joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac1a
Capabilities:
Download url
Receive data

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x24ac
call fcn.00429cbe
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x24a8], eax
xor edi, edi
mov eax, dword [ebp + 0x14]
mov esi, ecx
push 0x208
mov dword [ebp - 0x24ac], eax
lea eax, [ebp - 0x414]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
push 0x1048
lea eax, [ebp - 0x24a4]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
cmp dword [ebp - 0x24a8], edi
jne 0x40ac83
xor al, al
jmp 0x40adcc
push 0x208
lea eax, [ebp - 0x20c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [esi + 0x414], 1
jne 0x40acc2
push ecx
mov ecx, dword [0x445340]
lea eax, [ebp - 0x20c]
push eax
call fcn.00406972
test eax, eax
jne 0x40acd8
mov edi, 0x80004005
jmp 0x40adc7
push 0x104
lea ecx, [esi + 0x20a]
lea edx, [ebp - 0x20c]
call fcn.00401c61
call fcn.00406713
push eax
lea eax, [esi + 0x20a]
push eax
push 0x104
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.Mso98Win32Client.dll_Ordinal_2486]
test eax, eax
je 0x40acb8
push dword [ebp - 0x24a8]
lea eax, [ebp - 0x414]
push eax
push str._s_content__s
lea eax, [ebp - 0x24a4]
push 0xffffffffffffffff
push eax
call fcn.0040b44a
add esp, 0x14
test eax, eax
jle 0x40acb8
test ebx, ebx
je 0x40ad38
push 0x104
mov edx, ebx
lea ecx, [ebp - 0x24a4]
call fcn.00401c61
mov ecx, esi
call fcn.00408375
mov esi, eax
test esi, esi
je 0x40ac7c
push 0x1048
lea eax, [ebp - 0x145c]
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea edx, [ebp - 0x145c]
mov ebx, 0x824
mov ecx, esi
push ebx
call fcn.00401c61
mov esi, dword [sym.imp.Mso20Win32Client.dll_Ordinal_502]
lea eax, [ebp - 0x145c]
push ebx
push eax
push 0x42ead8
call esi
push ebx
lea eax, [ebp - 0x145c]
push eax
push dword [ebp - 0x24a8]
call esi
mov eax, dword [ebp - 0x24ac]
test eax, eax
je 0x40adb0
push dword [ebp + 0x18]
mov edx, eax
lea ecx, [ebp - 0x145c]
call fcn.00401c61
push edi
push edi
lea eax, [ebp - 0x145c]
push eax
lea eax, [ebp - 0x24a4]
push eax
push edi
call dword [sym.imp.urlmon.dll_URLDownloadToFileW]
test edi, edi
setns al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004282ce
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40b0b9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1050
call fcn.00429cbe
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, ecx
call fcn.0040810f
test al, al
jne 0x40b0eb
mov esi, 0x80004005
jmp 0x40b183
mov ecx, esi
call fcn.0040aa96
test al, al
je 0x40b0e1
push dword [0x43fc5c]
mov ecx, esi
push str.HTMLMESSAGE
call fcn.00408375
push eax
push str._s_s._d.htm
lea eax, [ebp - 0x104c]
push 0xffffffffffffffff
push eax
call fcn.0040b44a
add esp, 0x18
test eax, eax
jle 0x40b0e1
inc dword [0x43fc5c]
lea eax, [ebp - 0x104c]
push 1
xor esi, esi
push esi
push 0x80
push 2
push esi
push esi
push 0x40000000
push eax
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_913]
mov edi, eax
cmp edi, 0xffffffff
jne 0x40b154
xor al, al
jmp 0x40b188
push esi
lea eax, [ebp - 0x1050]
push eax
push dword [ebp + 0xc]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
push edi
sbb esi, esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
add esi, 1
js 0x40b183
lea eax, [ebp - 0x104c]
push eax
call fcn.00403677
test esi, esi
setns al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004282ce
mov esp, ebp
pop ebp
ret 8
Function at 0x40bfba
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1058
call fcn.00429cbe
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov ebx, ecx
test edi, edi
jne 0x40bfe4
xor al, al
jmp 0x40c168
push 1
mov ecx, 0x445320
call fcn.00403567
test al, al
jne 0x40bffd
push 7
call fcn.004025c4
jmp 0x40bfdd
mov eax, dword [ebx]
test eax, eax
je 0x40c01f
cmp edi, eax
je 0x40c01f
mov eax, dword [eax + 8]
mov dword [edi + 8], eax
push dword [ebx]
call fcn.00401f23
pop ecx
xor ecx, ecx
mov dword [ebx], edi
cmp dword [edi + 8], ecx
cmovne edi, ecx
test edi, edi
jne 0x40c02a
mov al, 1
jmp 0x40c168
cmp byte [ebx + 0xc], 0
jne 0x40c04e
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0xc]
test al, al
jne 0x40c04e
call fcn.0040dfa3
cmp eax, 3
sete al
test al, al
jne 0x40c0b9
mov byte [ebx + 0xc], 1
cmp dword [ebx + 4], 2
je 0x40c063
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x10]
test al, al
je 0x40c120
mov esi, dword [sym.imp.Mso30Win32Client.dll_Ordinal_1117]
call esi
test al, al
je 0x40c087
call fcn.0040db83
test al, al
jne 0x40c087
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
test al, al
je 0x40c120
push ecx
lea eax, [ebp - 0x1054]
push eax
call fcn.004037d0
push 1
push str.ms_help:__ms.
lea eax, [ebp - 0x1054]
push eax
call dword [sym.imp.Mso30Win32Client.dll_Ordinal_141]
lea ecx, [ebp - 0x1054]
cmp ecx, eax
jne 0x40c0e4
call fcn.0040c554
jmp 0x40c0e6
push 4
push edi
mov ecx, ebx
call fcn.0040c225
cmp word [0x43fe78], 0
jne 0x40c0d4
call fcn.0040de11
jmp 0x40c0d9
mov eax, 0x43fe78
push eax
call fcn.00403677
jmp 0x40c023
xor al, al
test al, al
je 0x40c149
call esi
test al, al
jne 0x40c120
push 1
push edi
mov ecx, ebx
call fcn.0040c225
xor eax, eax
push eax
push eax
push eax
push 0x40de92
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
test eax, eax
je 0x40c023
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40c023
mov eax, dword [edi]
mov ecx, edi
push dword [ebx + 4]
call dword [eax]
mov byte [ebp - 0x1055], al
cmp edi, dword [ebx]
je 0x40c143
push dword [ebx]
call fcn.00401f23
mov al, byte [ebp - 0x1055]
pop ecx
mov dword [ebx], edi
and dword [edi + 8], 0
jmp 0x40c168
push 2
push edi
mov ecx, ebx
call fcn.0040c225
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x18]
push eax
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 0x14]
push eax
call fcn.0040c279
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004282ce
mov esp, ebp
pop ebp
ret 4
Function at 0x40e283
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
call fcn.0040e1f2
mov edi, eax
test edi, edi
jne 0x40e29a
push 2
pop eax
jmp 0x40e2e5
push esi
push 2
pop esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.UseLegacySearch
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40e2db
cmp dword [ebp - 0xc], 4
jne 0x40e2db
cmp dword [ebp - 4], eax
jne 0x40e2d2
xor esi, esi
jmp 0x40e2db
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
cmove esi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40e41e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push 2
call fcn.0040e2ea
mov edi, eax
test edi, edi
jne 0x40e437
mov esi, 0x80004003
jmp 0x40e45d
push 4
lea eax, [ebp + 0xc]
xor esi, esi
push eax
push 4
push esi
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne esi, ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
pop edi
setns al
pop esi
pop ebp
ret 8

Function at 0x40e49a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x420]
xor esi, esi
push eax
mov dword [ebp - 0x418], esi
mov dword [ebp - 0x41c], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x40e4de
mov esi, 0x80004005
jmp 0x40e595
push ecx
mov ecx, dword [0x445340]
lea eax, [ebp - 0x20c]
push eax
call fcn.00406972
test eax, eax
jne 0x40e4ff
mov esi, 0x80004003
jmp 0x40e595
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x420]
lea eax, [ebp - 0x414]
push str._d:_s
push 0xffffffffffffffff
push eax
call fcn.0040b4b2
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
push 0x42f820
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_1721]
test eax, eax
jne 0x40e4d4
push esi
lea eax, [ebp - 0x41c]
push eax
push esi
push 2
push 1
push esi
push esi
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40e4d4
mov ecx, 0x445320
call fcn.00402ac1
push 4
mov dword [ebp - 0x424], eax
lea eax, [ebp - 0x424]
push eax
push 3
push esi
push esi
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
mov ecx, 0x80004005
cmovne esi, ecx
cmp dword [ebp - 0x418], 0
je 0x40e5aa
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x41c], 0
je 0x40e5bf
push dword [ebp - 0x41c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
pop esi
setns al
xor ecx, ebp
call fcn.004282ce
mov esp, ebp
pop ebp
ret
Function at 0x40e5d5
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x418], 0
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x40e67f
push ecx
mov ecx, dword [0x445340]
lea eax, [ebp - 0x20c]
push eax
call fcn.00406972
test eax, eax
je 0x40e66a
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x41c]
lea eax, [ebp - 0x414]
push str._d:_s
push 0xffffffffffffffff
push eax
call fcn.0040b4b2
add esp, 0x14
lea eax, [ebp - 0x418]
push eax
push 0x42f820
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_1542]
test eax, eax
jne 0x40e66a
lea eax, [ebp - 0x414]
push eax
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
cmp dword [ebp - 0x418], 0
je 0x40e67f
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004282ce
mov esp, ebp
pop ebp
ret

Function at 0x40f8c4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x40f904
cmp dword [esi + 4], 0x100
jne 0x40f904
cmp dword [esi + 8], 0x75
jne 0x40f8e2
xor eax, eax
jmp 0x40f907
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jns 0x40f904
mov eax, dword [esi + 8]
cmp eax, 9
je 0x40f8de
cmp eax, 0x4c
je 0x40f8de
add eax, 0xffffffb2
cmp eax, 1
jbe 0x40f8de
xor eax, eax
inc eax
pop esi
pop ebp
ret 0xc
Function at 0x41044c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.00429cbe
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x2010], ebx
call fcn.00410427
push 1
push 0
push 0x80
push 3
push 0
push 1
push Ordinal_1
push esi
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_913]
mov esi, eax
cmp esi, 0xffffffff
je 0x410585
push 0
lea eax, [ebp - 0x2008]
mov edi, 0x2000
push eax
push 0x1fff
lea eax, [ebp - 0x2004]
mov dword [ebp - 0x2008], edi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
test eax, eax
je 0x41057f
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x2008]
test eax, eax
je 0x410585
cmp eax, edi
jae 0x4105a1
mov byte [ebp + eax - 0x2004], 0
lea esi, [ebp - 0x2004]
mov al, byte [esi]
cmp al, 0xa
je 0x410574
cmp al, 0xd
je 0x410574
cmp al, 0xef
je 0x410574
cmp al, 0xbb
je 0x410574
cmp al, 0xbf
je 0x410574
test al, al
je 0x41057a
mov edi, esi
cmp al, 0xd
je 0x410521
test al, al
je 0x410521
inc edi
mov al, byte [edi]
cmp al, 0xa
jne 0x410512
xor eax, eax
mov ebx, edi
cmp byte [edi], al
sete al
sub ebx, esi
inc ebx
mov dword [ebp - 0x2014], eax
mov ecx, ebx
call fcn.00401f42
mov dword [ebp - 0x200c], eax
test eax, eax
je 0x41057a
push ebx
mov edx, eax
mov ecx, esi
call fcn.004105a7
mov ebx, dword [ebp - 0x2010]
lea eax, [ebp - 0x200c]
push eax
push ebx
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_692]
cmp eax, 0xffffffff
je 0x410585
cmp dword [ebp - 0x2014], 0
jne 0x41057a
mov esi, edi
jmp 0x4104f6
inc esi
jmp 0x4104f6
xor eax, eax
inc eax
jmp 0x41058e
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, ebx
call fcn.00410427
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004282ce
mov esp, ebp
pop ebp
ret 8
call fcn.00428a82
int3

Function at 0x41337e
Capabilities:
Get thread local storage value

Disassembly:
cmp byte [0x43c6c4], 0
push esi
push edi
push dword [0x43c6c0]
mov edi, ecx
je 0x413399
call dword [sym.imp.KERNEL32.dll_FlsGetValue]
jmp 0x41339f
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x4133bc
mov ecx, esi
call fcn.004133c1
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0xc]
mov byte [esi + 0x14], 0
mov al, 1
jmp 0x4133be
xor al, al
pop edi
pop esi
ret
Function at 0x413cd6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, ecx
push eax
push 0x20019
push 0
push str.CLSID
push Ordinal_1
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x413d6d
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 8]
call edi
test eax, eax
jne 0x413d62
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push str.InsecureQI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413d62
cmp dword [ebp - 0xc], edi
jne 0x413d62
mov edi, dword [ebp - 0x10]
cmp edi, 3
ja 0x413d62
cmp dword [ebp - 4], eax
je 0x413d6f
push dword [ebp - 4]
call esi
jmp 0x413d6f
cmp dword [ebp - 4], 0
je 0x413d6d
push dword [ebp - 4]
call esi
xor edi, edi
cmp dword [ebp - 8], 0
je 0x413d7a
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41404c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x445260], 0
je 0x414064
mov eax, dword [0x445264]
jmp 0x414132
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4140b2
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x445264
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4140b2
cmp dword [ebp - 8], 4
je 0x41410b
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x4140c3
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x414113
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x445264
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x414113
cmp dword [ebp - 8], 4
jne 0x414113
mov esi, dword [0x445264]
jmp 0x414119
mov dword [0x445264], esi
cmp dword [ebp - 4], 0
mov byte [0x445260], 1
je 0x41412f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4154f5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [esi + 0x3c], 0
je 0x415518
push 0
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [esi + 0x3c]
and dword [esi + 0x3c], 0
pop esi
pop ebp
ret 4
Function at 0x416c4f
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0xd0], 0
jne 0x416db1
mov eax, dword [esi + 0xcc]
test eax, eax
je 0x416db1
push 0
lea ecx, [ebp - 0x60]
push ecx
push eax
call dword [sym.imp.Mso20Win32Client.dll_Ordinal_1414]
test eax, eax
jne 0x416db1
lea eax, [ebp - 0x30]
mov dword [ebp - 0x30], 0x2c
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowPlacement]
test eax, eax
je 0x416db1
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp eax, 0x32
jl 0x416d6f
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
cmp eax, 0x32
jl 0x416d6f
push edi
push 2
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_MonitorFromRect]
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x58], 0x28
push ecx
push eax
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
mov esi, dword [ebp - 0x44]
sub esi, dword [ebp - 0x54]
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x40]
add eax, esi
sub edi, dword [ebp - 0x50]
push 4
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push 4
push 0
push str.WindowPosLeft
push dword [ebp - 0x60]
call ebx
mov eax, dword [ebp - 0x10]
add eax, edi
push 4
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push 4
push 0
push str.WindowPosTop
push dword [ebp - 0x60]
call ebx
mov eax, dword [ebp - 0xc]
add eax, esi
push 4
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push 4
push 0
push str.WindowPosRight
push dword [ebp - 0x60]
call ebx
mov eax, dword [ebp - 8]
add eax, edi
push 4
mov dword [ebp - 0x5c], eax
lea eax, [ebp - 0x5c]
push eax
push 4
push 0
push str.WindowPosBottom
push dword [ebp - 0x60]
call ebx
pop edi
mov ecx, dword [ebp - 0x28]
mov eax, ecx
and eax, 3
cmp al, 3
jne 0x416d84
mov dword [ebp - 0x5c], 1
jmp 0x416d93
and cl, 6
xor eax, eax
cmp cl, 6
setne al
dec eax
mov dword [ebp - 0x5c], eax
push 4
lea eax, [ebp - 0x5c]
push eax
push 4
push 0
push 0x430d58
push dword [ebp - 0x60]
call ebx
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004282ce
mov esp, ebp
pop ebp
ret
Function at 0x4187e4
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 8]
mov eax, dword [esi + 0x44]
cmp eax, edi
je 0x41889a
test eax, eax
je 0x41881c
add eax, 0x44
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
je 0x41881c
mov eax, dword [esi + 0x44]
add eax, 0x44
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x20]
test edi, edi
je 0x418825
lea edx, [edi + 0x44]
jmp 0x418827
xor edx, edx
mov eax, dword [esi + 0x44]
push ebx
test eax, eax
je 0x418834
lea ebx, [eax + 0x44]
jmp 0x418836
xor ebx, ebx
mov eax, dword [esi + 0x48]
push edx
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
mov eax, dword [esi]
mov dword [esi + 0x44], edi
push dword [edi + 4]
push esi
call dword [eax + 0x14]
push eax
call dword [sym.imp.Mso30Win32Client.dll_Ordinal_374]
pop ebx
test eax, eax
je 0x4188b8
mov ecx, dword [esi + 0x188]
test ecx, ecx
je 0x418874
mov eax, dword [esi + 0x44]
push 0
push dword [eax + 4]
push 0
push 1
call fcn.0041e8e1
mov eax, dword [esi + 0x44]
test eax, eax
je 0x41889a
add eax, 0x44
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
test eax, eax
je 0x41889a
mov eax, dword [esi + 0x44]
add eax, 0x44
push eax
mov ecx, dword [eax]
call dword [ecx + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [esi + 0x5c]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [esi]
push 0
push esi
call dword [eax + 0x54]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 4
call fcn.0041335b
int3

Function at 0x41e8e1
Capabilities:
Check mutex on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
mov eax, ecx
xor ebx, ebx
mov dword [ebp - 4], eax
test esi, esi
je 0x41e8f7
mov dword [esi], ebx
cmp dword [eax], ebx
jne 0x41e8ff
xor al, al
jmp 0x41e96c
push edi
push dword [eax + 8]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov edi, eax
test edi, edi
je 0x41e969
push 0x1f4
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x41e95b
mov eax, dword [ebp - 4]
push ebx
push ebx
push ebx
push 6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov ecx, eax
test ecx, ecx
je 0x41e95b
test esi, esi
je 0x41e93f
mov eax, dword [ecx]
mov dword [esi], eax
cmp byte [ebp + 8], bl
jne 0x41e94d
cmp byte [ebp + 0xc], bl
je 0x41e952
cmp dword [ecx], ebx
jne 0x41e952
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
push ecx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov bl, 1
push edi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425bfc
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x4452a0]
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x120], ecx
push edi
inc ebx
xor edi, edi
test eax, eax
jne 0x425cc1
mov esi, 0x114
lea eax, [ebp - 0x118]
push esi
push edi
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x118], esi
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
jbe 0x425c75
mov dword [0x4452a0], ebx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004282ce
mov esp, ebp
pop ebp
ret
jne 0x425cb9
cmp dword [ebp - 0x110], ebx
jb 0x425ca5
lea eax, [ebp - 0x11c]
mov dword [ebp - 0x11c], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_IsWow64Process]
test eax, eax
je 0x425cb1
cmp dword [ebp - 0x11c], edi
je 0x425cb1
mov dword [0x4452a0], 2
jmp 0x425cc6
mov dword [0x4452a0], ebx
jmp 0x425c62
push 2
pop eax
mov dword [0x4452a0], eax
cmp eax, 2
jne 0x425c62
mov esi, dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
push edi
call esi
mov ebx, eax
push ebx
call esi
test ebx, ebx
je 0x425ceb
push dword [ebp - 0x120]
call ebx
mov edi, eax
test edi, edi
je 0x425ceb
cmp edi, 1
jne 0x425cf5
mov dword [0], 1
mov eax, edi
jmp 0x425c64

Function at 0x42695c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43c4e8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [ebp - 0x20c]
push edi
push 0xffffffffffffffff
push ecx
push 0x104
push eax
mov edi, edx
call esi
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add eax, 2
lea ecx, [ebp - 4]
push 0xffffffffffffffff
sub ecx, eax
push edi
sar ecx, 1
push ecx
push eax
call esi
add esp, 0x24
lea ecx, [ebp - 0x20c]
call fcn.00426901
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x4269cd
and dword [0x4452a4], 0
jmp 0x4269d4
call edi
mov dword [0x4452a4], eax
test esi, esi
je 0x4269e1
and dword [0x4452ac], 0
jmp 0x4269f8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x4452ac], eax
cmp eax, 0xffffffff
je 0x426a01
and dword [0x4452a8], 0
jmp 0x426a08
call edi
mov dword [0x4452a8], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004282ce
mov esp, ebp
pop ebp
ret