joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a2da
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43ac12
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x128
mov dword [ebp - 0x130], ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x10]
push eax
push 0x20019
push 0
lea ecx, [ebp + 0xc]
call fcn.004014c0
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x42a452
mov dword [ebp - 0x120], 0x104
push 0x104
push 0
lea edx, [ebp - 0x11c]
push edx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x120]
push eax
lea ecx, [ebp - 0x11c]
push ecx
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
cmp eax, 0x103
je 0x42a448
lea ecx, [ebp - 0x11c]
push ecx
lea ecx, [ebp - 0x128]
call sub.MFC42.DLL_CString::CString_3
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x18]
add edx, 1
mov dword [ebp - 0x18], edx
push 0x104
push 0
lea eax, [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x44ce1c
lea ecx, [ebp + 0xc]
push ecx
lea edx, [ebp - 0x124]
push edx
call sub.MFC42.DLL_operator
mov byte [ebp - 4], 2
lea eax, [ebp - 0x128]
push eax
lea ecx, [ebp - 0x124]
call sub.MFC42.DLL_CString::operator_1
lea ecx, [ebp - 0x124]
push ecx
mov ecx, dword [ebp + 0x10]
call sub.MFC42.DLL_CStringList::AddTail
mov dword [ebp - 0x120], 0x104
mov edx, dword [ebp + 0x10]
push edx
push ecx
mov ecx, esp
mov dword [ebp - 0x12c], esp
lea eax, [ebp - 0x124]
push eax
call fcn.004355ce
mov dword [ebp - 0x134], eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x130]
call fcn.0042a2da
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x124]
call sub.MFC42.DLL_CString::CString
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x128]
call sub.MFC42.DLL_CString::CString
jmp 0x42a357
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x430964
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
cmp eax, 1
jne 0x43099b
lea edx, [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strcpy
add esp, 8
mov al, 1
jmp 0x43099d
xor al, al
mov esp, ebp
pop ebp
ret 8
Function at 0x40113b
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x43d1e4
call fcn.0041e498
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], edi
call fcn.004328b3
xor esi, esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], esi
mov dword [edi], method.CWnd.virtual_0
call fcn.00403987
lea eax, [ebp - 0x20]
push eax
call fcn.004011e5
mov ecx, eax
call fcn.004011d2
push esi
call fcn.004011e5
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
push esi
call fcn.004011e5
push dword [eax + 0x1c]
push esi
push esi
push esi
push esi
push 0x40000000
push str.BackWnd
push esi
push esi
push esi
push esi
call fcn.004339b9
push eax
push 0x28
mov ecx, edi
call fcn.00433281
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x403454
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push ebx
push esi
push edi
mov ebx, ecx
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x120]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x120]
push eax
xor eax, eax
push eax
push eax
push 0x8005
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edi, [ebp - 0x120]
or ecx, 0xffffffff
xor eax, eax
push 5
repne scasb al, byte es:[edi]
pop ecx
dec edi
mov esi, 0x44e2f0
lea eax, [ebp - 0x120]
push 0x44e304
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.004016a6
mov ecx, eax
call fcn.00401702
lea ecx, [ebp - 0x1c]
mov esi, eax
call fcn.00403987
lea eax, [ebp - 0x1c]
mov ecx, ebx
push eax
call fcn.004011d2
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x100], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x104], eax
mov al, byte [ebx + 0xd8]
mov byte [esi + 0x108], al
push dword [ebp - 0x1c]
lea eax, [ebp - 0xc]
push 0x44e310
push eax
call fcn.0041e8a9
add esp, 0xc
mov esi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x44e314
push 0x44e31c
call esi
push dword [ebp - 0x18]
lea eax, [ebp - 0xc]
push 0x44e324
push eax
call fcn.0041e8a9
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x44e328
push 0x44e330
call esi
push dword [ebx + 0xd8]
lea eax, [ebp - 0xc]
push 0x44e338
push eax
call fcn.0041e8a9
add esp, 0xc
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x44e33c
push 0x44e344
call esi
mov ecx, ebx
call fcn.00405942
pop edi
pop esi
pop ebx
leave
ret
Function at 0x409dd0
Capabilities:
Print debug messages
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
push edi
mov esi, ecx
push str.OnBack
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, dword [esi + 0x614]
add esi, 0x614
xor ebx, ebx
cmp eax, ebx
je 0x409e0e
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x409e0e
