joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424ca0
Capabilities:
Get graphical window text

Disassembly:
test al, al
je 0x424d8d
mov eax, dword [0x4be784]
mov byte [eax + 0x18e0], 0
push 0x11
mov eax, dword [0x4be784]
add eax, 0x867
push eax
mov eax, dword [0x4be94c]
mov eax, dword [eax]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [0x4be784]
add eax, 0x867
call fcn.004b8144
test eax, eax
jle 0x424d70
mov eax, dword [0x4be784]
add eax, 0x867
call fcn.004b8144
cmp eax, 0x10
jge 0x424d70
mov eax, dword [0x4be784]
add eax, 0x867
mov dl, 1
call fcn.004aab28
mov eax, dword [0x4be4c4]
fistp qword [eax]
wait
mov eax, dword [0x4be95c]
cmp byte [eax], 0
jne 0x424d62
mov eax, dword [0x4be784]
mov edx, dword [0x4be4c4]
mov ecx, dword [edx]
mov dword [eax + 0x16dc], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0x16e0], ecx
mov eax, dword [0x4be784]
push dword [eax + 0x16e0]
push dword [eax + 0x16dc]
call fcn.004b849c
push eax
mov eax, dword [0x4be94c]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowTextA
jmp 0x424e74
mov eax, dword [0x4be94c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetFocus
ret
mov ax, 0x14a
call fcn.004aa600
push eax
mov eax, dword [0x4be94c]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetWindowTextA
jmp 0x424e74
mov eax, dword [0x4be784]
mov byte [eax + 0x18e0], 1
push 0x11
mov eax, dword [0x4beadc]
push eax
mov eax, dword [0x4be94c]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_GetWindowTextA
mov eax, dword [0x4beadc]
call fcn.004b8144
test eax, eax
jle 0x424e5d
mov eax, dword [0x4beadc]
call fcn.004b8144
cmp eax, 0x10
jge 0x424e5d
mov al, 1
call fcn.004aa774
mov eax, dword [0x4be4c4]
fistp qword [eax]
wait
mov eax, dword [0x4be95c]
cmp byte [eax], 0
jne 0x424e4e
mov eax, dword [0x4be784]
mov edx, dword [0x4be4c4]
mov ecx, dword [edx]
mov dword [eax + 0x16dc], ecx
mov ecx, dword [edx + 4]
mov dword [eax + 0x16e0], ecx
mov eax, dword [0x4be784]
push dword [eax + 0x16e0]
push dword [eax + 0x16dc]
xor edx, edx
mov al, 1
call fcn.004af0b0
mov edx, eax
mov eax, dword [0x4be784]
add eax, 0x867
call fcn.004b81b0
mov eax, dword [0x4be784]
add eax, 0x867
push eax
mov eax, dword [0x4be94c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
jmp 0x424e74
mov eax, dword [0x4be94c]
mov eax, dword [eax + 4]
push eax
call sub.user32.dll_SetFocus
ret
mov ax, 0x14a
call fcn.004aa600
push eax
mov eax, dword [0x4be94c]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetWindowTextA
ret

Function at 0x428184
Capabilities:
Hide graphical window

Disassembly:
mov edx, dword [0x4be784]
cmp byte [edx + 0x1939], 0
je 0x4281d4
mov edx, dword [0x4be744]
cmp dword [edx], 0
jle 0x4281b6
test al, al
je 0x4281b6
call fcn.00428038
push 4
mov eax, dword [0x4be58c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4be744]
cmp dword [eax], 0
jne 0x4281d4
call fcn.0042812c
push 0
mov eax, dword [0x4be58c]
mov eax, dword [eax]
push eax
call sub.user32.dll_ShowWindow
ret
Function at 0x429120
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push ecx
mov esi, ecx
mov byte [esp], dl
mov ebx, eax
mov eax, dword [0x4be4f8]
cmp dword [eax], 0
jne 0x42918c
push 0x4bd57c
push 1
