joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d8be
Capabilities:
Get file version info

Disassembly:
mov eax, 0x4ff866
call fcn.004af370
sub esp, 0x14
push ebx
call fcn.004d41f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
and dword [ebp - 0x14], 0
push 0x505800
lea eax, [ebp - 0x18]
push eax
call fcn.004d63e0
mov eax, dword [eax]
lea ecx, [ebp - 0x10]
push ecx
push eax
mov byte [ebp - 4], 1
call fcn.004d5d70
mov ecx, dword [ebp - 0x18]
mov ebx, eax
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
add ecx, 0xfffffff0
inc bl
call fcn.0040141b
test bl, bl
pop ebx
je 0x40d92d
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040141b
jmp 0x40d9a3
push esi
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x40d996
push edi
call fcn.004d41e0
mov esi, eax
test esi, esi
pop ecx
je 0x40d996
push esi
push edi
push dword [ebp - 0x14]
push dword [ebp - 0x10]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x40d98f
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x504c10
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x40d98f
cmp dword [ebp - 0x1c], 0x34
jne 0x40d98f
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 8]
mov edx, dword [ebp + 8]
mov dword [edx], ecx
mov eax, dword [eax + 0xc]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push esi
call fcn.004d41d0
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040141b
pop edi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x40d9af
Capabilities:
Copy file

Disassembly:
mov eax, 0x4ff890
call fcn.004af370
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0x18]
xor edi, edi
push dword [ebp + 0x14]
mov dword [ebp - 0x20], edi
push dword [ebp + 0x10]
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], edi
call fcn.0040d656
add esp, 0x10
test eax, eax
jne 0x40db2d
lea ecx, [ebp - 0x30]
call fcn.004d40c0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.00405560
add esp, 0x10
cmp eax, edi
je 0x40dae6
lea eax, [ebp - 0x24]
push eax
call fcn.00402a49
pop ecx
push dword [ebp + 0x10]
mov byte [ebp - 4], 2
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00402e2f
add esp, 0xc
mov ecx, dword [ebp - 0x24]
add ecx, 0xfffffff0
mov byte [ebp - 4], 4
call fcn.0040141b
push 0x1042
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x40]
call fcn.004d6310
push dword [ebp - 0x20]
lea ecx, [ebp - 0x40]
push dword [ebp - 0x14]
mov byte [ebp - 4], 5
call fcn.004d5880
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 4
call fcn.004d5c00
push dword [ebp + 0x10]
call fcn.004c559c
push edi
push 0x24
push str.The_OleAut32.dll_in_your_system_is_too_old_to_run_this_application._Do_you_want_to_update_it__r_n_r_nIf_you_decide_to_update_the_dll__be_sure_to_close_any_other_running_applications.
call fcn.004e5430
cmp eax, 6
je 0x40daa4
cmp dword [ebp - 0x14], edi
je 0x40da9a
push dword [ebp - 0x14]
call fcn.004d41d0
pop ecx
cmp dword [ebp - 0x18], edi
je 0x40dadb
push dword [ebp - 0x18]
jmp 0x40dad5
mov esi, dword [ebp - 0x18]
push edi
push esi
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
test eax, eax
jne 0x40db00
push edi
push edi
push str.Failed_to_update_the_OleAut32.dll_
call fcn.004e5430
cmp dword [ebp - 0x14], edi
je 0x40dad0
push dword [ebp - 0x14]
call fcn.004d41d0
pop ecx
cmp esi, edi
je 0x40dadb
push esi
call fcn.004aead9
pop ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040141b
or dword [ebp - 4], 0xffffffff
call fcn.004d4100
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040141b
or dword [ebp - 4], 0xffffffff
call fcn.004d4100
cmp dword [ebp - 0x14], edi
je 0x40db22
push dword [ebp - 0x14]
call fcn.004d41d0
pop ecx
cmp esi, edi
je 0x40db2d
push esi
call fcn.004aead9
pop ecx
xor eax, eax
inc eax
jmp 0x40daf1
Function at 0x40e91c
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp dword [ebp + 8], 1
jg 0x40e92f
xor eax, eax
leave
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpiA]
push str._AfterInstall
push dword [edi + 4]
call esi
test eax, eax
jne 0x40e96f
xor esi, esi
inc esi
lea eax, [ebp - 0x190]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
mov eax, esi
dec eax
je 0x40e986
dec eax
jne 0x40e991
push str.BeforeUninst
jmp 0x40e98b
push str._BeforeUninst
push dword [edi + 4]
call esi
test eax, eax
jne 0x40e982
push 2
pop esi
jmp 0x40e947
xor eax, eax
jmp 0x40e99f
push str.AfterInstall
call fcn.00409fb0
pop ecx
call dword [sym.imp.ole32.dll_OleUninitialize]
call sub.WSOCK32.dll_WSACleanup
xor eax, eax
inc eax
pop esi
leave
ret
Function at 0x41285a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x412878
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x41287f
call fcn.004017e5
mov esi, eax
mov eax, dword [ebp + 0x18]
sub eax, 0x100
je 0x412899
dec eax
je 0x4128af
dec eax
je 0x412899
dec eax
dec eax
je 0x412899
dec eax
je 0x4128af
dec eax
jne 0x4128a9
mov eax, dword [ebp + 0x14]
test byte [eax + 8], 0x10
jne 0x4128a9
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop esi
leave
ret
push edi
mov edi, dword [ebp + 0x14]
test byte [edi + 0xc], 1
je 0x4128df
cmp dword [ebp + 0x1c], 0x1b
jne 0x4128df
test esi, esi
je 0x4128df
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4128df
push 0
push 0
push 0x10
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
test byte [edi + 0xc], 0x10
je 0x41298e
movzx eax, word [edi + 0x14]
cmp eax, dword [ebp + 0x1c]
jne 0x41298e
xor eax, eax
mov al, byte [edi + 0x16]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
and eax, 4
mov dword [ebp + 8], eax
je 0x412918
push 0x12
call ebx
test ah, ah
js 0x412918
and dword [ebp + 8], 0
jmp 0x41291f
mov dword [ebp + 8], 1
xor eax, eax
mov al, byte [edi + 0x16]
and eax, 2
mov dword [ebp + 0x18], eax
je 0x41293a
push 0x11
call ebx
test ah, ah
js 0x41293a
and dword [ebp + 0x18], 0
jmp 0x412941
mov dword [ebp + 0x18], 1
xor eax, eax
mov al, byte [edi + 0x16]
and eax, 1
mov dword [ebp - 8], eax
je 0x41295a
push 0x10
call ebx
test ah, ah
js 0x41295a
xor eax, eax
jmp 0x41295d
xor eax, eax
inc eax
cmp dword [ebp + 8], 0
pop ebx
je 0x41298e
cmp dword [ebp + 0x18], 0
je 0x41298e
test eax, eax
je 0x41298e
test esi, esi
je 0x41298e
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41298e
push 0
push 0
push 0x10
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_PostMessageA]
test byte [edi + 8], 0x10
pop edi
jmp 0x4128a0

Function at 0x415cb8
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x94
mov eax, dword [0x556184]
test eax, eax
jne 0x415d60
push 0x94
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.004af490
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x415cff
and dword [0x556184], eax
jmp 0x415d60
cmp dword [ebp - 0xc], 0
jne 0x415d0a
xor eax, eax
inc eax
jmp 0x415d51
push 2
pop ecx
cmp dword [ebp - 0xc], ecx
jne 0x415d39
cmp dword [ebp - 0x18], 4
jne 0x415d1d
push 6
pop eax
jmp 0x415d51
push 5
pop eax
cmp dword [ebp - 0x18], eax
jne 0x415d51
cmp dword [ebp - 0x14], 0
jne 0x415d2f
push 7
jmp 0x415d1a
cmp dword [ebp - 0x14], 1
jne 0x415d51
push 8
jmp 0x415d1a
push 4
pop eax
cmp dword [ebp - 0x18], eax
jne 0x415d58
cmp dword [ebp - 0x14], 0xa
jne 0x415d4b
push 3
jmp 0x415d1a
