joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1314be64
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe64
push ebx
push esi
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131448dc
xor eax, eax
push ebp
push 0x1314c005
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_GetSystemMetrics
mov esi, eax
push 1
call sub.user32.dll_GetSystemMetrics
mov ebx, eax
mov eax, esi
imul ebx
lea eax, [eax + eax*2]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
call fcn.131428c4
mov dword [ebp - 0x14], eax
push 0
call sub.user32.dll_GetDC
mov dword [ebp - 8], eax
push ebx
push esi
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleBitmap
mov edi, eax
mov eax, dword [ebp - 8]
push eax
call sub.gdi32.dll_CreateCompatibleDC
mov dword [ebp - 0xc], eax
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_SelectObject
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push ebx
push esi
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_BitBlt
mov word [ebp - 0x22], 0x4d42
mov eax, esi
imul ebx
lea eax, [eax + eax*2]
add eax, 0xe
add eax, 0x2c
mov dword [ebp - 0x20], eax
mov word [ebp - 0x1c], 0
mov word [ebp - 0x1a], 0
mov dword [ebp - 0x18], 0x3a
mov dword [ebp - 0x4e], 0x2c
mov dword [ebp - 0x4a], esi
mov dword [ebp - 0x46], ebx
mov word [ebp - 0x42], 1
mov word [ebp - 0x40], 0x18
xor eax, eax
mov dword [ebp - 0x3e], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x3a], eax
xor eax, eax
mov dword [ebp - 0x2a], eax
push 0
lea eax, [ebp - 0x4e]
push eax
mov eax, dword [ebp - 0x14]
push eax
push ebx
push 0
push edi
mov eax, dword [ebp - 0xc]
push eax
call sub.gdi32.dll_GetDIBits
push edi
call sub.gdi32.dll_DeleteObject
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x19c]
call fcn.13142f94
mov edx, 1
lea eax, [ebp - 0x19c]
call fcn.131433e4
call fcn.131429c8
push 0
lea edx, [ebp - 0x22]
mov ecx, 0xe
lea eax, [ebp - 0x19c]
call fcn.13143118
call fcn.131429c8
push 0
lea edx, [ebp - 0x4e]
mov ecx, 0x2c
lea eax, [ebp - 0x19c]
call fcn.13143118
call fcn.131429c8
push 0
mov edx, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x19c]
call fcn.13143118
call fcn.131429c8
lea eax, [ebp - 0x19c]
call fcn.13143138
call fcn.131429c8
mov eax, dword [ebp - 0x14]
call fcn.131428f4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314c00c
lea eax, [ebp - 4]
call fcn.1314446c
ret
Function at 0x1314c130
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x1314c139
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x8010], edx
mov dword [ebp - 0x8014], edx
mov dword [ebp - 0x8018], edx
xor edx, edx
push ebp
push 0x1314c25b
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
push eax
push 0
push 0
push 2
call sub.mpr.dll_WNetOpenEnumA
mov dword [ebp - 8], 0x400
mov dword [ebp - 0xc], 0x8000
jmp 0x1314c214
mov esi, dword [ebp - 8]
dec esi
test esi, esi
jl 0x1314c214
inc esi
lea ebx, [ebp - 0x8004]
cmp dword [ebx], 2
jne 0x1314c200
push dword [0x1315bb14]
lea eax, [ebp - 0x8010]
push eax
lea eax, [ebp - 0x8018]
mov edx, dword [ebx + 0xc]
call fcn.13144648
mov eax, dword [ebp - 0x8018]
lea edx, [ebp - 0x8014]
call fcn.1314b93c
mov eax, dword [ebp - 0x8014]
mov ecx, 0x104
mov edx, 3
call fcn.1314494c
push dword [ebp - 0x8010]
push 0x1314c274
mov eax, 0x1315bb14
mov edx, 3
call fcn.131447ac
cmp dword [ebx + 4], 0
jbe 0x1314c20e
lea eax, [ebx - 8]
call fcn.1314c130
add ebx, 0x20
dec esi
jne 0x1314c1a0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x800c]
push eax
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetEnumResourceA
test eax, eax
je 0x1314c191
mov eax, dword [ebp - 4]
push eax
call sub.mpr.dll_WNetCloseEnum
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314c262
lea eax, [ebp - 0x8018]
mov edx, 3
call fcn.13144490
ret
Function at 0x1314c278
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe1c
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x1e4], eax
mov dword [ebp - 0x1dc], eax
mov dword [ebp - 0x1e0], eax
