joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10254707
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x4c
mov eax, dword [ebp + 8]
mov dword [0x1026ea60], 0x26de
mov dword [ebp - 0x10], eax
call fcn.10253d32
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov dword [0x1026ea60], 0xe73
mov eax, dword [eax + esi]
cmp eax, 0x4550
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edi
je 0x10254753
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x78]
mov dword [0x1026ea5c], 0x16bd
mov ecx, eax
add ecx, 0x20
mov edx, dword [ebp - 0x14]
add edx, ecx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
add ecx, dword [edx]
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
mov ebx, dword [esi + edi + 0x18]
cmp ebx, 0
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], eax
jne 0x102547a6
mov eax, dword [ebp - 0x30]
add esp, 0x4c
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x20]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
xor edx, edx
mov esi, dword [ebp - 0x2c]
mov edi, dword [esi + eax*4]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x48], edx
mov eax, dword [ebp - 0x48]
mov ecx, eax
mov edx, dword [ebp - 0x44]
add ecx, edx
mov esi, dword [ebp - 0x14]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x4c], eax
mov byte [ebp - 0x4d], bh
mov byte [ebp - 0x4e], cl
je 0x10254834
mov eax, dword [ebp - 0x4c]
add eax, 1
mov cl, byte [ebp - 0x4d]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x4e]
and ch, dl
cmp eax, 0x20
setb dl
mov dword [ebp - 0x54], eax
mov byte [ebp - 0x55], ch
mov byte [ebp - 0x56], dl
mov al, byte [ebp - 0x55]
mov cl, byte [ebp - 0x56]
and al, cl
test al, 1
mov edx, dword [ebp - 0x54]
mov dword [ebp - 0x48], edx
jne 0x102547d2
mov al, byte [ebp - 0x4e]
test al, 1
jne 0x1025486a
jmp 0x1025483d
xor eax, eax
mov ecx, dword [ebp - 0x40]
add ecx, 2
mov edx, dword [ebp - 0x3c]
add edx, 1
mov esi, dword [ebp - 0x28]
cmp edx, esi
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], edx
jb 0x102547b8
jmp 0x1025479b
mov eax, dword [ebp - 0x40]
movzx ecx, word [eax]
mov edx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x20]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x14]
add edi, dword [edx + ecx*4]
mov dword [0x1026ea5c], 0x22a3
mov dword [ebp - 0x30], edi
jmp 0x1025479b
Function at 0x102548de
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx + 0x10]
mov ecx, dword [ecx + 0x3c]
mov dword [0x1026ea5c], 0x1927
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ecx
xor eax, eax
mov dword [ebp - 0x10], eax
jmp 0x10254928
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x10254982
jmp 0x10254a19
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], edx
je 0x10254996
jmp 0x102549aa
mov dword [0x1026ea5c], 0x21a9
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x18], 0x6f
je 0x102549e3
jmp 0x10254a19
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x14]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x10254a20
jmp 0x10254a19
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x102549f8
jmp 0x10254a19
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x14], eax
je 0x10254940
jmp 0x10254a19
mov dword [0x1026ea5c], 0x9f6
mov eax, dword [ebp - 0x18]
add eax, 1
cmp eax, 0x104
setl cl
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x25], cl
mov al, byte [ebp - 0x25]
test al, 1
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x24]
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x1c], edx
