joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44817c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff9c4
mov ecx, 0x80
lea eax, [ebp - 0x23c]
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
lea edi, [ebp - 0x23c]
mov byte [ebp - 1], 0
push esi
xor ebx, ebx
mov esi, 0x52182f
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x43c]
push esi
mov esi, 0x521a2f
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x63c]
push esi
mov esi, 0x521c2f
mov ecx, 0x80
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x3c]
push esi
mov esi, 0x521e2f
mov ecx, 0xe
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
push eax
mov edx, dword [ebp + 8]
push edx
call fcn.004474e4
add esp, 8
test al, al
jne 0x448201
mov ebx, 0xfffffd9d
jmp 0x4483fd
lea eax, [ebp - 0x23c]
lea edx, [ebp - 0x3c]
push eax
push edx
lea ecx, [ebp - 0x63c]
push 0x5ec0a9
push ecx
call fcn.004d75f8
add esp, 0x10
test esi, esi
jne 0x448399
push 1
lea eax, [ebp - 0x43c]
push 0x200
push eax
lea edx, [ebp - 0x63c]
push 0x5ec0ae
push edx
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
jne 0x44825d
mov ebx, 0xfffffd9a
jmp 0x4483fd
lea eax, [ebp - 0x43c]
push eax
call fcn.004da810
pop ecx
push 0x5ec0bf
lea edx, [ebp - 0x43c]
push edx
call fcn.004d302d
add esp, 8
test eax, eax
je 0x448284
mov bl, 1
lea eax, [ebp - 0x63c]
lea edx, [ebp - 0x43c]
push eax
push 0x5ec0c4
push edx
call fcn.004d75f8
add esp, 0xc
lea ecx, [ebp - 0x43c]
lea eax, [ebp - 0x43c]
push 1
push 0x200
push ecx
push 0x5ec0cb
push eax
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x4482ce
mov byte [ebp - 1], 1
test bl, bl
je 0x448399
mov dl, byte [ebp - 1]
test dl, dl
je 0x448399
lea ecx, [ebp - 0x63c]
lea eax, [ebp - 0x43c]
push ecx
push 0x5ec0dc
push eax
call fcn.004d75f8
add esp, 0xc
lea edx, [ebp - 0x43c]
push edx
push 0x80000002
call fcn.00406990
add esp, 8
lea ecx, [ebp - 0x23c]
push ecx
push 0x5ec0e3
lea eax, [ebp - 0x43c]
push eax
call fcn.004d75f8
add esp, 0xc
lea edx, [ebp - 0x43c]
lea ecx, [ebp - 0x63c]
push edx
push 0
push ecx
push 0x80000002
call fcn.00407410
add esp, 0x10
test al, al
jne 0x448356
mov ebx, 0xfffffd97
jmp 0x4483fd
lea eax, [ebp - 0x63c]
lea edx, [ebp - 0x43c]
push eax
push 0x5ec0ea
push edx
call fcn.004d75f8
add esp, 0xc
lea ecx, [ebp - 0x23c]
lea eax, [ebp - 0x43c]
push ecx
push 0
push eax
push 0x80000002
call fcn.00407410
add esp, 0x10
test al, al
jne 0x448399
mov ebx, 0xfffffd93
jmp 0x4483fd
push 1
lea eax, [ebp - 0x43c]
push 0x200
push eax
lea edx, [ebp - 0x63c]
push 0x5ec0f1
push edx
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
jne 0x4483cb
mov ebx, 0xfffffd90
jmp 0x4483fd
mov al, byte [ebp - 0x43c]
test al, al
jne 0x4483dc
mov ebx, 0xfffffd8d
jmp 0x4483fd
xor ebx, ebx
test esi, esi
je 0x4483fd
push 0x200
push esi
lea eax, [ebp - 0x43c]
push eax
call sub.KERNEL32.dll_ExpandEnvironmentStringsA
test eax, eax
jne 0x4483fd
mov ebx, 0xfffffd89
test ebx, ebx
je 0x448408
test esi, esi
je 0x448408
mov byte [esi], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455530
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea eax, [ebp - 0x100]
push eax
push ebx
call sub.USER32.dll_GetClassNameA
lea eax, [ebp - 0x100]
mov edx, 0x5ed198
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4555a2
test cl, cl
je 0x45557a
