joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42e9fc
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x42f4ae
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi]
push ebx
xor ebx, ebx
cmp dword [eax + 4], 2
push edi
sete bl
test ebx, ebx
je 0x42f4d2
push dword [eax + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call dword [esi + 0xc]
jmp 0x42f503
cmp dword [esi + 8], 0
jne 0x42f4f3
push 0x47442c
push dword [eax + 8]
call fcn.00444ab9
pop ecx
pop ecx
mov dword [esi + 8], eax
test eax, eax
jne 0x42f4f3
or eax, 0xffffffff
jmp 0x42f529
push dword [esi + 8]
push dword [ebp + 0xc]
push 1
push dword [ebp + 8]
call fcn.0044194e
mov edi, eax
add esp, 0x10
test edi, edi
je 0x42f511
cmp edi, dword [ebp + 0xc]
jbe 0x42f527
test ebx, ebx
jne 0x42f521
push dword [esi + 8]
call fcn.00444831
and dword [esi + 8], ebx
pop ecx
mov eax, dword [esi]
mov eax, dword [eax]
mov dword [esi], eax
mov eax, edi
pop edi
pop ebx
pop ebp
ret
Function at 0x431680
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46adb8
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x486be4]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
mov edi, dword [esp + 0x20]
push edi
call fcn.00404946
mov dword [esp + 0x18], 0
test edi, edi
je 0x4316c4
add edi, 0x28
jmp 0x4316c6
xor edi, edi
mov dword [esi + 0x28], vtable.boost::exception.0
mov ecx, dword [edi + 4]
mov dword [esi + 0x2c], ecx
test ecx, ecx
je 0x4316de
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
mov eax, dword [edi + 8]
mov dword [esi + 0x30], eax
mov ecx, dword [edi + 0xc]
mov dword [esi + 0x34], ecx
mov edx, dword [edi + 0x10]
mov dword [esi + 0x38], edx
mov dword [esi], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.1.0
mov dword [esi + 0x28], vtable.boost::exception_detail::error_info_injector_class_std::logic_error_.0
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x10
ret 4

Function at 0x4317d0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46ae18
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x486be4]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x486be4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 8]
mov eax, dword [esp + 0x4c]
mov esi, ecx
xor ecx, ecx
mov word [esp + 0x10], cx
mov ecx, dword [esp + 0x50]
push edx
push ecx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], 0
call fcn.00430f40
mov eax, dword [esp + 0x48]
mov ecx, dword [esp + 0x44]
lea edx, [esp + 0xc]
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
push edx
push eax
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.00431210
cmp dword [esp + 0x24], 8
jb 0x43186c
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0043f3a8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043f928
add esp, 0x30
ret 0x1c
Function at 0x431890
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x46ae48
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x486be4]
xor eax, esp
mov dword [esp + 0x20], eax
push esi
mov eax, dword [0x486be4]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov edx, dword [esp + 0x50]
mov eax, dword [esp + 0x4c]
mov esi, ecx
mov ecx, dword [esp + 8]
push ecx
push edx
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x30], 0xf
mov dword [esp + 0x2c], 0
mov byte [esp + 0x1c], 0
call fcn.00431010
mov ecx, dword [esp + 0x48]
mov edx, dword [esp + 0x44]
lea eax, [esp + 0xc]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
push eax
push ecx
mov ecx, esi
mov dword [esp + 0x48], 0
call fcn.00431140
cmp dword [esp + 0x24], 0x10
jb 0x43192a
mov edx, dword [esp + 0x10]
push edx
call fcn.0043f3a8
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0043f928
add esp, 0x30
ret 0x1c

Function at 0x43273a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov eax, dword [eax]
push esi
mov dword [ecx], eax
mov dword [ecx + 0x1380], 1
push edi
mov edx, dword [ecx + 0x1380]
lea eax, [ecx + edx*4]
mov esi, dword [eax - 4]
mov edi, esi
shr edi, 0x1e
xor edi, esi
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax], edi
inc dword [ecx + 0x1380]
cmp dword [ecx + 0x1380], 0x270
jl 0x43274e
pop edi
pop esi
ret 4

