joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eb3b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.0041fe40
cmp byte [0x453898], 0
je 0x41ebca
cmp word [0x45389a], 0
je 0x41ebca
push esi
push 0x800
lea eax, [ebp - 0x1008]
push eax
push 0x45389a
call fcn.0041d6d4
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push str.SoftwareWinRAR_SFX
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x41ebc9
push dword [ebp + 8]
call fcn.00424e13
pop ecx
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1008]
push 1
push esi
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x41ebce
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2000
call fcn.0041fe40
push esi
push dword [ebp + 8]
push str.sfxcmd
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push 0x1000
lea eax, [ebp - 0x2000]
push eax
push dword [ebp + 8]
call fcn.00411688
mov esi, eax
test esi, esi
je 0x41ec26
movzx ecx, word [esi]
push ecx
jmp 0x41ec11
add esi, 2
movzx eax, word [esi]
push eax
call fcn.004117a4
test al, al
jne 0x41ec0a
push esi
push str.sfxpar
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
leave
ret 4

Function at 0x42c0a6
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp ax, bx
jbe 0x42c0c6
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x42c0c0
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x42c0b1
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0042be6c
enter 0xffffffffffffd2cf, 0x3a
lea eax, [ebp - 0x58]
push eax
call fcn.0042be7c
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0042be31
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x42c15a
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx
Function at 0x42c166
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp ax, bx
jbe 0x42c0c6
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x42c0c0
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x42c0b1
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0042be6c
enter 0xffffffffffffd2cf, 0x3a
lea eax, [ebp - 0x58]
push eax
call fcn.0042be7c
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.0042be31
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x42c15a
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
ror byte [eax + 0x45c6c15d], 0xc2
in al, dx

Function at 0x42cb60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp + 0xc], 8
jne 0x42ccf2
and byte [ebp - 0x6b8], 0
and byte [ebp - 0x6b7], 0
invalid
test dword [edx - 7], ecx
invalid
invalid

Function at 0x42d246
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
invalid
invalid
Function at 0x401996
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
test ebx, ebx
sete dl
cmp dword [ebp + 8], 0
sete al
mov ecx, 0
or dl, al
jne 0x401ada
lea ecx, [edi*4 + 0xb]
mov edx, 0x2aaaaaab
mov eax, ecx
imul edx
sar edx, 1
mov eax, ecx
sar eax, 0x1f
sub edx, eax
lea edx, [edx*4 + 1]
cmp edx, dword [ebp + 0x14]
jle 0x401a3d
mov dword [esp], 0x6f
call 0x40c300
sub esp, 4
mov ecx, 0
jmp 0x401ada
movzx eax, byte [ecx]
and eax, 3
shl eax, 4
movzx eax, byte [eax + section.w59ciabo]
mov byte [ebx + 1], al
mov byte [ebx + 2], 0x3d
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
movzx eax, byte [ecx + 1]
and eax, 0xf
movzx eax, byte [eax*4 + section.w59ciabo]
mov byte [ebx + 2], al
mov byte [ebx + 3], 0x3d
add ebx, 4
jmp 0x401ad2
mov esi, 0
mov ecx, dword [ebp + 8]
cmp esi, edi
jge 0x401ad2
movzx eax, byte [ecx]
shr al, 2
movzx eax, al
movzx eax, byte [eax + section.w59ciabo]
mov byte [ebx], al
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x4019fc
movzx edx, byte [ecx]
and edx, 3
shl edx, 4
movzx eax, byte [ecx + 1]
shr al, 4
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.w59ciabo]
mov byte [ebx + 1], al
mov eax, edi
sub eax, esi
cmp eax, 2
je 0x401a1f
movzx edx, byte [ecx + 1]
and edx, 0xf
shl edx, 2
movzx eax, byte [ecx + 2]
shr al, 6
movzx eax, al
or edx, eax
movzx eax, byte [edx + section.w59ciabo]
mov byte [ebx + 2], al
movzx eax, byte [ecx + 2]
and eax, 0x3f
movzx eax, byte [eax + section.w59ciabo]
mov byte [ebx + 3], al
add esi, 3
add ecx, 3
add ebx, 4
cmp esi, edi
jl 0x401a4d
mov byte [ebx], 0
mov ecx, 1
mov eax, ecx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x401020
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
mov ebx, ecx
push edi
lea edi, [ebx + 0x150]
mov ecx, 0xe
mov esi, str.identifierBegin:abcdefghijklmnopqrstuvwxyz:identifierEnd
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
movsb byte es:[edi], byte [esi]
call fcn.00417c20
push 0x206
lea eax, [esp + 0x12]
push 0
push eax
mov word [esp + 0x18], 0
call fcn.0042cac0
add esp, 0xc
cmp dword [ebx + 0xa8], 8
jb 0x40107f
mov ecx, dword [ebx + 0x94]
jmp 0x401085
lea ecx, [ebx + 0x94]
lea edx, [esp + 0xc]
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
add ecx, 2
add edx, 2
test ax, ax
jne 0x401090
lea edi, [esp + 0xc]
add edi, 0xfffffffe
jmp 0x4010b0
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x4010b0
mov ecx, 9
mov esi, str.PeopleCalendar.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x104
lea edx, [ebx + 0x45c]
push edx
push 0x47f78c
push str.Spreader
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.AppInfo
call esi
lea eax, [esp + 0xc]
push eax
push 0x104
add ebx, 0x254
push ebx
push str.lastgf
push 0x47f73c
push str.AppInfo
call esi
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.0042caa2
add esp, 0x20c
ret 4

Function at 0x401980
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push esi
push 0x47f7f8
mov esi, ecx
call ebx
test eax, eax
mov dword [esi], eax
jne 0x40199a
pop esi
pop ebx
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetNativeSystemInfo
push eax
call edi
mov dword [esi + 8], eax
mov eax, dword [esi]
push str.IsWow64Process
push eax
call edi
mov ecx, dword [esi]
push str.Wow64DisableWow64FsRedirection
push ecx
mov dword [esi + 0xc], eax
call edi
mov edx, dword [esi]
push str.Wow64RevertWow64FsRedirection
push edx
mov dword [esi + 0x18], eax
call edi
mov dword [esi + 0x14], eax
mov eax, dword [esi]
push str.GetSystemWow64DirectoryW
push eax
call edi
push 0x47f884
mov dword [esi + 0x10], eax
call ebx
test eax, eax
mov dword [esi + 4], eax
jne 0x4019f2
pop edi
pop esi
pop ebx
ret
push str.Wow64RevertWow64FsRedirection
push eax
call edi
mov ecx, dword [esi + 4]
push str.Wow64RevertWow64FsRedirection
push ecx
mov dword [esi + 0x20], eax
call edi
pop edi
mov dword [esi + 0x1c], eax
pop esi
mov eax, 1
pop ebx
ret
Function at 0x402180
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x402199
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4021d4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x4021d0
lea ebx, [ebx]
cmp esi, eax
jae 0x4021d4
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x4021c0
cmp esi, eax
jb 0x4021da
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x409b70
Capabilities:
Create shortcut via ishelllink

Disassembly:
push 0xffffffffffffffff
push 0x478120
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x40], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x49a670]
xor eax, esp
push eax
lea eax, [esp + 0x58]
mov dword fs:[0], eax
mov edx, dword [esp + 0x68]
xor esi, esi
mov ebx, 7
mov eax, edx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x4c], esi
mov word [esp + 0x3c], si
lea edi, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x409bc0
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x40]
call fcn.00401850
push 1
push 0x47fe18
lea ecx, [esp + 0x40]
mov dword [esp + 0x68], esi
call fcn.00406100
push 5
push 0x480688
lea ecx, [esp + 0x40]
call fcn.00406100
push 4
push 0x4802e0
lea ecx, [esp + 0x40]
call fcn.00406100
call fcn.00402050
mov ecx, eax
call fcn.00415a70
mov ecx, eax
mov dword [esp + 0x34], ebx
mov dword [esp + 0x30], esi
mov word [esp + 0x20], si
lea edi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
cmp dx, si
jne 0x409c30
sub ecx, edi
sar ecx, 1
push ecx
push eax
lea ecx, [esp + 0x24]
call fcn.00401850
mov ebp, 8
push ebp
push str.RiLi.exe
lea ecx, [esp + 0x24]
mov byte [esp + 0x68], 1
call fcn.00406100
cmp dword [esp + 0x34], ebp
mov edi, dword [esp + 0x20]
jae 0x409c71
lea edi, [esp + 0x20]
cmp dword [esp + 0x50], ebp
mov ebx, dword [esp + 0x3c]
jae 0x409c7f
lea ebx, [esp + 0x3c]
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jl 0x409d06
lea eax, [esp + 0x14]
push eax
push 0x4837ec
push 1
push esi
push 0x4837fc
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x409d00
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
push edi
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x3c]
push 1
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
lea edx, [esp + 0x18]
push edx
push 0x48380c
push eax
mov eax, dword [ecx]
call eax
test eax, eax
jl 0x409cf4
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x18]
push esi
push ebx
push eax
call edx
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
call dword [sym.imp.ole32.dll_CoUninitialize]
cmp dword [esp + 0x34], ebp
jb 0x409d19
mov eax, dword [esp + 0x20]
push eax
call fcn.0042397c
add esp, 4
cmp dword [esp + 0x50], ebp
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], esi
mov word [esp + 0x20], si
jb 0x409d3d
mov ecx, dword [esp + 0x3c]
push ecx
call fcn.0042397c
add esp, 4
mov ecx, dword [esp + 0x58]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x40]
xor ecx, esp
call fcn.0042caa2
add esp, 0x50
ret 4
Function at 0x40a010
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push esi
push edi
mov edi, dword [esp + 0x21c]
xor esi, esi
push 0x206
lea eax, [esp + 0x12]
push esi
push eax
mov word [esp + 0x18], si
call fcn.0042cac0
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0xc
push edi
call ebx
test eax, eax
jne 0x40a0fd
push edi
lea ecx, [esp + 0x10]
push 0x47f870
push ecx
call fcn.0042cb6a
lea edx, [esp + 0x18]
push str..del
push edx
call fcn.0042dddf
add esp, 0x14
test eax, eax
je 0x40a08b
push 5
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x40a0fd
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test esi, esi
jne 0x40a0ab
push edi
lea eax, [esp + 0x14]
push str._s.del
push eax
call fcn.0042cb6a
add esp, 0xc
jmp 0x40a0bf
push esi
push edi
lea ecx, [esp + 0x18]
push str._s.del_d
push ecx
call fcn.0042cb6a
add esp, 0x10
lea edx, [esp + 0x10]
push edx
call ebp
test eax, eax
je 0x40a0df
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
jne 0x40a0df
cmp esi, 0xa
jg 0x40a0fc
add esi, 1
jmp 0x40a092
lea ecx, [esp + 0x10]
push ecx
push edi
call fcn.0042e01e
add esp, 8
push 5
push 0
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
pop ebp
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0042caa2
add esp, 0x20c
ret 4

Function at 0x40a150
Capabilities:
Delete file

Disassembly:
push 0xffffffffffffffff
push 0x478198
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x49a670]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [esp + 0x1c]
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x40a1a5
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x40a1dc
cmp dword [esi - 4], 1
jle 0x40a1bc
mov ecx, dword [esi - 0xc]
push ecx
lea ecx, [esp + 0x20]
call fcn.004022b0
mov esi, dword [esp + 0x1c]
push esi
mov ecx, edi
call fcn.0040a010
lea eax, [esi - 0x10]
mov dword [esp + 0x14], 0xffffffff
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40a1e8
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, 1
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x40a210
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x4781e1
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x420], eax
push ebx
push esi
mov eax, dword [0x49a670]
xor eax, esp
push eax
lea eax, [esp + 0x430]
mov dword fs:[0], eax
mov esi, ecx
push 0x206
lea eax, [esp + 0x22]
push 0
push eax
mov word [esp + 0x28], 0
call fcn.0042cac0
push 0x206
lea ecx, [esp + 0x236]
push 0
push ecx
mov word [esp + 0x23c], 0
call fcn.0042cac0
add esp, 0x18
push 0x47fe24
lea ecx, [esp + 0x10]
call fcn.00402a40
push 0x47fe24
lea ecx, [esp + 0x14]
mov dword [esp + 0x43c], 0
call fcn.00402a40
mov bl, 1
push 0x47fe24
lea ecx, [esp + 0x18]
mov byte [esp + 0x43c], bl
call fcn.00402a40
cmp dword [esp + 0x440], 0
mov byte [esp + 0x438], 2
push 0
je 0x40a3c8
push 0x17
lea edx, [esp + 0x24]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40a326
push 0x480688
lea ecx, [esp + 0x20]
push ecx
lea edx, [esp + 0x22c]
push 0x480870
push edx
call fcn.0042cb6a
add esp, 0xc
lea eax, [esp + 0x228]
mov ecx, esp
mov dword [esp + 0x1c], esp
push eax
call fcn.00402a40
mov ecx, esi
call fcn.004113f0
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
or edx, 0xffffffff
lea ecx, [eax + 0xc]
mov byte [esp + 0x438], bl
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a34d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x10]
add eax, 0xfffffff0
mov byte [esp + 0x438], 0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a375
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0xc]
add eax, 0xfffffff0
mov dword [esp + 0x438], 0xffffffff
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40a3a0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov ecx, dword [esp + 0x430]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x420]
xor ecx, esp
call fcn.0042caa2
add esp, 0x430
ret 4
push 2
lea ecx, [esp + 0x24]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x40a2ed
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
mov byte [esp + 0x438], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jmp 0x40a341

Function at 0x40a500
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x206
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call fcn.0042cac0
add esp, 0xc
push 0
push 0x10
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40a553
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.0040a400
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.0042caa2
add esp, 0x20c
ret
Function at 0x40a570
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x206
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call fcn.0042cac0
add esp, 0xc
push 0
push 0xb
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40a5c3
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.0040a400
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.0042caa2
add esp, 0x20c
ret

Function at 0x40a5e0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x208], eax
push esi
push 0x206
lea eax, [esp + 0xa]
push 0
push eax
mov esi, ecx
mov word [esp + 0x10], 0
call fcn.0042cac0
add esp, 0xc
push 0
push 2
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea edx, [esp + 4]
push edx
mov ecx, esi
call fcn.0040a400
mov ecx, dword [esp + 0x20c]
pop esi
xor ecx, esp
call fcn.0042caa2
add esp, 0x20c
ret

Function at 0x40a650
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push 0x206
lea eax, [esp + 0xa]
push 0
push eax
mov ebx, ecx
mov word [esp + 0x10], 0
call fcn.0042cac0
add esp, 0xc
push 0
push 0x1a
lea ecx, [esp + 0xc]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x40a6c6
push esi
push edi
lea edi, [esp + 0xc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x40a6a0
mov ecx, 0x15
mov esi, str.MicrosoftInternet_ExplorerQuick_Launch
lea edx, [esp + 0xc]
rep movsd dword es:[edi], dword [esi]
push edx
mov ecx, ebx
call fcn.0040a400
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
pop ebx
xor ecx, esp
call fcn.0042caa2
add esp, 0x20c
ret

Function at 0x40a8c0
Capabilities:
Delete service
Stop service

Disassembly:
sub esp, 0x20
mov eax, dword [0x49a670]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
push 0xf003f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x40a935
push edi
push 0xf003f
push str.PeopleCDTime
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
je 0x40a934
lea eax, [esp + 0x10]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x40a931
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
je 0x40a931
mov ebx, 1
push edi
call ebp
pop edi
push esi
call ebp
mov ecx, dword [esp + 0x28]
pop esi
pop ebp
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0042caa2
add esp, 0x20
ret
Function at 0x40be00
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4783b8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x49a670]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
xor eax, eax
mov dword [esp + 8], eax
mov ecx, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esi], ecx
lea ecx, [esi + 8]
mov dword [esi + 4], edx
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 7
push eax
mov dword [esp + 0x1c], eax
mov word [ecx + 4], ax
lea eax, [esp + 0x30]
push eax
call fcn.00401760
cmp dword [esp + 0x40], 8
jb 0x40be6f
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.0042397c
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret