joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007290
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x100072f8
push esi
push edi
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp byte [ecx + ebx - 1], 0x5c
je 0x100072c3
mov byte [ecx + ebx], 0x5c
mov byte [ecx + ebx + 1], 0
mov edi, str.MacromedShockwave_8_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
mov eax, 1
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
ret 4
xor eax, eax
pop ebx
ret 4

Function at 0x9f2058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x9f21a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9f207e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f206a
add dl, dl
jne 0x9f2089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f20dc
xor eax, eax
add dl, dl
jne 0x9f2096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9f217d
add dl, dl
jne 0x9f20a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f20b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f20bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f20c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9f20d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9f2075
mov eax, 1
add dl, dl
jne 0x9f20ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9f20f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f20e1
sub eax, ebx
mov ebx, 1
jne 0x9f2128
mov ecx, 1
add dl, dl
jne 0x9f210e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f2119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f2105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f2075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9f213f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9f214a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9f2136
cmp eax, 0x7d00
jae 0x9f216d
cmp eax, 0x500
jb 0x9f2168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f2075
cmp eax, 0x7f
ja 0x9f2170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9f2075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9f219e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9f2075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x1003251
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx + 0xc4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
ret 8

Function at 0x1003332
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 0xcc], bl
push edi
je 0x10033bb
lea eax, [ebp - 0xc]
push eax
push ebx
lea edi, [esi + 0x14c]
push edi
push 0x10032e1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
mov dword [ebp - 4], eax
jne 0x100336f
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x10033e0
mov eax, dword [edi]
mov ecx, edi
call dword [eax + pe_nt_image_headers32]
cmp eax, 2
jne 0x1003383
or eax, 0xffffffff
jmp 0x10033e0
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
cmp eax, ebx
jne 0x10033e0
cmp byte [esi + 0xcc], bl
je 0x10033bb
mov eax, dword [esi + 0xc8]
jmp 0x10033c0
mov eax, 0x80000002
lea ecx, [ebp - 0x10]
push ecx
add esi, 0xc4
push esi
push ebx
push 0x2001f
push ebx
push ebx
push ebx
push str.SOFTWAREMicrosoftMosTraceCurrentVersionDebugAsyncTrace
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1003b2a
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x70
push 0x10020c8
call fcn.01003dd0
xor ebx, ebx
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
call edi
cmp word [eax], 0x5a4d
jne 0x1003b67
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1003b67
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1003b7f
cmp eax, 0x20b
je 0x1003b6c
mov dword [ebp - 0x1c], ebx
jmp 0x1003b93
cmp dword [ecx + 0x84], 0xe
jbe 0x1003b67
xor eax, eax
cmp dword [ecx + 0xf8], ebx
jmp 0x1003b8d
cmp dword [ecx + 0x74], 0xe
jbe 0x1003b67
xor eax, eax
cmp dword [ecx + 0xe8], ebx
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], ebx
push 2
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x100540c], 0xffffffff
or dword [0x1005410], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1005400]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x10053fc]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1005408], eax
call fcn.01003dcc
cmp dword [0x1005230], ebx
jne 0x1003bee
push fcn.01003dcc
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01003dba
push 0x1001318
push 0x1001314
call sub.msvcrt.dll__initterm
mov eax, dword [0x10053f8]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x10053f4]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x1001310
push 0x1001304
call sub.msvcrt.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x34], esi
cmp byte [esi], 0x22
jne 0x1003c84
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x1003c58
cmp al, 0x22
jne 0x1003c4a
cmp byte [esi], 0x22
jne 0x1003c61
inc esi
mov dword [ebp - 0x34], esi
mov al, byte [esi]
cmp al, bl
je 0x1003c6b
cmp al, 0x20
jbe 0x1003c5d
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x4c], 1
je 0x1003c8f
movzx eax, word [ebp - 0x48]
jmp 0x1003c92
cmp byte [esi], 0x20
jbe 0x1003c61
inc esi
mov dword [ebp - 0x34], esi
jmp 0x1003c84
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call edi
push eax
call main
mov esi, eax
mov dword [ebp - 0x7c], esi
cmp dword [ebp - 0x1c], ebx
jne 0x1003caf
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1003ce4
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01003e09
ret
Function at 0x401d7d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push dword [0x424664]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [0x424664]
call dword [sym.imp.USER32.dll_DestroyWindow]
cmp dword [0x424668], 0
je 0x401daf
push dword [0x424668]
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [0x42466c], 0
je 0x401dc4
push dword [0x42466c]
call dword [sym.imp.GDI32.dll_DeleteObject]
xor eax, eax
pop ebp
ret

Function at 0x401dc8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
and dword [0x42466c], 0
push 0x1d4c
push dword [0x424f70]
call dword [sym.imp.USER32.dll_LoadBitmapA]
mov dword [0x424668], eax
cmp dword [0x424668], 0
jne 0x401e28
push 0x42466c
call fcn.004022b1
pop ecx
mov dword [0x424668], eax
cmp dword [0x424668], 0
jne 0x401e28
push 0x10
push str.Error
push str.Unable_to_locate_process_internal_binary_resource.__Please_contact_your_software_vendor.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x401f49
mov dword [ebp - 0x4c], 3
mov dword [ebp - 0x48], 0x401f4b
and dword [ebp - 0x44], 0
and dword [ebp - 0x40], 0
mov eax, dword [0x424f70]
mov dword [ebp - 0x3c], eax
push 0x3e8
push dword [0x424f70]
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [ebp - 0x38], eax
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 0x34], eax
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
mov dword [ebp - 0x28], 0x421038
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
movzx eax, ax
test eax, eax
jne 0x401e91
xor eax, eax
jmp 0x401f49
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [0x424668]
call dword [sym.imp.GDI32.dll_GetObjectA]
mov eax, dword [ebp - 0x20]
inc eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
inc eax
inc eax
mov dword [ebp - 0x1c], eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [ebp - 0x20]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [ebp - 0x1c]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 0xc], eax
push 0
push dword [0x424f70]
push 0
push 0
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0xc]
push dword [ebp - 8]
push 0x80800000
push str.DeIsAbtWinName
push str.DeIsAbtClsName
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401f15
xor eax, eax
jmp 0x401f49
mov eax, dword [ebp - 4]
mov dword [0x424664], eax
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 5
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
pop eax
leave
ret
Function at 0x407972
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
test eax, eax
jne 0x40798c
xor eax, eax
jmp 0x407a8c
push dword [ebp + 8]
call fcn.004077c9
pop ecx
push 0x421490
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x41c]
push eax
call fcn.0040831c
push dword [ebp + 0xc]
lea eax, [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 8]
add eax, 0x2a6
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
movsx eax, byte [ebp - 0x314]
test eax, eax
jne 0x407a40
push 0x105
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 1
lea eax, [ebp - 0x314]
push eax
call fcn.0040831c
push str.IsUninst.exe
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x4214d8
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 8]
add eax, 0x13d
push eax
lea eax, [ebp - 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x314]
push eax
push 0xffffffffffffffff
push 1
push str.UninstallString
lea eax, [ebp - 0x41c]
push eax
push dword [0x42137c]
call fcn.0040ffaf
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
add eax, 0x242
push eax
push 0xffffffffffffffff
push 1
push str.DisplayName
lea eax, [ebp - 0x41c]
push eax
push dword [0x42137c]
call fcn.0040ffaf
push 1
pop eax
leave
ret

Function at 0x4085c6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x108]
push eax
call fcn.004092f1
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x40860b
xor eax, eax
jmp 0x408620
mov eax, dword [ebp - 0x10c]
and eax, 0x10
mov dword [ebp - 0x110], eax
mov eax, dword [ebp - 0x110]
leave
ret 4
Function at 0x40961d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push dword [ebp + 8]
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
lea eax, [ebp - 0x254]
push eax
call fcn.0040831c
push 0x421520
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x254]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x409681
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
jmp 0x4096f7
mov dword [ebp - 8], 1
cmp dword [ebp - 8], 0
je 0x4096eb
mov eax, dword [ebp - 0x14c]
and eax, 0x10
test eax, eax
je 0x4096b3
movsx eax, byte [ebp - 0x120]
cmp eax, 0x2e
jne 0x4096b3
mov dword [ebp - 0x258], 1
jmp 0x4096ba
and dword [ebp - 0x258], 0
mov eax, dword [ebp - 0x258]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4096d6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
jmp 0x4096f7
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 8], eax
jmp 0x409688
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
leave
ret 4

Function at 0x409f14
Capabilities:
Get disk information
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
cmp dword [ebp + 0xc], 0
je 0x409f29
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
cmp eax, 0x5c
jne 0x409ff2
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 1]
cmp eax, 0x5c
jne 0x409ff2
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp + 8]
call fcn.00409c06
test eax, eax
jne 0x409f69
xor eax, eax
jmp 0x40a05c
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x220], eax
cmp dword [ebp - 0x220], 0
je 0x409f8e
cmp dword [ebp - 0x220], 1
jne 0x409fa7
cmp dword [ebp - 0x220], 0x64
jle 0x409fa7
cmp dword [ebp - 0x220], 0
jge 0x409fa7
xor eax, eax
jmp 0x40a05c
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x409fd9
or eax, 0xffffffff
jmp 0x40a05c
push dword [ebp - 0x224]
push dword [ebp - 0x114]
push dword [ebp - 4]
call fcn.0040a6e3
add esp, 0xc
jmp 0x40a05c
mov eax, dword [ebp + 8]
mov al, byte [eax]
mov byte [ebp - 0x21c], al
mov eax, dword [ebp + 8]
mov al, byte [eax + 1]
mov byte [ebp - 0x21b], al
mov byte [ebp - 0x21a], 0x5c
and byte [ebp - 0x219], 0
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
test eax, eax
jne 0x40a045
xor eax, eax
jmp 0x40a05c
push dword [ebp - 0x224]
push dword [ebp - 0x114]
push dword [ebp - 4]
call fcn.0040a6e3
add esp, 0xc
leave
ret 8
Function at 0x40a1ac
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 8]
movsx eax, byte [eax]
test eax, eax
je 0x40a1f4
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 1]
cmp eax, 0x3a
jne 0x40a1f4
mov eax, dword [ebp + 8]
movsx eax, byte [eax + 2]
test eax, eax
jne 0x40a1f4
mov byte [ebp - 0x106], 0x5c
and byte [ebp - 0x105], 0
lea eax, [ebp - 0x108]
push eax
call fcn.004092f1
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x40a221
or eax, 0xffffffff
jmp 0x40a22e
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x10c]
mov dword [eax], ecx
xor eax, eax
leave
ret

Function at 0x40a230
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
push dword [ebp + 8]
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0xc], 0xc
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0
je 0x40a28a
cmp dword [0x424704], 0
je 0x40a28a
push dword [ebp + 8]
call dword [0x424704]
xor eax, eax
cmp dword [ebp - 0x118], 0
sete al
leave
ret
Function at 0x40ffaf
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 4
jl 0x41000d
cmp dword [ebp - 0x814], 5
jle 0x40ffd5
jmp 0x41000d
push dword [ebp + 0x1c]
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x800]
push eax
call 0x41a050
pop ecx
mov dword [ebp - 0x808], eax
lea eax, [ebp - 0x808]
mov dword [ebp - 0x804], eax
mov dword [ebp + 0x18], 4
jmp 0x410032
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x804], eax
cmp dword [ebp + 0x14], 1
je 0x410022
cmp dword [ebp + 0x14], 2
jne 0x410032
push dword [ebp - 0x804]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [ebp + 0x18], eax
cmp dword [ebp + 0x18], 0xffffffff
jne 0x410048
push dword [ebp - 0x804]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [ebp + 0x18], eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fd31
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jne 0x410085
push 0x4247e0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0040fb6d
mov dword [ebp - 0x80c], eax
cmp dword [ebp - 0x80c], 0
jne 0x410085
xor eax, eax
jmp 0x4100e3
push dword [ebp + 0x18]
push dword [ebp - 0x804]
push dword [ebp + 0x14]
push 0
push dword [ebp + 0x10]
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
je 0x4100c1
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4100e3
push dword [ebp - 0x80c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x810], eax
cmp dword [ebp - 0x810], 0
je 0x4100e0
xor eax, eax
jmp 0x4100e3
push 1
pop eax
leave
ret 0x18

Function at 0x41115d
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_SetRectEmpty]
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
jne 0x411192
xor eax, eax
jmp 0x41120e
push 0
push dword [ebp - 0x1c]
call dword [sym.imp.USER32.dll_ShowWindow]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0xa0]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
mov dword [eax + 4], ecx
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
add ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax + 8], ecx
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x14]
add ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax + 0xc], ecx
xor eax, eax
leave
ret
Function at 0x4181e0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x418207
xor eax, eax
jmp 0x41821c
mov eax, dword [ebp - 8]
shl eax, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
leave
ret 4

Function at 0x4184b8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and dword [ebp - 4], 0
push dword [ebp + 8]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x210]
push eax
call fcn.004092f1
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4184fb
xor eax, eax
jmp 0x4184fe
mov eax, dword [ebp - 4]
leave
ret 4

Function at 0x418502
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x20c]
push eax
call fcn.004092f1
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
leave
ret 8
Function at 0x418cd8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 1
test eax, eax
jne 0x418cf5
xor eax, eax
jmp 0x418e5d
lea eax, [ebp - 0x354]
push eax
mov eax, dword [ebp + 8]
push dword [eax + 0x21c]
call fcn.00408266
push 1
lea eax, [ebp - 0x354]
push eax
call fcn.0040831c
push 0x421fdc
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x24c]
push eax
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x418d4e
xor eax, eax
jmp 0x418e5d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 2
test eax, eax
je 0x418d68
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
cmp dword [ebp - 4], 0
je 0x418e5a
mov eax, dword [ebp - 0x24c]
and eax, 0x10
test eax, eax
je 0x418e19
movsx eax, byte [ebp - 0x220]
cmp eax, 0x2e
je 0x418e19
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x354]
push eax
call fcn.00408266
push 1
lea eax, [ebp - 0x10c]
push eax
call fcn.0040831c
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 1
lea eax, [ebp - 0x10c]
push eax
call fcn.0040831c
mov eax, dword [ebp + 8]
add eax, 0xc
push eax
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x21c]
push dword [eax + 0x114]
call 0x41dd10
lea eax, [ebp - 0x10c]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x21c]
push dword [eax + 0x114]
call 0x41ddb0
lea eax, [ebp - 0x24c]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x418e3b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 1
pop eax
jmp 0x418e5d
mov eax, dword [ebp + 8]
mov eax, dword [eax + 4]
and eax, 2
test eax, eax
je 0x418e55
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.USER32.dll_CharLowerA]
jmp 0x418d68
push 1
pop eax
leave
ret
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6e50545f
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1f37152d
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219