jne 0x10254928
jmp 0x10254996
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
cmp word [eax + ecx*2 - 0x16], 0x61
je 0x10254914
jmp 0x10254a19
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff8
shl eax, 1
mov ecx, dword [ebp - 0xc]
add ecx, eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp word [eax], 0x6c
je 0x10254962
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10254a20
mov eax, dword [ebp - 0x20]
add esp, 0x2c
pop ebp
ret
Function at 0x10254a28
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x50
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov eax, dword [ebp - 0x30]
mov cl, byte [eax + 0x10256528]
mov dl, byte [eax + 0x102564f9]
sub dl, cl
mov byte [ebp + eax - 0x24], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x30], eax
jne 0x10254a40
lea eax, [ebp - 0x24]
mov dword [0x1026ea5c], 0x1372
mov dword [ebp - 0x34], eax
call fcn.10255125
mov dword [esp], eax
mov eax, dword [ebp - 0x34]
mov dword [esp + 4], eax
call fcn.10253e8b
cmp eax, 0
mov dword [ebp - 0x38], eax
je 0x10254b4f
mov eax, dword [ebp - 0x38]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov ecx, dword [0x1026ea5c]
add ecx, 0xffffdbc9
mov dword [0x1026ea5c], ecx
mov dword [esp], eax
mov ecx, dword [ebp - 0x28]
mov dword [esp + 4], ecx
mov dword [ebp - 0x3c], eax
call fcn.1025405a
xor eax, eax
mov ecx, dword [0x1026ea5c]
add ecx, 0xffffe005
mov dword [0x1026ea60], ecx
mov ecx, dword [ebp - 0x3c]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xd0
mov dword [ecx + 0xd0], 0x4550
add ecx, 0xffc00000
mov edx, dword [ebp - 0x2c]
mov dword [edx + 0x20], ecx
mov dword [0x1026ea5c], 0x19c4
mov ecx, dword [ebp - 0x3c]
mov dword [edx], ecx
add ecx, 0x1418
mov esi, dword [ebp - 0x3c]
cmp esi, 0
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x10254b46
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
add esp, 0x50
pop esi
pop ebp
ret
xor eax, eax
add esp, 0x50
pop esi
pop ebp
ret
Function at 0x10254c71
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x2c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1026ea64], 0
mov dword [0x1026ea68], 0
mov dword [0x1026ea74], 0
mov ebx, dword [0x1026ea60]
add ebx, 0xfffff338
mov dword [0x1026ea5c], ebx
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
je 0x10254def
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov dword [0x1026ea5c], 0x20d1
mov dword [0x1026ea60], 0x7e7
add ecx, 1
mov dword [ebp - 0x2c], eax
mov eax, ecx
mov dword [ebp - 0x30], edx
cdq
idiv esi
mov dword [0x1026ea64], edx
mov ecx, dword [ebp - 0x20]
movzx edi, byte [ecx + edx]
mov ebx, dword [ebp - 0x30]
add edi, ebx
mov eax, edi
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1026ea68], edx
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1026ea6c], cl
mov edi, dword [ebp - 0x20]
mov cl, byte [edi + edx]
mov byte [edi + esi], cl
mov cl, byte [0x1026ea6c]
mov edx, dword [0x1026ea68]
mov byte [edi + edx], cl
mov dword [0x1026ea60], 0x2664
mov edx, dword [0x1026ea64]
movzx edx, byte [edi + edx]
mov ebx, dword [0x1026ea68]
movzx ebx, byte [edi + ebx]
add ebx, edx
and ebx, 0xff
mov dword [0x1026ea74], ebx
mov dword [0x1026ea5c], 0x1fb1
mov cl, byte [edi + ebx]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x2c]
mov ch, byte [edx + ebx]
mov byte [0x1026ea79], ch
mov byte [0x1026ea7a], cl
xor ch, cl
mov byte [0x1026ea78], ch
mov dword [0x1026ea5c], 0x251f
mov edx, dword [ebp - 0x1c]
mov byte [edx + ebx], ch
mov dword [0x1026ea60], 0x13d3
