joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b1c
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004077d2
test al, al
jne 0x407c75
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
call fcn.00407993
mov edi, dword [ebp - 0x18]
cmp edi, ebx
pop ecx
jg 0x407b63
push ebx
push ebx
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
sub eax, 0x10
call fcn.00407082
mov esi, eax
add esi, 0x10
dec edi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], edi
cmp byte [ebp + 0xc], bl
je 0x407b84
inc dword [ebp - 8]
xor eax, eax
inc eax
cmp dword [ebp - 8], eax
mov dword [ebp - 0x10], eax
jle 0x407c65
mov edi, 0x435794
jmp 0x407b9c
xor ebx, ebx
lea eax, [esi - 0x10]
call fcn.00407082
add eax, 0x10
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 4]
push eax
call fcn.0040147d
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 0x1c]
call fcn.004064b3
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00401663
push ebx
mov ebx, dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x407c16
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
cmp eax, 0xb7
je 0x407c28
cmp dword [ebp - 0x10], 1
jle 0x407bf9
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [ebx - 0x10]
call fcn.004039c4
lea eax, [esi - 0x10]
call fcn.004039c4
lea esi, [ebp - 0x1c]
call fcn.0040647e
mov eax, dword [ebp - 4]
jmp 0x407c77
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x407c28
lea ebx, [ebp - 4]
call fcn.00406b45
mov ebx, dword [ebp - 4]
push edi
lea eax, [ebp - 0xc]
push eax
call fcn.0040147d
mov esi, dword [ebp - 0x10]
mov eax, esi
lea ecx, [ebp - 0x1c]
call fcn.004064b3
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0xc]
call fcn.00401663
lea eax, [ebx - 0x10]
call fcn.004039c4
inc esi
cmp esi, dword [ebp - 8]
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0xc]
jl 0x407b9a
lea eax, [esi - 0x10]
call fcn.004039c4
lea esi, [ebp - 0x1c]
call fcn.0040647e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407efe
Capabilities:
Delete directory
Delete file

Disassembly:
push ecx
push ebx
push ebp
mov ebx, eax
cmp byte [ebx + 0xac], 0
push esi
push edi
mov dword [ebx], 0x4357f0
je 0x407f92
cmp dword [ebx + 0x78], 3
je 0x407f47
call fcn.00408e61
mov eax, dword [ebx + 0x78]
cmp eax, 2
je 0x407f47
cmp eax, 1
je 0x407f47
mov eax, dword [ebx + 0x40]
mov ecx, eax
shr ecx, 3
test cl, 1
jne 0x407f40
shr eax, 6
test al, 1
je 0x407f47
mov eax, ebx
call fcn.004084bd
mov edi, dword [ebx + 0x94]
xor esi, esi
test edi, edi
jle 0x407f6f
lea ebp, [ebx + 0x90]
mov eax, esi
mov ecx, ebp
call fcn.004064b3
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
inc esi
cmp esi, edi
jl 0x407f59
mov esi, dword [ebx + 0xa0]
dec esi
js 0x407f92
lea edi, [ebx + 0x9c]
mov eax, esi
mov ecx, edi
call fcn.004064b3
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
dec esi
jns 0x407f7e
mov eax, dword [ebx + 0xb0]
push 0x10
pop edi
sub eax, edi
call fcn.004039c4
mov eax, dword [ebx + 0xa8]
sub eax, edi
call fcn.004039c4
lea esi, [ebx + 0x9c]
call fcn.0040647e
lea esi, [ebx + 0x90]
call fcn.0040647e
lea esi, [ebx + 0x84]
call fcn.00409e10
mov eax, dword [ebx + 0x6c]
test eax, eax
je 0x407fe2
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebx + 0x6c], 0
lea esi, [ebx + 0x60]
call fcn.00409dd3
mov eax, dword [ebx + 0x5c]