Function at 0x432dc6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
cmp dword [esp + 4], 0
push ebp
push esi
push edi
jne 0x432e15
add ecx, 4
mov esi, 0x270
mov ebp, bind
mov edi, 0x9908b0df
mov eax, dword [ecx - 4]
xor eax, dword [ecx]
and eax, ebp
xor eax, dword [ecx - 4]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, edi
xor edx, dword [ecx + 0x630]
shr eax, 1
xor edx, eax
mov dword [ecx + 0x9bc], edx
add ecx, 4
dec esi
jne 0x432de2
jmp 0x432edf
cmp dword [esp + 0x10], 1
jne 0x432edf
lea esi, [ecx + 0x9c0]
mov dword [esp + 0x10], 0xe3
mov ebp, bind
mov edi, 0x9908b0df
push ebx
lea edx, [esi + 4]
mov eax, dword [edx]
xor eax, dword [esi]
and eax, ebp
xor eax, dword [esi]
mov ebx, eax
and bl, 1
movzx ebx, bl
neg ebx
sbb ebx, ebx
and ebx, edi
xor ebx, dword [esi + 0x634]
shr eax, 1
xor ebx, eax
dec dword [esp + 0x14]
mov dword [esi - 0x9c0], ebx
mov esi, edx
jne 0x432e39
lea esi, [ecx + 0xd4c]
mov dword [esp + 0x14], 0x18c
lea edx, [esi + 4]
mov eax, dword [edx]
xor eax, dword [esi]
and eax, ebp
xor eax, dword [esi]
mov ebx, eax
and bl, 1
movzx ebx, bl
neg ebx
sbb ebx, ebx
and ebx, edi
xor ebx, dword [esi - 0xd4c]
shr eax, 1
xor ebx, eax
dec dword [esp + 0x14]
mov dword [esi - 0x9c0], ebx
mov esi, edx
jne 0x432e78
mov eax, dword [ecx + 0x137c]
xor eax, dword [ecx]
pop ebx
and eax, ebp
xor eax, dword [ecx + 0x137c]
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, edi
xor edx, dword [ecx + 0x630]
shr eax, 1
xor edx, eax
and dword [ecx + 0x1380], 0
mov dword [ecx + 0x9bc], edx
pop edi
pop esi
pop ebp
ret 4
Function at 0x43f928
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x486be4]
jne 0x43f932
repz ret
jmp fcn.00447a1c

Function at 0x453a1d
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0044740c
and dword [ebp - 4], 0
cmp dword [0x48e404], 0
mov ebx, eax
jne 0x453ace
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x453b7f
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x453b7f
push eax
call fcn.0044739a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x48e404], eax
call esi
push eax
call fcn.0044739a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x48e408], eax
call esi
push eax
call fcn.0044739a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x48e40c], eax
call esi
push eax
call fcn.0044739a
pop ecx
mov dword [0x48e414], eax
test eax, eax
je 0x453ace
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0044739a
pop ecx
mov dword [0x48e410], eax
mov eax, dword [0x48e410]
cmp eax, ebx
je 0x453b26
cmp dword [0x48e414], ebx
je 0x453b26
push eax
call fcn.00447415
push dword [0x48e414]
mov esi, eax
call fcn.00447415
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x453b26
test edi, edi
je 0x453b26
call esi
test eax, eax
je 0x453b1d
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x453b1d
test byte [ebp - 0xc], 1
jne 0x453b26
or dword [ebp + 0x10], 0x200000
jmp 0x453b5f
mov eax, dword [0x48e408]
cmp eax, ebx
je 0x453b5f
push eax
call fcn.00447415
pop ecx
test eax, eax
je 0x453b5f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x453b5f
mov eax, dword [0x48e40c]
cmp eax, ebx
je 0x453b5f
push eax
call fcn.00447415
pop ecx
test eax, eax
je 0x453b5f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x48e404]
call fcn.00447415
pop ecx
test eax, eax
je 0x453b7f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x453b81
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x100062fa
pop dword [ebp - 0x50]
mov eax, 0xe0037871
sub eax, 0xd0031577
sub dword [ebp - 0x50], eax
push 0x40
push 0x1000
push 0x39be0
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x50]
call dword [eax]
mov ecx, 0x4ae1
mov ebx, eax
mov esi, 0x3ab8cb7f
add esi, 0xd548ba81
add esi, dword [ebp - 0x50]
mov edi, 0xe7afa65a
sub edi, 0xce1e537d
sub dword [ebp - 0x3c], eax
mov edx, dword [esi]
xor dword [ebp - 0x14], 0x431f9904
add edx, edi
sub dword [ebp - 0x14], 0x2b95f92d
mov dword [ebx], edx
mov dword [ebp - 0x20], 0x353b3850
add ebx, 0x140656be
add ebx, 0xebf9a946
add esi, 0x413d8e00
sub esi, 0x413d8dfc
loop 0x1000634e
add eax, 0x762f8368
sub eax, 0x762e6511
xor ebx, ebx
add ebx, eax
add eax, 0x252db825
add eax, 0xdad247e0
mov ecx, 0xef7d08a2
sub ecx, 0xdf7d08a2
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x10010e00
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x10010e0f
pop dword [ebp - 0x4c]
mov eax, 0xb8416ae2
add eax, 0x57bfa32d
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x965677cd
sub dword [ebp - 0x5c], 0x48043282
mov dword [ebp - 0x58], 0x8caf3bbd
sub dword [ebp - 0x58], 0x5a7bef78
mov dword [ebp - 0x54], 0xeaa13ed
add dword [ebp - 0x54], 0x3da23041
mov dword [ebp - 0x50], 0xb1c42e5e
sub dword [ebp - 0x50], 0xb1c42e5e
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x34ed77a1
sub dword [ebp - 0x5c], 0xc07b0e4b
mov dword [ebp - 0x58], 0xc441b644
add dword [ebp - 0x58], 0x7d2aab31
mov dword [ebp - 0x54], 0xa07f1049
add dword [ebp - 0x54], 0xc2f05c23
mov dword [ebp - 0x50], 0x59e6a6eb
add dword [ebp - 0x50], 0xa6195915
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x3a397
push 0
call eax
mov ecx, 0x4384
mov edx, eax
mov ebx, 0x92d5068f
add ebx, 0x7d2e0571
add ebx, dword [ebp - 0x4c]
mov esi, 0x5f9ce341
add esi, 0x2fdc0467
xor dword [ebp - 0x48], eax
mov edi, dword [ebx]
sub dword [ebp - 0x48], 0x7f4a3294
add edi, esi
xor dword [ebp - 0x14], 0x988295ef
mov dword [edx], edi
add dword [ebp - 0xc], 0x7465ec2f
add edx, 0xd9d320f2
add edx, 0x262cdf12
add ebx, 0xd6270d00
add ebx, 0x29d8f304
loop 0x10010f21
add eax, 0xf9cfa530
sub eax, 0xf9cea44d
mov ebx, eax
add eax, 0xb941da5b
add eax, 0x46be25aa
mov ecx, 0xf8158692
add ecx, 0x17ea796e
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x1001ca50
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001caeb
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001caa2
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001caa2
cmp esi, ebx
jge 0x1001caa2
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001cae5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001cae5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e0]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e0]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001cafd
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001cd20
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
mov eax, dword [ebp + 8]
je 0x1001cd48
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cd62
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022ac0
leave
ret 4

Function at 0x1001cf30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001cf66
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cfc5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022ac0
leave
ret 0x10

Function at 0x1001cfe0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da18], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d00c
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d03d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d03b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_void___stdcall_MATRIX3D::SetRotate_struct__point3d_const___double_
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d03d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022ac0
leave
ret 8
Function at 0x402160
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x438590]
test eax, eax
je 0x402194
cmp dword [0x438588], 1
je 0x402180
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
call fcn.004013d0
mov dword [0x438588], 0
mov dword [0x438590], 0
xor eax, eax
ret
Function at 0x402ca0
Capabilities:
Shutdown system

Disassembly:
push 0x438560
push 0x28
mov dword [0x438568], 0xc
mov dword [0x438570], 1
mov dword [0x43856c], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x402d6f
push 0x438554
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [0x438560]
push 0
push 0
push 0
push 0x438550
push 0
push eax
mov dword [0x438550], 1
mov dword [0x43855c], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x402d6f
mov eax, dword [esp + 4]
mov ecx, eax
and ecx, 2
cmp cl, 2
jne 0x402d3e
mov edx, dword [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
ret
mov ecx, eax
and ecx, 1
cmp cl, 1
jne 0x402d55
mov edx, dword [esp + 8]
push edx
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
ret
push 0
push 0
push 0x10
push 0
push str.ProgMan
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_PostMessageA]
ret