cmp dword [ebp - 0x14], 0x5a
jne 0x415d58
mov dword [0x556184], eax
jmp 0x415d60
mov dword [0x556184], ecx
mov eax, ecx
add ebp, 0x78
leave
ret
Function at 0x4165bc
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
mov eax, dword [esi + 0x1c]
xor ebp, ebp
cmp eax, ebp
push edi
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
je 0x4165dc
mov ecx, dword [esi + 0xc]
cmp ecx, ebp
je 0x4165dc
push eax
push ecx
call edi
mov ecx, dword [esi + 0x20]
cmp ecx, ebp
je 0x4165ee
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x4165ee
push ecx
push eax
call edi
mov eax, dword [esi + 0x14]
cmp eax, ebp
mov ebx, dword [sym.imp.GDI32.dll_DeleteObject]
je 0x416601
push eax
call ebx
mov dword [esi + 0x14], ebp
mov eax, dword [esi + 0x18]
cmp eax, ebp
je 0x41660e
push eax
call ebx
mov dword [esi + 0x18], ebp
mov eax, dword [esi + 0xc]
cmp eax, ebp
mov edi, dword [sym.imp.GDI32.dll_DeleteDC]
je 0x416621
push eax
call edi
mov dword [esi + 0xc], ebp
mov eax, dword [esi + 0x10]
cmp eax, ebp
je 0x41662e
push eax
call edi
mov dword [esi + 0x10], ebp
mov eax, dword [esi + 0x64]
cmp eax, ebp
je 0x41663b
push eax
call ebx
mov dword [esi + 0x64], ebp
cmp dword [esp + 0x14], ebp
je 0x41668f
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov edi, eax
test edi, 0x80000
je 0x41668f
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
mov ebx, eax
cmp ebx, ebp
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
je 0x416672
push 0
push dword [esi + 4]
call ebp
and edi, 0xfff7ffff
push edi
push 0xffffffffffffffec
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowLongA]
test ebx, ebx
je 0x41668f
push 5
push dword [esi + 4]
call ebp
pop edi
pop esi
pop ebp
pop ebx
ret 4

Function at 0x4188d7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
push esi
call fcn.004af4f0
pop ecx
xor ecx, ecx
xor edx, edx
test eax, eax
jbe 0x418909
movzx ebx, byte [edx + esi]
mov edi, ecx
shr edi, 9
xor edi, ecx
shr edi, 7
xor edi, ebx
shl ecx, 5
xor ecx, edi
inc edx
cmp edx, eax
jb 0x4188ef
mov eax, ecx
xor edx, edx
mov ecx, 0x101
div ecx
mov edi, dword [ebp + 0xc]
lea ebx, [edi + edx*4 + 0x68]
mov esi, dword [ebx]
jmp 0x41893a
push dword [ebp + 0x10]
push dword [esi]
call fcn.004b15d0
test eax, eax
pop ecx
pop ecx
jne 0x418937
mov eax, dword [ebp + 0x14]
cmp dword [esi + 8], eax
je 0x418991
mov esi, dword [esi + 0xc]
test esi, esi
jne 0x41891f
push 0x10
push dword [ebp + 8]
call fcn.0045787a
push dword [ebp + 0x10]
mov esi, eax
call fcn.004af4f0
inc eax
push eax
push dword [ebp + 8]
call fcn.0045787a
push dword [ebp + 0x10]
mov dword [esi], eax
push eax
call fcn.004af6d0
mov eax, dword [edi + 0x60]
mov dword [esi + 4], eax
mov eax, dword [ebp + 0x14]
mov dword [esi + 8], eax
mov eax, dword [ebx]
mov dword [esi + 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebx], esi
add esp, 0x1c
and dword [eax], 0
mov eax, dword [edi + 0x60]
lea ecx, [eax + 1]
mov dword [edi + 0x60], ecx
pop edi
pop esi
pop ebx
pop ebp
ret
mov eax, dword [ebp + 0x18]
mov dword [eax], 1
mov eax, dword [esi + 4]
jmp 0x41898c
Function at 0x41e6fe
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
call fcn.004017e5
test eax, eax
je 0x41e71b
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x41e71f
xor eax, eax
jmp 0x41e797
push edi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, esi
call fcn.0041de4f
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
call fcn.0041df20
add esp, 0xc
test eax, eax
je 0x41e78c
cmp dword [ebp - 4], 0
je 0x41e78c
push dword [ebp - 4]
push 0x2000
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esi + 4], eax
je 0x41e78c
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov edi, eax
lea eax, [ebp - 4]
push eax
push edi
push dword [ebp + 8]
call fcn.0041df20
add esp, 0xc
test eax, eax
push edi
jne 0x41e79c
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov ecx, esi
call fcn.0041de4f
xor esi, esi
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop edi
pop esi
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esi + 4]
push 8
call dword [sym.imp.USER32.dll_SetClipboardData]
xor esi, esi
inc esi
jmp 0x41e78e

Function at 0x41feea
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
call fcn.004017e5
test eax, eax
je 0x41ff00
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x41ff04
xor eax, eax
jmp 0x41ff29
push esi
push 8
call dword [sym.imp.USER32.dll_GetClipboardData]
push dword [esp + 0xc]
push dword [esp + 0xc]
push eax
call fcn.0041fd5c
add esp, 0xc
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
ret 8
Function at 0x4209be
Capabilities:
Create directory

Disassembly:
mov eax, 0x5000bf
call fcn.004af370
sub esp, 0x10c
push ebx
push esi
push edi
call fcn.004d41f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 4], ebx
jne 0x4209ff
lea eax, [ebp + 8]
push eax
call fcn.00403dec
pop ecx
mov byte [ebp - 4], 1
jmp 0x420a59
push str.movies
push esi
call fcn.004b40ba
test eax, eax
pop ecx
pop ecx
jne 0x420a72
mov eax, dword [0x555cd8]
cmp eax, ebx
je 0x420aca
mov eax, dword [eax + 4]
jmp 0x420a3a
mov ecx, eax
mov eax, dword [eax]
lea esi, [ecx + 8]
push 0x42
pop ecx
lea edi, [ebp - 0x118]
rep movsd dword es:[edi], dword [esi]
cmp dword [ebp - 0x14], 1
je 0x420a43
cmp eax, ebx
jne 0x420a22
jmp 0x420aca
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp + 8]
push eax
call fcn.00403980
pop ecx
pop ecx
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x10]
call fcn.004016ca
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0040141b
jmp 0x420aca
push str.attachments
push esi
call fcn.004b40ba
test eax, eax
pop ecx
pop ecx
jne 0x420ab6
lea eax, [ebp - 0x10]
push eax
call fcn.0041ff2c
test eax, eax
pop ecx
je 0x420aca
push dword [ebp - 0x10]
call fcn.0040191f
test eax, eax
pop ecx
jne 0x420aca
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x420aca
lea ecx, [ebp - 0x10]
call fcn.004014e5
jmp 0x420aca
push esi
call fcn.0040191f
test eax, eax
pop ecx
je 0x420aca
push esi
lea ecx, [ebp - 0x10]
call fcn.00401711
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], ebx
je 0x420b4b
push 0x2f
push 0x5c
lea ecx, [ebp - 0x10]
call fcn.0041fbc6
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 0xc]
cmp byte [ecx + eax - 1], 0x2f
je 0x420af5
push 0x2f
lea ecx, [ebp - 0x10]
call fcn.00402c3c
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp + 8]
push 0x508078
push eax
call fcn.00402ead
add esp, 0xc
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.004016ca
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.0040141b
call fcn.00409d82
mov esi, eax
cmp esi, ebx
je 0x420b4b
lea ecx, [ebp - 0x10]
call fcn.00402996
mov edi, eax
mov eax, dword [esi]
push edi
push esi
call dword [eax + 0xbc]
push edi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040141b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x420b65
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x500101
call fcn.004af370
sub esp, 0x24
push ebx
push esi
push edi
call fcn.004d41f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004d41f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov esi, 0x104
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.0041fb4e
