joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e621
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44ebd3
mov eax, dword fs:[0]
push eax
push ecx
mov eax, 0x8888
call fcn.00442eb0
mov eax, dword [0x46a2c8]
xor eax, esp
mov dword [esp + 0x8884], eax
push esi
push edi
mov eax, dword [0x46a2c8]
xor eax, esp
push eax
lea eax, [esp + 0x8898]
mov dword fs:[0], eax
xor eax, eax
push 0x7fe
mov word [esp + 0x90], ax
xor esi, esi
lea eax, [esp + 0x92]
mov edi, ecx
push esi
push eax
mov dword [esp + 0x34], edi
call fcn.004345b0
add esp, 0xc
mov eax, dword [edi]
lea ecx, [esp + 0x40]
push ecx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x3c]
push ecx
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x38]
push ecx
lea ecx, [esp + 0x4c]
push ecx
push esi
lea ecx, [esp + 0x48]
push ecx
lea ecx, [esp + 0xb4]
push ecx
push eax
mov dword [esp + 0x54], 0x400
mov dword [esp + 0x60], esi
mov dword [esp + 0x50], esi
mov dword [esp + 0x6c], esi
mov dword [esp + 0x40], esi
mov dword [esp + 0x5c], esi
mov dword [esp + 0x64], esi
mov dword [esp + 0x68], esi
mov dword [esp + 0x48], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x40e703
xor al, al
jmp 0x40e7b8
cmp dword [esp + 0x10], esi
je 0x40e6fc
mov dword [esp + 0x14], esi
jbe 0x40e7b6
push esi
push esi
push esi
push esi
lea ecx, [esp + 0x28]
push ecx
lea ecx, [esp + 0x8a0]
xor eax, eax
push ecx
push dword [esp + 0x2c]
mov word [esp + 0x8a8], ax
mov eax, dword [edi]
push eax
mov dword [esp + 0x38], 0x3fff
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x40e7a4
lea eax, [esp + 0x88c]
push eax
lea eax, [esp + 0x20]
push eax
call fcn.0040890f
mov dword [esp + 0x88a0], esi
mov edi, dword [ebx + 0x14]
lea eax, [esp + 0x1c]
push eax
push dword [edi + 4]
push edi
call fcn.004101d8
mov ecx, dword [ebx + 0x18]
mov edx, 0x3fffffff
sub edx, ecx
cmp edx, 1
jb 0x40e7db
inc ecx
mov dword [ebx + 0x18], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
or dword [esp + 0x88a0], 0xffffffff
mov dword [ecx], eax
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
call fcn.0040117e
mov edi, dword [esp + 0x28]
inc dword [esp + 0x14]
mov eax, dword [esp + 0x14]
cmp eax, dword [esp + 0x10]
jb 0x40e713
mov al, 1
mov ecx, dword [esp + 0x8898]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [esp + 0x8884]
xor ecx, esp
call fcn.004312e6
mov esp, ebp
pop ebp
ret
push str.list_T__too_long
lea ecx, [esp + 0x74]
call fcn.00408a63
lea eax, [esp + 0x70]
push eax
lea ecx, [esp + 0x4c]
mov byte [esp + 0x88a4], 1
call fcn.00401250
push 0x462c7c
lea eax, [esp + 0x4c]
push eax
mov dword [esp + 0x50], vtable.std::length_error.0
call fcn.004348ab
int3
Function at 0x40eae6
Capabilities:
Query environment variable

Disassembly:
push ebp
sub esp, 0x800
lea ebp, [esp - 4]
mov eax, dword [0x46a2c8]
xor eax, ebp
mov dword [ebp + 0x800], eax
push 0x10
mov eax, 0x44eb95
call fcn.00434cdd
and dword [ebp - 0x18], 0
mov esi, ecx
mov dword [ebp - 0x1c], esi
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp + 0x80c]
add eax, 0xfffffff0
call fcn.0040d0b9
lea edi, [eax + 0x10]
mov dword [esi], edi
xor eax, eax
push 0x7fe
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
mov dword [ebp - 0x18], ebx
call fcn.004345b0
mov edi, dword [edi - 0xc]
add esp, 0xc
mov dword [ebp - 0x10], edi
test edi, edi
je 0x40ebcd
mov edi, 0x459d68
push edi
xor ecx, ecx
call fcn.0040c5c7
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40ebcd
mov eax, dword [ebp - 0x10]
dec eax
cmp ebx, eax
je 0x40ebcd
lea ecx, [ebx + 1]
push edi
call fcn.0040c5c7
mov ecx, eax
lea eax, [ebp - 0x10]
sub ecx, ebx
push eax
inc ecx
mov edx, ebx
mov eax, esi
call fcn.0040c63f
push 0x400
lea eax, [ebp]
mov byte [ebp - 4], 2
mov edi, dword [ebp - 0x10]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [ebp]
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0040890f
mov byte [ebp - 4], 3
push dword [ebp - 0x14]
push edi
push esi
call fcn.0040fe83
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040117e
lea eax, [edi - 0x10]
call fcn.0040117e
mov eax, dword [ebp + 0x80c]
add eax, 0xfffffff0
call fcn.0040117e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x800]
xor ecx, ebp
call fcn.004312e6
add ebp, 0x804
leave
ret

Function at 0x40ec5f
Capabilities:
Check if file exists

Disassembly:
push 8
mov eax, 0x4501c0
call fcn.00434cdd
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
push dword [ebp + 8]
push eax
call fcn.0040890f
lea ecx, [ebp - 0x14]
call fcn.0040eae6
pop ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
push dword [eax]
lea eax, [ebp - 0x10]
push eax
call fcn.0040890f
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040117e
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40ecba
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40ecba
mov bl, 1
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040117e
mov al, bl
call fcn.00434db5
ret
Function at 0x40eccd
Capabilities:
Get common file path

Disassembly:
push 0x10
mov eax, 0x44eb46
call fcn.00434d10
mov ebx, dword [ebp + 8]
xor esi, esi
push 0x454ad8
mov dword [ebp - 4], esi
push ebx
mov dword [ebp - 0x18], esi
call fcn.0040890f
push esi
mov dword [ebp - 4], esi
xor edi, edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
inc edi
mov dword [ebp - 0x18], edi
call esi
xor ecx, ecx
push 2
pop edx
mov dword [ebp - 0x1c], eax
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004303a4
pop ecx
mov dword [ebp - 0x14], eax
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 4], edi
mov byte [ebp - 4], 2
call esi
test eax, eax
je 0x40ed37
push dword [ebp - 0x14]
push ebx
call fcn.00408956
mov eax, dword [ebx]
push 0x5c
push eax
call fcn.00432542
pop ecx
pop ecx
test eax, eax
jne 0x40ed4c
or eax, 0xffffffff
jmp 0x40ed50
sub eax, dword [ebx]
sar eax, 1
mov ecx, dword [ebx]
mov ecx, dword [ecx - 0xc]
dec ecx
cmp eax, ecx
je 0x40ed70
push 0x459d5c
push ebx
call fcn.0040d088
jmp 0x40ed70
push dword [ebp - 0x14]
call fcn.004312db
pop ecx
mov eax, ebx
call fcn.00434db5
ret

Function at 0x40ed81
Capabilities:
Create directory

Disassembly:
push 0x10
mov eax, 0x45019d
call fcn.00434cdd
lea eax, [ebp - 0x10]
xor edi, edi
push eax
mov dword [ebp - 0x18], edi
call fcn.0040eccd
pop ecx
lea esi, [ebp - 0x14]
mov dword [ebp - 4], edi
call fcn.00423db8
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x14]
cmp dword [eax - 0xc], edi
jne 0x40edec
push ecx
mov eax, esp
mov dword [ebp - 0x1c], esp
push 0x459d6c
push eax
call fcn.0040890f
lea eax, [ebp - 0x1c]
push eax
call fcn.0040f5fc
pop ecx
pop ecx
mov edi, esi
mov byte [ebp - 4], 2
call fcn.0040c54a
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.0040117e
mov eax, dword [ebp - 0x14]
push dword [eax - 0xc]
push eax
lea eax, [ebp - 0x10]
call fcn.0040d369
push 0x459d5c
lea eax, [ebp - 0x10]
push eax
call fcn.0040d088
push dword [ebp - 0x10]
lea eax, [ebp - 0x18]
push eax
call fcn.0040890f
mov byte [ebp - 4], 3
push dword [ebp - 0x18]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40ee3e
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40ee3e
push 0x454ad8
push ebx
call fcn.0040890f
jmp 0x40ee4e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040d0b9
add eax, 0x10
mov dword [ebx], eax
mov eax, dword [ebp - 0x18]
add eax, 0xfffffff0
call fcn.0040117e
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040117e
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.0040117e
mov eax, ebx
call fcn.00434db5
ret
Function at 0x40f8eb
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.00442eb0
mov eax, dword [0x46a2c8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x3c
push 0
push esi
call fcn.004345b0
lea eax, [ebp - 0x2004]
mov dword [esi + 0x10], eax
add esp, 0xc
mov eax, 0x1000
lea ecx, [ebp - 0x4004]
mov dword [esi], 0x3c
mov dword [esi + 0x14], eax
mov dword [esi + 0x2c], ecx
mov dword [esi + 0x30], eax
mov eax, dword [edi]
mov ecx, dword [eax - 0xc]
push esi
push 0
push ecx
push eax
call dword [sym.imp.WININET.dll_InternetCrackUrlW]
mov ecx, dword [ebp - 4]
neg eax
sbb eax, eax
xor ecx, ebp
neg eax
call fcn.004312e6
leave
ret