mov eax, dword [0x4bf704]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x4bf704]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov edx, dword [0x4be4f8]
mov dword [edx], eax
push 0x4bd57c
push 2
mov eax, dword [0x4bf704]
push eax
call sub.kernel32.dll_FindResourceA
push eax
mov eax, dword [0x4bf704]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov edx, dword [0x4be608]
mov dword [edx], eax
mov byte [esi], 0
cmp bl, 0xf
jne 0x4291ac
mov eax, dword [0x4be6ec]
cmp byte [eax], 1
jbe 0x4291d6
mov cl, 1
mov edx, esi
mov al, byte [esp]
call fcn.00429000
jmp 0x4291d6
mov eax, ebx
and eax, 0xff
bt dword [0x4bd558], eax
setb al
test al, al
je 0x4291cb
mov eax, dword [0x4be6ec]
cmp byte [eax], 1
jbe 0x4291d6
xor ecx, ecx
mov edx, esi
mov eax, ebx
call fcn.00429000
pop edx
pop esi
pop ebx
ret

Function at 0x42a048
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x4bd590], 0
jne 0x42a11a
mov byte [0x4bd590], 1
xor eax, eax
mov dword [0x4bd588], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x42a090
cmp dword [esp + 0x1c], 3
jne 0x42a0f0
cmp dword [esp + 0x20], 0x33
jbe 0x42a0f0
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x42a124
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x42a11a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x42a154
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x42a11a
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x42a11a
cmp byte [esp + 9], 0
jne 0x42a11a
jmp 0x42a105
push 0
push 0x42a154
push 0x42a15c
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x42a11a
mov eax, dword [0x4bd584]
call fcn.00404d14
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4bd588], eax
add esp, 0xac
ret
Function at 0x42a67c
Capabilities:
Open clipboard

Disassembly:
push ebx
push ecx
mov byte [esp + 1], 1
mov byte [esp], 1
test al, al
je 0x42a6eb
mov eax, dword [0x4beaa0]
cmp byte [eax], 0
je 0x42a6d0
call sub.user32.dll_CountClipboardFormats
test eax, eax
jle 0x42a6d0
mov eax, dword [0x4be4a8]
mov byte [eax], 1
mov ax, 0x57
call fcn.004aa600
mov edx, 0x12
call fcn.004b12a8
cmp al, 3
je 0x42a798
cmp al, 1
sete byte [esp]
test al, al
sete byte [esp + 1]
jmp 0x42a6eb
mov ax, 0x58
call fcn.004aa600
mov edx, 2
call fcn.004b12a8
test al, al
je 0x42a798
mov eax, dword [0x4beaa0]
cmp byte [eax], 0
je 0x42a752
cmp byte [esp], 0
je 0x42a728
push 0x4000
mov eax, dword [0x4be6c4]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be638]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualFree_1
mov eax, dword [0x4beaa0]
mov byte [eax], 0
mov eax, dword [0x4be6c4]
xor edx, edx
mov dword [eax], edx
mov bl, 1
cmp byte [esp + 1], 0
je 0x42a780
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42a780
call sub.user32.dll_EmptyClipboard
cmp eax, 1
sbb ebx, ebx
inc ebx
call sub.user32.dll_CloseClipboard
jmp 0x42a780
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42a77e
call sub.user32.dll_EmptyClipboard
cmp eax, 1
sbb ebx, ebx
inc ebx
call sub.user32.dll_CloseClipboard
mov eax, dword [0x4be6c4]
xor edx, edx
mov dword [eax], edx
jmp 0x42a780
xor ebx, ebx
test bl, bl
jne 0x42a798
mov ax, 0x59
call fcn.004aa600
mov edx, eax
mov ax, 0x1b
call fcn.004acdac
pop edx
pop ebx
ret
Function at 0x42afa0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, eax
mov byte [esp], 0