mov dword [ebp - 0x1d4], eax
mov dword [ebp - 0x1d8], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1314c443
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
call fcn.1314c130
jmp 0x1314c410
lea eax, [ebp - 4]
push eax
mov edx, dword [0x1315bb14]
mov eax, 0x1314c45c
call fcn.131449d4
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [0x1315bb14]
call fcn.1314494c
xor eax, eax
push ebp
push 0x1314c3d6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
lea eax, [ebp - 0x1d4]
mov ecx, 0x1314c468
mov edx, dword [ebp - 4]
call fcn.13144738
mov eax, dword [ebp - 0x1d4]
call fcn.131448ec
push eax
lea edx, [ebp - 0x1d8]
xor eax, eax
call fcn.13142c40
mov eax, dword [ebp - 0x1d8]
call fcn.131448ec
push eax
call sub.kernel32.dll_CopyFileA
lea eax, [ebp - 0x1e0]
mov ecx, 0x1314c480
mov edx, dword [ebp - 4]
call fcn.13144738
mov eax, dword [ebp - 0x1e0]
call fcn.131448ec
mov edx, eax
lea eax, [ebp - 0x1dc]
call fcn.13144648
mov eax, dword [ebp - 0x1dc]
call fcn.1314be30
test al, al
je 0x1314c3cc
lea eax, [ebp - 0x1e4]
mov ecx, 0x1314c480
mov edx, dword [ebp - 4]
call fcn.13144738
mov edx, dword [ebp - 0x1e4]
lea eax, [ebp - 0x1d0]
call fcn.13142f94
lea eax, [ebp - 0x1d0]
call fcn.13142d30
call fcn.131429c8
mov edx, 0x1314c49c
lea eax, [ebp - 0x1d0]
call fcn.13144a80
call fcn.131435d8
call fcn.131429c8
lea eax, [ebp - 0x1d0]
call fcn.13143138
call fcn.131429c8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x1314c3e0
push 0x1315bb14
mov edx, dword [0x1315bb14]
mov eax, 0x1314c45c
call fcn.131449d4
add eax, 2
push eax
mov eax, dword [0x1315bb14]
call fcn.131446ec
mov ecx, eax
mov eax, dword [0x1315bb14]
pop edx
call fcn.1314494c
cmp dword [0x1315bb14], 0
jne 0x1314c2c1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314c44a
lea eax, [ebp - 0x1e4]
mov edx, 5
call fcn.13144490
lea eax, [ebp - 4]
call fcn.1314446c
ret
Function at 0x1314c6fc
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.131448dc
mov eax, dword [ebp - 8]
call fcn.131448dc
mov eax, dword [ebp + 8]
call fcn.131448dc
xor eax, eax
push ebp
push 0x1314c7b4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.131448ec
push eax
push esi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x1314c791
mov eax, dword [ebp + 8]
call fcn.131446ec
inc eax
push eax
mov eax, dword [ebp + 8]
call fcn.131448ec
push eax
push 1
push 0
mov eax, dword [ebp - 8]
call fcn.131448ec
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314c7bb
lea eax, [ebp - 8]
mov edx, 2
call fcn.13144490
lea eax, [ebp + 8]
call fcn.1314446c
ret
Function at 0x1314d360
Capabilities:
Get hostname

Disassembly:
push ebx
add esp, 0xffffffe8
mov ebx, eax
mov dword [esp], 0x10
push esp
lea eax, [esp + 8]
push eax
call sub.kernel32.dll_GetComputerNameA
mov edx, ebx
lea eax, [esp + 4]
call fcn.13146cc0
add esp, 0x18
pop ebx
ret

Function at 0x1314d388
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff4
mov ebp, ecx
mov edi, edx
mov esi, eax
xor ebx, ebx
push 0
push 0
push 0
push 0
push 0x1314d430
call sub.wininet.dll_InternetOpenA
mov dword [esp], eax
cmp dword [esp], 0
je 0x1314d423
push 0
push 0
push 0
push 0
mov eax, esi
call fcn.131448ec
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [esp + 4], eax
cmp dword [esp + 4], 0
je 0x1314d40d
lea eax, [esp + 8]
push eax
push ebp
push edi
mov eax, dword [esp + 0x10]
push eax
call sub.wininet.dll_InternetReadFile
test eax, eax
jne 0x1314d401
mov eax, dword [esp + 4]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [esp]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x1314d423
mov eax, dword [esp + 4]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x1314d418
mov eax, dword [esp]
push eax
call sub.wininet.dll_InternetCloseHandle
jmp 0x1314d423
mov eax, dword [esp]
push eax
call sub.wininet.dll_InternetCloseHandle
mov bl, 1
mov eax, ebx
add esp, 0xc
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1314d558
Capabilities:
Shutdown system