Function at 0x410265
Capabilities:
Read file on windows

Disassembly:
push 0
push dword [esp + 0xc]
push 0x100
push dword [esp + 0x10]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x410287
call fcn.00409e43
jmp 0x410289
xor eax, eax
ret 8

Function at 0x4148e9
Capabilities:
Log keystrokes via polling

Disassembly:
push 0x20
mov eax, 0x44d1db
call fcn.00434cdd
cmp esi, 0x25
je 0x41496a
cmp esi, 0x27
je 0x41496a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 8
test al, al
je 0x414918
cmp esi, 0x46
je 0x41496a
cmp esi, 0x50
je 0x41496a
cmp esi, 0x74
je 0x41496a
and dword [ebp - 0x10], 0
and dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
push 0x45a844
add eax, 0x4c
push eax
lea ebx, [ebp - 0x10]
mov dword [ebp - 0x24], esi
call fcn.00414f93
test eax, eax
jl 0x414959
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
lea edx, [ebp - 0x2c]
push edx
push eax
call dword [ecx + 0x14]
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x41496a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
call fcn.00434db5
ret 0xc
Function at 0x414d99
Capabilities:
Delete registry value

Disassembly:
push 0x10
mov eax, 0x44fffb
call fcn.00434cdd
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
push ecx
mov dword [ebp - 4], ebx
mov eax, esp
mov dword [ebp - 0x14], esp
push str.U29mdHdhcmVcXE1pY3Jvc29mdFxcSW50ZXJuZXQgRXhwbG9yZXJcXFN0eWxlcw
push eax
mov esi, 0xf003f
call fcn.0040890f
lea eax, [ebp - 0x14]
push eax
call fcn.0040f5fc
pop ecx
pop ecx
push dword [eax]
mov eax, esi
push SysReAllocString
lea ecx, [ebp - 0x1c]
call fcn.0040d974
test eax, eax
mov eax, dword [ebp - 0x14]
setne byte [ebp - 0xd]
add eax, 0xfffffff0
call fcn.0040117e
cmp byte [ebp - 0xd], bl
je 0x414e0a
lea esi, [ebp - 0x1c]
call fcn.0040d91c
xor al, al
call fcn.00434db5
ret 4
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x48]
cmp eax, ebx
je 0x414e5e
push eax
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.TWF4U2NyaXB0U3RhdGVtZW50cw
push eax
call fcn.0040890f
lea eax, [ebp - 0x14]
push eax
call fcn.0040f5fc
pop ecx
pop ecx
push dword [eax]
lea eax, [ebp - 0x1c]
push eax
call fcn.0040da55
test eax, eax
mov eax, dword [ebp - 0x14]
setne byte [ebp + 0xb]
add eax, 0xfffffff0
call fcn.0040117e
cmp byte [ebp + 0xb], bl
jne 0x414df8
lea esi, [ebp - 0x1c]
call fcn.0040d91c
mov bl, 1
jmp 0x414e9b
push ecx
mov eax, esp
mov dword [ebp + 8], esp
push str.TWF4U2NyaXB0U3RhdGVtZW50cw
push eax
call fcn.0040890f
lea eax, [ebp - 0x14]
push eax
call fcn.0040f5fc
pop ecx
pop ecx
push dword [eax]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
mov eax, dword [ebp - 0x14]
setne byte [ebp + 0xb]
add eax, 0xfffffff0
call fcn.0040117e
cmp byte [ebp + 0xb], bl
je 0x414e52
lea esi, [ebp - 0x1c]
call fcn.0040d91c
mov al, bl
jmp 0x414e02
Function at 0x416f74
Capabilities:
Write file on windows

Disassembly:
push 0x90
mov eax, 0x450798
call fcn.00434d10
mov esi, dword [ebp + 8]
lea edi, [esi + 4]
xor ebx, ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esi], 0xffffffff
jne 0x416fa0
push edi
jmp 0x417068
mov byte [ebp - 4], 1
push dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
push ecx
add eax, 0xfffffff0
mov dword [ebp + 0x14], esp
mov edi, esp
call fcn.0040d0b9
push dword [ebp + 0xc]
add eax, 0x10
mov dword [edi], eax
lea eax, [ebp - 0x14]
push eax
call fcn.00416dba
push 0xfde9
mov byte [ebp - 4], 2
push dword [ebp - 0x14]
lea eax, [ebp - 0x98]
mov dword [ebp - 0x9c], eax
lea eax, [ebp - 0x9c]
push eax
call fcn.00409062
lea eax, [ebp + 0x14]
mov byte [ebp - 4], 3
mov ecx, dword [ebp - 0x9c]
push eax
call fcn.0040c496
lea eax, [ebp - 0x98]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x9c], eax
je 0x41701e
push dword [ebp - 0x9c]
call fcn.004314e1
pop ecx
push 0x45a99c
lea eax, [ebp + 0x14]
push eax
call fcn.0040c507
push ebx
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], ebx
push dword [eax - 0xc]
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 0x14]
add eax, 0xfffffff0
call fcn.0040117e
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.0040117e
jmp 0x417064
add esi, 4
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp + 0x10]
add eax, 0xfffffff0
call fcn.0040117e
call fcn.00434db5
ret 0x10
Function at 0x421c15
Capabilities:
Parse credit card information

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, eax
mov ecx, dword [esi + 0x40]
push edi
mov edi, 0xffff
xor al, al
mov bl, 1
cmp ecx, edi
je 0x421db1
mov ebp, 0x10000000
cmp ecx, 0x7c
je 0x421db1
cmp ecx, 0x29
jne 0x421c5f
cmp dword [esi + 0x10], 0
jne 0x421db1
test dword [esi + 0x44], ebp
jne 0x421c5f
push 5
call fcn.004304f8
pop ecx
jmp 0x421d9b
cmp ecx, 0x2e
jne 0x421c7b
push 5
lea eax, [esi + 0x18]
push eax
call fcn.00421e96
mov eax, esi
call fcn.00421be9
jmp 0x421d9b
cmp ecx, 0x5c
jne 0x421cdc
mov eax, esi
call fcn.00421be9
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x421caf
cmp word [esi + 0x3e], 0x62
jne 0x421caf
push 4
lea eax, [esi + 0x18]
push eax
call fcn.00421e96
mov eax, esi
call fcn.00421be9
jmp 0x421da2
test eax, eax
je 0x421cd0
cmp word [esi + 0x3e], 0x42
jne 0x421cd0
push 4
lea eax, [esi + 0x18]
push eax
call fcn.00421e96
mov eax, dword [esi + 0x1c]
add eax, 8
or dword [eax], 1
jmp 0x421ca3
mov eax, esi
call fcn.0042264a
jmp 0x421d9b
cmp ecx, 0x5b
jne 0x421d06
mov eax, esi
call fcn.00421be9
mov eax, esi
call fcn.004225ff
cmp dword [esi + 0x40], 0x5d
je 0x421c6f
push 4
call fcn.004304f8
pop ecx
jmp 0x421c6f
cmp ecx, 0x28
jne 0x421d30
mov eax, esi
call fcn.00421be9
call fcn.0042271c
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x421d27
push 5
call fcn.004304f8
pop ecx
mov eax, esi
call fcn.00421be9
jmp 0x421d97
cmp ecx, 0x5e
jne 0x421d3c
push 2
jmp 0x421c9a
cmp ecx, 0x24
jne 0x421d48
push 3
jmp 0x421c9a
cmp ecx, 0x2a
je 0x421d8f
cmp ecx, 0x2b
je 0x421d8f
cmp ecx, 0x3f
je 0x421d8f
cmp ecx, 0x7b
je 0x421d8f
cmp ecx, 0x7d
jne 0x421d6d
test dword [esi + 0x44], ebp
jne 0x421d6d
push 6
jmp 0x421c54
cmp ecx, 0x5d
jne 0x421d7e
test dword [esi + 0x44], ebp
jne 0x421d7e
push 4
jmp 0x421c54
mov ax, word [esi + 0x3e]
lea ecx, [esi + 0x18]
call fcn.004228b2
jmp 0x421c6f
push 0xa
call fcn.004304f8
pop ecx
test bl, bl
je 0x421da2
mov eax, esi
call fcn.004227ea
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, edi
jne 0x421c35
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x43018e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x46c8e0], 0
push esi
jne 0x430101
call fcn.00430027
test eax, eax
je 0x430144
mov eax, dword [0x46c8e0]
cmp eax, 1
jne 0x430122
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x430144
pop esi
ret
push eax
call dword [0x46c8e8]
test eax, eax
jne 0x43018c
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x430148
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x46c8e0]
call dword [0x46c8e8]
mov edi, eax
test edi, edi
je 0x43016d
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x430189
mov edi, esi
add esi, 0xff0
push edi
push dword [0x46c8e0]
call dword [0x46c8e4]
add edi, 0x10
cmp edi, esi
jb 0x430175
mov eax, edi
pop edi
pop esi
ret
jmp 0x4300ee

Function at 0x4312e6
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46a2c8]
jne 0x4312f0
repz ret
jmp fcn.00439a7b

Function at 0x445f9a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0043b048
and dword [ebp - 4], 0
cmp dword [0x46d5c0], 0
mov ebx, eax
jne 0x44604b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4460fc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4460fc
push eax
call fcn.0043afd6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x46d5c0], eax
call esi
push eax
call fcn.0043afd6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x46d5c4], eax
call esi
push eax
call fcn.0043afd6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x46d5c8], eax
call esi
push eax
call fcn.0043afd6
pop ecx
mov dword [0x46d5d0], eax
test eax, eax
je 0x44604b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0043afd6
pop ecx
mov dword [0x46d5cc], eax
mov eax, dword [0x46d5cc]
cmp eax, ebx
je 0x4460a3
cmp dword [0x46d5d0], ebx
je 0x4460a3
push eax
call fcn.0043b051
push dword [0x46d5d0]
mov esi, eax
call fcn.0043b051
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4460a3
test edi, edi
je 0x4460a3
call esi
test eax, eax
je 0x44609a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x44609a
test byte [ebp - 0xc], 1
jne 0x4460a3
or dword [ebp + 0x10], 0x200000
jmp 0x4460dc
mov eax, dword [0x46d5c4]
cmp eax, ebx
je 0x4460dc
push eax
call fcn.0043b051
pop ecx
test eax, eax
je 0x4460dc
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4460dc
mov eax, dword [0x46d5c8]
cmp eax, ebx
je 0x4460dc
push eax
call fcn.0043b051
pop ecx
test eax, eax
je 0x4460dc
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x46d5c0]
call fcn.0043b051
pop ecx
test eax, eax
je 0x4460fc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4460fe
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x434d50
Capabilities:
Create directory
Delete directory

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0xa30
push edi
mov edi, dword [esp + 0xa3c]
lea eax, [esp + 4]
push eax
lea ecx, [esp + 0x830]
push ecx
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x434dea
lea eax, [esp + 0x82c]
push eax
lea ecx, [esp + 0x10]
push 0x48a270
push ecx
call fcn.0041353a
lea edx, [esp + 0x18]
push edx
call fcn.004112d5
add esp, 0x10
cmp word [esp + eax*2 + 0xa], 0x5c
jne 0x434dd4
lea eax, [esp + 0xc]
push eax
call fcn.004112d5
add esp, 4
cmp word [esp + eax*2 + 8], 0x3a
je 0x434dd4
lea ecx, [esp + 0xc]
push ecx
call fcn.004112d5
add esp, 4
xor edx, edx
mov word [esp + eax*2 + 0xa], dx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x434df6
cmp byte [esp + 0xa40], al
jne 0x434df6
xor eax, eax
pop edi
add esp, 0xa30
ret 0xc
push esi
push 0
push 0x2200000
push 3
push 0
push 0
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x434eba
push 0x14
lea eax, [esp + 0x21c]
push 0
push eax
call fcn.004131f0
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x228], 0xa0000003
call fcn.004112d5
add eax, eax
mov word [esp + 0x232], ax
mov edx, dword [esp + 0x232]
push 0x104
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x240]
add edx, 2
push ecx
mov word [esp + 0x240], dx
call fcn.0041326a
mov eax, dword [esp + 0x23e]
add esp, 0x1c
push 0
add eax, 0xc
mov word [esp + 0x220], ax
lea edx, [esp + 0x10]
push edx
push 0
movzx eax, ax
push 0
add eax, 8
push eax
lea ecx, [esp + 0x22c]
push ecx
push 0x900a4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
test eax, eax
jne 0x434ece
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
xor eax, eax
pop edi
add esp, 0xa30
ret 0xc
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop edi
add esp, 0xa30
ret 0xc

Function at 0x434fa9
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [esp + 0x210]
push ecx
push 0
push 0x4876f0
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
add esp, 0x20c
ret 4

Function at 0x435152
Capabilities:
Read file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x464]
test eax, eax
je 0x435168
cmp eax, 0x10000
jne 0x43518c
mov eax, dword [esi + 0x1c]
mov ecx, dword [esi + 0x45c]
push eax
push 0x10000
push 1
push ecx
call fcn.004151b0
add esp, 0x10
mov dword [esi + 0x464], 0
mov ecx, dword [esi + 0x464]
mov edx, dword [esi + 0x45c]
mov al, byte [ecx + edx]
inc ecx
mov dword [esi + 0x464], ecx
pop esi
ret 4

Function at 0x4351a6
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x460]
test eax, eax
je 0x4351d5
mov ecx, dword [esi + 0x20]
mov edx, dword [esi + 0x458]
push ecx
push eax
push 1
push edx
call fcn.004146ce
add esp, 0x10
mov dword [esi + 0x460], 0
pop esi
ret 4
Function at 0x407470
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x7c6ee4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push 0x40
mov dword [ebp - 0x50], eax
mov esi, ecx
lea eax, [ebp - 0x44]
mov dword [ebp - 0x4c], edx
push 0
push eax
call fcn.0050c5b0
mov eax, dword [ebx]
add esp, 0xc
mov dword [ebp - 0x48], 0
test eax, eax
jne 0x4074b1
xor al, al
jmp 0x4074b4
mov al, byte [eax + 8]
movzx ecx, al
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], ecx
test eax, eax
je 0x4075a1
push edi
cmp eax, ecx
mov edi, ecx
cmovb edi, eax
mov eax, dword [ebx]
test eax, eax
je 0x407521
push dword [ebx + 4]
mov eax, dword [eax + 0x10]
call eax
mov eax, dword [ebx]
add esp, 4
test eax, eax
je 0x407521
push dword [ebp + 0xc]
mov eax, dword [eax + 0x14]
push dword [ebp - 0x50]
push dword [ebx + 4]
call eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x407521
mov eax, dword [eax + 0x14]
lea ecx, [ebp - 0x48]
push 4
push ecx
push dword [ebx + 4]
call eax
mov eax, dword [ebx]
add esp, 0xc
test eax, eax
je 0x407521
mov eax, dword [eax + 0x18]
lea ecx, [ebp - 0x44]
push ecx
push dword [ebx + 4]
call eax
add esp, 8
xor ecx, ecx
test edi, edi
je 0x40758c
cmp edi, 0x20
jb 0x40757a
lea edx, [esi - 1]
lea eax, [ebp + edi - 0x45]
add edx, edi
cmp esi, eax
ja 0x407540
lea eax, [ebp - 0x44]
cmp edx, eax
jae 0x40757a
mov eax, edi
and eax, 0xffffffe0
nop word [eax + eax]
movups xmm0, xmmword [esi]
movups xmm1, xmmword [ebp + ecx - 0x44]
pxor xmm1, xmm0
movups xmmword [esi], xmm1
movups xmm0, xmmword [esi + 0x10]
movups xmm1, xmmword [ebp + ecx - 0x34]
add ecx, 0x20
pxor xmm1, xmm0
movups xmmword [esi + 0x10], xmm1
add esi, 0x20
cmp ecx, eax
jb 0x407550
cmp ecx, edi
jae 0x40758c
nop
mov al, byte [ebp + ecx - 0x44]
inc ecx
xor byte [esi], al
inc esi
cmp ecx, edi
jb 0x407580
mov eax, dword [ebp - 0x4c]
inc byte [ebp - 0x45]
sub eax, edi
mov ecx, dword [ebp - 0x54]
mov dword [ebp - 0x4c], eax
jne 0x4074c6
pop edi
pop esi
mov eax, 0x40
lea ecx, [ebp - 0x44]
pop ebx
nop dword [eax + eax]
mov byte [ecx], 0
lea ecx, [ecx + 1]
sub eax, 1
jne 0x4075b0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0050b38b
mov esp, ebp
pop ebp
ret