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4555a2
add eax, 2
add edx, 2
test cl, cl
jne 0x45555e
jne 0x4555a2
mov eax, ebx
push 0
push 0x5ed1a5
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
mov eax, ebx
push 0
push 0x5ed1ae
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
lea eax, [ebp - 0x100]
mov edx, 0x5ed1b3
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x4555de
test cl, cl
je 0x4555c9
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x4555de
add eax, 2
add edx, 2
test cl, cl
jne 0x4555ad
jne 0x4555de
mov eax, ebx
push 0
push 0x5ed1bc
push 0
push eax
call sub.USER32.dll_FindWindowExA
mov ebx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x455601
test esi, esi
je 0x4555ec
mov byte [esi], 0
push esi
push 0x200
push 0xd
push ebx
call sub.USER32.dll_SendMessageA
mov eax, 1
jmp 0x455653
push ebx
call fcn.00455528
pop ecx
push esi
push 0
push 0xc
push ebx
call sub.USER32.dll_SendMessageA
push ebx
push ebx
call sub.USER32.dll_GetDlgCtrlID
and ax, 0xffff
movzx edx, ax
or edx, 0x3000000
push edx
push 0x111
push ebx
call sub.USER32.dll_GetParent
push eax
call sub.USER32.dll_SendMessageA
push 0
call sub.KERNEL32.dll_Sleep
push 0x32
call sub.KERNEL32.dll_Sleep
push 0
call sub.KERNEL32.dll_Sleep
mov eax, 1
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4559bc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov ecx, 0xa
push ebx
push esi
push edi
lea edi, [ebp - 0x2c]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0x10]
push esi
mov esi, 0x530358
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
pop esi
test ebx, ebx
jne 0x4559e9
xor eax, eax
jmp 0x455b78
mov edx, dword [ebp + 0xc]
dec edx
je 0x455a01
dec edx
je 0x455a1b
dec edx
je 0x455a31
dec edx
je 0x455aab
jmp 0x455b20
push 0x104
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x455b24
xor eax, eax
jmp 0x455b78
push ebx
call fcn.00448108
pop ecx
test eax, eax
je 0x455b24
xor eax, eax
jmp 0x455b78
push 1
push 0x104
push ebx
lea edx, [ebp - 0x2c]
push 0x5ed1c1
push edx
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x455a5d
mov cl, byte [ebx]
test cl, cl
jne 0x455b24
push 0x5ed1d1
call fcn.004de5fc
pop ecx
mov edi, eax
test edi, edi
jne 0x455a86
push esi
mov esi, 0x5ed1de
mov edi, ebx
mov eax, edi
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x455b24
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x455b24
push 1
push 0x104
push ebx
lea eax, [ebp - 0x2c]
push 0x5ed1ef
push eax
push 0x80000002
call fcn.00406a10
add esp, 0x18
test eax, eax
je 0x455ad3
mov dl, byte [ebx]
test dl, dl
jne 0x455b24
push 0x5ed205
call fcn.004de5fc
pop ecx
mov edi, eax
test edi, edi
jne 0x455afb
push esi
mov esi, 0x5ed217
mov edi, ebx
mov eax, edi
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
pop esi
jmp 0x455b24
push esi
xor eax, eax
push edi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, ebx
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
jmp 0x455b24
xor eax, eax
jmp 0x455b78
mov dl, byte [ebx]
test dl, dl
jne 0x455b2e
xor eax, eax
jmp 0x455b78
test esi, 0x100
je 0x455b60
push ebx
call fcn.004d2f1c
pop ecx
test eax, eax
je 0x455b60
push ebx
call fcn.004d2f1c
pop ecx
movsx edx, byte [ebx + eax - 1]
cmp edx, 0x5c
je 0x455b60
push 0x5ed22e
push ebx
call fcn.004d2e40
add esp, 8
test esi, 0x200
je 0x455b76
push 0x5ed230
push ebx
call fcn.004d2e40
add esp, 8
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45932c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ax, word [0x530697]
mov word [ebp - 3], ax
mov al, byte [0x530699]
mov byte [ebp - 1], al
lea edx, [ebp - 3]
push edx
call sub.KERNEL32.dll_GetDriveTypeA
cmp eax, 2
jne 0x45938d
test ebx, ebx
jne 0x45938c
test esi, esi
je 0x459385
xor eax, eax
push esi
lea edi, [ebp - 3]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
mov eax, 1
jmp 0x4593a7
dec ebx
dec byte [ebp - 3]
movsx eax, byte [ebp - 3]
cmp eax, 0x43
je 0x45939e
cmp eax, 0x63
jne 0x45934d
test esi, esi
je 0x4593a5
mov byte [esi], 0
xor eax, eax
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45b34c
Capabilities:
Create process on windows
Impersonate user

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff7c
push ebx
push esi
push edi
mov ebx, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov eax, 0x5308f5
call fcn.004d57f0
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], 0xffffff9c
mov word [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push eax
push 0
push 2
mov edx, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp + 0xc]
push ecx
push esi
call sub.ADVAPI32.dll_LogonUserA
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x45b3c0
test ebx, ebx
je 0x45b4d4
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5edf7f
push ebx
call fcn.004d75f8
add esp, 0xc
jmp 0x45b4d4
mov edx, dword [ebp - 0x28]
push edx
call fcn.0045b240
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
test ecx, ecx
jne 0x45b3f5
test ebx, ebx
je 0x45b4d4
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5edf88
push ebx
call fcn.004d75f8
add esp, 0xc
jmp 0x45b4d4
push 0
lea eax, [ebp - 0x2c]
push eax
lea edx, [ebp - 0x28]
push edx
push esi
call fcn.00447d84
add esp, 0x10
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
test ecx, ecx
je 0x45b437
test ebx, ebx
je 0x45b4d4
call sub.KERNEL32.dll_GetLastError
push eax
mov eax, dword [ebp - 0x30]
push eax
push 0x5edf91
push ebx
call fcn.004d75f8
add esp, 0x10
jmp 0x45b4d4
push 0x44
push 0
lea edx, [ebp - 0x74]
push edx
call fcn.004d2d9c
add esp, 0xc
mov dword [ebp - 0x74], 0x44
test byte [ebp + 0x21], 1
je 0x45b45b
mov dword [ebp - 0x6c], 0x5edf9d
lea ecx, [ebp - 0x84]
lea eax, [ebp - 0x74]
push ecx
push eax
push 0
push 0
push 0
push 1
push 0
push 0
mov edx, dword [ebp + 0x14]
push edx
push 0
mov ecx, dword [ebp - 0x28]
push ecx
call sub.ADVAPI32.dll_CreateProcessAsUserA
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
test eax, eax
jne 0x45b4ac
mov dword [ebp - 0x30], 0xffffff3b
test ebx, ebx
je 0x45b4d4
call sub.KERNEL32.dll_GetLastError
push eax
push 0x5edfbf
push ebx
call fcn.004d75f8
add esp, 0xc
jmp 0x45b4d4
mov edx, dword [ebp - 0x80]
push edx
call sub.KERNEL32.dll_CloseHandle
mov ecx, dword [ebp - 0x84]
push ecx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
mov dword [ebp - 0x30], eax
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x45b52a
push 0
lea ecx, [ebp - 0x2c]
push ecx
lea eax, [ebp - 0x28]
push eax
call fcn.00447da8
add esp, 0xc
mov edx, dword [ebp - 0x28]
test edx, edx
je 0x45b4f6
mov ecx, dword [ebp - 0x28]
push ecx
call sub.KERNEL32.dll_CloseHandle
mov word [ebp - 0x14], 0
jmp 0x45b51d
mov eax, dword [ebp - 0x30]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x90]
mov esi, dword [ebp - 0x8c]
mov ebx, dword [ebp - 0x88]
pop ebp
ret
Function at 0x45fa3c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.0045f9d0
mov esi, eax
push esi
push ebx
push 0x5ef066
lea eax, [ebp - 0x24]
push eax
call fcn.004d75f8
add esp, 0x10
test byte [0x528c3d], 4
je 0x45fa81
lea edx, [ebp - 0x24]
push edx
push 0x5ef070
push 0x528c40
call fcn.004541dc
add esp, 0xc
push ebx
push 0x5ef07c
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d75f8
add esp, 0xc
test ebx, 0x10000
je 0x45fad0
push 0xa1
call sub.USER32.dll_GetAsyncKeyState
test ax, ax
je 0x45fad0
and ebx, 0xfffeffff
test byte [0x528c3d], 4
je 0x45fad0
push 0x5ef08b
push 0x5ef07f
push 0x528c40
call fcn.004541dc
add esp, 0xc
test esi, 0x80000
je 0x45fc34
test bl, 2
jne 0x45fc34
test esi, 0x10000
je 0x45fb41
and ebx, 0xffff1fff
lea eax, [ebp - 0x24]
or ebx, 0x4000
push ebx
push 0x5ef098
push eax
call fcn.004d75f8
add esp, 0xc
test byte [0x528c3d], 4
je 0x45fb2a
lea edx, [ebp - 0x24]
push edx
push 0x5ef09b
push 0x528c40
call fcn.004541dc
add esp, 0xc
push ebx
push 0x5ef0aa
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d75f8
add esp, 0xc
jmp 0x45fc34
push 0x13
call fcn.0045f294
pop ecx
call fcn.0045eea4
call fcn.00488b54
call fcn.00479b08
call fcn.0045eeac
test bh, 0x40
jne 0x45fbb6
test bh, 8
jne 0x45fbb6
and ebx, 0xfffff8ff
lea eax, [ebp - 0x24]
or ebx, 0x400
push ebx
push 0x5ef0ad
push eax
call fcn.004d75f8
add esp, 0xc
test byte [0x528c3d], 4
je 0x45fba4
lea edx, [ebp - 0x24]
push edx
push 0x5ef0b0
push 0x528c40
call fcn.004541dc
add esp, 0xc
push ebx
push 0x5ef0c0
lea ecx, [ebp - 0x24]
push ecx
call fcn.004d75f8
add esp, 0xc
test bh, 2
je 0x45fbe0
test esi, 0x200
jne 0x45fc34
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x24]
push eax
push 0x29
call fcn.00465b1c
add esp, 0x1c
jmp 0x45fcfa
test bh, 4
je 0x45fc0a
test esi, 0x400
jne 0x45fc34
push 0
push 0
push 0
push 0
push 0
lea edx, [ebp - 0x24]
push edx
push 0x29
call fcn.004659f8
add esp, 0x1c
jmp 0x45fcfa
test bh, 1
je 0x45fc34
test esi, 0x100
jne 0x45fc34
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push ecx
push 0x29
call fcn.0046590c
add esp, 0x1c
jmp 0x45fcfa
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1b9
call fcn.004659f8
xor eax, eax
add esp, 0x1c
xor edi, edi
mov dword [ebp - 4], eax
test bl, 1
je 0x45fc5c
or edi, 1
test bh, 0x40
je 0x45fc69
or edi, 0x100
jmp 0x45fca7
test bh, 0x80
je 0x45fc76
or edi, 0x200
jmp 0x45fca7
test bh, 0x20
je 0x45fc92
or edi, 0x10
mov eax, dword [0x52fcc4]
cmp eax, 0xffffff
je 0x45fca7
mov dword [ebp - 4], eax
or edi, 0x40
jmp 0x45fca7
or edi, 0x20
mov eax, dword [0x52fcc0]
cmp eax, 0xffffff
je 0x45fca7
mov dword [ebp - 4], eax
or edi, 0x40
test esi, 0x400
je 0x45fcb5
or edi, 0x1000
push edi
push esi
push ebx
push 0x5ef0c3
lea edx, [ebp - 0x24]
push edx
call fcn.004d75f8
add esp, 0x14
test byte [0x528c3d], 4
je 0x45fce8
lea ecx, [ebp - 0x24]
push ecx
push 0x5ef0d4
push 0x528c40
call fcn.004541dc
add esp, 0xc
mov eax, dword [ebp - 4]
push eax
push edi
call fcn.00458aa0
add esp, 8
mov eax, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x460a00
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff7dc
mov eax, 0x530e80
push ebx
push esi
push edi
call fcn.004d57f0
mov word [ebp - 0x14], 8
mov dl, byte [0x52e3f9]
test dl, dl
je 0x460a6b
test byte [0x528c3d], 4
je 0x460a46
push 0x5ef3bc
push 0x5ef3a8
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push 0
push 0xc
call fcn.0046590c
add esp, 0x1c
mov ecx, dword [ebp - 0x24]
mov dword fs:[0], ecx
jmp 0x460b01
test byte [0x528c3d], 4
je 0x460a8b
push 0x5ef3cf
push 0x5ef3bd
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 0
push 0xb
lea eax, [ebp - 0x424]
push eax
call fcn.00443488
add esp, 0xc
test eax, eax
jle 0x460acb
lea edx, [ebp - 0x424]
lea ecx, [ebp - 0x824]
push edx
push 0x5ef3d0
push ecx
call fcn.004d75f8
add esp, 0xc
push 5
lea eax, [ebp - 0x824]
push eax
call sub.KERNEL32.dll_WinExec
mov word [ebp - 0x14], 0
jmp 0x460af2
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x830]
mov esi, dword [ebp - 0x82c]
mov ebx, dword [ebp - 0x828]
pop ebp
ret
Function at 0x460b90
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed8
mov eax, 0x530e94
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
call fcn.004d57f0
mov word [ebp - 0x14], 8
test ebx, ebx
jne 0x460be4
test byte [0x528c3d], 4
je 0x460bd3
push 0x5ef40f
push 0x5ef403
push 0x528c40
call fcn.004541dc
add esp, 0xc
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x460dad
mov cl, byte [ebx]
test cl, cl
jne 0x460c1e
test byte [0x528c3d], 4
je 0x460c0a
push 0x5ef420
push 0x5ef414
push 0x528c40
call fcn.004541dc
add esp, 0xc
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x460dad
mov cl, byte [0x52e3f9]
test cl, cl
je 0x460c68
test byte [0x528c3d], 4
je 0x460c44
push ebx
push 0x5ef423
push 0x528c40
call fcn.004541dc
add esp, 0xc
push 0
push 0
push 0
push 0
push 0
push ebx
push 0xb
call fcn.0046590c
add esp, 0x1c
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x460dad
test byte [0x528c3d], 4
je 0x460c84
push ebx
push 0x5ef431
push 0x528c40
call fcn.004541dc
add esp, 0xc
xor eax, eax
mov edi, ebx
or ecx, 0xffffffff
lea esi, [ebp - 0x128]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
movsx eax, byte [ebp - 0x128]
cmp eax, 0x30
jne 0x460cc6
mov dl, byte [ebp - 0x127]
test dl, dl
jne 0x460cc6
mov byte [ebp - 0x128], 0
movsx ecx, byte [ebp - 0x128]
cmp ecx, 0xffffffac
jne 0x460cd9
mov byte [ebp - 0x128], 0
push 1
push 0x5ef462
push 0x5ef453
push 0x5ef43d
push 0x80000001
call fcn.00406a4c
add esp, 0x14
push 1
push 0x5ef488
push 0x5ef47a
push 0x5ef464
push 0x80000001
call fcn.00406a4c
add esp, 0x14
lea eax, [ebp - 0x128]
push 1
push eax
push 0x5ef4a0
push 0x5ef48a
push 0x80000001
call fcn.00406a4c
add esp, 0x14
push 3
lea edx, [ebp - 0x128]
push edx
push 0
push 0x14
call sub.USER32.dll_SystemParametersInfoA
test eax, eax
je 0x460d6b
push 1
push 0
call sub.USER32.dll_GetDesktopWindow
push eax
call sub.USER32.dll_InvalidateRect
mov eax, 1
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
jmp 0x460dad
push 1
push 0
call sub.USER32.dll_GetDesktopWindow
push eax
call sub.USER32.dll_InvalidateRect
mov word [ebp - 0x14], 0
jmp 0x460da1
xor eax, eax
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
mov esp, ebp
mov edi, dword [ebp - 0x134]
mov esi, dword [ebp - 0x130]
mov ebx, dword [ebp - 0x12c]
pop ebp
ret
Function at 0x461af4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaec
push esi
push edi
mov esi, 0x530f48
lea edi, [ebp - 0x104]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x53104c
lea edi, [ebp - 0x208]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x531150
lea edi, [ebp - 0x30c]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x531254
lea edi, [ebp - 0x410]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
mov esi, 0x531358
lea edi, [ebp - 0x514]
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
push 0x104
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_GetSystemDirectoryA
test eax, eax
jne 0x461b82
mov esi, 0x5ef705
lea edi, [ebp - 0x104]
mov eax, edi
mov ecx, 5
rep movsd dword es:[edi], dword [esi]
lea edx, [ebp - 0x104]
test edx, edx
je 0x461bcb
lea ecx, [ebp - 0x104]
push ecx
call fcn.004d2f1c
pop ecx
test eax, eax
je 0x461bcb
lea eax, [ebp - 0x104]
push eax
call fcn.004d2f1c
pop ecx
movsx edx, byte [ebp + eax - 0x105]
cmp edx, 0x5c
je 0x461bcb
push 0x5ef719
lea ecx, [ebp - 0x104]
push ecx
call fcn.004d2e40
add esp, 8
push 0x5ef71b
lea eax, [ebp - 0x104]
push eax
call fcn.004d2e40
add esp, 8
push 0x2100
lea edx, [ebp - 0x104]
push edx
call fcn.00405c58
add esp, 8
test eax, eax
jne 0x461bfe
xor eax, eax
jmp 0x461cc8
test byte [ebp + 8], 1
je 0x461c0e
mov eax, 1
jmp 0x461cc8
mov byte [ebp - 0x30c], 0
mov dl, byte [0x52e3f9]
test dl, dl
jne 0x461c32
mov cl, byte [0x52e3fd]
test cl, cl
jne 0x461c32
mov al, byte [0x52e3ff]
test al, al
je 0x461cb0
lea edx, [ebp - 0x208]
push edx
push 0x1faf
call fcn.00452a6c
add esp, 8
lea ecx, [ebp - 0x30c]
push ecx
lea eax, [ebp - 0x208]
push eax
call fcn.0043bd14
add esp, 8
lea edx, [ebp - 0x208]
push edx
push 0x1fb0
call fcn.00452a6c
add esp, 8
lea ecx, [ebp - 0x514]
push ecx
lea eax, [ebp - 0x208]
push eax
call fcn.0043bd14
add esp, 8
lea edx, [ebp - 0x208]
push edx
push 0x1fb1
call fcn.00452a6c
add esp, 8
lea ecx, [ebp - 0x410]
push ecx
lea eax, [ebp - 0x208]
push eax
call fcn.0043bd14
add esp, 8
push 0x10100
push 0
push 0
lea edx, [ebp - 0x104]
push edx
call fcn.00462b5c
add esp, 0x10
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x462bb8
Capabilities:
Persist via run registry key

Disassembly:
push ebx
add esp, 0xfffff7f4
push 0x5ef9d5
push 0x80000002
call fcn.004072f8
add esp, 8
mov ebx, eax
xor eax, eax
test ebx, ebx
mov dword [esp], eax
je 0x462c44
mov dword [esp + 4], 0x400
mov dword [esp + 8], 1
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x414]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x10]
push ecx
push ebx
call fcn.0040738c
add esp, 0x18
test eax, eax
je 0x462c44
lea eax, [esp + 0x40c]
push eax
lea edx, [esp + 0x10]
push edx
call fcn.00462b80
add esp, 8
test al, al
jne 0x462bdc
push 0x10
push 0
lea ecx, [esp + 0x414]
push ecx
call fcn.00462b38
add esp, 0xc
jmp 0x462bdc
push 0x5efa03
push 0x80000001
call fcn.004072f8
add esp, 8
mov ebx, eax
xor eax, eax
test ebx, ebx
mov dword [esp], eax
je 0x462cc9
mov dword [esp + 4], 0x400
mov dword [esp + 8], 1
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
lea eax, [esp + 0x414]
push eax
lea edx, [esp + 0x18]
push edx
lea ecx, [esp + 0x10]
push ecx
push ebx
call fcn.0040738c
add esp, 0x18
test eax, eax
je 0x462cc9
lea eax, [esp + 0x40c]
push eax
lea edx, [esp + 0x10]
push edx
call fcn.00462b80
add esp, 8
test al, al
jne 0x462c61
push 0x10
push 0
lea ecx, [esp + 0x414]
push ecx
call fcn.00462b38
add esp, 0xc
jmp 0x462c61
mov eax, 1
add esp, 0x80c
pop ebx
ret