push esi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0041e96e
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x20]
call fcn.004028b4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.004028b4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call fcn.004028b4
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 4
call fcn.004028b4
mov byte [ebp - 4], 5
call fcn.004d41f0
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x24], eax
push 1
lea eax, [ebp - 0x24]
push 0x5077b0
push eax
mov byte [ebp - 4], 6
call fcn.004016b7
mov esi, dword [ebp - 0x24]
add esp, 0xc
push dword [esi - 0xc]
lea ecx, [ebp - 0x28]
push esi
call fcn.00402c67
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push 0x5077b4
push eax
call fcn.004016b7
add esp, 0xc
push ebx
mov edi, dword [ebp - 0x28]
push edi
push dword [ebp - 0x10]
call fcn.004f36c0
test eax, eax
jne 0x420c91
lea ecx, [esi - 0x10]
call fcn.0040141b
lea ecx, [edi - 0x10]
call fcn.0040141b
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040141b
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040141b
mov ecx, dword [ebp - 0x20]
add ecx, 0xfffffff0
jmp 0x420d50
push 0x5077c4
lea ecx, [ebp - 0x20]
call fcn.00402fc1
push 0x5077e0
push dword [ebp + 0xc]
lea eax, [ebp - 0x10]
push 0x5077cc
push eax
call fcn.004016b7
add esp, 0x10
push ebx
mov ebx, dword [ebp - 0x20]
push ebx
push dword [ebp - 0x10]
call fcn.004f36c0
test eax, eax
je 0x420d27
lea ecx, [ebp - 0x2c]
mov eax, 0x208
push ecx
push eax
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x2c], eax
call fcn.004015ef
push eax
push dword [ebp + 8]
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x30], eax
call fcn.0041e96e
cmp dword [ebp - 0x30], 0
jne 0x420d1a
mov eax, dword [ebp - 0x10]
cmp dword [eax - 0xc], 0
je 0x420d1a
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00407bd2
test al, al
pop ecx
pop ecx
je 0x420d27
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004f36c0
lea ecx, [esi - 0x10]
call fcn.0040141b
lea ecx, [edi - 0x10]
call fcn.0040141b
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0040141b
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.0040141b
lea ecx, [ebx - 0x10]
call fcn.0040141b
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.0040141b
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.0040141b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4218da
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
call fcn.004017e5
test eax, eax
je 0x4218f0
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4218f4
xor eax, eax
jmp 0x421929
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
je 0x42191f
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x42191f
mov ecx, dword [esp + 8]
push eax
call fcn.00401711
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
inc eax
pop esi
ret 4

Function at 0x424800
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, 0x100
push 1
push esi
mov dword [ebp - 4], esi
call fcn.004afff1
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x424871
push edi
push dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
cmp eax, 0xff
jl 0x42486a
add dword [ebp - 4], esi
push dword [ebp - 4]
push ebx
call fcn.004b12e2
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
je 0x42486e
push dword [ebp + 0x14]
push dword [ebp - 4]
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
mov ecx, dword [ebp - 4]
dec ecx
cmp eax, ecx
jge 0x42483c
mov eax, ebx
jmp 0x424870
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x424c51
