joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5219f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xcb000]
push edi
jmp 0x521a0a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x521a11
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x521a00
mov eax, 1
add ebx, ebx
jne 0x521a23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x521a34
jne 0x521a53
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x521a53
dec eax
add ebx, ebx
jne 0x521a40
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x521a18
add ebx, ebx
jne 0x521a4f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x521aa5
xor ecx, ecx
sub eax, 3
jb 0x521a6b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x521ada
sar eax, 1
mov ebp, eax
jmp 0x521a76
add ebx, ebx
jne 0x521a76
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x521a44
inc ecx
add ebx, ebx
jne 0x521a84
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x521a44
add ebx, ebx
jne 0x521a91
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x521a86
jne 0x521aa2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x521a86
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x521ac4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x521ab6
jmp 0x521a06
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x521ac4
add edi, ecx
jmp 0x521a06
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x521ae2
cmp byte [edi], 0x11
jne 0x521ae2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x521ae7
lea edi, [esi + 0x11a000]
mov eax, dword [edi]
or eax, eax
je 0x521b5f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x16a4f0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x16a66c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x521b14
mov ecx, edi
jns 0x521b43
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x16a670]
or eax, eax
je 0x521b59
mov dword [ebx], eax
add ebx, 4
jmp 0x521b31
call dword [esi + 0x16a680]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x521b90
cmp al, 0xef
ja 0x521b83
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x521b65
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x521b72
mov ebp, dword [esi + 0x16a674]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x521bc4
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x421b98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 8]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], edx
xor eax, eax
mov dword [ebp - 0x14], eax
push 0x11
call sub.user32.dll_GetKeyState
test ax, 0x8000
setne al
cmp dword [0x447758], 0
sete dl
or al, dl
jne 0x421cdc
mov eax, dword [0x44775c]
mov bx, 0xffff
call fcn.00402eb8
mov eax, dword [0x447758]
mov esi, dword [eax + 8]
dec esi
test esi, esi
jl 0x421cab
inc esi
xor edi, edi
mov edx, edi
mov eax, dword [0x447758]
call fcn.0040e91c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0xc]
je 0x421ca3
mov eax, dword [ebp - 0x10]
cmp byte [eax + 0x16c], 0
je 0x421ca3
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x50]
test al, al
je 0x421ca3
mov eax, dword [ebp - 0x10]
call fcn.00429a14
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x421ca3
push ebp
call fcn.00421b54
pop ecx
test al, al
jne 0x421ca3
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x8c]
cmp eax, dword [ebp - 0x10]
jne 0x421c5f
mov eax, dword [ebp - 0x10]
call fcn.00428358
dec eax
jle 0x421ca3
mov byte [ebp - 0x15], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x15]
push eax
lea ecx, [ebp - 0x28]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
mov bx, 0xffc2
call fcn.00402eb8
cmp byte [ebp - 0x15], 0
je 0x421ca3
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0x28]
push eax
call sub.user32.dll_PtInRect
test eax, eax
je 0x421ca3
mov edx, dword [ebp - 0x10]
mov eax, dword [0x44775c]
call fcn.00421404
inc edi
dec esi
jne 0x421bf2
mov eax, dword [0x44775c]
cmp dword [eax + 8], 0
jle 0x421cc3
mov eax, dword [0x44775c]
call fcn.00421494
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x421cdc
push ebp
mov eax, dword [ebp - 0x14]
call fcn.00421a0c
pop ecx
test al, al
jne 0x421cdc
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4256f0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x42572b
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x425712
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x425723
add edx, ecx
invalid
push esp
invalid
Function at 0x425dc8
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x425d87
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x425da5
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x425e03
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x425dea
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x425df3
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x425dfd
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x425ddf
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x425d69
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x425e50
dec eax
je 0x425e47
sub eax, 3
je 0x425e3e
mov dword [ebp - 4], 0x40
jmp 0x425e6d
mov dword [ebp - 4], 4
jmp 0x425e53
mov dword [ebp - 4], 0x20
jmp 0x425e53
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x425e9f
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x425e1f
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.004256b0
mov eax, dword [0xff62ce51]
jne 0x425eaa
push 1
push esi
call edi
mov eax, esi
jmp 0x425eab
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi

Function at 0x426ae0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x426b06
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x426ab0
call fcn.004256b0
mov bl, 0x23
mov al, 0xed
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
Function at 0x4272dc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [ebp - 0x6fc], 2
jne 0x427399
and byte [ebp - 0x79c], 0
and byte [ebp - 0x79b], 0
mov byte [ebp - 0x79a], 0x10
and byte [ebp - 0x799], 0
mov byte [ebp - 0x798], 0xb3
mov byte [ebp - 0x797], 0x8c
mov byte [ebp - 0x796], 0x80
mov byte [ebp - 0x795], 0x81
mov byte [ebp - 0x794], 0x9d
mov byte [ebp - 0x793], 0x8a
mov byte [ebp - 0x792], 0x9c
mov byte [ebp - 0x791], 0xc1
mov byte [ebp - 0x790], 0x8b
mov byte [ebp - 0x78f], 0x83
mov byte [ebp - 0x78e], 0x83
mov byte [ebp - 0x78d], 0xef
call fcn.004256b0
wait
sbb dh, byte [ebx - 0x6e]
push 0xc
lea eax, [ebp - 0x79c]
push eax
call fcn.004256c0
pop ecx
push eax
mov eax, dword [ebp - 0x550]
lea eax, [ebp + eax - 0x654]
push eax
call fcn.00425621
add esp, 0xc
lea eax, [ebp - 0x654]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 3
jne 0x42743a
and byte [ebp - 0x7ac], 0
and byte [ebp - 0x7ab], 0
mov byte [ebp - 0x7aa], 0xed
and byte [ebp - 0x7a9], 0
mov byte [ebp - 0x7a8], 0x4e
mov byte [ebp - 0x7a7], 0x55
mov byte [ebp - 0x7a6], 0x56
mov byte [ebp - 0x7a5], 0x7e
mov byte [ebp - 0x7a4], 0x21
mov byte [ebp - 0x7a3], 0x20
mov byte [ebp - 0x7a2], 0x3c
mov byte [ebp - 0x7a1], 0x76
mov byte [ebp - 0x7a0], 0x7e
mov byte [ebp - 0x79f], 0x7e
mov byte [ebp - 0x79e], 0x12
push 0xb
lea eax, [ebp - 0x7ac]
push eax
call fcn.004256c0
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00425621
add esp, 0xc
jmp 0x427628
cmp dword [ebp - 0x6fc], 4
jne fcn.004274e4
and byte [ebp - 0x7bc], 0
and byte [ebp - 0x7bb], 0
mov byte [ebp - 0x7ba], 2
clc
invalid
inc dword [edx]
and byte [ebp - 0x7b9], 0
mov byte [ebp - 0x7b8], 0xa1
mov byte [ebp - 0x7b7], 0xb2
mov byte [ebp - 0x7b6], 0xb1
mov byte [ebp - 0x7b5], 0xb8
mov byte [ebp - 0x7b4], 0xcf
mov byte [ebp - 0x7b3], 0xce
mov byte [ebp - 0x7b2], 0xd3
mov byte [ebp - 0x7b1], 0x99
mov byte [ebp - 0x7b0], 0x91
mov byte [ebp - 0x7af], 0x91
mov byte [ebp - 0x7ae], 0xfd
call fcn.004256b0
loop 0x42744e
rol dword [edi], 1
push 0xb
lea eax, [ebp - 0x7bc]
push eax
call fcn.004256c0
pop ecx
push eax
mov eax, dword [ebp - 0x338]
lea eax, [ebp + eax - 0x230]
push eax
call fcn.00425621
add esp, 0xc
jmp 0x427628
Function at 0x4a57e9
Capabilities:
Encode data using xor

Disassembly:
invalid
invalid
sub eax, 0x72d38800
sbb al, 0x38
nop
retf 0xd36e
rcr byte [ebp + 0x7ff4f0f9], 1
mov al, 0x5a
daa
and eax, 0x8ad4e8e7
imul edi, edi, 0x17
jo 0x4a5785
or al, 0xf8
adc byte [ecx + 0x35], 0x5f
mov eax, 0x2b538e1c
jp 0x4a57d3
xor eax, 0x8e1cb85f
push ebx
sub edi, dword [edx - 0x36]
loop 0x4a5800
ja 0x4a57b1
push esp
xchg cl, bl
out 0x8b, al
in eax, 0xdc
out 0xa6, al
loopne 0x4a5834
sbb al, 0x3c
fadd qword [ecx + 0x5c]
cmp al, 0xdc
inc ecx
pop esp
sal byte [eax], 1
cli
add al, 0x48
fucom st(1)
in al, dx
pop esi
shr dword [edi], cl
add byte [ebp + 0x35e09932], bh
push esi
push es
ficom dword [ecx - 0x6e7efa49]
xchg ecx, eax
cli
xchg esp, eax
pop ss
push ebx
inc eax
imul ebx, dword [edi - 0x1ccd111b], 0x8f3c3f4c
dec eax
cmp bl, dl
movsb byte es:[edi], byte [esi]
pop eax
pop es
push esp
in eax, dx
in eax, 0x89
inc edx
int1
push edi
push esi
inc eax
jge 0x4a5817
pop edi
in eax, dx
xchg dword [0xf7c7b83a], edx
mov dh, 0xbc
cdq
adc byte [edx], ah
enter 0xfffffffffffff346, 0x6e
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
push 0x4b
dec ecx
int1
lcall 0xdba, 0x119d287b
test dword [esi + 0x73], 0xa75d345c
cmp bl, byte [esi - 0x7d]
invalid
Function at 0x1e9e058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1e9e1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x1e9e07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e9e06a
add dl, dl
jne 0x1e9e089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e9e0dc
xor eax, eax
add dl, dl
jne 0x1e9e096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x1e9e17d
add dl, dl
jne 0x1e9e0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e9e0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e9e0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e9e0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x1e9e0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x1e9e075
mov eax, 1
add dl, dl
jne 0x1e9e0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1e9e0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e9e0e1
sub eax, ebx
mov ebx, 1
jne 0x1e9e128
mov ecx, 1
add dl, dl
jne 0x1e9e10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1e9e119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e9e105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e9e075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1e9e13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1e9e14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x1e9e136
cmp eax, 0x7d00
jae 0x1e9e16d
cmp eax, 0x500
jb 0x1e9e168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e9e075
cmp eax, 0x7f
ja 0x1e9e170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x1e9e075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x1e9e19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x1e9e075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x401d3e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x454
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push 0x1fe
mov edi, eax
lea eax, [ebp - 0x242]
push esi
push eax
mov word [ebp - 0x244], si
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x452]
push esi
push eax
mov word [ebp - 0x454], si
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x454]
push eax
call fcn.00405c80
push edi
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x244]
push str._SpecialRun__I64x__d
push 0xff
push eax
call sub.msvcrt.dll__snwprintf
push 0x38
lea eax, [ebp - 0x3c]
push esi
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x454]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x244]
mov dword [ebp - 0x2c], eax
add esp, 0x40
lea eax, [ebp - 0x40]
push eax
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x34], str.RunAs
mov dword [ebp - 0x3c], 0x40
mov dword [ebp - 0x24], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp eax, esi
mov edi, dword [ebp - 8]
je 0x401e23
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp + 8]
push eax
push edi
mov dword [ebp + 8], esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401e2b
cmp dword [ebp + 8], 0x103
je 0x401e2b
mov esi, dword [ebp + 8]
jmp 0x401e2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
pop edi
mov eax, esi
pop esi
leave
ret 4
Function at 0x403670
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi + 0x14], 0
jne 0x4036cb
push edi
push str.advapi32.dll
call fcn.004065eb
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp], str.CreateProcessWithLogonW
push eax
mov dword [esi + 0x14], eax
call edi
push str.CreateProcessWithTokenW
push dword [esi + 0x14]
mov dword [esi + 0xc], eax
call edi
push 0x40ee44
push dword [esi + 0x14]
mov dword [esi], eax
call edi
push str.DuplicateTokenEx
push dword [esi + 0x14]
mov dword [esi + 4], eax
call edi
push str.LogonUserExExW
push dword [esi + 0x14]
mov dword [esi + 8], eax
call edi
mov dword [esi + 0x10], eax
pop edi
ret

Function at 0x405747
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0040d5c0
push esi
push 0x2001f
lea eax, [ebp - 4]
push eax
xor esi, esi
call fcn.00405585
test eax, eax
jne 0x405802
push edi
mov edi, 0x7fe
push edi
lea eax, [ebp - 0x802]
push esi
push eax
mov word [ebp - 0x804], si
call sub.msvcrt.dll_memset
push edi
lea eax, [ebp - 0x1002]
push esi
push eax
mov word [ebp - 0x1004], si
call sub.msvcrt.dll_memset
lea edi, [ebx + 0x20a]
push edi
push ebx
push str._s_shell_scommand
mov esi, 0x3ff
lea eax, [ebp - 0x804]
push esi
push eax
call sub.msvcrt.dll__snwprintf
push edi
push ebx
push str._s_shell_s
lea eax, [ebp - 0x1004]
push esi
push eax
call sub.msvcrt.dll__snwprintf
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
add esp, 0x40
lea eax, [ebp - 0x804]
push eax
push dword [ebp - 4]
call esi
lea eax, [ebp - 0x1004]
push eax
push dword [ebp - 4]
call esi
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x405932
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcslen
pop ecx
add eax, eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
leave
ret

Function at 0x405c51
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
ret

Function at 0x405dbf
Capabilities:
Get common file path

Disassembly:
cmp word [0x420350], 0
push esi
mov esi, 0x420350
jne 0x405de0
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov dword [0x42055c], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x42055c]
pop ecx
pop ecx
pop esi
ret

Function at 0x405df3
Capabilities:
Get common file path

Disassembly:
cmp word [0x420560], 0
push esi
mov esi, 0x420560
jne 0x405e14
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [0x42076c], eax
push esi
push dword [esp + 0xc]
call sub.msvcrt.dll_wcscpy
mov eax, dword [0x42076c]
pop ecx
pop ecx
pop esi
ret
Function at 0x406135
Capabilities:
Create process on windows

Disassembly:
push 5
mov eax, 0x40e548
push eax
push eax
push dword [esp + 0x14]
push str.open
push dword [esp + 0x18]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
ret

Function at 0x4070ed
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x4131e8
push dword [esp + 0xc]
push esi
push 0x40e548
push dword [esp + 0x14]
push 0x4133f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x407112
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040d5c0
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x4131e8
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40e548
push dword [ebp + 8]
push 0x4133f8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x407181
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x407185
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040d5c0
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x4131e8
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x40e548
push dword [ebp + 8]
mov esi, 0x4133f8
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x4071ec
cmp dword [ebp + 0x10], 0
jne 0x4071ec
xor eax, eax
jmp 0x4071fa
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x407571
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00405c51
test eax, eax
pop ecx
je 0x4075f8
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x4131e8
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x4133f8
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x40f260
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x413480
mov dword [0x41347c], eax
call fcn.004070ed
push 0x3f
push str.TranslatorName
mov esi, 0x413500
call fcn.004070ed
push 0xff
push str.TranslatorURL
mov esi, 0x413580
call fcn.004070ed
add esp, 0x18
pop edi
pop esi
ret
Function at 0x4084af
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0040d5c0
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
leave
ret