add ebx, 1
mov edx, dword [ebp - 0x10]
cmp ebx, edx
mov dword [ebp - 0x38], ebx
je 0x10254def
mov eax, dword [0x1026ea64]
mov ecx, dword [0x1026ea68]
mov edx, dword [ebp - 0x38]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
jmp 0x10254cdc
add esp, 0x2c
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10254f2b
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x88
lea eax, [esp + 0x20]
lea ecx, [esp + 0x30]
mov dword [0x1026ea5c], 0x1f19
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.102542f7
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x78], ecx
mov dword [esp + 0x38], 0x112200
mov ecx, dword [0x1026ea48]
mov dword [esp + 0x58], ecx
mov ecx, dword [0x1026ea4c]
mov dword [esp + 0x40], ecx
mov ecx, dword [0x1026ea50]
mov dword [esp + 0x68], ecx
mov dword [esp + 0x18], eax
lea eax, [0x10254892]
mov ecx, dword [0x1026ea54]
mov dword [esp + 0x84], ecx
mov ecx, dword [0x1026ea58]
mov dword [esp + 0x44], ecx
mov dword [0x1026ea60], 0x4bf
mov dword [esp + 0x14], eax
jmp 0x10255008
lea eax, [esp + 0x30]
mov dword [0x1026ea60], 0x341
mov ecx, dword [esp + 0x28]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.10254a28
mov ecx, esp
lea edx, [esp + 0x30]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 1
mov dword [esp + 0x10], eax
jmp 0x10255000
mov eax, dword [esp + 0xc]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 8], ecx
je 0x1025502b
jmp 0x10255017
mov eax, dword [esp + 0x10]
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0xc], eax
je 0x10254fea
mov eax, dword [esp + 0xc]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
jmp 0x10255008
mov eax, dword [esp + 0xc]
mov dword [esp + 0x7c], eax
mov dword [0x1026ea60], 0xe73
mov ecx, dword [esp + 8]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x64], edx
call fcn.102548de
xor ecx, ecx
cmp eax, 0
mov dword [esp + 0x10], ecx
je 0x10254fb4
jmp 0x10255000
Function at 0x401ac0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x4051b0], eax
mov ecx, ebp
add ecx, 8
mov dword [0x4050f4], ecx
mov dword [0x405130], 0x30
mov dword [0x405134], 2
mov dword [0x40513c], 0
mov dword [0x405140], 0
mov dword [0x405138], 0x401f60
jmp 0x401b13
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x405144], eax
mov dword [0x405150], 0xf
mov dword [0x405158], 0x40409b
mov dword [0x4050ec], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x405148], eax
mov dword [0x40515c], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x40514c], eax
push 0x405130
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x4050ec]
push 0
push 0
push 0x1e4
push 0x21d
push 0x1f40
push 0xdac
push 0x40000
push str.gest
push str.werti
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x4051a8], eax
xor eax, eax
jmp 0x401bb2
push 5
push dword [0x4051a8]
call dword [sym.imp.user32.dll_ShowWindow]
test eax, eax
jne 0x401be6
push 0
push 0x1e0
push 0x219
push 0x1f40
push 0xdac
push dword [0x4051a8]
call dword [sym.imp.user32.dll_MoveWindow]
push dword [0x4051a8]
call dword [sym.imp.user32.dll_UpdateWindow]
push 0
push 0
push 0
push 0x405160
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x401c1f
push 0x405160
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405160
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x401bf2
mov eax, dword [0x405168]
jmp 0x401c2c
call 0x4013d0
ret

Function at 0x41b0de
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x41b0ed
pop dword [ebp - 0x20]
mov eax, 0x21c037be
add eax, 0xde81792f
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0xd705fae7
sub dword [ebp - 0x30], 0x88b3b59c
mov dword [ebp - 0x2c], 0x72783310
sub dword [ebp - 0x2c], 0x4044e6cb
mov dword [ebp - 0x28], 0xd2e087bb
sub dword [ebp - 0x28], 0x8694438d
mov dword [ebp - 0x24], 0x22771e86
add dword [ebp - 0x24], 0xdd88e17a
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0xea0a92a0
add dword [ebp - 0x30], 0x8a67d6b6
mov dword [ebp - 0x2c], 0x176b3347
add dword [ebp - 0x2c], 0x2a012e2e
mov dword [ebp - 0x28], 0xe814b21e
add dword [ebp - 0x28], 0x7b5aba4e
mov dword [ebp - 0x24], 0xfadd84d1
add dword [ebp - 0x24], 0x5227b2f
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x9410ae14
sub eax, 0x93cafd94
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x4d832
push 0
call eax
mov ecx, 0x3d5930e4
add ecx, 0xc2a717e4
mov edi, eax
mov edx, 0x476000
add edx, dword [ebp - 0x20]
mov esi, 0x87b8d0f3
add esi, 0x81fabc2e
xor dword [ebp - 0xc], 0xd928e585
mov ebx, dword [edx]
xor dword [ebp - 0x10], 0x326509df
sub ebx, esi
xor dword [ebp - 0x1c], 0xac48997d
mov dword [edi], ebx
add dword [ebp - 4], 0xfd6fa8d1
add edi, 4
add edx, 4
loop 0x41b204
add eax, 0x115f3
mov ebx, eax
add eax, 5
mov ecx, 0xf474fbbe
sub ecx, 0xf434fbbe
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x401e04
Capabilities:
Open clipboard

Disassembly:
push ebp
sub esp, 0x84
lea ebp, [esp - 4]
mov eax, dword [0x4a20b0]
xor eax, ebp
mov dword [ebp + 0x84], eax
push 0x38
mov eax, 0x484fa3
call fcn.00469021
mov esi, dword [ebp + 0x90]
mov ebx, ecx
mov ecx, dword [esi + 0x108]
mov eax, dword [ecx]
lea edx, [ebp]
push edx
call dword [eax + 8]
and dword [ebp - 4], 0
mov ecx, str.click
mov eax, esi
call fcn.0042f7fb
test eax, eax
jne 0x402037
mov ecx, str.btnClose
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401e77
push 2
lea esi, [ebx - 0x10]
call fcn.0042da24
jmp 0x402037
mov ecx, str.btnImportRule
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401e95
lea ecx, [ebx - 0x10]
call fcn.00403d4a
jmp 0x402037
mov ecx, str.btnViewRule
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401eb4
add ebx, 0xfffffff0
push ebx
call fcn.00403dfc
jmp 0x402037
mov ecx, str.btnUninst
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401ed2
lea ecx, [ebx - 0x10]
call fcn.00403113
jmp 0x402037
mov ecx, str.btnClearRules
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401ef0
lea ecx, [ebx - 0x10]
call fcn.00403288
jmp 0x402037
mov ecx, str.btnOk
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401f0f
add ebx, 0xfffffff0
push ebx
call fcn.00402e2b
jmp 0x402037
mov ecx, str.btnUpdateOfflineLic
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401f2e
add ebx, 0xfffffff0
push ebx
call fcn.00404187
jmp 0x402037
mov ecx, str.btnLeaveOfflineMode
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401f4d
add ebx, 0xfffffff0
push ebx
call fcn.004043c6
jmp 0x402037
mov ecx, str.btnOfflineReqCode
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401f6b
lea ecx, [ebx - 0x10]
call fcn.00403e7f
jmp 0x402037
mov ecx, str.btnModifyDepAndName
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401f89
lea edi, [ebx - 0x10]
call fcn.00403fdc
jmp 0x402037
mov ecx, str.btnHardwareCustomWnd
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x401fa7
lea ecx, [ebx - 0x10]
call fcn.004040a5
jmp 0x402037
mov ecx, str.btnCopyCid
lea eax, [ebp]
call fcn.0042f7fb
test eax, eax
jne 0x402037
lea eax, [ebp - 0x28]
push eax
call fcn.00414860
push eax
