joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10180ff0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x91], 0
mov dword [ebp - 0x98], 0
mov dword [ebp - 0x88], 0
lea eax, [ebp - 0x88]
push eax
push 0x10203a90
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x9c], eax
cmp dword [ebp - 0x9c], 0
jne 0x10181043
jmp 0x10181168
mov ecx, dword [ebp - 0x9c]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x98], eax
cmp dword [ebp - 0x98], 0
jne 0x10181066
jmp 0x10181168
mov edx, dword [ebp - 0x98]
push edx
mov eax, dword [ebp - 0x9c]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
push 0x10203aa8
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x1018108e
jmp 0x10181168
mov dword [ebp - 0x8c], 0
mov dword [ebp - 0x90], 0
lea edx, [ebp - 0x8c]
push edx
lea eax, [ebp - 0x90]
push eax
push 0x10203a8c
mov ecx, dword [ebp - 0x98]
push ecx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x101810ca
jmp 0x10181168
push 0x80
push 0
lea edx, [ebp - 0x84]
push edx
call fcn.101a9880
add esp, 0xc
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0xc]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 0xc]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 8]
and ecx, 0xffff
movzx edx, cx
push edx
mov eax, dword [ebp - 0x90]
mov ecx, dword [eax + 8]
shr ecx, 0x10
and ecx, 0xffff
movzx edx, cx
push edx
push 0x10203ac0
push 0xffffffffffffffff
push 0x40
lea eax, [ebp - 0x84]
push eax
call fcn.1010c6d0
add esp, 0x20
lea ecx, [ebp - 0x84]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10009a40
mov byte [ebp - 0x91], 1
xor edx, edx
jne 0x10181014
cmp dword [ebp - 0x98], 0
je 0x1018117e
mov eax, dword [ebp - 0x98]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [ebp - 0x91]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret
Function at 0x10181330
Capabilities:
Get session user name
List user accounts for group

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f9c4b
mov eax, dword fs:[0]
push eax
sub esp, 0x140
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 4
lea ecx, [ebp - 0x114]
call fcn.10008df0
lea ecx, [ebp - 0x114]
call fcn.10018880
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x114]
call fcn.10019070
mov byte [ebp - 0x125], 0
push 0x100
push 0
lea eax, [ebp - 0x110]
push eax
call fcn.101a9880
add esp, 0xc
mov dword [ebp - 0x11c], 0x7f
lea ecx, [ebp - 0x11c]
push ecx
lea edx, [ebp - 0x110]
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x101813c9
jmp 0x1018154c
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x110]
test edx, edx
jne 0x101813e2
jmp 0x1018154c
mov dword [ebp - 0x124], 0
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x14c], 0
push 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x118]
push ecx
push 0x400
lea edx, [ebp - 0x124]
push edx
push 1
push str.Administrators
push 0
call sub.NETAPI32.dll_NetLocalGroupGetMembers
mov dword [ebp - 0x13c], eax
cmp dword [ebp - 0x13c], 0
je 0x10181454
cmp dword [ebp - 0x13c], 0xea
je 0x10181454
jmp 0x1018154c
mov eax, dword [ebp - 0x124]
mov dword [ebp - 0x144], eax
mov dword [ebp - 0x12c], 0
jmp 0x1018147b
mov ecx, dword [ebp - 0x12c]
add ecx, 1
mov dword [ebp - 0x12c], ecx
mov edx, dword [ebp - 0x12c]
cmp edx, dword [ebp - 0x118]
jae 0x10181544
lea eax, [ebp - 0x110]
mov dword [ebp - 0x134], eax
imul ecx, dword [ebp - 0x12c], 0xc
mov edx, dword [ebp - 0x144]
mov eax, dword [edx + ecx + 8]
mov dword [ebp - 0x130], eax
mov ecx, dword [ebp - 0x130]
mov dx, word [ecx]
mov word [ebp - 0x136], dx
mov eax, dword [ebp - 0x134]
cmp dx, word [eax]
jne 0x10181516
cmp word [ebp - 0x136], 0
je 0x1018150a
mov ecx, dword [ebp - 0x130]
mov dx, word [ecx + 2]
mov word [ebp - 0x138], dx
mov eax, dword [ebp - 0x134]
cmp dx, word [eax + 2]
jne 0x10181516
add dword [ebp - 0x130], 4
add dword [ebp - 0x134], 4
cmp word [ebp - 0x138], 0
jne 0x101814b0
mov dword [ebp - 0x140], 0
jmp 0x10181521
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x140], ecx
mov edx, dword [ebp - 0x140]