mov ebx, dword [0x4be6c4]
mov ebx, dword [ebx]
mov eax, dword [0x4be828]
cmp byte [eax], 2
jne 0x42b004
mov eax, dword [0x4be6c4]
mov eax, dword [eax]
mov edx, dword [0x4be784]
movzx edx, byte [edx + 0x18ab]
mov ebx, edx
cdq
idiv ebx
mov ebx, eax
mov ecx, dword [0x4be6c4]
mov ecx, dword [ecx]
add ecx, 0xf
add ecx, 0xf
lea eax, [ecx + ecx*4]
add eax, 0x40
mov edx, dword [0x4be6c4]
test ecx, ecx
jns 0x42aff9
add ecx, 0xf
sar ecx, 4
mov edx, ecx
add edx, edx
add eax, edx
add ebx, eax
mov eax, dword [0x4be828]
cmp byte [eax], 1
jne 0x42b017
mov eax, dword [0x4be6c4]
mov ebx, dword [eax]
add ebx, ebx
mov eax, dword [0x4be828]
cmp byte [eax], 3
jne 0x42b046
mov eax, dword [0x4be6c4]
mov ebx, dword [eax]
add ebx, ebx
lea ebx, [ebx + ebx*2]
mov eax, dword [0x4be6c4]
mov eax, dword [eax]
test eax, eax
jns 0x42b03b
add eax, 0xf
sar eax, 4
lea eax, [eax + eax*2]
add ebx, eax
add ebx, 0x32
mov eax, dword [0x4be828]
cmp byte [eax], 4
jne 0x42b073
mov eax, dword [0x4be6c4]
mov ebx, dword [eax]
lea ebx, [ebx + ebx*4]
mov eax, dword [0x4be6c4]
mov eax, dword [eax]
test eax, eax
jns 0x42b068
add eax, 0xf
sar eax, 4
lea eax, [eax + eax*2]
add ebx, eax
add ebx, 0x32
cmp ebx, 0xff0000
jg 0x42b187
inc ebx
push ebx
push 0x2042
call sub.kernel32.dll_GlobalAlloc
mov dword [esi], eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GlobalLock
mov ebx, eax
test ebx, ebx
jne 0x42b0a8
mov eax, dword [0x4be828]
mov byte [eax], 0
jmp 0x42b187
mov eax, dword [0x4beb70]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x4be638]
mov dword [edx], eax
mov eax, dword [0x4be828]
cmp byte [eax], 0
jne 0x42b0e3
mov ecx, dword [0x4be6c4]
mov ecx, dword [ecx]
mov edx, dword [0x4be638]
mov edx, dword [edx]
mov eax, ebx
call fcn.004066dc
jmp 0x42b16e
mov eax, dword [0x4be828]
cmp byte [eax], 1
jne 0x42b144
mov edi, dword [0x4be6c4]
mov edi, dword [edi]
dec edi
test edi, edi
jl 0x42b166
inc edi
xor eax, eax
mov edx, dword [0x4be638]
mov edx, dword [edx]
add edx, eax
mov dl, byte [edx]
xor ecx, ecx
mov cl, dl
shr ecx, 4
mov ebp, dword [0x4be898]
mov cl, byte [ebp + ecx]
mov ebp, eax
add ebp, ebp
add ebp, ebx
mov byte [ebp], cl
and edx, 0xff
and edx, 0xf
mov ecx, dword [0x4be898]
mov dl, byte [ecx + edx]
mov ecx, eax
add ecx, ecx
add ecx, ebx
inc ecx
mov byte [ecx], dl
inc eax
dec edi
jne 0x42b0fd
jmp 0x42b166
mov eax, dword [0x4be828]
cmp byte [eax], 3
jb 0x42b15f
mov edx, dword [0x4be828]
mov dl, byte [edx]
mov eax, ebx
call fcn.0042a7c8
jmp 0x42b166
mov eax, ebx
call fcn.0042aa10
mov eax, dword [0x4be828]
mov byte [eax], 0
mov eax, dword [0x4beb70]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [esi]
push eax
call sub.kernel32.dll_GlobalUnlock
mov byte [esp], 1
mov al, byte [esp]
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x42b190
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
add esp, 0xfffffff8
mov byte [esp + 1], dl
mov byte [esp], al
xor ebx, ebx
mov eax, dword [0x4be6c4]
cmp dword [eax], 0xff0000
jg 0x42b30f
mov eax, dword [0x4be6c4]
cmp dword [eax], 0x4fb000
jge 0x42b1eb
cmp byte [esp], 0
jne 0x42b1eb
lea eax, [esp + 4]
call fcn.0042afa0
mov byte [esp + 2], al
cmp byte [esp + 2], 0
jne 0x42b1f0
mov ax, 0x59
call fcn.004aa600
mov edx, eax
mov ax, 0x1b
call fcn.004acdac
jmp 0x42b1f0
mov byte [esp + 2], 0
mov eax, dword [0x4beb60]
mov eax, dword [eax]
push eax
call sub.user32.dll_OpenClipboard
test eax, eax
je 0x42b2ef
call sub.user32.dll_EmptyClipboard
mov eax, dword [0x4beaa0]
mov byte [eax], 0
mov eax, dword [0x4beb70]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bec08]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
je 0x42b2e8
push 4
push 0x42
call sub.kernel32.dll_GlobalAlloc
mov edx, dword [0x4be370]
mov dword [edx], eax
mov eax, dword [0x4be370]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, dword [0x4beb5c]
mov dword [edx], eax
mov eax, dword [0x4beb5c]
cmp dword [eax], 0
je 0x42b297
mov eax, dword [0x4be6c4]
mov eax, dword [eax]
mov edx, dword [0x4beb5c]
mov edx, dword [edx]
mov dword [edx], eax
mov eax, dword [0x4be370]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [0x4be370]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bea20]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetClipboardData
test eax, eax
setne bl
cmp byte [esp + 2], 0
je 0x42b2e8
mov eax, dword [0x4be784]
cmp byte [eax + 0x189e], 1
jne 0x42b2dc
cmp byte [esp + 1], 0
je 0x42b2ce
mov eax, dword [0x4be638]
mov eax, dword [eax]
inc eax
cmp byte [eax], 0
jne 0x42b2ce
mov eax, dword [esp + 4]
push eax
push 0xd
call sub.user32.dll_SetClipboardData
jmp 0x42b2e8
mov eax, dword [esp + 4]
push eax
push 1
call sub.user32.dll_SetClipboardData
jmp 0x42b2e8
mov eax, dword [esp + 4]
push eax
push 7
call sub.user32.dll_SetClipboardData
call sub.user32.dll_CloseClipboard
jmp 0x42b319
cmp byte [esp + 2], 0
je 0x42b306
cmp byte [esp], 0
jne 0x42b306
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_GlobalFree
xor eax, eax
call fcn.0042a67c
jmp 0x42b319
mov eax, dword [0x4beaa0]
mov byte [eax], 1
mov bl, 1
test bl, bl
je 0x42b33e
mov eax, dword [0x4beaa0]
cmp byte [eax], 0
jne 0x42b352
mov eax, dword [0x4bec08]
mov eax, dword [eax]
push eax
call sub.user32.dll_IsClipboardFormatAvailable
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x42b352
mov ax, 0x59
call fcn.004aa600
mov edx, eax
mov ax, 0x1b
call fcn.004acdac
pop ecx
pop edx
pop ebx
ret
Function at 0x433ef8
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], 1
pushal
mov esi, dword [eax]
mov edi, dword [ecx]
mov eax, edx
mov ecx, 3
xor edx, edx
div ecx
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
lea ecx, [0x4bd598]
xor eax, eax
xor ebx, ebx
xor edx, edx
cmp dword [ebp - 8], 0
je 0x433f67
lodsw ax, word [esi]
mov bl, al
shr bl, 2
mov dl, byte [ebx + ecx]
mov bh, ah
and bh, 0xf
rol ax, 4
and ax, 0x3f
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
lodsb al, byte [esi]
mov bl, al
shr bx, 6
mov dl, byte [ebx + ecx]
and al, 0x3f
xor ah, ah
mov dh, byte [eax + ecx]
mov ax, dx
stosw word es:[edi], ax
dec dword [ebp - 8]
jne 0x433f2d
cmp dword [ebp - 0xc], 0
je 0x433fb7
xor eax, eax
xor ebx, ebx
xor edx, edx
lodsb al, byte [esi]
shl ax, 6
mov bl, ah
mov dl, byte [ebx + ecx]
dec dword [ebp - 0xc]
je 0x433fa2
shl ax, 2
and ah, 3
lodsb al, byte [esi]
shl ax, 4
mov bl, ah
mov dh, byte [ebx + ecx]
shl edx, 0x10
shr al, 2
mov bl, al
mov dl, byte [ebx + ecx]
mov dh, 0x3d
jmp 0x433fb1
shr al, 2
mov bl, al
mov dh, byte [ebx + ecx]
shl edx, 0x10
mov dh, 0x3d
mov dl, 0x3d
mov eax, edx
ror eax, 0x10
stosd dword es:[edi], eax
popal
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x436880
Capabilities:
Copy file
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov byte [ebp - 1], 0
cmp byte [ebp + 8], 0
jne 0x436a3b
test eax, eax
jne 0x4368d9
mov eax, ebx
add al, 0xb
call fcn.00421294
test al, al
je 0x436a3b
mov edx, dword [0x4be538]
lea eax, [ebp - 0x101]
call fcn.004b81b0
call fcn.004ae0a4
mov al, 0x15
call fcn.00421294
test al, al
je 0x436a3b
jmp 0x4368f1
lea edx, [ebp - 0x101]
xchg edx, eax
call fcn.004b81b0
mov eax, dword [0x4be538]
mov edx, esi
call fcn.004b81b0
mov eax, dword [0x4be538]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_lstrcmpiA
test eax, eax
jne 0x43691f
mov ax, 0x5a
call fcn.004aa600
mov edx, 3
call fcn.004b12a8
jmp 0x436a3b
cmp byte [ebp + 8], 0
jne 0x436a3b
test bl, bl
je 0x43693c
mov eax, dword [0x4be538]
mov al, byte [eax]
cmp al, byte [ebp - 0x101]
je 0x4369b5
xor eax, eax
mov al, bl
add eax, eax
add ax, 0xe0
dec eax
call fcn.004aa600
mov edx, eax
mov eax, dword [0x4bec98]
call fcn.004b81b0
lea eax, [ebp - 0x101]
call fcn.004aed10
mov edx, eax
mov eax, dword [0x4bec98]
mov ecx, 0x3c
call fcn.004b820c
mov eax, dword [0x4be784]
movzx eax, byte [eax + 0x188c]
lea eax, [eax + eax*4]
mov edx, dword [0x4be720]
lea eax, [edx + eax]
push eax
mov eax, dword [0x4bec98]
push eax
call sub.kernel32.dll_lstrcatA
mov eax, dword [0x4bec98]
mov dl, 3
call fcn.004ad8ec
push 0
call fcn.004ad860
mov eax, 0xa
call fcn.004ae058
test bl, bl
je 0x4369e6
mov eax, dword [0x4be538]
call fcn.004b1914
test al, al
je 0x4369d2
mov eax, dword [0x4be538]
push eax
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [0x4be538]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_MoveFileA
jmp 0x4369fa
push 0
mov eax, dword [0x4be538]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_CopyFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x436a1f
call sub.kernel32.dll_GetLastError_1
call fcn.004ae200
mov eax, dword [0x4bedb0]
mov edx, 1
call fcn.004b12a8
jmp 0x436a23
mov byte [ebp - 1], 1
test bl, bl
je 0x436a36
mov eax, dword [0x4be538]
mov al, byte [eax]
cmp al, byte [ebp - 0x101]
je 0x436a3b
call fcn.004adbe0
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x440114
Capabilities:
Read file via mapping

Disassembly:
push ebx
mov ebx, dword [0x4be97c]
mov eax, dword [0x4beb40]
mov eax, dword [eax]
call fcn.004b1c50
mov ecx, 0x10000000
mov edx, 0x80000000
call fcn.004adc9c
mov edx, dword [0x4bec30]
mov dword [edx], eax
push 0
push 0
push 0
push 0x8000002
push 0
mov eax, dword [0x4bec30]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov edx, dword [0x4be7c0]
mov dword [edx], eax
mov eax, dword [0x4be7c0]
cmp dword [eax], 0
jne 0x44018a
mov edx, dword [0x4bedb0]
mov ax, 9
call fcn.004acdac
xor eax, eax
mov dword [ebx], eax
mov eax, dword [0x4be318]
mov byte [eax], 0
jmp 0x4402f6
push 0
push 0
push 0
push 4
mov eax, dword [0x4be7c0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebx], eax
mov eax, dword [ebx]
add eax, 2
mov ax, word [eax]
mov edx, dword [0x4beac4]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 4
mov ax, word [eax]
mov edx, dword [0x4be988]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 6
mov ax, word [eax]
mov edx, dword [0x4beae8]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 8
mov ax, word [eax]
mov edx, dword [0x4beb58]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 0xa
mov ax, word [eax]
mov edx, dword [0x4beb3c]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 0xc
mov ax, word [eax]
mov edx, dword [0x4bea4c]
mov word [edx], ax
mov eax, dword [ebx]
add eax, 0xd
mov edx, dword [0x4be988]
movzx edx, word [edx]
add eax, edx
cmp byte [eax], 0
jne 0x4402db
mov edx, dword [0x4be988]
mov edx, eax
mov eax, dword [0x4beae8]
movzx eax, word [eax]
add edx, eax
cmp byte [edx], 0
jne 0x4402db
mov eax, dword [0x4be988]
mov eax, dword [0x4beae8]
mov eax, edx
mov edx, dword [0x4beb58]
movzx edx, word [edx]
add eax, edx
cmp byte [eax], 0
jne 0x4402db
mov edx, dword [0x4be988]
mov edx, dword [0x4beae8]
mov edx, dword [0x4beb58]
mov edx, dword [0x4beb3c]
movzx edx, word [edx]
add eax, edx
cmp byte [eax], 0
jne 0x4402db
mov eax, dword [ebx]
add eax, 0xd
mov edx, dword [0x4be988]
movzx edx, word [edx]
add eax, edx
mov edx, dword [0x4beae8]
movzx edx, word [edx]
add eax, edx
mov edx, dword [0x4beb58]
movzx edx, word [edx]
add eax, edx
mov edx, dword [0x4beb3c]
movzx edx, word [edx]
add eax, edx
mov edx, dword [0x4bea4c]
movzx edx, word [edx]
add eax, edx
cmp byte [eax], 0
jne 0x4402db
mov eax, dword [0x4be318]
mov byte [eax], 1
mov eax, dword [0x4bea4c]
cmp word [eax], 0
jbe 0x4402f6
mov eax, dword [0x4be318]
mov byte [eax], 5
jmp 0x4402f6
xor eax, eax
mov dword [ebx], eax
mov eax, dword [0x4be318]
mov byte [eax], 0
mov edx, dword [0x4bedb0]
mov ax, 9
call fcn.004acdac
mov eax, dword [0x4beb40]
mov eax, dword [eax + 4]
call fcn.004b1c50
push eax
call sub.kernel32.dll_LoadLibraryA
mov edx, dword [0x4be8ac]
mov dword [edx], eax
mov eax, dword [0x4be8ac]
cmp dword [eax], 0
jne 0x44032a
mov edx, dword [0x4bedb0]
mov ax, 9
call fcn.004acdac
pop ebx
ret
Function at 0x440ea0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff004
push eax
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404d04
xor eax, eax
push ebp
push 0x440fff
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1008]
mov edx, 0x1000
call fcn.004066e4
lea esi, [ebp - 0x1008]
mov eax, dword [ebp - 4]
call fcn.00404d14
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.004adc9c
mov edi, eax
cmp edi, 0xffffffff
jne 0x440f55
lea eax, [ebp - 8]
mov ecx, 0x441018
mov edx, dword [ebp - 4]
call fcn.00404b68
mov eax, dword [ebp - 8]
call fcn.00404d14
call fcn.004b1914
test al, al
je 0x440f55
mov eax, dword [ebp - 4]
call fcn.00404d14
push eax
mov eax, dword [ebp - 8]
call fcn.00404d14
push eax
call sub.kernel32.dll_MoveFileA
mov eax, dword [ebp - 4]
call fcn.00404d14
mov ecx, 0x8000000
mov edx, 0x80000000
call fcn.004adc9c
mov edi, eax
cmp edi, 0xffffffff
jne 0x440f6a
mov eax, dword [0x4be784]
mov word [eax + 0x1858], 0
jmp 0x440fe4
push 0x1000
push esi
push edi
call sub.kernel32.dll__lread
mov edx, dword [0x4be6b0]
mov dword [edx], eax
push edi
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [0x4be6b0]
cmp dword [eax], 0x19
jl 0x440fe4
mov edx, dword [0x4bec2c]
mov eax, esi
call fcn.004b82a4
test eax, eax
jne 0x440fe4
mov eax, esi
jmp 0x440fb1
inc eax
mov edx, eax
dec edx
cmp byte [edx], 0xa
je 0x440fb1
cmp byte [eax], 0
jne 0x440fa3
cmp byte [eax], 0x2f
jne 0x440fc1
lea edx, [eax + 1]
cmp byte [edx], 0x2f
je 0x440fa3
jmp 0x440fc1
inc eax
mov dl, byte [eax]
cmp dl, 0xa
je 0x440fc0
cmp dl, 0xd
je 0x440fc0
mov esi, eax
push 1
mov eax, dword [ebp - 4]
call fcn.00404d14
mov edx, eax
mov ecx, ebx
mov eax, esi
call fcn.004aad70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441006
lea eax, [ebp - 8]
mov edx, 2
call fcn.004048c0
ret
Function at 0x442790
Capabilities:
Delete file

Disassembly:
push ebx
push esi
mov esi, dword [0x4bedb0]
mov eax, dword [0x4be374]
mov edx, 0x10
call fcn.004066e4
jmp 0x4427af
push esi
call sub.kernel32.dll_DeleteFileA_1
mov edx, esi
mov eax, dword [0x4be3a8]
call fcn.004aa408
test al, al
jne 0x4427a9
mov eax, dword [0x4be600]
cmp dword [eax], 0
je 0x4427d6
mov eax, dword [0x4be600]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FreeLibrary_1
call fcn.004b3f58
push 0xff
push esi
mov eax, dword [0x4bf704]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
push esi
call sub.gdi32.dll_RemoveFontResourceA
cmp dword [0x4c12e4], 0
je 0x442806
mov eax, dword [0x4c12e4]
push eax
call sub.comctl32.dll_ImageList_Destroy
mov eax, dword [0x4beaec]
cmp dword [eax], 0
je 0x44282b
push 0x4000
mov eax, dword [0x4be394]
mov eax, dword [eax]
inc eax
push eax
mov eax, dword [0x4beaec]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_VirtualFree_1
mov eax, dword [0x4beb98]
cmp dword [eax], 0
je 0x44284b
push 0
push 0
push 0x404
mov eax, dword [0x4beb98]
mov eax, dword [eax]
push eax
call sub.user32.dll_SendMessageA
call fcn.0044032c
mov eax, dword [0x4becc4]
cmp dword [eax], 0
jbe 0x442867
mov eax, dword [0x4becc4]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_FreeLibrary_1
mov eax, dword [0x4be784]
cmp byte [eax + 0x18cf], 0
je 0x44289d
mov bl, 3
mov ecx, dword [0x4beb38]
mov edx, esi
mov eax, ebx
call fcn.004a1ee4
push esi
call sub.kernel32.dll_DeleteFileA_1
mov eax, dword [0x4beb38]
push eax
call sub.kernel32.dll_DeleteFileA_1
inc ebx
cmp bl, 0x1b
jne 0x442877
mov eax, dword [0x4bee54]
cmp dword [eax], 0
je 0x442908
mov eax, dword [0x4bedfc]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be51c]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [0x4be448]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be51c]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [0x4bef70]
mov eax, dword [eax]
push eax
mov eax, dword [0x4be51c]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_SelectObject
mov eax, dword [0x4be51c]
mov eax, dword [eax]
push eax
mov eax, dword [0x4bee54]
mov eax, dword [eax]
push eax
call sub.user32.dll_ReleaseDC
mov eax, dword [0x4be72c]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_DeleteDC
mov eax, dword [0x4be548]
mov eax, dword [eax]
push eax
call sub.gdi32.dll_DeleteObject
mov eax, dword [0x4be9d4]
cmp byte [eax + 0xc], 0
je 0x442950
mov eax, dword [0x4be9d4]
cmp dword [eax + 4], 0
jne 0x44293a
mov eax, dword [0x4bedf0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_DeleteFileA_1
jmp 0x442950
push 0
mov edx, dword [0x4bedf0]
mov edx, dword [edx]
mov eax, dword [0x4be9d4]
mov cl, 1
call fcn.004ac75c
pop esi
pop ebx
ret