lea eax, [ebp - 0x44]
push eax
mov byte [ebp - 4], 1
call fcn.0040124d
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x401fdd
mov edi, dword [eax + 4]
jmp 0x401fe0
lea edi, [eax + 4]
push dword [ebx - 0xc]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x401ff1
xor edi, edi
jmp 0x401ff8
call fcn.0041197f
mov edi, eax
push 0
push 1
lea esi, [ebp - 0x44]
call fcn.0040498a
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.0040488d
test edi, edi
je 0x402022
push 0x40
push 0x4892ac
push 0x4892b4
jmp 0x40202e
push 0x10
push 0x4892c8
push 0x4892d0
push dword [ebx - 0xc]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp]
call fcn.0042f563
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x84]
xor ecx, ebp
call fcn.004678b3
add ebp, 0x88
leave
ret 4
Function at 0x403113
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x4a20b0]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x484cec
call fcn.00469021
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x4bc], ebx
jne 0x40314b
cmp dword [esi + 0x4b4], ebx
je 0x40315a
mov eax, esi
call fcn.0040326f
test al, al
je 0x40324c
push str.CryptEnabled
push str.Softwareprojonepodlp_smprule_
mov edi, 0x489698
call fcn.00412528
test eax, eax
je 0x403177
mov edi, 0x4896d0
push 0x24
push 0x489728
push edi
push dword [esi + 4]
mov edi, dword [sym.imp.USER32.dll_MessageBoxW]
call edi
cmp eax, 6
jne 0x40324c
push ebx
lea ecx, [ebp]
mov dword [ebp + 0x18], 0xf
call fcn.00404bdf
lea eax, [ebp]
push eax
push 0x7d0
push str.http:__127.0.0.1:13004_ppmessage_messageuninstActionmodemanally
mov dword [ebp - 4], ebx
call fcn.0040ba46
xor eax, eax
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
call fcn.00469330
add esp, 0x18
push 0x104
lea eax, [ebp + 0x1c]
push eax
push str.poda32.exe
call fcn.004113db
mov dword [ebp - 0x10], ebx
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp + 0x1c]
push eax
call ebx
test eax, eax
je 0x40320b
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 0xa
jl 0x4031ed
lea eax, [ebp + 0x1c]
push eax
call ebx
test eax, eax
je 0x403228
push 0
push 0x48978c
push 0x489798
push dword [esi + 4]
call edi
jmp 0x403240
push 0x40
push 0x4897c4
push 0x4897d0
push dword [esi + 4]
call edi
push 1
call fcn.0042da24
push 0
push 1
lea ecx, [ebp]
call fcn.0040488d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.004678b3
add ebp, 0x228
leave
ret
Function at 0x403d4a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x484f06
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4a20b0]
xor eax, esp
mov dword [esp + 0x1c], eax
push esi
push edi
mov eax, dword [0x4a20b0]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov esi, ecx
mov edi, dword [esi + 4]
lea ecx, [esp + 0xc]
call fcn.004129d8
xor edi, edi
mov dword [esp + 0x38], edi
cmp dword [esp + 0x20], edi
je 0x403dd3
cmp dword [esp + 0x24], 8
mov eax, dword [esp + 0x10]
jae 0x403da9
lea eax, [esp + 0x10]
mov ecx, dword [esi + 4]
push eax
call fcn.004039ff
pop ecx
test eax, eax
je 0x403dd3
push 0x40
push 0x4892ac
push 0x489b04
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push edi
push esi
call fcn.00402064
push edi
push 1
lea esi, [esp + 0x14]
call fcn.0040498a
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.004678b3
mov esp, ebp
pop ebp
ret

Function at 0x403e7f
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x483a3b
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x4a20b0]
xor eax, esp
mov dword [esp + 0x58], eax
push ebx
push esi
push edi
mov eax, dword [0x4a20b0]
xor eax, esp
push eax
lea eax, [esp + 0x70]
mov dword fs:[0], eax
lea eax, [esp + 0x14]
push eax
mov esi, ecx
call fcn.004155a9
push eax
lea eax, [esp + 0x38]
xor ebx, ebx
push eax
mov dword [esp + 0x84], ebx
call fcn.0040124d
add esp, 0xc
push ebx
push 1
lea ecx, [esp + 0x1c]
mov byte [esp + 0x80], 2
call fcn.0040488d
cmp dword [esp + 0x44], ebx
jne 0x403f0d
push 0x10
push 0x4892c8
push 0x489b24
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x403fb2
cmp dword [esp + 0x48], 8
mov eax, dword [esp + 0x34]
jae 0x403f1c
lea eax, [esp + 0x34]
push eax
push 0x489b40
lea ecx, [esp + 0x54]
call fcn.0041244a
pop ecx
pop ecx
mov byte [esp + 0x78], 3
cmp dword [esp + 0x64], 8
mov eax, dword [esp + 0x50]
jae 0x403f41
lea eax, [esp + 0x50]
push eax
push 0x489b9c
push dword [esi + 4]
xor edi, edi
mov ecx, str._rY6R_
call fcn.0041795b
add esp, 0xc
cmp eax, 6
jne 0x403fa6
cmp dword [esp + 0x48], 8
mov edi, dword [esp + 0x34]
jae 0x403f6d
lea edi, [esp + 0x34]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x403f91
call fcn.0041197f
cmp eax, ebx
je 0x403f91
push 0x40
push 0x489bc8
push 0x489bac
jmp 0x403f9d
push 0x10
push 0x489bec
push 0x489bd0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push ebx
push 1
lea esi, [esp + 0x54]
call fcn.0040498a
push ebx
push 1
lea esi, [esp + 0x38]
call fcn.0040498a
mov ecx, dword [esp + 0x70]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x58]
xor ecx, esp
call fcn.004678b3
mov esp, ebp
pop ebp
ret
Function at 0x4043c6
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
sub esp, 0x5c
lea ebp, [esp - 4]
mov eax, dword [0x4a20b0]
xor eax, ebp
mov dword [ebp + 0x5c], eax
push 0x3c
mov eax, 0x484e89
call fcn.00469021
mov ebx, dword [ebp + 0x68]
push 0x24
push 0x489728
push 0x489ca0
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 6
jne 0x40451e
xor eax, eax
push 0x3e
push eax
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push eax
call fcn.00469330
mov eax, dword [0x4a76d0]
add esp, 0xc
push 0x403e73
lea ecx, [ebp + 0x1c]
push ecx
push 0x20
pop edi
push edi
push 0
push 0x489ce8
push 0x65
push eax
mov esi, eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0x489d00
push dword [ebx + 4]
push esi
call fcn.004284c9
add esp, 0x24
test eax, eax
je 0x40451e
lea eax, [ebp + 0x1c]
push eax
lea esi, [ebp - 0x2c]
call fcn.004045a2
and dword [ebp - 4], 0
mov eax, esi
push eax
lea eax, [ebp]
push eax
call fcn.004012d1
pop ecx
pop ecx
xor edi, edi
push 0
inc edi
push edi
mov byte [ebp - 4], 2
call fcn.0040498a
cmp dword [ebp + 0x18], 0x10
mov eax, dword [ebp + 4]
jae 0x404491
lea eax, [ebp + 4]
push eax
call fcn.00412de3
pop ecx
cmp eax, 0xffffffff
jne 0x4044b7
push 0x10
push 0x4892c8
push 0x489644
push dword [ebx + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
push 0
push edi
jmp 0x404516
push eax
call sub.WS2_32.dll_closesocket
call fcn.00415dd4
test eax, eax
jne 0x4044d4
push 0x10
push 0x4892c8
push 0x489d0c
jmp 0x4044a9
push edi
lea edi, [ebp - 0x48]
call fcn.0041487c
pop ecx
xor esi, esi
cmp dword [eax + 0x14], esi
push esi
push 1
mov ecx, edi
sete byte [ebp - 0xd]
call fcn.0040488d
cmp byte [ebp - 0xd], 0
je 0x404502
push 1
lea eax, [ebp]
call fcn.00414976
pop ecx
push esi
lea eax, [ebp]
call fcn.00414976
pop ecx
push esi
push ebx
call fcn.00402064
push esi
push 1
lea ecx, [ebp]
call fcn.0040488d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x5c]
xor ecx, ebp
call fcn.004678b3
add ebp, 0x60
leave
ret 4