joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4187a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push edi
push 0x228
lea ecx, [ebp - 0x22c]
push 0
push ecx
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x230], 0x22c
call fcn.004279d0
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea edx, [ebp - 0x230]
mov esi, eax
push edx
push esi
mov dword [ebp - 0x234], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x418865
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
mov eax, dword [ebp - 0x238]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call fcn.0041fcb7
add esp, 8
test eax, eax
jne 0x418852
mov edx, dword [ebp - 0x228]
push edx
push eax
push 1
call ebx
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call edi
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x418810
pop ebx
push esi
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
Function at 0x418d10
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x103
lea ecx, [ebp - 0x23b]
push 0
push ecx
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 0
call fcn.004279d0
push 0x103
lea edx, [ebp - 0x137]
push 0
push edx
mov byte [ebp - 0x138], 0
call fcn.004279d0
xor eax, eax
add esp, 0x18
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
push 0x104
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edi, edi
jmp 0x418dc0
push 0x104
lea ecx, [ebp - 0x138]
push 0
push ecx
call fcn.004279d0
push edi
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x138]
push str._sinfoem_i.inf
push eax
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x138]
push ecx
push 0x20
xor eax, eax
lea edx, [ebp - 0x34]
push edx
push 0x439a00
push 0x44449c
push str.Strings
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call esi
test eax, eax
je 0x418e95
lea eax, [ebp - 0x34]
push str.SunMoon_Rise
push eax
call fcn.0042caac
add esp, 8
test eax, eax
jne 0x418e95
lea ecx, [ebp - 0x138]
push ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0x439a00
push str.DriverName
push str.Strings
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call esi
test eax, eax
je 0x418e95
lea eax, [ebp - 0x14]
push 0x43c670
push eax
call fcn.0042caac
add esp, 8
test eax, eax
jne 0x418e95
lea ecx, [ebp - 0x138]
push 0x5c
push ecx
call fcn.00421ca0
add esp, 8
test eax, eax
jne 0x418eb5
inc edi
cmp edi, 0x3e7
jl 0x418dc0
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x240]
push 0xc
inc eax
push eax
push edx
call fcn.0041fef0
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
Function at 0x418ee0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x4444c4
call fcn.004042f0
xor eax, eax
add esp, 4
xor ebx, ebx
push 0x3e
lea ecx, [ebp - 0x66]
push ebx
push ecx
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov word [ebp - 0x68], ax
call fcn.004279d0
add esp, 0xc
push 0x3fe
lea eax, [ebp - 0x56e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x570], dx
call fcn.004279d0
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x16f]
push ebx
push ecx
mov byte [ebp - 0x170], bl
call fcn.004279d0
lea edx, [ebp - 0x24]
add esp, 0xc
push edx
call fcn.00418d10
add esp, 4
test eax, eax
je 0x4190a9
lea eax, [ebp - 0x68]
push eax
lea ebx, [ebp - 0x24]
call fcn.0040b5d0
add esp, 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x570]
push str.PnP___s__Exist.
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x570]
add esp, 0xc
push eax
call fcn.004042f0
add esp, 4
mov ecx, ebx
push ecx
lea edx, [ebp - 0x170]
push str.pnputil.exe__f__d__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x418ff8
lea ecx, [ebp - 0x594]
push ecx
call eax
movzx eax, word [ebp - 0x594]
test eax, eax
je 0x419033
cmp eax, 9
jne 0x419033
call fcn.00405ea0
push 0
cmp eax, 1
jne 0x41902a
lea edx, [ebp - 0x170]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
call fcn.00405f00
jmp 0x419044
lea eax, [ebp - 0x170]
push eax
jmp 0x41903c
push 0
lea ecx, [ebp - 0x170]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
cmp esi, 0x1f
ja 0x419068
push str.PnP_Delete_Result_Fail___
call fcn.004042f0
add esp, 4
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x24]
push edx
call fcn.00418d10
add esp, 4
test eax, eax
je 0x4190a2
push str.PnP_Delete_Fail___
call fcn.004042f0
add esp, 4
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
push str.PnP_Delete_Success___
jmp 0x4190ae
push str.PnP_oemX.inf_not_Exist.
call fcn.004042f0
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
Function at 0x419680
Capabilities:
Delete file
Delete service
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4c
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
test eax, eax
je 0x41989e
push 0xf01ff
push 0x442c08
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, eax
mov dword [ebp - 0xa4c], ebx
test ebx, ebx
je 0x41989e
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xa0e]
push ecx
mov word [ebp - 0xa10], ax
call fcn.004279d0
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
xor esi, esi
mov word [ebp - 0x210], dx
call fcn.004279d0
add esp, 0xc
lea ecx, [ebp - 0xa2c]
push ecx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
lea edx, [ebp - 0x210]
push str.C:Program_FilesWW2017CFwmcSystem7.exe
push edx
xor edi, edi
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x210]
push edi
push eax
call fcn.0042017e
add esp, 0x10
test eax, eax
jne 0x4197a1
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea ebx, [ebx]
cmp edi, 0x1e
je 0x41979b
push 0x435920
call fcn.004187a0
add esp, 4
push 0x80
lea ecx, [ebp - 0x210]
push ecx
call ebx
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x64
inc edi
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.0042017e
add esp, 8
test eax, eax
je 0x419750
mov ebx, dword [ebp - 0xa4c]
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 0xa48]
push ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0xa44], 1
je 0x419808
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
inc esi
push esi
lea edx, [ebp - 0xa10]
push 0x444610
push edx
call edi
lea eax, [ebp - 0xa10]
add esp, 0xc
push eax
call fcn.004042f0
add esp, 4
cmp esi, 5
je 0x41981a
lea ecx, [ebp - 0xa2c]
push ecx
push 0xc8
push ebx
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp esi, 5
jle 0x4197a1
push 0x44463c
call fcn.004042f0
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x419824
push str.PbkW
call fcn.004042f0
add esp, 4
push ebx
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x419865
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0xa10]
push 0x44467c
push edx
call edi
lea eax, [ebp - 0xa10]
add esp, 0xc
push eax
call fcn.004042f0
add esp, 4
mov dword [0x44992c], 0
jmp 0x41988c
lea ecx, [ebp - 0xa10]
push 0x4446a8
push ecx
call edi
lea edx, [ebp - 0xa10]
push edx
call fcn.004042f0
add esp, 0xc
mov dword [0x44992c], 1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
Function at 0x41a3f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.004279d0
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x412]
push eax
mov word [ebp - 0x414], dx
call fcn.004279d0
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x20c]
push str.C:Program_FilesWW2017CFWM7F.cab
push ecx
call edi
lea edx, [ebp - 0x414]
push str.C:Program_FilesWW2017CFwmcRMS7.exe
push edx
call edi
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0042017e
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x30
test eax, eax
jne 0x41a4a9
push esi
mov esi, 0x449640
mov edi, edi
mov ecx, dword [esi]
push ecx
lea edx, [ebp - 0x20c]
push str.C:Program_FilesWW2017CF_s
push edx
call edi
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call ebx
add esi, 4
cmp esi, 0x4496bc
jl 0x41a480
pop esi
lea ecx, [ebp - 0x414]
push ecx
call ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0041fb1e
mov esp, ebp
pop ebp
ret
Function at 0x41c950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x41c963
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x41c9dd
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00426d40
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x41c9b1
sub eax, edi
jmp 0x41c9b3
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x41c9a2
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x41c9d0
sub eax, edi
jmp 0x41c9d2
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x41c9c1
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x41ca92
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x41ca03
mov ebx, ecx
test ebx, ebx
je 0x41ca56
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x41ca25
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.0041d480
jmp 0x41ca3e
cmp eax, 2
jne 0x41ca44
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x41ca37
xor eax, eax
jmp 0x41ca41
mov edx, ebx
call fcn.0041db20
mov edx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.00426d40
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov edi, dword [esi + 0x74]
cmp edi, 3
jb 0x41ca7e
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp edi, 0x106
jae 0x41ca92
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x41c960
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41db00
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x41db0b
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.0041db20
Function at 0x41fb1e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x448044]
jne 0x41fb28
repz ret
jmp fcn.004223be

Function at 0x4200ff
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x420126
call fcn.0042368f
mov dword [eax], esi
call fcn.0042367c
push 0x16
pop esi
mov dword [eax], esi
call fcn.0042362a
mov eax, esi
jmp 0x42017b
test dword [ebp + 0xc], 0xfffffff9
jne 0x42010c
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x420153
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004236a2
pop ecx
call fcn.0042367c
mov eax, dword [eax]
jmp 0x42017b
test al, 0x10
jne 0x420179
test al, 1
je 0x420179
test byte [ebp + 0xc], 2
je 0x420179
call fcn.0042368f
mov dword [eax], 5
call fcn.0042367c
mov dword [eax], 0xd
jmp 0x42014a
xor eax, eax
pop esi
pop ebp
ret
Function at 0x42a324
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x448044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00422ee1
and dword [ebp - 0x14], 0
cmp dword [0x44b248], 0
mov dword [ebp - 0x18], eax
jne 0x42a3d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x42a47f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x434cf0
push ebx
call edi
test eax, eax
je 0x42a47f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44b248], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44b24c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44b250], eax
call edi
push eax
call esi
mov dword [0x44b258], eax
test eax, eax
je 0x42a3d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44b254], eax
mov eax, dword [0x44b254]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x42a430
cmp dword [0x44b258], ecx
je 0x42a430
push eax
call esi
push dword [0x44b258]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x42a430
test ebx, ebx
je 0x42a430
call edi
test eax, eax
je 0x42a427
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x42a427
test byte [ebp - 8], 1
jne 0x42a430
or dword [ebp + 0x10], 0x200000
jmp 0x42a463
mov eax, dword [0x44b24c]
cmp eax, dword [ebp - 0x18]
je 0x42a463
push eax
call esi
test eax, eax
je 0x42a463
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x42a463
mov eax, dword [0x44b250]
cmp eax, dword [ebp - 0x18]
je 0x42a463
push eax
call esi
test eax, eax
je 0x42a463
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44b248]
call esi
test eax, eax
je 0x42a47f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x42a481
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041fb1e
leave
ret
Function at 0x401069
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4bf030]
jne 0x401073
repz ret
jmp fcn.00401e41

Function at 0x408aeb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404d3a
and dword [ebp - 4], 0
cmp dword [0x4c1b68], 0
mov ebx, eax
jne 0x408b9c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x408c4d
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x408c4d
push eax
call fcn.00404cc8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4c1b68], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4c1b6c], eax
call esi
push eax
call fcn.00404cc8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4c1b70], eax
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x4c1b78], eax
test eax, eax
je 0x408b9c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404cc8
pop ecx
mov dword [0x4c1b74], eax
mov eax, dword [0x4c1b74]
cmp eax, ebx
je 0x408bf4
cmp dword [0x4c1b78], ebx
je 0x408bf4
push eax
call fcn.00404d43
push dword [0x4c1b78]
mov esi, eax
call fcn.00404d43
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408bf4
test edi, edi
je 0x408bf4
call esi
test eax, eax
je 0x408beb
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x408beb
test byte [ebp - 0xc], 1
jne 0x408bf4
or dword [ebp + 0x10], 0x200000
jmp 0x408c2d
mov eax, dword [0x4c1b6c]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x408c2d
mov eax, dword [0x4c1b70]
cmp eax, ebx
je 0x408c2d
push eax
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c2d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4c1b68]
call fcn.00404d43
pop ecx
test eax, eax
je 0x408c4d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x408c4f
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40af50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x828
mov eax, dword [0x4bf030]
xor eax, esp
mov dword [esp + 0x820], eax
mov eax, dword [0x2c9f55c]
push ebx
mov ebx, dword [0x2c9f280]
push esi
mov esi, dword [0x4bff60]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40af91
push str.Kapoza_yodiralozor
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov eax, dword [0x2c9f55c]
mov dword [0x4c1d0c], esi
cmp eax, 0x114e
jne 0x40afb6
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov eax, dword [0x2c9f55c]
cmp eax, 0x2f
jne 0x40afd6
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
push 0
lea ecx, [esp + 0x2c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_FindNextVolumeMountPointW]
call fcn.0040ae50
mov ecx, dword [esp + 0x82c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401069
add esp, 0x828
ret
Function at 0x10008110
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10081d62
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x100a836c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x430], esi
mov dword [ebp - 0x42c], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
push 0x208
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push eax
mov dword [ebp - 0x42c], 1
mov dword [ebp - 0x424], 0x104
call fcn.10057470
add esp, 0xc
mov dword [ebp - 0x428], 1
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x428]
push eax
push str.local_m2
push str.SOFTWAREComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x100081ee
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100081d0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000c2b0
cmp dword [esi + 0x10], 0
jne 0x1000826a
push 0x208
lea eax, [ebp - 0x420]
push 0
push eax
call fcn.10057470
add esp, 0xc
lea eax, [ebp - 0x420]
push 0x104
push eax
call fcn.10039150
lea ecx, [ebp - 0x420]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008224
sub ecx, edx
lea eax, [ebp - 0x420]
sar ecx, 1
push ecx
push eax
mov ecx, esi
call fcn.1000c2b0
cmp dword [esi + 0x14], 8
mov eax, esi
mov ecx, dword [esi + 0x10]
jb 0x1000824f
mov eax, dword [esi]
add ecx, ecx
push ecx
push eax
push 1
push str.local_m2
push str.SOFTWAREComMaster
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10031895
mov esp, ebp
pop ebp
ret