Disassembly:
add esp, 0xffffffe4
xor eax, eax
mov dword [esp + 4], eax
push esp
push 0x28
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x1314d5c9
lea eax, [esp + 0x10]
push eax
push 0x1314d5d0
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x1314d5c9
mov dword [esp + 0xc], 1
mov dword [esp + 0x18], 2
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
push 0
lea eax, [esp + 0x18]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
call sub.kernel32.dll_GetLastError_1
test eax, eax
jne 0x1314d5c9
push 0
push 6
call sub.user32.dll_ExitWindowsEx
test eax, eax
add esp, 0x1c
ret
Function at 0x1314e7d8
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131448dc
xor eax, eax
push ebp
push 0x1314e867
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
call sub.user32.dll_OpenClipboard
mov eax, dword [ebp - 4]
call fcn.131446ec
mov esi, eax
inc esi
push esi
push 0x2002
call sub.kernel32.dll_GlobalAlloc
mov ebx, eax
push ebx
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.131448ec
mov edx, dword [ebp - 8]
mov ecx, esi
call fcn.13142a9c
call sub.user32.dll_EmptyClipboard
push ebx
push 1
call sub.user32.dll_SetClipboardData
push ebx
call sub.kernel32.dll_GlobalUnlock
push ebx
call sub.kernel32.dll_GlobalFree
call sub.user32.dll_CloseClipboard
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314e86e
lea eax, [ebp - 4]
call fcn.1314446c
ret

Function at 0x1314e874
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131448dc
xor eax, eax
push ebp
push 0x1314e91b
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
call sub.kernel32.dll_SetErrorMode
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x1314e8fe
push dword fs:[eax]
mov dword fs:[eax], esp
push pe_nt_image_headers32
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push pe_nt_image_headers32
lea eax, [ebp - 0x114]
push eax
mov eax, dword [ebp - 4]
call fcn.131448ec
push eax
call sub.kernel32.dll_GetVolumeInformationA
cmp eax, 1
sbb eax, eax
inc eax
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314e905
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SetErrorMode
ret
Function at 0x1314eae8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.131448dc
mov eax, dword [ebp - 8]
call fcn.131448dc
xor eax, eax
push ebp
push 0x1314ebd2
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x1314eb24
mov byte [ebx], 0
lea eax, [ebp - 0xc]
push eax
push 1
push 0
mov eax, dword [ebp - 4]
call fcn.131448ec
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x1314ebb7
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.131448ec
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x1314eb67
cmp dword [ebp - 0x10], 1
je 0x1314eb72
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
jmp 0x1314ebb7
mov ecx, dword [ebp - 0x14]
dec ecx
mov eax, esi
xor edx, edx
call fcn.1314455c
lea eax, [ebp - 0x14]
push eax
mov eax, esi
call fcn.13144944
push eax
lea eax, [ebp - 0x10]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.131448ec
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test ebx, ebx
je 0x1314ebae
test eax, eax
sete al
mov byte [ebx], al
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1314ebd9
lea eax, [ebp - 8]
mov edx, 2
call fcn.13144490
ret
Function at 0x4069c5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x4069e9
xor eax, eax
test eax, eax
je 0x4069fc
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4069fc
xor ecx, ecx
jmp 0x4069ff
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b22
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dec], 0
push esi
jne 0x406b59
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b33
mov dword [ecx*4 + 0x427de8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b2e
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406b8a
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427de8]
xor eax, esi
inc ecx
dec edx
jne 0x406b6c
pop edi
not eax
pop esi
ret 0xc
Function at 0x407847
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x4291b0]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
mov esi, 0x104
mov dword [eax], edi
mov edx, esi
mov dword [eax + 4], edi
lea ecx, [esp + 0x1c]
call fcn.0040675d
push 0x401b10
mov edx, esi
lea ecx, [esp + 0x1c]
call fcn.00406792
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.api_ms_win_core_synch_l1_1_0.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x4078cd
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 2
je 0x4078f7
mov ecx, dword [ebp + 4]
mov edx, 0xc9
push 0x401ad4
call fcn.0040752b
mov edi, eax
jmp 0x4078f7
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.00407724
mov ebx, eax
test ebx, ebx
jns 0x4078fd
mov ecx, dword [ebp + 4]
mov edx, 0xcf
push ebx
push 0x401ad4
call fcn.0040750c
mov edi, ebx
test esi, esi
je 0x407911
jmp 0x40790b
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
push esi
call fcn.004075a9
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00426f20
mov esp, ebp
pop ebp
ret 8
Function at 0x408ec0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x10]
test esi, esi
je 0x409084
mov ax, word [edi + 2]
xor ecx, ecx
mov word [ebp - 0x20], ax
add esi, 0xa
mov al, byte [edi + 4]
mov bh, cl
mov byte [ebp - 0x1e], al
xor eax, eax
mov dword [ebp - 0x1c], ecx
mov word [ebp - 0x18], ax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 1], bh
jmp 0x408f2d
push dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
push dword [ebp + 8]
call fcn.004086a3
test eax, eax
js 0x40900a
lea eax, [ebp - 0x20]
mov ecx, edi
je 0x408fe1
push dword [ebp - 8]
push eax
call fcn.00408e2d
mov esi, eax
push dword [edi + 0x14]
lea eax, [ebp - 8]
mov dword [ebp - 8], esi
push eax
lea ecx, [ebp - 0x20]
call fcn.00408806
mov bl, al
test bl, bl
jne 0x408f01
mov esi, dword [ebp - 8]
mov dword [edi + 0x14], esi
xor edx, edx
test bh, bh
jne 0x408f72
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x20]
and dword [ebp - 0x14], edx
mov word [ebp - 0x18], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], eax
call fcn.00408716
mov edx, eax
mov ax, word [edi + 6]
lea ecx, [ebp - 0x34]
and dword [ebp - 0x28], 0
mov word [ebp - 0x34], ax
mov al, byte [edi + 8]
mov byte [ebp - 0x32], al
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov word [ebp - 0x2c], ax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
call fcn.00408716
mov ebx, dword [edi + 0x18]
add eax, edx
mov dword [ebp - 0xc], eax
mov edx, ebx
mov eax, dword [edi + 0x14]
sub edx, eax
cmp eax, ebx
sbb ecx, ecx
and ecx, edx
mov edx, dword [ebp - 0xc]
cmp ecx, edx
jb 0x409084
sub ebx, edx
lea ecx, [edx + esi]
sub ebx, esi
sub eax, esi
je 0x40903b
test ecx, ecx
jne 0x40901a
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [eax], 0x16
call sub.api_ms_win_crt_private_l1_1_0.dll__o__invalid_parameter_noinfo
jmp 0x40903b
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 8]
push eax
call fcn.00408cf7
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
jne 0x409003
mov al, 1
jmp 0x409086
mov bh, 1
mov byte [ebp - 1], bh
jmp 0x40900d
mov dword [ebp - 8], esi
test bl, bl
jne 0x408f4b
jmp 0x408f48
test esi, esi
je 0x408fce
cmp ebx, eax
jae 0x409030
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__errno]
mov dword [eax], 0x22
jmp 0x408fda
push eax
push esi
push ecx
call sub.api_ms_win_crt_private_l1_1_0.dll_memmove
add esp, 0xc
mov eax, dword [edi + 0x14]
add eax, dword [ebp - 0xc]
cmp byte [ebp - 1], 0
mov dword [edi + 0x14], eax
jne 0x409059
push eax
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.00408740
jmp 0x40906c
cmp byte [ebp - 0x1e], 0
je 0x40906c
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x20]
inc eax
push eax
call fcn.004086d0
push dword [edi + 0x14]
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00408740
mov byte [edi + 0x20], 1
jmp 0x408ffc
xor al, al
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x40ae8d
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0040b121

Function at 0x40be6e
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
xor esi, esi
push eax
push esi
push 0x10
push 0x401d90
push 0x401f28
push 0x80000001
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegGetValueW]
test eax, eax
jne 0x40bea8
cmp dword [ebp - 8], esi
je 0x40becd
push esi
push esi
push esi
push 0x40b930
push esi
push esi
call dword [sym.imp.api_ms_win_crt_private_l1_1_0.dll__o__beginthreadex]
add esp, 0x18
test eax, eax
jne 0x40bec6
mov eax, 0x80004005
jmp 0x40becf
push eax
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
xor eax, eax
pop esi
leave
ret

Function at 0x40cb68
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
mov dword [0x429ddc], 0x4221d0
push eax
push 0xd
push 0x400
mov dword [0x429de4], 0xc
call dword [sym.imp.api_ms_win_core_localization_l1_2_0.dll_GetLocaleInfoW]
cmp word [ebp - 4], 0x31
jne 0x40cbbc
mov eax, 0x3e8
mov dword [0x429da8], 0xa006
mov dword [0x429dc8], eax
mov dword [0x429dd0], eax
mov eax, 0x2ee
jmp 0x40cbda
mov eax, 0x9c4
mov dword [0x429da8], 0xa00a
mov dword [0x429dc8], eax
mov dword [0x429dd0], eax
mov eax, 0x7d0
mov dword [0x429dcc], eax
mov dword [0x429dc4], eax
leave
ret

Function at 0x40cd88
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x4291b0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [0x429e1c]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push ecx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ce03
push 0
lea eax, [ebp - 0x408]
push eax
push 0x400
lea eax, [ebp - 0x404]
push eax
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_ReadFile]
test eax, eax
jle 0x40cdfc
mov edx, dword [ebp - 0x408]
test edx, edx
je 0x40cdfc
lea ecx, [ebp - 0x404]
call fcn.0040ccf9
mov edi, eax
push esi
call dword [sym.imp.api_ms_win_core_handle_l1_1_0.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00426f20
leave
ret
Function at 0x40f631
Capabilities:
Open clipboard

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
push ebx
push esi
push edi
push dword [0x42a92c]
mov esi, ecx
call dword [sym.imp.USER32.dll_GetMenu]
mov edi, eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0xb0
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [ebp - 4]
xor ebx, ebx
cmp eax, dword [ebp - 0xc]
sete bl
push ebx
push 0x300
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x301
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x303
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push ebx
push 0x1c
xor ebx, ebx
inc ebx
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40f6ea
push ebx
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_CloseClipboard]
xor ecx, ecx
cmp dword [ebp - 8], ecx
sete cl
push ecx
push 0x302
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0xe
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
neg eax
sbb esi, esi
not esi
and esi, ebx
push esi
push 0x15
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
push 0x16
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push esi
push 0x1d
push ebx
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
xor ebx, ebx
cmp dword [0x42ab94], ebx
push 1
push edi
setne bl
call dword [sym.imp.USER32.dll_GetSubMenu]
push ebx
push 0x18
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
push 0
push 0
push 0xc6
push dword [0x42adac]
call dword [sym.imp.USER32.dll_SendMessageW]
xor ecx, ecx
test eax, eax
sete cl
push ecx
push 0x10
push 1
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
push eax
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov esi, dword [0x42ab94]
neg esi
push 2
sbb esi, esi
push edi
and esi, 8
call dword [sym.imp.USER32.dll_GetSubMenu]
push esi
push 0x20
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
push 3
push edi
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ecx, dword [0x42aba0]
neg ecx
sbb ecx, ecx
and ecx, 8
push ecx
push 0x1b
push eax
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop edi
pop esi
pop ebx
leave
ret