Capabilities:
Read .ini file

Disassembly:
push ebx
push esi
push edi
mov esi, 0x400
push 1
push esi
mov ebx, esi
call fcn.004afff1
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x424ca8
push ebp
push dword [esp + 0x14]
mov ebp, dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionNamesA]
push esi
push edi
call ebp
cmp eax, 0x3fe
jl 0x424ca1
add ebx, esi
push ebx
push edi
call fcn.004b12e2
mov edi, eax
test edi, edi
pop ecx
pop ecx
je 0x424ca5
push dword [esp + 0x14]
push ebx
push edi
call ebp
lea ecx, [ebx - 2]
cmp eax, ecx
jge 0x424c81
mov eax, edi
jmp 0x424ca7
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x429bdc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
push ebx
xor ebx, ebx
inc ebx
cmp dword [eax + 0xc], 0
jl 0x429c94
jg 0x429c00
cmp dword [eax + 8], ebx
jb 0x429c94
add eax, 0x10
cmp dword [eax], 4
jne 0x429c94
push edi
push eax
push dword [ebp + 8]
call fcn.0044ba59
mov edi, eax
push 0x3a
push edi
call fcn.004b0a90
lea ecx, [edi + 1]
add esp, 0x10
cmp eax, ecx
jne 0x429c86
push esi
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, eax
movsx eax, byte [edi]
push eax
call fcn.004b2179
sub eax, 0x61
pop ecx
js 0x429c85
mov edx, esi
mov ecx, eax
shr edx, cl
test bl, dl
je 0x429c85
push 4
push ebx
push dword [ebp + 8]
call fcn.00418324
mov esi, eax
movsx eax, byte [edi]
push eax
call fcn.004b0e83
and byte [esi + 3], 0
push esi
push dword [ebp + 0xc]
mov byte [esi], al
push dword [ebp + 0x14]
mov byte [esi + 1], 0x3a
push dword [ebp + 8]
mov byte [esi + 2], 0x5c
call fcn.0049beee
add esp, 0x20
mov dword [ebp - 4], ebx
pop esi
push edi
call fcn.004183b6
cmp dword [ebp - 4], 0
pop ecx
pop edi
jne 0x429c99
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop ebx
leave
ret

Function at 0x42a985
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
xor edi, edi
xor esi, esi
cmp dword [esp + 0x10], edi
jbe 0x42a9bb
mov eax, dword [esp + 0xc]
movzx eax, word [eax + esi*2]
push eax
call fcn.004b1800
pop ecx
mov ecx, edi
shr ecx, 9
xor ecx, edi
movzx eax, ax
shr ecx, 7
xor eax, ecx
shl edi, 5
xor edi, eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x42a991
mov eax, edi
pop edi
pop esi
ret

Function at 0x42d859
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
push pe_nt_image_headers32
push 1
push dword [ebp + 8]
call fcn.00418324
xor edi, edi
add esp, 0xc
cmp dword [ebp + 0x10], edi
mov esi, eax
je 0x42d949
push dword [ebp + 0x10]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call ebx
cmp eax, 0xffffffff
jne 0x42d8a6
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x42d949
push 0x105
lea eax, [ebp - 0x10c]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.004af490
add esp, 0xc
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x10c]
push eax
mov edi, 0x104
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
push edi
lea eax, [ebp - 0x10c]
push esi
push eax
call fcn.0042d736
push esi
call fcn.004af4f0
push esi
mov edi, eax
call fcn.0042d835
add esp, 0x14
test eax, eax
jne 0x42d90e
lea eax, [edi + esi - 1]
mov cl, byte [eax]
cmp cl, 0x5c
je 0x42d90b
cmp cl, 0x2f
jne 0x42d90e
and byte [eax], 0
push esi
call ebx
mov edi, dword [ebp + 8]
shr eax, 4
and eax, 1
push str.Folder
push edi
mov dword [esi + 0x104], eax
call fcn.004287bf
shl eax, 4
add eax, dword [edi + 0x42c]
push esi
mov eax, dword [eax + 8]
push dword [eax + 4]
push dword [ebp + 0xc]
push edi
call fcn.0049beee
add esp, 0x18
jmp 0x42d959
push esi
call fcn.004183b6
mov eax, dword [ebp + 0xc]
pop ecx
mov dword [eax], 1
pop edi
pop esi
pop ebx
leave
ret