push dword [esi]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0x7d
xor eax, eax
pop ecx
lea edi, [ebp - 0x200]
rep stosd dword es:[edi], eax
push 0x4551d4
lea eax, [ebp - 0x200]
push 0x1f4
push eax
push 0x4551ac
push 0x44e5d0
push 0x44e5d8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ebx
push 0x80
push 3
push ebx
push 3
lea eax, [ebp - 0x200]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x409e9a
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
mov byte [ebp - 0xc], 2
push eax
push esi
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], 0x2a
mov byte [ebp - 8], bl
mov byte [ebp - 7], bl
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
mov byte [ebp - 4], 1
call fcn.0041ae9d
pop ecx
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40cba0
Capabilities:
Create shortcut via ishelllink
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
cmp dword [ebp + 8], edi
jne 0x40cbcd
add esi, 0xa44
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40cc83
lea eax, [ebp - 4]
push eax
push 0x446dd0
push 1
push edi
push 0x446de0
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40cc6f
mov eax, dword [ebp - 4]
lea edx, [ebp - 8]
push edx
push 0x446df0
mov ecx, dword [eax]
push eax
call dword [ecx]
test eax, eax
jl 0x40cc6f
mov eax, dword [ebp - 4]
lea edx, [esi + 0x644]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x50]
test eax, eax
jl 0x40cc6f
mov eax, dword [ebp - 4]
push str.http:__www.zhaozhaola.com_
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
jl 0x40cc6f
mov eax, dword [ebp - 4]
push 0x4551d0
push eax
mov ecx, dword [eax]
call dword [ecx + 0x1c]
test eax, eax
jl 0x40cc6f
lea eax, [ebp - 0x210]
push 0x104
push eax
add esi, 0xa44
push 0xffffffffffffffff
push esi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 8]
lea edx, [ebp - 0x210]
push 1
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x40cc6f
push 1
pop edi
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, edi
pop edi
pop esi
leave
ret 4
Function at 0x40e2c9
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x43df50
call fcn.0041e498
sub esp, 0x108
push ebx
push esi
push edi
mov dword [ebp - 0x14], ecx
xor esi, esi
lea ebx, [ecx + 0x1e]
lea ecx, [ebp - 0x10]
call fcn.0040397c
and dword [ebp - 4], 0
lea eax, [esi + 0x190]
mov word [ebx], ax
lea ecx, [ebp - 0x10]
movzx eax, ax
push eax
call fcn.0043686f
push 0x4551d4
lea eax, [ebp - 0x114]
push 0xff
push eax
push 0x4552f0
lea ecx, [ebp - 0x10]
call fcn.00401751
push eax
push str.HotKey
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edi, [ebp - 0x114]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
jne 0x40e350
mov ecx, dword [ebp - 0x14]
push esi
lea eax, [ecx + 4]
push eax
call fcn.0040e388
jmp 0x40e360
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x114]
push eax
push esi
call fcn.0040e3d8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00435f75
inc esi
add ebx, 0x1c
cmp esi, 7
jl 0x40e2e4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x416529
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x43e6d7
call fcn.0041e498
sub esp, 0x18
push ebx
push esi
push edi
mov esi, str.handstar.htm
lea edi, [ebp - 0x24]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
call fcn.004016a6
push dword [eax + 0x8c]
lea ecx, [ebp - 0x10]
call fcn.00435fe3
xor ebx, ebx
push 0x450a8c
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
call fcn.004361ea
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x10]
push eax
call fcn.004361ea
push 0x450a90
push 0x450a94
lea ecx, [ebp - 0x10]
call fcn.0042fd73
lea ecx, [ebp - 0x14]
call fcn.0040397c
push 0x12c
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00436211
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00401751
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.00436260
push 1
push ebx
push ebx
push esi
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00435f75
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.00435f75
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x417e1d
Capabilities:
Print debug messages

Disassembly:
mov eax, 0x43e7b8
call fcn.0041e498
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004016a6
mov ecx, eax
call fcn.00401702
mov esi, dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push str.m_strCiZu1
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
call esi
mov dword [ebp - 0x10], ebx
lea ebx, [edi + 0x274]
mov ecx, ebx
call fcn.0041866f
test eax, eax
jbe 0x417ea6
push str.m_strCiZu2
call esi
push 2
mov ecx, ebx
push dword [ebp - 0x10]
call fcn.00418682
mov ecx, eax
call fcn.00401751
push eax
lea ecx, [ebp + 8]
call fcn.00401751
push eax
call fcn.0041f740
add esp, 0xc
test eax, eax
je 0x417f08
inc dword [ebp - 0x10]
mov ecx, ebx
call fcn.0041866f
cmp dword [ebp - 0x10], eax
jb 0x417e67
push str._find
call esi
push 0x4568f8
lea ecx, [edi + 0x26c]
call fcn.004360b2
cmp dword [0x456278], 0
je 0x417ee1
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push 0x450c58
call fcn.00435fe3
mov ecx, dword [0x456278]
call fcn.00407eb5
push str._find2
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00435f75
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 4
push str.m_strCiZu3
call esi
mov eax, dword [ebp - 0x18]
lea ebx, [edi + 0x284]
push 0
mov dword [ebp - 0x14], 1
cmp dword [eax + 0x3b0], 0
push dword [ebp - 0x10]
mov ecx, ebx
je 0x417f44
call fcn.00418682
mov ecx, eax
call fcn.00436211
push eax
call fcn.00415657
pop ecx
jmp 0x417f5e
call fcn.00418682
mov ecx, eax
call fcn.00436211
mov ecx, eax
call fcn.004156d7
push str.m_strCiZu4
call esi
cmp dword [0x456278], 0
je 0x417f88
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00418682
push ecx
mov ecx, esp
mov dword [ebp - 0x18], esp
push eax
call fcn.00435cea
mov ecx, dword [0x456278]
call fcn.00407eb5
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.00418682
push eax
lea ecx, [edi + 0x26c]
call fcn.00436062
push str.m_strCiZu
jmp 0x417ee6
Function at 0x4182b5
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
push ebx
push esi
push edi
mov ebx, ecx
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x12c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
push eax
xor eax, eax
push eax
push eax
push 0x8005
push eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
lea edi, [ebp - 0x12c]
or ecx, 0xffffffff
xor eax, eax
push 5
repne scasb al, byte es:[edi]
pop ecx
dec edi
mov esi, str.HandWriterSetting_
lea eax, [ebp - 0x12c]
push str.handpadtemp.ini
push eax
rep movsd dword es:[edi], dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrcatA]
call fcn.004016a6
mov ecx, eax
call fcn.00401702
fild dword [eax + 0x38c]
mov edi, dword [eax + 0x388]
mov esi, dword [eax + 0x384]
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], esi
fstp dword [ebp - 0xc]
fld dword [ebp - 0xc]
mov dword [ebx + 0x2c8], esi
mov dword [ebx + 0x2cc], edi
fstp dword [ebx + 0x2d0]
fild dword [eax + 0x390]
mov dword [ebx + 0x2d8], esi
fstp dword [ebp - 8]
fld dword [ebp - 8]
fstp dword [ebx + 0x2d4]
fild dword [ebp - 4]
fstp dword [ebp - 4]
fld dword [ebp - 4]
fadd dword [ebp - 8]
fstp dword [ebp - 4]
fld dword [ebp - 4]
call fcn.0041eadc
fild dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov dword [ebx + 0x2dc], eax
fstp dword [ebp - 0x10]
fld dword [ebp - 0x10]
fadd dword [ebp - 0xc]
call fcn.0041eadc
fld dword [ebp - 0xc]
fmul qword [0x4435a8]
mov dword [ebx + 0x2e0], eax
mov dword [ebx + 0x2e4], edi
fstp dword [ebp - 0x10]
fld dword [ebp - 4]
fld dword [ebp - 8]
fmul qword [0x4435a0]
fsubp st(1)
call fcn.0041eadc
and dword [ebp - 0xc], 0
mov dword [ebp - 0x18], eax
mov dword [ebp - 8], esi
mov esi, dword [ebp - 0xc]
fld dword [ebp - 0x10]
test esi, esi
jne 0x418400
fmul dword [0x443598]
fild dword [ebp - 8]
fstp dword [ebp - 4]
fadd dword [ebp - 4]
call fcn.0041eadc
fld dword [ebp - 0x10]
fmul dword [0x443594]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp dword [ebp - 4]
fadd dword [ebp - 4]
jmp 0x418429
fmul dword [0x443590]
fild dword [ebp - 8]
fstp dword [ebp - 4]
fadd dword [ebp - 4]
call fcn.0041eadc
fld dword [ebp - 0x10]
fmul dword [0x443594]
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp dword [ebp - 4]
fadd dword [ebp - 4]
call fcn.0041eadc
push dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], eax
push eax
push dword [ebp - 0x18]
push dword [ebp - 8]
call fcn.004021a8
lea edi, [esi + 0x31]
mov esi, eax
shl edi, 4
add edi, ebx
inc dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
cmp dword [ebp - 0xc], 8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov dword [ebp - 8], eax
jl 0x4183cb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4196c3
Capabilities:
Create thread

Disassembly:
mov eax, 0x43e858
call fcn.0041e498
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esi
call fcn.004189a6
mov ecx, 0xfa
xor eax, eax
lea edi, [esi + 0x46d]
mov dword [esi], method.CWnd.virtual_0
rep stosd dword es:[edi], eax
xor ebx, ebx
push str.padcom.dll
mov dword [ebp - 4], ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.SetAyscEvent
push eax
mov dword [0x456954], eax
call edi
push str.IsDriverWork
mov dword [0x456970], eax
push dword [0x456954]
call edi
push str.Connect_Driver
mov dword [0x45695c], eax
push dword [0x456954]
call edi
push str.GetDeviceType
mov dword [0x456950], eax
push dword [0x456954]
call edi
mov dword [0x456958], eax
call dword [0x45695c]
test al, al
jne 0x41976f
call dword [0x456950]
test al, al
je 0x41976f
call dword [0x456958]
mov dword [0x45694c], eax
push ebx
push ebx
push 1
mov byte [0x456968], 1
pop edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x45696c], eax
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push 0x4192a3
push 0x1000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [0x45696c]
mov dword [0x456964], eax
call dword [0x456970]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword [esi + 0x7c], eax
mov dword [esi + 0xc40], edi
mov dword [esi + 0x74], 0xff0000
mov dword [esi + 0x78], 0xffffff
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41f312
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41f332
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00420d2f
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x41f355
test byte [esp + 8], 2
je 0x41f355
call fcn.00420da2
mov dword [eax], 0xd
call fcn.00420dab
mov dword [eax], 5
jmp 0x41f32e
xor eax, eax
ret

Function at 0x432037
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x432059
cmp dword [edi + 0x3c], 0
jne 0x432059
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.0043b9bc
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.00432086
pop edi
pop esi
pop ebx
ret 8

Function at 0x4336ef
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x433727
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00436288
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00436260
jmp 0x433733
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x434df7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x434e39
call fcn.0043b9bc
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x434e39
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x434e30
xor eax, eax
jmp 0x434e41
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00434e47
pop edi
pop esi
pop ebx
ret 4
Function at 0x436e38
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x436e68
push edi
call ebx
push eax
call fcn.004382fc
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x436e92
test byte [ebp - 4], 1
je 0x436e92
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x436e92
push edi
call ebx
push eax
call fcn.004382fc
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x436f38
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.00436d85
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x436ec4
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.00436d85
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x436eda
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.00436d85
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x436f04
push 0
call ebx
push eax
call fcn.004382fc
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x436f22
push eax
call ebx
push eax
call fcn.004382fc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x436f36
push eax
call ebx
push eax
call fcn.004382fc
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x436f5f
test byte [ebp - 4], 1
jne 0x436f5f
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x436f5f
push edi
call ebx
push eax
call fcn.004382fc
pop edi
pop ebx
leave
ret 8

Function at 0x43c6b8
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43c6e6
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43c704
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043c61e
jmp 0x43c704
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43c704
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0043c61e
test edi, edi
mov eax, edi
jne 0x43c6ee
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push esi
push dword [0x406024]
mov esi, dword [sym.imp.USER32.dll_DestroyWindow]
call esi
push dword [0x406020]
call esi
push dword [0x406028]
call dword [sym.imp.USER32.dll_DestroyMenu]
push dword [0x40602c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x40120a
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0x90
xor ecx, ecx
cmp al, 0x10
sete cl
mov eax, ecx
ret

Function at 0x401220
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov byte [esi], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x401279
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 8]
mov dword [ebp - 4], 0x104
push dword [ebp + 0xc]
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
leave
ret