joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100356e7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov eax, dword [esi + 0x20]
push 0xfffffffffffffff0
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp al, 0xb
mov ebx, dword [esp + 0x10]
jne case.0x100356e0.14
cmp dword [ebx + 4], 0x100
jne case.0x100356e0.14
mov eax, dword [ebx + 8]
lea ecx, [eax - 0xd]
cmp ecx, 0x1b
ja case.0x100356e0.14
movzx ecx, byte [ecx + 0x10035838]
jmp dword [ecx*4 + 0x10035828]
mov ecx, esi
call sub.MFC80U.DLL_Ordinal_3395
test eax, 0x1000
jne 0x10035702
cmp dword [esi + 0xdc], 0
jne case.0x100356e0.14
mov eax, dword [esi + 0xdc]
cmp eax, 4
jne 0x1003574d
mov edx, dword [esi + 0x20]
push 0
push 1
push 0xf1
push edx
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esi + 0x20]
push eax
mov ecx, esi
call sub.MFC80U.DLL_Ordinal_2648
movzx edx, ax
push edx
push 0x111
mov ecx, esi
call fcn.10012140
mov ecx, eax
call fcn.100067b0
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
cmp eax, 2
jne 0x1003576b
mov ecx, dword [esi + 0x20]
xor eax, eax
cmp dword [esi + 0xd8], eax
push 0
sete al
push eax
push 0xf1
push ecx
jmp 0x1003571a
test eax, eax
jne 0x10035720
push 0x20
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jge 0x10035720
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
cmp dword [esi + 0xdc], 0
jne case.0x100356e0.14
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0xd
call edi
test ax, ax
jl 0x1003577c
push 0x20
call edi
test ax, ax
jge case.0x100356e0.14
pop edi
pop esi
mov eax, 1
pop ebx
ret 4
cmp dword [esi + 0xdc], 4
jne case.0x100356e0.14
cmp eax, 0x26
je 0x100357ce
cmp eax, 0x25
je 0x100357ce
xor eax, eax
jmp 0x100357d3
mov eax, 1
push eax
push esi
mov ecx, esi
call fcn.10012140
mov ecx, eax
call fcn.10035460
push 0
push 1
mov edi, eax
mov eax, dword [edi + 0x20]
push 0xf1
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [edi + 0x20]
push eax
mov ecx, edi
call sub.MFC80U.DLL_Ordinal_2648
movzx ecx, ax
push ecx
push 0x111
mov ecx, esi
call fcn.10012140
mov ecx, eax
call fcn.100067b0
push ebx
mov ecx, esi
call fcn.10031b20
pop edi
pop esi
pop ebx
ret 4
Function at 0x10036930
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x100463ea
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x1006c318]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x10], esi
mov eax, dword [sym.imp.MFC80U.DLL_Ordinal_577]
mov ecx, dword [sym.imp.MFC80U.DLL_Ordinal_293]
push eax
push ecx
push 2
push 4
push esi
call fcn.1003ec0c
push 0x10008aa0
push 0x10036010
push 2
push 4
lea edi, [esi + 8]
push edi
mov dword [esp + 0x30], 0
call fcn.1003ec0c
push str.NoImage
lea ecx, [esi + 4]
mov byte [esp + 0x20], 1
call dword [sym.imp.MFC80U.DLL_Ordinal_776]
push eax
mov ecx, esi
call dword [sym.imp.MFC80U.DLL_Ordinal_774]
mov eax, dword [edi]
xor ecx, ecx
test eax, eax
mov dword [esp + 0xc], ecx
je 0x100369c7
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov dword [edi], 0
je 0x100369d9
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, dword [esi + 0xc]
xor ecx, ecx
test eax, eax
mov dword [esp + 0xc], ecx
je 0x100369f4
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx]
push 1
call eax
mov ecx, dword [esp + 0xc]
test ecx, ecx
mov dword [esi + 0xc], 0
je 0x10036a07
mov edx, dword [ecx]
mov eax, dword [edx]
push 1
call eax
mov eax, esi
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0x14
ret

Function at 0x10038380
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 4], 0x100
jne 0x100383a0
mov edx, dword [eax + 8]
add edx, 0xffffffdb
cmp edx, 3
ja 0x100383a0
mov eax, 1
ret 4
mov dword [esp + 4], eax
jmp method.CImgButton.virtual_264
Function at 0x1003aa50
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
push esi
push edi
mov edi, dword [esp + 0x14]
push 5
push edi
mov dword [esp + 0x10], 0
call sub.MFC80U.DLL_Ordinal_1058
push 5
mov esi, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [esp + 0x18]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, dword [esp + 0x14]
push eax
push esi
call fcn.1003a830
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ecx
ret
Function at 0x1003e9c6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006c318]
jne 0x1003e9d0
repz ret
jmp fcn.1003f168
Function at 0x10003100
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000312c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x10003154
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000315a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x100031c2
jg 0x10003171
test esi, esi
je 0x100031c2
test ecx, ecx
jl 0x100031bd
jg 0x1000317b
test eax, eax
je 0x100031bd
cmp edi, ecx
jg 0x1000318f
jl 0x10003185
cmp esi, eax
jae 0x1000318f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x100031c5
mov ecx, dword [ebp + 8]
jmp 0x100031cf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x100031e9
jg 0x100031cf
test esi, esi
je 0x100031e9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x100031e9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003200
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x1000322c
jl 0x10003220
test ecx, ecx
jne 0x1000322c
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x10003245
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x10003293
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x10003299
mov edi, dword [ebp - 4]
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push edi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
add edi, esi
mov dword [ebp - 4], edi
add esp, 0xc
mov edi, dword [ebp + 0xc]
sub edi, esi
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x10003299
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x10003306
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x100032c2
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x100032f4
nop
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x10003306
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x100032d0
test edi, edi
je 0x10003306
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10003680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x100036b0
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100050bf
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x100036e0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x100036e0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100050bf
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x100037b8
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x10003709
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x10003715
movsx eax, bl
jmp 0x1000374d
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x25], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x25]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x10003777
sub eax, 1
je 0x10003777
sub eax, 2
jne 0x100037b8
movsx eax, byte [ebp - 0x25]
push dword [esi + 0x4c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100050bf
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10003795
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x100037b8
lea ecx, [ebp - 0x25]
mov byte [esi + 0x3d], 1
or eax, 0xffffffff
cmp dword [ebp - 0x30], ecx
pop edi
pop esi
cmovne eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100050bf
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100050bf
mov esp, ebp
pop ebp
ret 4
Function at 0x10003c40
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10003cfc
cmp byte [esi + 0x3d], 0
je 0x10003cfc
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10003cea
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10003cb1
sub eax, 1
je 0x10003cb5
sub eax, 2
jne 0x10003cea
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100050bf
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10003cd3
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10003cea
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100050bf
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100050bf
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.100050bf
mov esp, ebp
pop ebp
ret

Function at 0x10005def
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.10005dcb
pop esi
leave
ret 8
Function at 0x6203c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x195000]
push edi
jmp 0x6203da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6203e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6203d0
mov eax, 1
add ebx, ebx
jne 0x6203f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x620404
jne 0x620423
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x620423
dec eax
add ebx, ebx
jne 0x620410
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6203e8
add ebx, ebx
jne 0x62041f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x620475
xor ecx, ecx
sub eax, 3
jb 0x62043b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6204aa
sar eax, 1
mov ebp, eax
jmp 0x620446
add ebx, ebx
jne 0x620446
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x620414
inc ecx
add ebx, ebx
jne 0x620454
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x620414
add ebx, ebx
jne 0x620461
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x620456
jne 0x620472
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x620456
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x620494
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x620486
jmp 0x6203d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x620494
add edi, ecx
jmp 0x6203d6
pop esi
mov edi, esi
mov ecx, 0x62d3
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6204b2
cmp byte [edi], 0xe
jne 0x6204b2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6204b7
lea edi, [esi + 0x214000]
mov eax, dword [edi]
or eax, eax
je 0x62052f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2b2564]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2b2758]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6204e4
mov ecx, edi
jns 0x620513
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2b2760]
or eax, eax
je 0x620529
mov dword [ebx], eax
add ebx, 4
jmp 0x620501
call dword [esi + 0x2b275c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x620560
cmp al, 0xef
ja 0x620553
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x620535
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x620542
mov ebp, dword [esi + 0x2b2764]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x257]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x620594
sub esp, 0xffffff80
jmp 0x4e2599
Function at 0x4014f0
Capabilities:
Check if file exists
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41f725
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x430098]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
cmp dword [esi + 0x14], 8
mov eax, esi
mov byte [ebp - 4], 1
jb 0x40153e
mov eax, dword [esi]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x401640
lea eax, [ebp - 0x14]
push eax
push 0x422270
push 1
push 0
push 0x4268d4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x401640
cmp dword [esi + 0x2c], 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x50]
lea ecx, [esi + 0x18]
jb 0x401580
mov ecx, dword [ecx]
push ecx
push eax
call edx
test eax, eax
js 0x401640
cmp dword [esi + 0x44], 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
lea ecx, [esi + 0x30]
jb 0x40159f
mov ecx, dword [ecx]
push ecx
push eax
call edx
test eax, eax
js 0x401640
cmp dword [esi + 0x5c], 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x44]
lea ecx, [esi + 0x48]
jb 0x4015be
mov ecx, dword [ecx]
push dword [esi + 0x60]
push ecx
push eax
call edx
test eax, eax
js 0x401640
mov eax, dword [ebp - 0x14]
push dword [esi + 0x64]
push eax
mov ecx, dword [eax]
call dword [ecx + 0x3c]
test eax, eax
js 0x401640
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x34]
movzx ecx, word [esi + 0x68]
push ecx
push eax
call edx
test eax, eax
js 0x401640
cmp dword [esi + 0x80], 8
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
lea ecx, [esi + 0x6c]
jb 0x401603
mov ecx, dword [ecx]
push ecx
push eax
call edx
test eax, eax
js 0x401640
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x18]
push edx
push 0x422280
push eax
mov ecx, dword [eax]
mov byte [ebp - 4], 2
call dword [ecx]
mov byte [ebp - 4], 1
test eax, eax
js 0x401640
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x401643
cmp dword [esi + 0x14], 8
mov ecx, dword [eax]
jb 0x401639
mov esi, dword [esi]
push 1
push esi
push eax
call dword [ecx + 0x18]
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 3
test eax, eax
je 0x401651
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 4
test eax, eax
je 0x401665
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040ae95
mov esp, ebp
pop ebp
ret
Function at 0x4044da
Capabilities:
Check if file exists
Delete file
Print debug messages

Disassembly:
push 0x70
mov eax, 0x41fd26
call fcn.0040b3d5
mov edi, ecx
mov dword [ebp - 0x78], edi
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push ebx
mov edx, 0x4224fc
call fcn.00403b7c
and dword [ebp - 4], 0
mov edx, eax
push 0x4224f8
lea ecx, [ebp - 0x40]
call fcn.00403a95
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004046d5
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebx + 0x14], 8
mov eax, ebx
jb 0x404537
mov eax, dword [ebx]
push dword [ebx + 0x10]
lea ecx, [ebp - 0x28]
push eax
call fcn.00407ab6
mov byte [ebp - 4], 3
cmp dword [eax + 0x14], 8
jb 0x40454f
mov eax, dword [eax]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
call fcn.004046d5
test esi, esi
jne 0x40456f
mov ecx, ebx
call fcn.00408383
lea esi, [edi + 0x30]
mov dword [ebp - 0x74], esi
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 4]
mov byte [ebp - 4], 4
add edi, 0x4c
push ebx
mov ecx, edi
call fcn.00404285
mov eax, dword [ebp - 0x78]
xor ebx, ebx
cmp dword [eax + 0x5c], ebx
je 0x404682
cmp byte [ebp + 0xc], bl
je 0x4045af
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x4045a8
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x2d
push dword [ebp - 0x74]
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x28]
push 0x50
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
call fcn.00403dbb
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x7c]
call fcn.0040945e
lea ecx, [ebp - 0x70]
push ecx
mov ecx, eax
call fcn.004094da
mov byte [ebp - 4], 6
mov edx, eax
push 0x4224f8
lea ecx, [ebp - 0x58]
call fcn.00403a95
mov byte [ebp - 4], 7
cmp dword [eax + 0x14], 8
mov ecx, dword [eax + 0x10]
jb 0x40460d
mov eax, dword [eax]
push ecx
push eax
lea ecx, [ebp - 0x28]
call fcn.00403640
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x58]
call fcn.004046d5
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x70]
call fcn.004046d5
mov edx, edi
lea ecx, [ebp - 0x28]
call fcn.004043df
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x14]
cmp edx, 8
jb 0x404672
mov ecx, dword [ebp - 0x28]
lea edx, [edx*2 + 2]
mov eax, ecx
cmp edx, 0x1000
jb 0x404669
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4046a1
push edx
push ecx
call fcn.0040ae87
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 2
mov ecx, esi
mov eax, dword [esi]
call dword [eax + 8]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.004046d5
call fcn.0040b37f
ret 8
call fcn.0040eaba
int3
Function at 0x404c4e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41fe5b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x430098]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0x10]
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x404cd5
cmp dword [ebp + 0x10], 1
je 0x404caa
cmp dword [ebp + 0x10], 2
jne 0x404cc5
mov ecx, dword [ebp - 0x10]
test esi, esi
je 0x404ccf
test ecx, ecx
je 0x404cca
test cl, 1
jne 0x404cc5
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x404ccf
push 0xd
pop eax
jmp 0x404cd5
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0xc