea edx, [esp + 4]
mov ecx, 0x3e9
call fcn.00401bc4
add esp, 0x3f0
pop ebx
ret
Function at 0x411658
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x48], edx
mov dword [ebp - 8], edx
mov byte [ebp - 1], al
xor eax, eax
push ebp
push 0x4117f2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x418644]
mov eax, dword [eax]
mov edx, dword [eax + 0xe4]
mov eax, dword [0x4197b8]
mov eax, dword [eax + 0x5c]
call fcn.0040a770
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.0040acd8
mov eax, 0x28
call fcn.00414994
mov edi, eax
dec edi
test edi, edi
jl 0x4117cf
inc edi
xor ebx, ebx
mov esi, ebx
add esi, esi
lea esi, [esi + esi*2]
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x10]
call fcn.00408fe4
xor edx, edx
mov dl, byte [ebp - 1]
cmp eax, edx
jne 0x4117c7
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 4]
lea ecx, [ebp - 8]
xor edx, edx
call fcn.00410160
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00401338
mov dword [ebp - 0x44], 0x3c
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 8]
call fcn.00401dd4
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 8]
call fcn.00404068
mov eax, dword [ebp - 0x48]
call fcn.00401dd4
mov dword [ebp - 0x2c], eax
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 8]
lea ecx, [ebp - 0x4c]
xor edx, edx
call fcn.00410160
mov eax, dword [ebp - 0x4c]
call fcn.00401dd4
mov dword [ebp - 0x30], eax
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0xc]
call fcn.00408fe4
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x40], 0x400
mov eax, dword [0x418640]
mov eax, dword [eax]
mov eax, dword [eax + esi*4 + 0x14]
call fcn.00408fe4
dec eax
jne 0x41178b
mov eax, dword [ebp - 0x40]
or eax, 0x40
or eax, 0x200
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
jmp 0x4117a2
mov eax, dword [0x418684]
mov eax, dword [eax]
call fcn.0040acd8
push 0x32
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
je 0x411796
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x4197b8]
call fcn.004102f0
inc ebx
dec edi
jne 0x4116bb
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4117f9
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.00401a74
lea eax, [ebp - 8]
call fcn.00401a50
ret