mov dword [ebp - 0x148], edx
cmp dword [ebp - 0x148], 0
jne 0x1018153f
mov byte [ebp - 0x125], 1
jmp 0x10181544
jmp 0x1018146c
xor eax, eax
jne 0x1018138c
lea ecx, [ebp - 0x114]
call fcn.10019390
mov cl, byte [ebp - 0x125]
mov byte [ebp - 0x126], cl
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x114]
call fcn.10018900
mov al, byte [ebp - 0x126]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret
Function at 0x101815a0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x534
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x114
push 0
lea eax, [ebp - 0x530]
push eax
call fcn.101a9880
add esp, 0xc
mov dword [ebp - 0x530], 0x114
push 0x410
push 0
lea ecx, [ebp - 0x414]
push ecx
call fcn.101a9880
add esp, 0xc
mov dword [ebp - 0x534], 0x207
lea edx, [ebp - 0x530]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1018166f
cmp dword [ebp - 0x52c], 6
jb 0x1018166f
mov eax, dword [ebp - 0x534]
mov dword [ebp - 0x41c], eax
lea ecx, [ebp - 0x41c]
push ecx
lea edx, [ebp - 0x414]
push edx
push 0x10203ea0
push 0x10203eb0
push reloc.gdiplus.dll_Ordinal_1
call fcn.10186b60
add esp, 0x14
movzx eax, al
test eax, eax
je 0x1018166f
mov ecx, 2
imul edx, ecx, 0
movzx eax, word [ebp + edx - 0x414]
test eax, eax
je 0x1018166f
lea ecx, [ebp - 0x414]
push ecx
mov ecx, dword [ebp + 8]
call fcn.10009a40
mov al, 1
jmp 0x10181729
mov edx, dword [ebp - 0x534]
mov dword [ebp - 0x418], edx
lea eax, [ebp - 0x418]
push eax
lea ecx, [ebp - 0x414]
push ecx
push 0
push 0x10203f4c
push SysReAllocStringLen
call fcn.10186b60
add esp, 0x14
movzx edx, al
test edx, edx
je 0x101816cb
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x414]
test edx, edx
je 0x101816cb
lea eax, [ebp - 0x414]
push eax
mov ecx, dword [ebp + 8]
call fcn.10009a40
mov al, 1
jmp 0x10181729
mov ecx, dword [ebp - 0x534]
mov dword [ebp - 0x418], ecx
lea edx, [ebp - 0x418]
push edx
lea eax, [ebp - 0x414]
push eax
push 0
push 0x10203f7c
push reloc.gdiplus.dll_Ordinal_1
call fcn.10186b60
add esp, 0x14
movzx ecx, al
test ecx, ecx
je 0x10181727
mov edx, 2
imul eax, edx, 0
movzx ecx, word [ebp + eax - 0x414]
test ecx, ecx
je 0x10181727
lea edx, [ebp - 0x414]
push edx
mov ecx, dword [ebp + 8]
call fcn.10009a40
mov al, 1
jmp 0x10181729
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret

Function at 0x10186160
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
call sub.SensApi.dll_IsNetworkAlive
test eax, eax
je 0x1018618d
mov dword [ebp - 0x14], 1
jmp 0x101861ad
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x101861a0
mov dword [ebp - 0x10], 1
jmp 0x101861a7
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x14], ecx
mov dl, byte [ebp - 0x14]
mov byte [ebp - 9], dl
mov eax, dword [ebp - 8]
push eax
push 0x1020401c
call fcn.10186cf0
add esp, 8
movzx ecx, byte [ebp - 9]
test ecx, ecx
je 0x10186204
push 0
lea edx, [ebp - 8]
push edx
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
cmp eax, 1
jne 0x101861e6
mov dword [ebp - 0x18], 1
jmp 0x101861ed
mov dword [ebp - 0x18], 0
mov al, byte [ebp - 0x18]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
push ecx
push 0x10204034
call fcn.10186cf0
add esp, 8
mov al, byte [ebp - 9]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret
Function at 0x101874d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101f9fe1
mov eax, dword fs:[0]
push eax
sub esp, 0x108
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0xa8]
call fcn.10009ab0
mov dword [ebp - 4], 0
lea eax, [ebp - 0xa8]
push eax
call fcn.101877c0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10187547
mov byte [ebp - 0xc1], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.10008820
mov al, byte [ebp - 0xc1]
jmp 0x101876d8
push 0x10269ed8
lea edx, [ebp - 0xa8]
push edx
lea eax, [ebp - 0xc0]
push eax
call fcn.1000e680
add esp, 0xc
mov byte [ebp - 4], 1
push 0x80
push 0
lea ecx, [ebp - 0x90]
push ecx
call fcn.101a9880
add esp, 0xc
lea ecx, [ebp - 0xc0]
call fcn.100099e0
push eax
push 0x40