sub eax, edi
call fcn.004039c4
mov eax, dword [ebx + 0x58]
sub eax, edi
call fcn.004039c4
mov eax, dword [ebx + 0x54]
sub eax, edi
call fcn.004039c4
mov eax, dword [ebx + 0x50]
sub eax, edi
call fcn.004039c4
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x4084bd
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
mov edi, eax
mov eax, dword [edi + 0x58]
sub eax, 0x10
call fcn.00407082
add eax, 0x10
xor edx, edx
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x40]
inc edx
test dl, al
jne 0x40850f
shr eax, 3
movzx ecx, al
and al, dl
and ecx, edx
movzx eax, al
add ecx, ecx
or ecx, edx
neg eax
sbb eax, eax
and eax, 7
push ecx
push eax
mov eax, edi
call fcn.00408a79
lea ecx, [edi + 0x60]
call fcn.00409d32
add eax, 0x18
jmp 0x408555
shr eax, 6
test dl, al
je 0x408576
lea esi, [ebp - 8]
mov ecx, edi
call fcn.00409bbf
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00401663
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.004039c4
lea esi, [ebp - 4]
call fcn.004070da
push 6
mov eax, edi
call fcn.00408abd
lea ecx, [edi + 0x84]
call fcn.00409d53
lea edi, [ebp - 8]
call fcn.004072fc
mov eax, dword [eax]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00401663
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.004039c4
lea eax, [ebp - 4]
push eax
call fcn.00407474
mov esi, dword [ebp - 4]
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea eax, [esi - 0x10]
call fcn.004039c4
pop edi
xor eax, eax
pop esi
leave
ret
Function at 0x408e61
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx + 0x40]
sub esp, 0x10
test al, 1
je 0x408e79
shr eax, 6
test al, 1
je 0x408f40
mov eax, dword [ebx + 0x64]
and dword [ebp - 8], 0
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x408f40
push esi
push edi
mov eax, dword [ebp - 8]
lea ecx, [ebx + 0x60]
call fcn.00409d32
mov esi, eax
cmp byte [esi + 0x1c], 0
je 0x408f2f
mov eax, dword [esi]
cmp eax, 1
je 0x408ebd
cmp eax, 3
je 0x408ebd
cmp eax, 0x64
jb 0x408ed5
cmp dword [ebx + 0x78], 2
jne 0x408ed5
jmp 0x408f2f
mov eax, dword [ebx + 0x78]
cmp eax, 4
je 0x408ed5
cmp eax, 2
je 0x408f2f
cmp eax, 1
je 0x408f2f
test byte [esi + 8], 1
jne 0x408f2f
lea edi, [ebx + 0x58]
mov eax, dword [edi]
sub eax, 0x10
call fcn.00407082
add eax, 0x10
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x18]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 4]
call fcn.00401663
lea esi, [ebp - 4]
call fcn.0040642d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push edi
mov eax, esi
lea edi, [ebp - 0xc]
call fcn.004072fc
push eax
call fcn.00407677
mov eax, dword [ebp - 0xc]
pop ecx
pop ecx
add eax, 0xfffffff0
call fcn.004039c4
mov eax, dword [ebp - 4]
add eax, 0xfffffff0
call fcn.004039c4
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jl 0x408e8d
pop edi
pop esi
leave
ret
Function at 0x408f42
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x18
push ebx
push esi
push edi
mov ebx, 0x400
push ebx
mov esi, eax
call fcn.0042371a
mov edi, eax
xor edx, edx
pop ecx
mov dword [esp + 0xc], edi
cmp edi, edx
jne 0x408f71
push edx
call fcn.00423725
pop ecx
push 3
pop eax
jmp 0x4090b7
push ebp
mov dword [esp + 0x14], edx
mov dword [esp + 0x24], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], edx
mov eax, dword [esp + 0x20]
inc dword [esp + 0x14]
add dword [esp + 0x18], 0xa
add eax, ebx
cmp dword [esp + 0x14], 1
mov dword [esp + 0x20], eax
jle 0x408fa0
sub eax, dword [esp + 0x18]
mov ecx, dword [esi + 0x6c]
push 2
push edx
neg eax
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x4090ac
mov eax, dword [esi + 0x6c]
push 0
lea ecx, [esp + 0x20]
push ecx
push ebx
push edi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4090ac
cmp dword [esp + 0x1c], ebx
jne 0x4090ac
xor eax, eax
jmp 0x408fe8
mov edi, dword [esp + 0x10]
xor ecx, ecx
add edi, eax
mov dl, byte [edi]
cmp dl, byte [ecx + str.ADVINSTSFX]
jne 0x408ffd
inc ecx
inc edi
cmp ecx, 0xa
jl 0x408fec
cmp ecx, 0xa
jne 0x40900d
lea ecx, [eax + ebp - 0x40]
mov dword [esp + 0x24], ecx
add eax, 0xa
inc eax
cmp eax, 0x3f6
jb 0x408fe4
mov edi, dword [esp + 0x24]
xor ebp, ebp
cmp edi, ebp
jne 0x40902a
mov edi, dword [esp + 0x10]
xor edx, edx
jmp 0x408f82
mov eax, dword [esi + 0x6c]
push ebp
push ebp
push edi
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x409042
push dword [esp + 0x10]
jmp 0x4090ad
mov eax, dword [esi + 0x6c]
push ebp
lea ecx, [esp + 0x20]
push ecx
push 0x4c
lea ecx, [esi + 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40909b
cmp dword [esp + 0x1c], ebp
je 0x40909b
xor eax, eax
movzx ecx, byte [esi + eax + 0x44]
movsx edx, byte [eax + str.ADVINSTSFX]
cmp ecx, edx
jne 0x409097
inc eax
cmp eax, 0xa
jl 0x409064
cmp dword [esi + 0x10], 0x64
jne 0x409097
sub edi, dword [esi + 0x14]
push dword [esp + 0x10]
mov dword [esi + 0x80], edi
call fcn.00423725
pop ecx
xor eax, eax
jmp 0x4090b6
push 5
jmp 0x40909d
push 2
pop esi
push dword [esp + 0x10]
call fcn.00423725
pop ecx
mov eax, esi
jmp 0x4090b6
push edi
call fcn.00423725
pop ecx
push 2
pop eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x18
ret
Function at 0x4090be
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
xor ebx, ebx
push esi
cmp dword [edi + 0xc], ebx
jne 0x4090d4
xor eax, eax
jmp 0x4091ed
mov ecx, dword [edi + 0x80]
add ecx, dword [edi + 0x18]
mov eax, dword [edi + 0x6c]
push ebx
push ebx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x4090f7
push 2
pop eax
jmp 0x4091ed
mov ecx, 0x43d85c
lea esi, [ebp - 0x14]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call fcn.004039a9
mov byte [ebp - 0x10], bl
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp dword [edi + 0xc], ebx
jbe 0x4091d7
mov esi, dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [edi + 0x6c]
push ebx
lea ecx, [ebp - 0xc]
push ecx
push 0x18
lea ecx, [ebp - 0x2c]
push ecx
push eax
call esi
test eax, eax
je 0x4091d4
cmp dword [ebp - 0xc], ebx
je 0x4091d4
cmp dword [ebp - 4], ebx
je 0x409161
push dword [ebp - 4]
call fcn.00423725
pop ecx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 4]
inc eax
push ecx
call fcn.00409c07
test al, al
je 0x4091d0
mov eax, dword [edi + 0x6c]
push ebx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x18]
add ecx, ecx
push ecx
push dword [ebp - 4]
push eax
call esi
test eax, eax
je 0x4091d4
cmp dword [ebp - 0xc], ebx
je 0x4091d4
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 4]
xor eax, eax
mov word [edx + ecx*2], ax
lea eax, [ebp - 0x2c]
lea ebx, [edi + 0x60]
push eax
call fcn.00409c94
mov eax, dword [ebp - 8]
mov ecx, ebx
call fcn.00409d32
push dword [ebp - 4]
add eax, 0x18
push eax
call fcn.004038ad
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
xor ebx, ebx
cmp eax, dword [edi + 0xc]
jb 0x40912e
jmp 0x4091d7
push 3
jmp 0x4091d6
push 2
pop ebx
push dword [ebp - 4]
call fcn.00423725
mov eax, dword [ebp - 0x14]
pop ecx
add eax, 0xfffffff0
call fcn.004039c4
mov eax, ebx
pop esi
pop ebx
leave
ret
Function at 0x4091f1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
xor esi, esi
cmp dword [edi + 0x88], esi
jle 0x40920a
xor eax, eax
jmp 0x40932c
mov ecx, dword [edi + 0x80]
add ecx, dword [edi + 8]
mov eax, dword [edi + 0x6c]
push esi
push esi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
jne 0x40922d
push 2
pop eax
jmp 0x40932c
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
cmp dword [edi + 4], esi
jbe 0x409321
mov eax, dword [edi + 0x6c]
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
lea ecx, [ebp - 8]
push ecx
push 8
lea ecx, [ebp - 0x14]
push ecx
push eax
call ebx
test eax, eax
je 0x40931e
cmp dword [ebp - 8], esi
je 0x40931e
mov eax, dword [0x43d85c]
mov ecx, 0x43d85c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 4], esi
je 0x409294
push dword [ebp - 4]
call fcn.00423725
pop ecx
mov dword [ebp - 4], esi
mov eax, dword [ebp - 0x10]
lea ecx, [ebp - 4]
inc eax
push ecx
call fcn.00409c07
test al, al
je 0x409304
mov eax, dword [edi + 0x6c]
push esi
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, ecx
push ecx
push dword [ebp - 4]
push eax
call ebx
test eax, eax
je 0x409313
cmp dword [ebp - 8], esi
je 0x409313
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
xor ecx, ecx
push eax
mov word [eax + edx*2], cx
lea eax, [ebp - 0x1c]
push eax
call fcn.004038ad
lea esi, [edi + 0x84]
lea ebx, [ebp - 0x1c]
call fcn.0041973e
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004039c4
inc dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
xor esi, esi
cmp eax, dword [edi + 4]
jb 0x409242
jmp 0x409321
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004039c4
push 3
jmp 0x409320
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.004039c4
push 2
pop esi
push dword [ebp - 4]
call fcn.00423725
pop ecx
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x40a1b4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
and dword [ebp - 8], 0
and dword [ebp - 4], 0
or eax, 0xffffffff
push ebx
push esi
push edi
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
movzx ebx, ax
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov dword [ebp - 0xc], eax
call fcn.00416846
cmp eax, 0x11
jl 0x40a23a
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
push str.GetSystemDefaultUILanguage
push edi
call esi
test eax, eax
je 0x40a226
call eax
movzx eax, ax
mov dword [ebp - 4], eax
push str.GetUserDefaultUILanguage
push edi
call esi
test eax, eax
je 0x40a23a
call eax
movzx eax, ax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 8]
mov edi, dword [edx + 4]
xor esi, esi
test edi, edi
jle 0x40a29b
push esi
mov ecx, edx
call fcn.0040700f
movzx eax, word [eax]
cmp ax, bx
jne 0x40a259
mov dword [ebp - 0x20], esi
cmp al, bl
jne 0x40a260
mov dword [ebp - 0x10], esi
cmp ax, word [ebp - 0xc]
jne 0x40a269
mov dword [ebp - 0x28], esi
cmp al, byte [ebp - 0xc]
jne 0x40a271
mov dword [ebp - 0x18], esi
cmp ax, word [ebp - 4]
jne 0x40a27a
mov dword [ebp - 0x24], esi
cmp al, byte [ebp - 4]
jne 0x40a282
mov dword [ebp - 0x14], esi
cmp ax, word [ebp - 8]
jne 0x40a28b
mov dword [ebp - 0x2c], esi
cmp al, byte [ebp - 8]
jne 0x40a293
mov dword [ebp - 0x1c], esi
mov edx, dword [ebp + 8]
inc esi
cmp esi, edi
jl 0x40a246
pop edi
pop esi
xor ecx, ecx
pop ebx
mov eax, dword [ebp + ecx*4 - 0x2c]
test eax, eax
jge 0x40a2c4
inc ecx
cmp ecx, 8
jb 0x40a2a0
xor eax, eax
cmp dword [edx + 4], eax
jg 0x40a2ce
push eax
push eax
push 1
push 0xc000008c
call dword [sym.imp.KERNEL32.dll_RaiseException]
push eax
mov ecx, edx
call fcn.0040700f
jmp 0x40a2d0
mov eax, dword [edx]
mov ax, word [eax]
leave
ret

Function at 0x40a346
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, 0x43d85c
call fcn.004039a9
movzx ebx, word [ebp + 0xc]
mov edi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push 0
push 0x435508
push 2
push ebx
call edi
mov esi, eax
lea eax, [esi - 1]
push eax
push 0x78
pop ecx
lea edx, [ebp - 4]
call fcn.00407c7c
push esi
lea esi, [ebp - 4]
call fcn.0040642d
push eax
push 2
push ebx
call edi
mov esi, dword [ebp - 4]
push esi
push dword [ebp + 0xc]
push 0x435848
push dword [ebp + 8]
call fcn.00406c06
add esp, 0x10
lea eax, [esi - 0x10]
call fcn.004039c4
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40afa3
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebx + 8]
mov eax, dword [eax + 0x30]
sub esp, 0x20
cmp dword [eax - 0xc], 0
push esi
push edi
jne 0x40afbb
mov al, 1
jmp 0x40aff9
and dword [ebp - 0x20], 0
push 7
pop ecx
xor eax, eax
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebx + 8]
lea esi, [eax + 0x30]
mov ecx, dword [esi]
call fcn.00415a40
mov ecx, dword [ebp - 0x18]
shr ecx, 0x14
cmp ecx, eax
jge 0x40afb7
push esi
push 0xd4
mov eax, ebx
call fcn.0040b043
xor al, al
pop edi
pop esi
leave
ret

Function at 0x40affd
Capabilities:
Check internet connectivity via wininet

Disassembly:
mov eax, dword [edi + 8]
cmp byte [eax + 0x35], 0
jne 0x40b009
mov al, 1
ret
push esi
xor esi, esi
push 0
push 1
push dword [esi + 0x437ac8]
call dword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
jne 0x40b03f
add esi, 4
cmp esi, 0xc
jb 0x40b00c
mov eax, dword [edi + 8]
add eax, 0x70
push eax
push 0xe2
mov eax, edi
call fcn.0040b043
xor al, al
pop esi
ret
mov al, 1
pop esi
ret

Function at 0x40b043
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, eax
mov eax, dword [esi + 4]
mov eax, dword [eax + 0x50]
push edi
push 0x10
pop edi
sub eax, edi
call fcn.00407082
add eax, edi
lea ebx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0041570e
mov eax, dword [0x43d85c]
mov ebx, 0x43d85c
mov ecx, ebx
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, edi
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004036ec
mov eax, dword [0x43d85c]
mov ecx, ebx
call dword [eax + 0xc]
mov ebx, dword [ebp - 8]
add eax, edi
mov edi, dword [ebp - 4]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0xc]
push dword [eax]
lea eax, [ebp + 8]
push edi
push ebx
push eax
call fcn.00406c06
add esp, 0x10
cmp byte [esi + 0xc], 0
je 0x40b0c3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x40b0ea
mov eax, dword [esi]
call fcn.0040cc34
mov eax, dword [esi]
push 0
call fcn.0040cb6e
mov esi, eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
push 0x30
lea ecx, [ebp + 8]
push esi
push ecx
call fcn.00419c90
add esp, 0xc
mov eax, dword [ebp + 8]
add eax, 0xfffffff0
call fcn.004039c4
lea eax, [ebx - 0x10]
call fcn.004039c4
lea eax, [edi - 0x10]
call fcn.004039c4
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40cc41
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0x419df6
push esi
push esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x10], eax
mov ebx, 0x1ff
jmp 0x40cca5
push 1
push esi
push esi
push esi
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x40cca5
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push ebx
push 0xffffffffffffffff
push esi
lea eax, [ebp - 0x10]
push eax
push 1
call edi
cmp eax, 1
je 0x40cc7e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d698
Capabilities:
Query environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x43c07c]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push esi
call fcn.0041557c
test al, al
jne 0x40d750
push str.ProgramFilesFolder
push edi
call fcn.004065f1
mov esi, str.AppDataFolder
test eax, eax
je 0x40d6f1
push str.ProgramFiles
push edi
call fcn.0040d7fd
pop ecx
pop ecx
test al, al
jne 0x40d6f1
push esi
push edi
call fcn.004065f1
test eax, eax
jne 0x40d750
push esi
push edi
call fcn.004065f1
neg eax
sbb al, al
inc al
push 0
pop eax
mov word [ebp - 0x7c], ax
mov eax, str.APPDATA
jne 0x40d711
mov eax, str.PROGRAMFILES
push 0x104
lea ecx, [ebp - 0x7c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
jbe 0x40d730
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x7c], ax
inc esi
xor eax, eax
mov word [ebp + esi*2 - 0x7c], ax
cmp word [ebp - 0x7c], ax
je 0x40d747
lea eax, [ebp - 0x7c]
push eax
push edi
call fcn.004038ad
xor eax, eax
test esi, esi
setne al
jmp 0x40d752
xor al, al
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
pop esi
call fcn.0042370b
add ebp, 0x190
leave
ret

Function at 0x40d851
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
test eax, eax
je 0x40d8f2
dec eax
dec eax
push esi
mov esi, 0x85
je 0x40d88e
sub eax, 3
je 0x40d887
dec eax
je 0x40d880
dec eax
je 0x40d879
sub eax, 3
je 0x40d8f1
jmp 0x40d893
mov esi, 0x83
jmp 0x40d893
mov esi, 0x82
jmp 0x40d893
mov esi, 0x81
jmp 0x40d893
mov esi, 0x84
cmp byte [0x43d2cc], 0
mov eax, dword [0x43d85c]
mov ecx, 0x43d85c
je 0x40d8cc
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 4]
push eax
call fcn.004036ec
push 0
lea esi, [ebp - 4]
call fcn.0040d91c
mov eax, dword [ebp - 4]
pop ecx
add eax, 0xfffffff0
jmp 0x40d8ec
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 4]
push eax
call fcn.004036ec
mov esi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea eax, [esi - 0x10]
call fcn.004039c4
pop esi
leave
ret

Function at 0x40d91c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
cmp byte [0x43d2cc], al
je 0x40d97c
push edi
push 0x10
pop edi
cmp byte [ebp + 8], al
je 0x40d939
mov edi, 0x40010
push eax
lea eax, [ebp - 8]
call fcn.004038d0
push dword [esi]
lea eax, [ebp - 4]
call fcn.004038d0
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
call fcn.00419c90
mov eax, dword [ebp - 4]
add esp, 0xc
add eax, 0xfffffff0
call fcn.004039c4
mov eax, dword [ebp - 8]
add eax, 0xfffffff0
call fcn.004039c4
pop edi
leave
ret
push dword [esi]
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
leave
ret