Function at 0x404030
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov edx, dword [esp + 0x5c]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push edx
push 0
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
pop edi
je 0x4040c1
mov eax, dword [esp]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0xa
push eax
call esi
cmp eax, 0x102
jne 0x40409d
call fcn.00403fd0
mov ecx, dword [esp + 4]
push 0xa
push ecx
call esi
cmp eax, 0x102
je 0x404088
mov eax, dword [esp + 4]
lea edx, [esp + 0x5c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x5c]
pop esi
add esp, 0x54
ret
call fcn.00403f90
mov eax, dword [esp + 0x58]
add esp, 0x54
ret
Function at 0x404420
Capabilities:
Access peb ldr_data
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x428d60
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x4346c0]
xor edi, edi
mov dword [esp + 0x28], edi
xor esi, esi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], eax
mov ecx, dword [esp + 0x30]
mov byte [esp + 0x28], 1
push ecx
lea ecx, [esp + 0x34]
call fcn.0041ea0b
push 1
lea edx, [esp + 0x1c]
push edi
push edx
lea ecx, [esp + 0x3c]
mov byte [esp + 0x34], 2
call fcn.0041c398
mov eax, dword [eax]
push 0x434228
push eax
mov byte [esp + 0x30], 3
call fcn.0040e344
add esp, 8
test eax, eax
jne 0x4044c8
lea eax, [esp + 0x14]
push 1
push eax
lea ecx, [esp + 0x38]
call fcn.0041c42e
mov eax, dword [eax]
push 0x434224
push eax
call fcn.0040e344
add esp, 8
lea ecx, [esp + 0x14]
test eax, eax
sete bl
call fcn.0041e99d
test bl, bl
je 0x4044c8
mov bl, 1
jmp 0x4044ca
xor bl, bl
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.0041e99d
test bl, bl
je 0x404514
mov ecx, dword [esp + 0x30]
lea edx, [esp + 0x18]
mov eax, dword [ecx - 8]
lea ecx, [esp + 0x30]
add eax, 0xfffffffe
push eax
push 1
push edx
call fcn.0041c398
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 4
call fcn.0041ead6
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.0041e99d
push str.HKEY_LOCAL_MACHINE
lea ecx, [esp + 0x34]
call fcn.0041c59a
test eax, eax
jl 0x40452b
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push str.HKEY_CURRENT_USER
lea ecx, [esp + 0x34]
call fcn.0041c59a
test eax, eax
jl 0x404542
mov esi, SysReAllocStringLen
push str.HKEY_CLASSES_ROOT
lea ecx, [esp + 0x34]
call fcn.0041c59a
test eax, eax
jl 0x404559
mov esi, SysReAllocStringLen
push 0x43418c
lea ecx, [esp + 0x34]
call fcn.0041c59a
inc eax
lea ecx, [esp + 0x30]
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041c375
push eax
lea ecx, [esp + 0x34]
mov byte [esp + 0x2c], 5
call fcn.0041ead6
lea ecx, [esp + 0x18]
mov byte [esp + 0x28], 2
call fcn.0041e99d
lea ecx, [esp + 0x30]
push ecx
lea ecx, [esp + 0x14]
call fcn.0041ead6
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x1c]
lea eax, [esp + 0xc]
push edx
push eax
push edi
push 0xf003f
push edi
push 0x438548
push edi
push ecx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x404604
mov edx, dword [esp + 0x38]
lea ecx, [esp + 0x38]
mov eax, dword [edx - 8]
inc eax
push eax
push edi
call fcn.0041edb8
mov ecx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x3c]
push 1
push edi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4045f9
mov edi, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x30]
mov byte [esp + 0x28], 1
call fcn.0041e99d
lea ecx, [esp + 0x10]
mov byte [esp + 0x28], 0
call fcn.0041e99d
lea ecx, [esp + 0x38]
mov dword [esp + 0x28], 0xffffffff
call fcn.0041e99d
mov ecx, dword [esp + 0x20]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret