joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407e60
Capabilities:
Check for peb beingdebugged flag
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0xffffffffffffffff
push 0x41563b
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x47c], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41a0e8]
xor eax, esp
push eax
lea eax, [esp + 0x494]
mov dword fs:[0], eax
mov eax, dword [esp + 0x4a8]
mov edi, dword [esp + 0x4a4]
mov ecx, dword [esp + 0x4ac]
xor ebp, ebp
xor edx, edx
mov dword [esp + 0x14], eax
mov eax, edi
mov word [esp + 0x20], dx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], ebp
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bp
jne 0x407ed2
sub eax, edx
sar eax, 1
push eax
push edi
lea ecx, [esp + 0x24]
call fcn.00407920
mov eax, dword [esp + 0x30]
lea esi, [eax - 1]
mov dword [esp + 0x49c], ebp
cmp esi, eax
jbe 0x407f03
call fcn.0040bbb2
mov eax, dword [esp + 0x20]
mov ebx, 8
cmp dword [esp + 0x34], ebx
jae 0x407f16
lea eax, [esp + 0x20]
cmp word [eax + esi*2], 0x5c
je 0x407f2d
push 1
push 0x416248
lea ecx, [esp + 0x24]
call fcn.00407800
push 1
push 0x41625c
lea ecx, [esp + 0x24]
call fcn.00407800
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x34], ebx
jae 0x407f4b
lea eax, [esp + 0x20]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x407f79
cmp dword [esp + 0x34], 8
jb 0x407f72
mov edx, dword [esp + 0x20]
push edx
call fcn.0040b2af
add esp, 4
xor eax, eax
jmp 0x408048
push 0x208
lea eax, [esp + 0x28c]
push ebp
push eax
call fcn.0040b9d0
mov esi, dword [sym.imp.SHLWAPI.dll_StrCmpW]
mov ebp, dword [sym.imp.SHLWAPI.dll_PathCombineW]
add esp, 0xc
jmp 0x407fa0
push 0x416250
lea ecx, [esp + 0x68]
push ecx
call esi
test eax, eax
je 0x408014
push 0x416254
lea edx, [esp + 0x68]
push edx
call esi
test eax, eax
je 0x408014
lea eax, [esp + 0x64]
push eax
push edi
lea ecx, [esp + 0x290]
push ecx
call ebp
test byte [esp + 0x38], 0x10
lea ecx, [esp + 0x288]
je 0x40800a
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
push ecx
call fcn.00407e60
mov edx, dword [esp + 0x20]
add esp, 0xc
cmp dword [edx], 0
je 0x408014
lea eax, [esp + 0x288]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x408014
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.00407c80
lea edx, [esp + 0x38]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407fa0
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x34], 8
jb 0x408043
mov eax, dword [esp + 0x20]
push eax
call fcn.0040b2af
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x494]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x47c]
xor ecx, esp
call fcn.0040b9b9
add esp, 0x48c
ret
Function at 0x408170
Capabilities:
Delete directory

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x14]
push esi
mov esi, dword [esp + 0x1c]
push edi
mov edi, dword [esp + 0x14]
lea edx, [esp + 8]
mov dword [esp + 8], eax
push edx
lea eax, [esp + 0x1c]
push eax
push edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x24], esi
call fcn.00407e60
add esp, 0xc
test esi, esi
je 0x4081af
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
xor eax, eax
pop esi
add esp, 8
ret

Function at 0x408580
Capabilities:
Get disk size

Disassembly:
sub esp, 0x18
cmp dword [ecx + 0x18], 8
jb 0x40858e
mov eax, dword [ecx + 4]
jmp 0x408591
lea eax, [ecx + 4]
lea ecx, [esp]
push ecx
lea edx, [esp + 0xc]
push edx
lea ecx, [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
cmp eax, 1
jne 0x4085d7
cmp dword [esp + 4], 0
ja 0x4085d7
jb 0x4085bd
cmp dword [esp], 0x5f5e100
jae 0x4085d7
push 0
push 0x416338
push 0x41630c
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
add esp, 0x18
ret
mov eax, 1
add esp, 0x18
ret

Function at 0x408df0
Capabilities:
Get common file path
Get program files directory

Disassembly:
sub esp, 0x414
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
mov esi, dword [esp + 0x41c]
push 0
push 0x41624c
mov ecx, esi
call fcn.00407920
push esi
push str.InstallLocation
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallXlNetAcc
push 0x80000002
call fcn.0040ad80
add esp, 0x10
test eax, eax
je 0x408f1e
push edi
push 0
push 0x41624c
mov ecx, esi
call fcn.00407920
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x12]
push ecx
mov word [esp + 0x14], ax
call fcn.0040b9d0
add esp, 0xc
cmp dword [esi + 0x18], 8
lea edi, [esi + 4]
jb 0x408e70
mov eax, dword [edi]
jmp 0x408e72
mov eax, edi
push 0x41624c
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
je 0x408eac
push 0x19
push 0
push str.InstallerIPCListenerPort
mov ecx, esi
call fcn.00408330
cmp eax, 0xffffffff
jne 0x408eac
cmp dword [esi + 0x18], 8
jb 0x408e9f
mov edi, dword [edi]
push str...XlNetAcc
push edi
lea edx, [esp + 0x10]
push edx
jmp 0x408ef4
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x21a]
push ecx
mov word [esp + 0x21c], ax
call fcn.0040b9d0
add esp, 0xc
lea edx, [esp + 0x210]
push edx
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x416364
lea eax, [esp + 0x214]
push eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [esp + 8]
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x408f02
sub eax, edx
sar eax, 1
push eax
lea edx, [esp + 8]
push edx
mov ecx, esi
call fcn.00407920
mov ecx, dword [esp + 0x414]
pop esi
xor ecx, esp
call fcn.0040b9b9
add esp, 0x414
ret 4
Function at 0x408f40
Capabilities:
Create directory
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x41572b
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x42c], eax
push ebx
push esi
mov eax, dword [0x41a0e8]
xor eax, esp
push eax
lea eax, [esp + 0x43c]
mov dword fs:[0], eax
xor eax, eax
push 0x206
mov ebx, ecx
push eax
lea ecx, [esp + 0x32]
push ecx
mov word [esp + 0x34], ax
call fcn.0040b9d0
add esp, 0xc
lea edx, [esp + 0x28]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.XlNetAccInstall
lea eax, [esp + 0x2c]
push eax
call esi
xor ecx, ecx
push ecx
mov word [esp + 0x14], cx
push 0x41624c
lea ecx, [esp + 0x14]
mov dword [esp + 0x2c], 7
mov dword [esp + 0x28], 0
call fcn.00407920
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x23a]
push eax
mov dword [esp + 0x450], 0
mov word [esp + 0x23c], dx
call fcn.0040b9d0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x234]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x234]
push eax
call fcn.00408070
mov eax, dword [esp + 0x18]
add esp, 8
cmp dword [esp + 0x24], 8
jae 0x409041
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x2c]
push ecx
call esi
push 0
lea edx, [esp + 0x2c]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
lea eax, [esp + 0x28]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x409060
sub eax, edx
sar eax, 1
push eax
lea eax, [esp + 0x2c]
push eax
mov ecx, ebx
call fcn.00407920
cmp dword [esp + 0x24], 8
jb 0x409090
mov ecx, dword [esp + 0x10]
push ecx
call fcn.0040b2af
add esp, 4
mov ecx, dword [esp + 0x43c]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x42c]
xor ecx, esp
call fcn.0040b9b9
add esp, 0x43c
ret

Function at 0x409180
Capabilities:
Check for peb beingdebugged flag

Disassembly:
push 0xffffffffffffffff
push 0x415798
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x41a0e8]
xor eax, esp
push eax
lea eax, [esp + 0x2c]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x40]
xor edi, edi
push 0xffffffffffffffff
push edi
xor eax, eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x18], edi
mov dword [esp + 0x34], 7
mov dword [esp + 0x30], edi
mov word [esp + 0x20], ax
call fcn.00407700
mov edx, dword [esp + 0x44]
mov eax, edx
mov dword [esp + 0x34], edi
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, di
jne 0x4091e0
sub eax, esi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00407800
mov esi, dword [esp + 0x3c]
push 0xffffffffffffffff
push edi
xor edx, edx
mov dword [esi + 0x18], 7
mov dword [esi + 0x14], edi
push eax
mov ecx, esi
mov word [esi + 4], dx
call fcn.00407700
cmp dword [esp + 0x28], 8
jb 0x40922d
mov eax, dword [esp + 0x14]
push eax
call fcn.0040b2af
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0x2c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x2c
ret
Function at 0x409630
Capabilities:
Access peb ldr_data
Set file attributes

Disassembly:
push 0xffffffffffffffff
push 0x415838
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x20], eax
push ebx
push esi
mov eax, dword [0x41a0e8]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov dword [esp + 0x28], 7
mov dword [esp + 0x24], 0
mov word [esp + 0x14], ax
lea ecx, [esp + 0x10]
push ecx
mov ecx, esi
mov dword [esp + 0x3c], eax
call fcn.00408df0
push 0xb
push str._preInstall
lea ecx, [esp + 0x18]
call fcn.00407800
mov eax, dword [esp + 0x14]
mov ebx, 8
mov dword [esp + 0xc], 1
cmp dword [esp + 0x28], ebx
jae 0x4096b4
lea eax, [esp + 0x14]
lea edx, [esp + 0xc]
push edx
push eax
call fcn.00407a10
add esp, 8
cmp dword [esp + 0xc], 0
je 0x4096e6
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebx
jae 0x4096d7
lea eax, [esp + 0x14]
push 1
push 0
push 0
push eax
call fcn.00408170
add esp, 0x10
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebx
jae 0x4096f4
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
push ecx
push eax
call fcn.00407a10
add esp, 8
cmp dword [esp + 0xc], 0
jne 0x40975a
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebx
jae 0x409717
lea eax, [esp + 0x14]
push eax
call fcn.00407a50
add esp, 4
test eax, eax
je 0x40976a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40976a
cmp eax, 0x50
je 0x40976a
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebx
jae 0x40974f
lea eax, [esp + 0x14]
push eax
call fcn.00407a50
add esp, 4
jmp 0x40976a
push 0
push 0x41624c
lea ecx, [esp + 0x18]
call fcn.00407920
mov edx, dword [esp + 0x24]
push 0
push 0x41624c
push edx
push 0
lea ecx, [esp + 0x20]
call fcn.00407360
test eax, eax
je 0x4097ad
mov eax, dword [esp + 0x14]
cmp dword [esp + 0x28], ebx
jae 0x409793
lea eax, [esp + 0x14]
push 2
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0xffffffffffffffff
push 0
lea eax, [esp + 0x18]
push eax
lea ecx, [esi + 0x1c]
call fcn.00407700
cmp dword [esp + 0x28], ebx
jb 0x4097c0
mov ecx, dword [esp + 0x14]
push ecx
call fcn.0040b2af
add esp, 4
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.0040b9b9
add esp, 0x30
ret
Function at 0x40a510
Capabilities:
Accept command line arguments

Disassembly:
push 0xffffffffffffffff
push 0x415968
mov eax, dword fs:[0]
push eax
sub esp, 0x68
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x64], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x41a0e8]
xor eax, esp
push eax
lea eax, [esp + 0x7c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x8c]
mov ecx, dword [esp + 0x90]
lea edx, [esp + 0x14]
push edx
push eax
mov dword [esp + 0x20], ecx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
xor edi, edi
xor ebx, ebx
cmp dword [esp + 0x14], edi
mov dword [esp + 0x20], eax
jle 0x40a707
mov dword [esp + 0x1c], 0x3a
mov ebp, 7
mov eax, dword [esp + 0x20]
mov ecx, dword [eax + ebx*4]
xor edx, edx
mov eax, ecx
mov dword [esp + 0x74], ebp
mov dword [esp + 0x70], edi
mov word [esp + 0x60], dx
lea esi, [eax + 2]
lea ebx, [ebx]
mov dx, word [eax]
add eax, 2
cmp dx, di
jne 0x40a5a0
sub eax, esi
sar eax, 1
push eax
push ecx
lea ecx, [esp + 0x64]
call fcn.00407920
push edi
xor eax, eax
push 0x41624c
lea ecx, [esp + 0x48]
mov dword [esp + 0x8c], edi
mov dword [esp + 0x60], ebp
mov dword [esp + 0x5c], edi
mov word [esp + 0x4c], ax
call fcn.00407920
xor ecx, ecx
push edi
mov word [esp + 0x2c], cx
push 0x41624c
lea ecx, [esp + 0x2c]
mov byte [esp + 0x8c], 1
mov dword [esp + 0x44], ebp
mov dword [esp + 0x40], edi
call fcn.00407920
push 1
push edi
lea edx, [esp + 0x24]
push edx
lea ecx, [esp + 0x68]
mov byte [esp + 0x90], 2
call fcn.00408330
mov esi, eax
cmp esi, 0xffffffff
jne 0x40a647
push eax
push 1
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x4c]
call fcn.004075f0
push edi
push 0x41624c
lea ecx, [esp + 0x2c]
call fcn.00407920
jmp 0x40a678
cmp esi, 1
jbe 0x40a678
lea ecx, [esi - 1]
push ecx
push 1
lea edx, [esp + 0x64]
push edx
lea ecx, [esp + 0x4c]
call fcn.004075f0
inc esi
cmp esi, dword [esp + 0x70]
jae 0x40a678
push 0xffffffffffffffff
push esi
lea eax, [esp + 0x64]
push eax
lea ecx, [esp + 0x30]
call fcn.004075f0
lea ecx, [esp + 0x40]
push ecx
mov ecx, dword [esp + 0x1c]
call fcn.0040a3e0
push 0xffffffffffffffff
push edi
lea edx, [esp + 0x2c]
push edx
mov ecx, eax
call fcn.00407700
mov esi, 8
cmp dword [esp + 0x3c], esi
jb 0x40a6ad
mov eax, dword [esp + 0x28]
push eax
call fcn.0040b2af
add esp, 4
xor ecx, ecx
mov dword [esp + 0x3c], ebp
mov dword [esp + 0x38], edi
mov word [esp + 0x28], cx
cmp dword [esp + 0x58], esi
jb 0x40a6cf
mov edx, dword [esp + 0x44]
push edx
call fcn.0040b2af
add esp, 4
xor eax, eax
mov dword [esp + 0x58], ebp
mov dword [esp + 0x54], edi
mov word [esp + 0x44], ax
mov dword [esp + 0x84], 0xffffffff
cmp dword [esp + 0x74], esi
jb 0x40a6fc
mov ecx, dword [esp + 0x60]
push ecx
call fcn.0040b2af
add esp, 4
inc ebx
cmp ebx, dword [esp + 0x14]
jl 0x40a57f
xor eax, eax
mov ecx, dword [esp + 0x7c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.0040b9b9
add esp, 0x74
ret 8
Function at 0x40a7c0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x4159cb
mov eax, dword fs:[0]
push eax
sub esp, 0x3c0
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x3bc], eax
push esi
push edi
mov eax, dword [0x41a0e8]
xor eax, esp
push eax
lea eax, [esp + 0x3cc]
mov dword fs:[0], eax
mov edi, dword [esp + 0x3dc]
mov esi, ecx
call fcn.0040afc0
test eax, eax
je 0x40a853
push 0x208
lea eax, [esp + 0x1c4]
push 0
push eax
call fcn.0040b9d0
add esp, 0xc
push 0x104
lea ecx, [esp + 0x1c4]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 1
lea edx, [esp + 0x1c4]
push edx
push str.SoftwareMicrosoftWindows_NTCurrentVersionAppCompatFlagsCompatibility_AssistantPersisted
push 0x80000001
call fcn.0040ad50
add esp, 0x10
mov ecx, esi
call fcn.004081d0
test eax, eax
jne 0x40a868
mov eax, 1
jmp 0x40a8fc
mov ecx, esi
call fcn.00408f40
mov ecx, esi
call fcn.00408580
test eax, eax
jne 0x40a881
mov eax, 2
jmp 0x40a8fc
mov ecx, esi
call fcn.004097e0
test eax, eax
jne 0x40a893
mov eax, 3
jmp 0x40a8fc
lea eax, [esp + 0xf]
push eax
lea ecx, [esp + 0x13]
push ecx
lea ecx, [esp + 0x18]
call fcn.00409840
lea edx, [esp + 0x10]
push edx
push edi
mov ecx, esi
mov dword [esp + 0x3dc], 0
call fcn.0040a510
lea eax, [esp + 0x30]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
push edi
mov ecx, esi
call fcn.00409250
mov dword [esp + 0x3d4], 0xffffffff
lea ecx, [esp + 0x10]
test al, al
jne 0x40a8f5
call fcn.0040a730
mov eax, 4
jmp 0x40a8fc
call fcn.0040a730
xor eax, eax
mov ecx, dword [esp + 0x3cc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x3bc]
xor ecx, esp
call fcn.0040b9b9
add esp, 0x3cc
ret 4

Function at 0x40ac10
Capabilities:
Create thread
Extract resource via kernel32 functions

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push esi
push edi
mov dword [esp + 8], ecx
movzx ecx, word [esp + 0x10]
push eax
push ecx
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x40ac3c
pop edi
mov eax, 0x80004005
pop esi
pop ecx
ret 8
push esi
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
je 0x40ac31
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebp, eax
cmp ebp, edi
jne 0x40ac62
pop ebp
pop edi
mov eax, 0x80004005
pop esi
pop ecx
ret 8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x14
mov ebx, eax
call fcn.0040b522
add esp, 4
cmp eax, edi
je 0x40ac90
xor edx, edx
mov dword [eax + 4], edi
mov word [eax], dx
mov dword [eax + 8], edi
mov dword [eax + 0xc], edi
mov dword [eax + 0x10], edi
mov esi, eax
jmp 0x40ac92
xor esi, esi
mov eax, dword [esp + 0x10]
mov cx, word [esp + 0x18]
mov dword [esi + 0xc], eax
mov word [esi], cx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea edx, [esp + 0x1c]
push edx
push edi
push esi
push 0x40a9e0
push edi
mov dword [esi + 0x10], eax
push edi
mov dword [esp + 0x34], edi
call fcn.0040bfa1
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop ebp
pop edi
xor eax, eax
pop esi
pop ecx
ret 8
Function at 0x40ad50
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 4
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0xc]
push 4
push ecx
push edx
push eax
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
neg eax
sbb eax, eax
and eax, 0x80004005
ret

Function at 0x40ad80
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x40c
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x408], eax
push ebx
mov ebx, dword [esp + 0x41c]
push ebp
mov ebp, dword [esp + 0x424]
push esi
mov esi, dword [esp + 0x41c]
push edi
mov edi, dword [esp + 0x424]
push 0x400
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0040b9d0
add esp, 0xc
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x18]
push eax
push ebx
push edi
push esi
mov dword [esp + 0x2c], 0x200
mov dword [esp + 0x28], 0xffffffff
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x40ae02
mov ecx, ebp
call fcn.00407dc0
mov eax, 0x80004005
jmp 0x40ae2e
lea eax, [esp + 0x18]
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40ae10
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x1c]
push ecx
mov ecx, ebp
call fcn.00407920
xor eax, eax
mov ecx, dword [esp + 0x418]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040b9b9
add esp, 0x40c
ret
Function at 0x40ae50
Capabilities:
Create directory
Extract resource via kernel32 functions

Disassembly:
sub esp, 0x20c
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x208], eax
mov eax, dword [esp + 0x214]
push ebx
mov ebx, dword [esp + 0x21c]
push esi
push eax
movzx eax, word [esp + 0x21c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
test esi, esi
jne 0x40aea8
pop esi
mov eax, 0x80004005
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040b9b9
add esp, 0x20c
ret
push esi
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40ae8c
push edi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x40af9a
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push eax
push edi
mov dword [esp + 0x20], 0
call fcn.004010b0
add esp, 0x14
test eax, eax
jne 0x40af9a
mov dword [esp + 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
lea ecx, [ecx]
mov eax, dword [esp + 0xc]
push 1
lea edx, [esp + 0x14]
push edx
push eax
call fcn.004012d0
add esp, 0xc
cmp dword [esp + 0x10], 0
jne 0x40af00
push 0
push ebx
push 0
call dword [sym.imp.SHELL32.dll_SHCreateDirectoryExW]
mov eax, ebx
lea edx, [eax + 2]
jmp 0x40af30
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40af30
mov ecx, dword [esp + 0xc]
sub eax, edx
sar eax, 1
push eax
push ebx
push ecx
call fcn.00401010
xor edx, edx
push 0x1fe
push edx
lea eax, [esp + 0x2a]
push eax
mov word [esp + 0x2c], dx
call fcn.0040b9d0
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x2c]
push ecx
push 0
push edx
call fcn.00401420
mov eax, dword [esp + 0x30]
push eax
call fcn.00401230
add esp, 0x28
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x208]
xor ecx, esp
call fcn.0040b9b9
add esp, 0x20c
ret
mov ecx, dword [esp + 0x214]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 0x80004005
call fcn.0040b9b9
add esp, 0x20c
ret

Function at 0x40afc0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x41a0e8]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.0040b9d0
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [esp + 4], 6
jb 0x40b022
cmp dword [esp + 0x10], 2
jne 0x40b022
mov eax, 1
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0040b9b9
add esp, 0x118
ret
mov ecx, dword [esp + 0x114]
xor ecx, esp
xor eax, eax
call fcn.0040b9b9
add esp, 0x118
ret
Function at 0x40b190
Capabilities:
Terminate process

Disassembly:
mov eax, dword [esp + 0xc]
sub esp, 0x38
push eax
call fcn.00408820
mov ecx, eax
call fcn.0040a7c0
test eax, eax
je 0x40b1b3
mov eax, 1
add esp, 0x38
ret 0x10
push esi
xor esi, esi
push edi
lea ecx, [esp + 8]
mov dword [esp + 8], vtable.WTL::CMessageLoop.0
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x20], esi
call fcn.0040b040
mov edi, eax
call fcn.00408820
mov ecx, eax
call fcn.004081c0
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x18]
cmp eax, esi
je 0x40b211
push eax
call fcn.0040c051
add esp, 4
mov dword [esp + 0x18], esi
mov eax, dword [esp + 0xc]
pop edi
mov dword [esp + 0x18], esi
mov dword [esp + 0x1c], esi
cmp eax, esi
pop esi
je 0x40b22c
push eax
call fcn.0040c051
add esp, 4
xor eax, eax
add esp, 0x38
ret 0x10

Function at 0x40b9b9
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a0e8]
jne 0x40b9c3
repz ret
jmp fcn.0040e39c
Function at 0x41392b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040dcda
and dword [ebp - 4], 0
cmp dword [0x41bb74], 0
mov ebx, eax
jne 0x4139dc
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x413a8d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x413a8d
push eax
call fcn.0040dc68
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41bb74], eax
call esi
push eax
call fcn.0040dc68
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41bb78], eax
call esi
push eax
call fcn.0040dc68
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x41bb7c], eax
call esi
push eax
call fcn.0040dc68
pop ecx
mov dword [0x41bb84], eax
test eax, eax
je 0x4139dc
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040dc68
pop ecx
mov dword [0x41bb80], eax
mov eax, dword [0x41bb80]
cmp eax, ebx
je 0x413a34
cmp dword [0x41bb84], ebx
je 0x413a34
push eax
call fcn.0040dce3
push dword [0x41bb84]
mov esi, eax
call fcn.0040dce3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x413a34
test edi, edi
je 0x413a34
call esi
test eax, eax
je 0x413a2b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x413a2b
test byte [ebp - 0xc], 1
jne 0x413a34
or dword [ebp + 0x10], 0x200000
jmp 0x413a6d
mov eax, dword [0x41bb78]
cmp eax, ebx
je 0x413a6d
push eax
call fcn.0040dce3
pop ecx
test eax, eax
je 0x413a6d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x413a6d
mov eax, dword [0x41bb7c]
cmp eax, ebx
je 0x413a6d
push eax
call fcn.0040dce3
pop ecx
test eax, eax
je 0x413a6d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41bb74]
call fcn.0040dce3
pop ecx
test eax, eax
je 0x413a8d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x413a8f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret