joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402e60
Capabilities:
Create thread
Read .ini file

Disassembly:
sub esp, 0x104
mov eax, dword [0x435e48]
xor eax, esp
mov dword [esp + 0x100], eax
push ebx
push ebp
push esi
push edi
push 0x439f80
push 0x208
push 0x43a950
push str.DFT_ERR_STR
push str.TEST
push str.TIMER
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push str.DFT_ERR_STR
push 0x43a950
call fcn.004129cf
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 8
push 0
push 0
neg eax
push 0x439b30
sbb eax, eax
push 0x402f80
and eax, 0xfffff916
push 0
add eax, 0x708
push 0
mov dword [0x439b30], eax
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, eax
push esi
call ebx
mov ebp, dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x402f1d
call ebp
push eax
lea eax, [esp + 0x18]
push str.CreateThread_failed__error_code___d
push eax
call fcn.00412760
add esp, 8
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00404c20
call fcn.00402dc0
add esp, 4
push 0
push 0
push 0
push 0x403800
push 0
push 0
call edi
mov esi, eax
push esi
call ebx
test esi, esi
jne 0x402f64
call ebp
push eax
lea eax, [esp + 0x18]
push str.CreateThread_failed_NPServer___error_code___d
push eax
call fcn.00412760
add esp, 8
lea edx, [esp + 0x18]
mov ecx, esp
mov dword [esp + 0x14], esp
push edx
call fcn.00404c20
call fcn.00402dc0
add esp, 4
mov ecx, dword [esp + 0x110]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00412539
add esp, 0x104
ret

Function at 0x4046d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4046e9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x404724
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x404720
lea ebx, [ebx]
cmp esi, eax
jae 0x404724
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x404710
cmp esi, eax
jb 0x40472a
pop esi
pop edi
xor eax, eax
pop ebx
ret
movzx eax, word [esi]
neg eax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret
Function at 0x404ce0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x74
push esi
push edi
xor esi, esi
push 0x44
lea eax, [esp + 0x34]
push esi
push eax
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call fcn.00414d60
mov ecx, 5
add esp, 0xc
mov dword [esp + 0x5c], 1
mov word [esp + 0x60], cx
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea edx, [esp + 8]
push edx
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x404d32
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
add esp, 0x74
ret
mov edx, dword [esp + 8]
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x1c]
push ecx
push 0x12
push edx
call edi
test eax, eax
je 0x404dc7
mov eax, dword [esp + 0x14]
cmp eax, 1
je 0x404da6
jle 0x404dcf
cmp eax, 3
jg 0x404dcf
mov edx, dword [esp + 8]
lea eax, [esp + 0x18]
push eax
push 4
lea ecx, [esp + 0x14]
push ecx
push 0x13
push edx
mov dword [esp + 0x2c], 4
call edi
test eax, eax
je 0x404dc7
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 1
push 2
push esi
push 0x2000000
push ecx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
je 0x404dc7
mov ecx, dword [esp + 0x10]
jmp 0x404daa
mov ecx, dword [esp + 8]
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push ebx
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
jne 0x404dcf
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
pop edi
mov eax, esi
pop esi
add esp, 0x74
ret
Function at 0x404de0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x42a468
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
push esi
mov eax, dword [0x435e48]
xor eax, esp
push eax
lea eax, [esp + 0x74]
mov dword fs:[0], eax
mov dword [esp + 0x7c], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_WTSGetActiveConsoleSessionId]
lea ecx, [esp + 0xc]
push ecx
push eax
call sub.WTSAPI32.dll_WTSQueryUserToken
test eax, eax
jne 0x404e77
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x7c], 0xffffffff
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x404e64
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, esi
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x78
ret
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
mov esi, 1
push esi
push esi
push 0
push 0x2000000
push edx
call dword [sym.imp.ADVAPI32.dll_DuplicateTokenEx]
test eax, eax
jne 0x404ec2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov dword [esp + 0x7c], 0xffffffff
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jmp 0x404e58
push 0x44
lea ecx, [esp + 0x28]
push 0
push ecx
call fcn.00414d60
add esp, 0xc
lea edx, [esp + 0x24]
push edx
mov dword [esp + 0x28], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 5
mov word [esp + 0x54], ax
mov eax, dword [esp + 0x84]
mov dword [esp + 0x50], esi
cmp dword [eax - 4], esi
jle 0x404f17
mov ecx, dword [eax - 0xc]
push ecx
lea ecx, [esp + 0x88]
call fcn.004049a0
mov eax, dword [esp + 0x84]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
push edx
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x404e99
mov dword [esp + 0x7c], 0xffffffff
mov eax, dword [esp + 0x84]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x404f6e
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
xor eax, eax
mov ecx, dword [esp + 0x74]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x78
ret
Function at 0x404f90
Capabilities:
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x42a518
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebp
push esi
push edi
mov eax, dword [0x435e48]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov edi, edx
xor ebp, ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
lea eax, [esp + 0x14]
push eax
push 0x20119
push ebp
push ecx
mov dword [esp + 0x40], ebp
push 0x80000002
mov dword [esp + 0x28], ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebp
jne 0x405024
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x18]
push edx
push ebp
lea ecx, [esp + 0x24]
push ecx
push ebp
push edi
push eax
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], 0x100
mov dword [esp + 0x30], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, ebp
je 0x405037
mov esi, eax
mov eax, dword [esp + 0x14]
cmp eax, ebp
je 0x405022
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x24
ret
mov eax, dword [esp + 0x1c]
cmp eax, 1
je 0x40504c
cmp eax, 2
je 0x40504c
mov esi, 0xd
jmp 0x405013
mov eax, dword [ebx]
mov ecx, dword [esp + 0x18]
sub eax, 0x10
mov edx, 1
sub edx, dword [eax + 0xc]
mov eax, dword [eax + 8]
shr ecx, 1
sub eax, ecx
or edx, eax
mov dword [esp + 0x1c], ecx
jge 0x405074
push ecx
mov ecx, ebx
call fcn.00404a70
mov esi, dword [ebx]
push edi
lea ecx, [esp + 0x24]
push ecx
lea edi, [esp + 0x24]
call fcn.004051c0
mov esi, eax
mov eax, dword [ebx]
mov ecx, dword [eax - 8]
cmp eax, ebp
jne 0x405094
xor eax, eax
jmp 0x4050a2
push ecx
push eax
call fcn.0041394f
add esp, 8
cmp eax, ebp
jl 0x4050b9
mov ecx, dword [ebx]
cmp eax, dword [ecx - 8]
jg 0x4050b9
mov dword [ecx - 0xc], eax
mov edx, dword [ebx]
xor ecx, ecx
mov word [edx + eax*2], cx
jmp 0x405013
push 0x80070057
call fcn.00404af0
int3

Function at 0x4051c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [edi]
lea ecx, [esp]
push ecx
mov ecx, dword [esp + 0xc]
push esi
add eax, eax
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x18]
push 0
mov dword [edi], 0
mov edx, dword [ecx]
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40522e
mov eax, dword [esp + 0xc]
cmp eax, 1
je 0x4051ff
cmp eax, 2
jne 0x40521a
mov eax, dword [esp]
test esi, esi
je 0x405228
test eax, eax
je 0x405223
test al, 1
jne 0x40521a
mov ecx, eax
shr ecx, 1
cmp word [esi + ecx*2 - 2], 0
je 0x405228
mov eax, 0xd
pop ecx
ret 8
xor edx, edx
mov word [esi], dx
shr eax, 1
mov dword [edi], eax
xor eax, eax
pop ecx
ret 8
Function at 0x406930
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1f44
call fcn.00416a10
mov eax, dword [0x435e48]
xor eax, esp
mov dword [esp + 0x1f40], eax
mov eax, dword [esp + 0x1f48]
push esi
mov esi, ecx
test eax, eax
jne 0x406970
xor al, al
pop esi
mov ecx, dword [esp + 0x1f40]
xor ecx, esp
call fcn.00412539
add esp, 0x1f44
ret 4
push edi
push 0x42ff80
push eax
call fcn.00413aa1
mov edi, eax
add esp, 8
test edi, edi
jne 0x40698c
xor al, al
jmp 0x406a37
push ebp
push 2
push 0
push edi
call fcn.00413b42
push edi
call fcn.00413d64
push 0
push 0
push edi
mov ebp, eax
call fcn.00413b42
add esp, 0x1c
test ebp, ebp
je 0x4069c6
mov eax, 0x10624dd3
mul ebp
shr edx, 9
mov eax, edx
imul eax, eax, 0x1f40
sub ebp, eax
jmp 0x4069ca
xor edx, edx
xor ebp, ebp
test edx, edx
jbe 0x406a00
push ebx
mov ebx, edx
push edi
push 0x1f40
lea ecx, [esp + 0x18]
push 1
push ecx
call fcn.00414072
add esp, 0x10
lea edx, [esp + 0x10]
push edx
mov eax, 0x1f40
mov byte [esp + 0x14], 0
call fcn.00406880
sub ebx, 1
jne 0x4069d1
pop ebx
test ebp, ebp
je 0x406a2b
push edi
push ebp
lea eax, [esp + 0x14]
push 1
push eax
call fcn.00414072
add esp, 0x10
lea ecx, [esp + 0xc]
mov byte [esp + 0xc], 0
push ecx
mov eax, ebp
mov byte [esp + ebp + 0xf], 0
call fcn.00406880
push edi
call fcn.00412c4a
add esp, 4
mov al, 1
pop ebp
mov ecx, dword [esp + 0x1f48]
pop edi
pop esi
xor ecx, esp
call fcn.00412539
add esp, 0x1f44
ret 4

Function at 0x412539
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x435e48]
jne 0x412543
repz ret
jmp fcn.00416f5f

Function at 0x412cc6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x412cf7
call fcn.00414d1f
mov dword [eax], esi
call fcn.00414d0c
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.00417bdc
add esp, 0x14
push 0x16
pop eax
jmp 0x412d4c
test dword [ebp + 0xc], 0xfffffff9
jne 0x412cd3
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x412d24
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00414d32
pop ecx
call fcn.00414d0c
mov eax, dword [eax]
jmp 0x412d4c
test al, 0x10
jne 0x412d4a
test al, 1
je 0x412d4a
test byte [ebp + 0xc], 2
je 0x412d4a
call fcn.00414d1f
mov dword [eax], 5
call fcn.00414d0c
mov dword [eax], 0xd
jmp 0x412d1b
xor eax, eax
pop esi
pop ebp
ret
Function at 0x425774
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004170d7
and dword [ebp - 4], 0
cmp dword [0x439ac4], 0
mov ebx, eax
jne 0x425825
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4258d6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4258d6
push eax
call fcn.00417065
mov dword [esp], 0x42ed08
push edi
mov dword [0x439ac4], eax
call esi
push eax
call fcn.00417065
mov dword [esp], 0x42ecf4
push edi
mov dword [0x439ac8], eax
call esi
push eax
call fcn.00417065
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x439acc], eax
call esi
push eax
call fcn.00417065
pop ecx
mov dword [0x439ad4], eax
test eax, eax
je 0x425825
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00417065
pop ecx
mov dword [0x439ad0], eax
mov eax, dword [0x439ad0]
cmp eax, ebx
je 0x42587d
cmp dword [0x439ad4], ebx
je 0x42587d
push eax
call fcn.004170e0
push dword [0x439ad4]
mov esi, eax
call fcn.004170e0
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x42587d
test edi, edi
je 0x42587d
call esi
test eax, eax
je 0x425874
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x425874
test byte [ebp - 0xc], 1
jne 0x42587d
or dword [ebp + 0x10], 0x200000
jmp 0x4258b6
mov eax, dword [0x439ac8]
cmp eax, ebx
je 0x4258b6
push eax
call fcn.004170e0
pop ecx
test eax, eax
je 0x4258b6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4258b6
mov eax, dword [0x439acc]
cmp eax, ebx
je 0x4258b6
push eax
call fcn.004170e0
pop ecx
test eax, eax
je 0x4258b6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x439ac4]
call fcn.004170e0
pop ecx
test eax, eax
je 0x4258d6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4258d8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40e058
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
mov esi, edx
mov ebx, eax
lea edx, [ebp - 9]
mov eax, ebx
call fcn.0040e00c
test al, al
jne 0x40e079
xor eax, eax
mov dword [ebp - 4], eax
jmp 0x40e0c5
xor eax, eax
push ebp
push 0x40e0b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00404d24
push eax
call sub.kernel32.dll_DeleteFileW
mov dword [ebp - 4], eax
call sub.kernel32.dll_GetLastError
mov dword [ebp - 0x10], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e0bc
lea eax, [ebp - 9]
call fcn.0040e048
ret
mov eax, dword [ebp - 4]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40e304
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x40e30c
push ecx
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x40e3f9
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.0040b8ec
mov edx, dword [ebp - 8]
mov ecx, 0x40e414
xor eax, eax
call fcn.0040e1e8
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_CreateDirectoryW
test eax, eax
jne 0x40e3c7
call sub.kernel32.dll_GetLastError
mov ebx, eax
cmp ebx, 0xb7
je 0x40e326
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov al, 0x36
call fcn.0040de10
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov eax, ebx
xor edx, edx
push edx
push eax
lea eax, [ebp - 0x20]
call fcn.00407e04
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
lea edx, [ebp - 0x24]
mov eax, ebx
call fcn.0040be74
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea edx, [ebp - 0x18]
mov ecx, 2
mov al, 0x68
call fcn.0040dde0
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x406c78]
call fcn.00409740
call fcn.00403f88
jmp 0x40e326
mov eax, esi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e400
lea eax, [ebp - 0x24]
mov edx, 3
call fcn.00404c90
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00404c90
ret

Function at 0x40e428
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffec
mov eax, dword [0x412c7c]
cmp dword [eax], 2
jne 0x40e490
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
jne 0x40e44b
xor eax, eax
jmp 0x40e49f
lea eax, [esp + 8]
push eax
push 0x40e4a4
push 0
call sub.advapi32.dll_LookupPrivilegeValueW
mov dword [esp + 4], 1
mov dword [esp + 0x10], 2
push 0
push 0
push 0
lea eax, [esp + 0x10]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError
test eax, eax
je 0x40e490
xor eax, eax
jmp 0x40e49f
push 0
push 2
call sub.user32.dll_ExitWindowsEx
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x14
ret
Function at 0x40e4cc
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov ebx, eax
mov esi, ecx
dec esi
test esi, esi
jl 0x40e526
inc esi
xor edi, edi
cmp edi, 1
jne 0x40e4f2
mov eax, dword [ebp + 0xc]
push eax
call sub.kernel32.dll_Sleep_1
jmp 0x40e500
cmp edi, 1
jle 0x40e500
mov eax, dword [ebp + 8]
push eax
call sub.kernel32.dll_Sleep_1
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0040e058
test eax, eax
jne 0x40e526
call sub.kernel32.dll_GetLastError
cmp eax, 2
je 0x40e526
call sub.kernel32.dll_GetLastError
cmp eax, 3
je 0x40e526
inc edi
dec esi
jne 0x40e4e2
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 8

Function at 0x40e530
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, eax
push 2
lea eax, [ebp - 4]
push eax
push 0x20001004
movzx eax, bx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
test eax, eax
jle 0x40e554
mov eax, dword [ebp - 4]
jmp 0x40e557
or eax, 0xffffffff
pop ebx
pop ecx
pop ebp
ret

Function at 0x40e55c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov byte [ebp - 1], dl
mov edi, eax
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
mov byte [ebp - 2], 0
test esi, esi
je 0x40e5a9
xor ebx, ebx
jmp 0x40e59e
mov eax, dword [ebp - 8]
mov edx, dword [eax]
mov eax, esi
call fcn.00407af8
test eax, eax
jne 0x40e59d
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 2
jmp 0x40e653
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e57f
movzx eax, byte [ebp - 1]
sub al, 1
jb 0x40e5b5
je 0x40e5be
jmp 0x40e5c7
call fcn.0040bba4
mov esi, eax
jmp 0x40e5c9
call sub.kernel32.dll_GetUserDefaultLangID
mov esi, eax
jmp 0x40e5c9
xor esi, esi
test si, si
je 0x40e653
xor ebx, ebx
jmp 0x40e5ef
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
movzx edx, si
cmp eax, edx
jne 0x40e5ee
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e653
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e5d6
xor ebx, ebx
jmp 0x40e648
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x28]
and eax, 0x3ff
mov edx, esi
and dx, 0x3ff
movzx edx, dx
cmp eax, edx
jne 0x40e647
mov eax, esi
and ax, 0x3ff
cmp ax, 4
jne 0x40e63c
mov eax, dword [ebp - 8]
movzx eax, word [eax + 0x28]
call fcn.0040e530
push eax
mov eax, esi
call fcn.0040e530
pop edx
cmp edx, eax
jne 0x40e647
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov byte [ebp - 2], 1
jmp 0x40e653
inc ebx
lea edx, [ebp - 8]
mov eax, ebx
call edi
test al, al
jne 0x40e5fe
movzx eax, byte [ebp - 2]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 4
Function at 0x40ea50
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40eb25
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x40eb40
push ebx
push 0x40eb50
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040513c
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403250
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x40ead0
mov al, 0x6a
call fcn.0040e660
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040ea24
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x40ead9
call fcn.0040ea24
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40eb2c
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40ec40
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ed0b
jmp 0x40ecff
cmp dword [esi + 0x10], 0x1000
jne 0x40eceb
test byte [esi + 0x15], 1
jne 0x40eceb
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x40ec9c
cmp ebp, 2
je 0x40ec9c
cmp ebp, 0x10
je 0x40ec9c
cmp ebp, 0x20
jne 0x40ecb8
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x40ecb8
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x40ecc9
mov eax, dword [esi]
add eax, ebx
call fcn.0040ec38
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x40ecbc
cmp byte [esp + 4], 0
je 0x40eceb
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x40ed0b
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x40ec71
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x40452b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x40a700]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040348c
and dword [ebp - 0x14], 0
cmp dword [0x40b924], 0
mov dword [ebp - 0x18], eax
jne 0x4045de
push str.USER32.DLL
call dword [sym.imp.KERNEL32.DLL_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x404686
mov edi, dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x404686
mov esi, dword [sym.imp.KERNEL32.DLL_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x40b924], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x40b928], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x40b92c], eax
call edi
push eax
call esi
mov dword [0x40b934], eax
test eax, eax
je 0x4045de
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x40b930], eax
mov eax, dword [0x40b930]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.DLL_DecodePointer]
cmp eax, ecx
je 0x404637
cmp dword [0x40b934], ecx
je 0x404637
push eax
call esi
push dword [0x40b934]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x404637
test ebx, ebx
je 0x404637
call edi
test eax, eax
je 0x40462e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40462e
test byte [ebp - 8], 1
jne 0x404637
or dword [ebp + 0x10], 0x200000
jmp 0x40466a
mov eax, dword [0x40b928]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40466a
mov eax, dword [0x40b92c]
cmp eax, dword [ebp - 0x18]
je 0x40466a
push eax
call esi
test eax, eax
je 0x40466a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x40b924]
call esi
test eax, eax
je 0x404686
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x404688
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404896
leave
ret

Function at 0x404896
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40a700]
jne 0x4048a0
repz ret
jmp fcn.00405a36