lea edx, [ebp - 0x90]
push edx
push 0x10205f10
mov ecx, 0x10269f68
call fcn.100099e0
push eax
mov ecx, 0x10269f50
call fcn.100099e0
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x90]
test edx, edx
jne 0x101875f9
mov byte [ebp - 0xc2], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.10008820
mov al, byte [ebp - 0xc2]
jmp 0x101876d8
push 0x10269f80
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0xfc]
push ecx
call fcn.1000e680
add esp, 0xc
mov dword [ebp - 0xc8], eax
mov edx, dword [ebp - 0xc8]
push edx
lea ecx, [ebp - 0xa8]
call fcn.1000d580
lea ecx, [ebp - 0xfc]
call fcn.10008820
push 0x10
lea eax, [ebp - 0xa8]
push eax
call fcn.1000e4e0
add esp, 8
lea ecx, [ebp - 0x90]
push ecx
lea ecx, [ebp - 0xe4]
call fcn.10008860
mov byte [ebp - 4], 2
lea edx, [ebp - 0xe4]
push edx
lea eax, [ebp - 0xa8]
push eax
lea ecx, [ebp - 0x114]
push ecx
call fcn.1000e680
add esp, 0xc
mov dword [ebp - 0xcc], eax
mov edx, dword [ebp - 0xcc]
push edx
mov ecx, dword [ebp + 8]
call fcn.1000d580
lea ecx, [ebp - 0x114]
call fcn.10008820
mov byte [ebp - 4], 1
lea ecx, [ebp - 0xe4]
call fcn.10008820
mov byte [ebp - 0xc3], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xc0]
call fcn.10008820
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa8]
call fcn.10008820
mov al, byte [ebp - 0xc3]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret
Function at 0x10188c40
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101fa2b8
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x68]
call fcn.10009ab0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x68]
push eax
call fcn.10188dc0
add esp, 4
movzx ecx, al
test ecx, ecx
jne 0x10188ca5
mov byte [ebp - 0x69], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10008820
mov al, byte [ebp - 0x69]
jmp 0x10188da7
lea edx, [ebp - 0x68]
push edx
call fcn.1000ec70
add esp, 4
movzx eax, al
test eax, eax
jne 0x10188cd3
mov byte [ebp - 0x6a], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10008820
mov al, byte [ebp - 0x6a]
jmp 0x10188da7
push 0x40
push 0
lea ecx, [ebp - 0x50]
push ecx
call fcn.101a9880
add esp, 0xc
lea ecx, [ebp - 0x68]
call fcn.100099e0
push eax
push 0x20
lea edx, [ebp - 0x50]
push edx
push 0x10206270
push 0x10206004
push 0x10205fec
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 0x74], 0x10206274
lea eax, [ebp - 0x50]
mov dword [ebp - 0x70], eax
mov ecx, dword [ebp - 0x70]
mov dx, word [ecx]
mov word [ebp - 0x76], dx
mov eax, dword [ebp - 0x74]
cmp dx, word [eax]
jne 0x10188d59
cmp word [ebp - 0x76], 0
je 0x10188d50
mov ecx, dword [ebp - 0x70]
mov dx, word [ecx + 2]
mov word [ebp - 0x78], dx
mov eax, dword [ebp - 0x74]
cmp dx, word [eax + 2]
jne 0x10188d59
add dword [ebp - 0x70], 4
add dword [ebp - 0x74], 4
cmp word [ebp - 0x78], 0
jne 0x10188d14
mov dword [ebp - 0x7c], 0
jmp 0x10188d61
sbb ecx, ecx
or ecx, 1
mov dword [ebp - 0x7c], ecx
mov edx, dword [ebp - 0x7c]
mov dword [ebp - 0x80], edx
cmp dword [ebp - 0x80], 0
jne 0x10188d85
mov byte [ebp - 0x6b], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10008820
mov al, byte [ebp - 0x6b]
jmp 0x10188da7
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp + 8]
call fcn.10009a40
mov byte [ebp - 0x6c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.10008820
mov al, byte [ebp - 0x6c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret
Function at 0x101890a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101fa386
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.10191780
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1030], 0
lea ecx, [ebp - 0x102c]
call fcn.10009ab0
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x1014]
call fcn.10008df0
lea ecx, [ebp - 0x1014]
call fcn.10018880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1014]
call fcn.10019070
push 0x1000
push 0
lea eax, [ebp - 0x1010]
push eax
call fcn.101a9880
add esp, 0xc
push 0
push 0x1c
lea ecx, [ebp - 0x1010]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x10189151
lea edx, [ebp - 0x1010]
push edx
lea ecx, [ebp - 0x102c]
call fcn.10009a40
lea ecx, [ebp - 0x1014]
call fcn.10019390
lea eax, [ebp - 0x102c]
push eax
mov ecx, dword [ebp + 8]
call fcn.10009a70
mov ecx, dword [ebp - 0x1030]
or ecx, 1
mov dword [ebp - 0x1030], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.10018900
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.10008820
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret
Function at 0x1018bd40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x101fa386
mov eax, dword fs:[0]
push eax
mov eax, 0x1024
call fcn.10191780
mov eax, dword [0x102632d4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1030], 0
lea ecx, [ebp - 0x102c]
call fcn.10009ab0
mov dword [ebp - 4], 0
push 4
lea ecx, [ebp - 0x1014]
call fcn.10008df0
lea ecx, [ebp - 0x1014]
call fcn.10018880
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1014]
call fcn.10019070
push 0x1000
push 0
lea eax, [ebp - 0x1010]
push eax
call fcn.101a9880
add esp, 0xc
push 0
push 0x1a
lea ecx, [ebp - 0x1010]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x1018bdf1
lea edx, [ebp - 0x1010]
push edx
lea ecx, [ebp - 0x102c]
call fcn.10009a40
lea ecx, [ebp - 0x1014]
call fcn.10019390
lea eax, [ebp - 0x102c]
push eax
mov ecx, dword [ebp + 8]
call fcn.10009a70
mov ecx, dword [ebp - 0x1030]
or ecx, 1
mov dword [ebp - 0x1030], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1014]
call fcn.10018900
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x102c]
call fcn.10008820
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.101912fd
mov esp, ebp
pop ebp
ret
Function at 0x10194ab1
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x101c896e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.101c862e
Function at 0x404960
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42432d
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x433018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
js 0x404a5f
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0
push eax
push 0x425470
push 1
push 0
push 0x425480
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4049d1
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x40]
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
push 0x425398
push 0
call edi
mov esi, eax
test esi, esi
je 0x4049d7
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov edi, 0xc350
push 0
push esi
call ebx
sub edi, 1
jne 0x4049f1
push edi
push 0x402470
push esi
call dword [sym.imp.USER32.dll_EnumChildWindows]
push 1
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
test eax, eax
je 0x404a37
push edi
push edi
push 0xf5
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x404ae0
push 0x10
push 0x4253a0
push str.b_rN0R_tc
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x404ae0
push eax
push str.COM_initialization_failed:
push 0x434040
call fcn.004010d0
add esp, 8
mov ecx, eax
call fcn.00402010
mov esi, eax
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + esi + 0x30]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x14], ecx
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [ebp - 0x18]
mov dword [ebp - 4], 0
push eax
call fcn.004013a0
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
mov eax, dword [edx + 0x20]
call eax
mov ecx, dword [ebp - 0x14]
mov byte [ebp - 0x24], al
mov dword [ebp - 4], 0xffffffff
test ecx, ecx
je 0x404acf
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x404acf
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push dword [ebp - 0x24]
mov ecx, esi
call fcn.00404790
mov ecx, esi
call fcn.004045d0
push str.pause
call fcn.0040b177
add esp, 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00406cef
mov esp, ebp
pop ebp
ret

Function at 0x415fdd
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4291f8
push 0x4291f0
push str.FlsAlloc
push 0x1e
call fcn.00415e4a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416011
push dword [ebp + 8]
mov ecx, esi
call dword [0x425178]
call esi
jmp 0x416017
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4
Function at 0x41605b
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x429208
push 0x429200
push str.FlsGetValue
push 0x20
call fcn.00415e4a
mov esi, eax
add esp, 0x10
test esi, esi
je 0x416092
push dword [ebp + 8]
mov ecx, esi
call dword [0x425178]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x418142
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00417fb3

Function at 0x41853c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407a60
mov eax, dword [0x433018]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00415856
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41857e
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4186da
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00423990
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x4348f8]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00419533
mov ecx, dword [esi*4 + 0x4348f8]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4186d3
cmp eax, dword [edi + ecx + 0x24]
jne 0x4186d3
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4186d3
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00419533
add esp, 0x14
test edx, edx
jl 0x4186d3
jg 0x418649
test eax, eax
jb 0x4186d3
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4186d3
jl 0x418663
cmp dword [ebp - 0x1008], eax
ja 0x4186d3
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x418681
test ebx, ebx
je 0x4186ba
cmp ecx, edi
jae 0x4186ba
mov al, byte [ecx]
cmp al, 0xd
jne 0x41869b
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4186a7
cmp byte [ecx + 1], 0xa
jne 0x4186a7
inc ecx
jmp 0x4186a7
movzx eax, al
movsx eax, byte [eax + 0x4332b8]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x418681
cmp edx, ebx
jne 0x418681
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4186d8
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.00406cef
leave
ret
Function at 0x4189d1
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
sar ecx, 6
push esi
push edi
imul edi, eax, 0x38
mov eax, dword [ecx*4 + 0x4348f8]
mov dword [ebp - 0x10], ecx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x14], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x418a11
cmp byte [ebx], 0xa
jne 0x418a11
or byte [eax + edi + 0x28], 4
jmp 0x418a16
and byte [eax + edi + 0x28], 0xfb
add ecx, ebx
mov edx, ebx
mov dword [ebp - 0xc], ecx
mov esi, ebx
cmp ebx, ecx
jae 0x418b14
mov al, byte [edx]
cmp al, 0x1a
je 0x418af6
lea ecx, [edx + 1]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 0xc]
cmp al, 0xd
je 0x418a45
mov edx, dword [ebp - 8]
mov byte [esi], al
jmp 0x418a6a
mov eax, dword [ebp - 8]
cmp eax, ecx
jae 0x418a74
mov cl, byte [eax]
xor eax, eax
cmp cl, 0xa
sete al
inc eax
add edx, eax
cmp cl, 0xa
sete al
dec al
and al, 3
add al, 0xa
mov byte [esi], al
mov ecx, dword [ebp - 0xc]
inc esi
cmp edx, ecx
jb 0x418a27
jmp 0x418b14
push 0
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x418af1
cmp dword [ebp - 0xc], 0
je 0x418af1
mov ecx, dword [ebp - 0x10]
mov eax, dword [ecx*4 + 0x4348f8]
test byte [eax + edi + 0x28], 0x48
je 0x418acb
mov dl, byte [ebp - 1]
lea eax, [esi + 1]
mov dword [ebp - 0x14], eax
cmp dl, 0xa
jne 0x418ab6
mov byte [esi], dl
jmp 0x418ac7
mov byte [esi], 0xd
mov eax, dword [ecx*4 + 0x4348f8]
mov byte [eax + edi + 0x2a], dl
mov eax, dword [ebp - 0x14]
mov esi, eax
jmp 0x418b14
cmp byte [ebp - 1], 0xa
jne 0x418ada
cmp esi, ebx
jne 0x418ada
mov byte [esi], 0xa
jmp 0x418b13
push 1
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [ebp + 8]
call fcn.00419551
add esp, 0x10
cmp byte [ebp - 1], 0xa
je 0x418b14
mov byte [esi], 0xd
jmp 0x418b13
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx*4 + 0x4348f8]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x418b10
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x418b14
mov byte [esi], 0x1a
inc esi
sub esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret