joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c490
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x40c51e
push dword fs:[eax]
mov dword fs:[eax], esp
test edi, edi
setl bl
mov eax, esi
call fcn.00404510
mov eax, edi
mov ecx, 0xa
cdq
idiv ecx
mov eax, edx
cdq
xor eax, edx
sub eax, edx
mov edx, eax
add edx, 0x30
lea eax, [ebp - 4]
call fcn.004046f8
mov eax, dword [ebp - 4]
mov edx, esi
mov ecx, 1
call fcn.00404aa4
mov eax, edi
mov ecx, 0xa
cdq
idiv ecx
mov edi, eax
test edi, edi
jne 0x40c4b6
test bl, bl
je 0x40c508
mov edx, esi
mov ecx, 1
mov eax, 0x40c534
call fcn.00404aa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c525
lea eax, [ebp - 4]
call fcn.00404510
ret

Function at 0x4101e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov dword [esp], edx
mov edx, dword [esp]
mov ebx, 0x9e3779b9
mov esi, ebx
cmp edx, 0xc
jb 0x410276
mov edi, eax
add ebx, dword [edi]
add esi, dword [edi + 4]
add ecx, dword [edi + 8]
sub ebx, esi
sub ebx, ecx
mov edi, ecx
shr edi, 0xd
xor ebx, edi
sub esi, ecx
sub esi, ebx
mov edi, ebx
shl edi, 8
xor esi, edi
sub ecx, ebx
sub ecx, esi
mov edi, esi
shr edi, 0xd
xor ecx, edi
sub ebx, esi
sub ebx, ecx
mov edi, ecx
shr edi, 0xc
xor ebx, edi
sub esi, ecx
sub esi, ebx
mov edi, ebx
shl edi, 0x10
xor esi, edi
sub ecx, ebx
sub ecx, esi
mov edi, esi
shr edi, 5
xor ecx, edi
sub ebx, esi
sub ebx, ecx
mov edi, ecx
shr edi, 3
xor ebx, edi
sub esi, ecx
sub esi, ebx
mov edi, ebx
shl edi, 0xa
xor esi, edi
sub ecx, ebx
sub ecx, esi
mov edi, esi
shr edi, 0xf
xor ecx, edi
add eax, 0xc
sub edx, 0xc
cmp edx, 0xc
jae 0x4101fe
add ecx, dword [esp]
cmp edx, 0xb
ja case.0x410282.0
jmp dword [edx*4 + 0x410289]
xor edx, edx
mov dl, byte [eax + 0xa]
shl edx, 0x18
add ecx, edx
xor edx, edx
mov dl, byte [eax + 9]
shl edx, 0x10
add ecx, edx
xor edx, edx
mov dl, byte [eax + 8]
shl edx, 8
add ecx, edx
xor edx, edx
mov dl, byte [eax + 7]
shl edx, 0x18
add esi, edx
xor edx, edx
mov dl, byte [eax + 6]
shl edx, 0x10
add esi, edx
xor edx, edx
mov dl, byte [eax + 5]
shl edx, 8
add esi, edx
xor edx, edx
mov dl, byte [eax + 4]
add esi, edx
xor edx, edx
mov dl, byte [eax + 3]
shl edx, 0x18
add ebx, edx
xor edx, edx
mov dl, byte [eax + 2]
shl edx, 0x10
add ebx, edx
xor edx, edx
mov dl, byte [eax + 1]
shl edx, 8
add ebx, edx
movzx eax, byte [eax]
add ebx, eax
sub ebx, esi
sub ebx, ecx
mov eax, ecx
shr eax, 0xd
xor ebx, eax
sub esi, ecx
sub esi, ebx
mov eax, ebx
shl eax, 8
xor esi, eax
sub ecx, ebx
sub ecx, esi
mov eax, esi
shr eax, 0xd
xor ecx, eax
sub ebx, esi
sub ebx, ecx
mov eax, ecx
shr eax, 0xc
xor ebx, eax
sub esi, ecx
sub esi, ebx
mov eax, ebx
shl eax, 0x10
xor esi, eax
sub ecx, ebx
sub ecx, esi
mov eax, esi
shr eax, 5
xor ecx, eax
sub ebx, esi
sub ebx, ecx
mov eax, ecx
shr eax, 3
xor ebx, eax
sub esi, ecx
sub esi, ebx
mov eax, ebx
shl eax, 0xa
xor esi, eax
sub ecx, ebx
sub ecx, esi
shr esi, 0xf
xor ecx, esi
mov eax, ecx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x427bec
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00406408
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 1
mov eax, dword [0x4628fc]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
push ebp
push 0x427c53
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x427c29
mov eax, dword [0x4628fc]
mov edx, dword [eax]
call dword [edx + 0x10]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3e], 0
je 0x427c3b
mov eax, dword [ebp - 4]
cmp dword [eax + 0x28], 0
je 0x427c1f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427c5a
mov eax, dword [0x4628fc]
mov edx, dword [eax]
call dword [edx + 8]
ret

Function at 0x427c6c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
call fcn.00406408
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov byte [eax + 0x30], 1
mov eax, dword [0x4628fc]
mov edx, dword [eax]
call dword [edx + 0xc]
xor eax, eax
push ebp
push 0x427cca
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x427ca9
mov eax, dword [0x4628fc]
mov edx, dword [eax]
call dword [edx + 0x10]
mov eax, dword [ebp - 4]
cmp dword [eax + 0x3e], 0
jne 0x427c9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x427cd1
mov eax, dword [0x4628fc]
mov edx, dword [eax]
call dword [edx + 8]
ret
Function at 0x429190
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov edi, dword [ebp + 0xc]
xor eax, eax
push ebp
push 0x429369
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x42777c]
call fcn.0040d73c
mov ebx, eax
mov eax, dword [ebp + 0x10]
mov dword [ebx + 8], eax
mov eax, dword [0x4628fc]
mov edx, dword [eax]
call dword [edx + 0xc]
xor ecx, ecx
push ebp
push 0x429347
push dword fs:[ecx]
mov dword fs:[ecx], esp
xor ecx, ecx
push ebp
push 0x429320
push dword fs:[ecx]
mov dword fs:[ecx], esp
test edi, edi
jne 0x429205
call fcn.00406408
mov eax, dword [eax + 8]
jmp 0x429207
mov eax, edi
cmp dword [ebp + 8], 0
je 0x429215
mov edx, dword [ebp + 8]
mov dword [ebx + 0x31], edx
jmp 0x42921b
mov edx, dword [eax + 0x31]
mov dword [ebx + 0x31], edx
mov edx, dword [eax + 0x3e]
test edx, edx
jne 0x42922a
mov dword [ebx + 0x36], ebx
mov dword [eax + 0x3e], ebx
jmp 0x429236
mov edx, dword [edx + 0x36]
mov dword [ebx + 0x36], edx
mov edx, dword [eax + 0x3e]
mov dword [edx + 0x36], ebx
inc dword [0x4628ec]
mov edx, dword [0x4628ec]
mov dword [ebx + 0x42], edx
mov edx, dword [ebp - 4]
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], esi
xor edx, edx
mov dword [ebx + 0x3e], edx
mov dword [ebx + 0x3a], eax
mov byte [ebx + 0x35], 1
lea edx, [ebp - 0x10]
mov eax, esi
call fcn.0040c8a8
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0xc]
mov edx, 0x429384
call fcn.0040481c
mov ecx, dword [ebp - 0xc]
mov dl, 1
mov eax, dword [0x427530]
call fcn.0040d878
mov dword [ebx + 0x24], eax
add dword [ebp - 8], 0xf4240
push ebx
push 4
lea eax, [ebx + 0x14]
push eax
mov ecx, 0x428e40
mov edx, dword [ebp - 8]
xor eax, eax
call fcn.004044c4
mov dword [ebx + 0x18], eax
mov eax, dword [ebx + 0x18]
test eax, eax
je 0x4292b2
cmp eax, 0xffffffff
jne 0x4292cb
mov edx, 0x42939c
mov ecx, 0x4293b4
mov eax, 0x7e9
call fcn.00427a14
call fcn.00403ecc
cmp dword [ebp + 0x18], 0
je 0x4292d9
mov edx, dword [ebp + 0x14]
mov eax, ebx
call dword [ebp + 0x18]
cmp dword [0x46156c], 0
je 0x4292ea
mov eax, ebx
call dword [0x46156c]
mov eax, dword [0x462904]
cmp eax, dword [0x462908]
je 0x429306
mov eax, dword [0x462908]
push eax
mov eax, dword [ebx + 0x18]
push eax
call sub.kernel32.dll_SetThreadAffinityMask
mov byte [ebx + 0x35], 0
mov eax, dword [ebx + 0x18]
push eax
call sub.kernel32.dll_ResumeThread
cmp eax, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x42932f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42934e
mov eax, dword [0x4628fc]
mov edx, dword [eax]
call dword [edx + 8]
ret
Function at 0x429fb8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42a06f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov ecx, 0x42a084
mov edx, ebx
call fcn.0040481c
push 0
push 0
lea eax, [ebp - 0xc]
call fcn.00404a10
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov dword [ebp - 8], eax
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x42a052
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.0040cd00
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0xc]
call fcn.00404a10
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0040c3d8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42a059
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040268c
ret

Function at 0x42af80
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x42b051
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.kernel32.dll_GetEnvironmentStringsA
mov ebx, eax
jmp 0x42b02d
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040c3d8
mov edx, dword [ebp - 4]
mov al, 0x3d
call fcn.0040c8c8
mov esi, eax
cmp esi, 1
jle 0x42b01a
lea ecx, [ebp - 0xc]
mov edx, esi
dec edx
mov eax, dword [ebp - 4]
call fcn.004107ec
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0041c754
mov edx, dword [ebp - 8]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00404564
lea ecx, [ebp - 0x14]
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.00410864
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.0041c754
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
call fcn.00404564
mov eax, dword [ebp + 8]
add eax, 0xffffffe4
call fcn.0040ccdc
mov eax, dword [ebp - 4]
call fcn.004047d0
add ebx, eax
jmp 0x42b027
inc ebx
cmp byte [ebx], 0
jne 0x42b026
inc ebx
cmp byte [ebx], 0
jne 0x42afa6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b058
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00404534
ret

Function at 0x42b498
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b530
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
test eax, eax
jne 0x42b4de
mov eax, ebx
call fcn.00404510
jmp 0x42b512
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
call fcn.00404708
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0041c754
mov edx, dword [ebp - 0x10c]
mov eax, ebx
mov ecx, 0x42b544
call fcn.0040481c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b537
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404534
ret
Function at 0x42b548
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push ebx
xor edx, edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x110], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42b5e0
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x105
lea eax, [ebp - 0x105]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
test eax, eax
jne 0x42b58e
mov eax, ebx
call fcn.00404510
jmp 0x42b5c2
lea eax, [ebp - 0x110]
lea edx, [ebp - 0x105]
call fcn.00404708
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0041c754
mov edx, dword [ebp - 0x10c]
mov eax, ebx
mov ecx, 0x42b5f4
call fcn.0040481c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b5e7
lea eax, [ebp - 0x110]
mov edx, 2
call fcn.00404534
ret

Function at 0x42d784
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
xor eax, eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x124], eax
mov dword [ebp - 0x118], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x110], eax
xor eax, eax
push ebp
push 0x42d8ed
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x110]
mov eax, dword [0x462718]
call fcn.0042cdf8
mov eax, dword [ebp - 0x110]
lea edx, [ebp - 0x10c]
call fcn.0042c728
mov edx, dword [ebp - 0x10c]
mov eax, 0x462930
call fcn.00404564
lea edx, [ebp - 0x114]
mov eax, dword [0x462930]
call fcn.0042c140
mov edx, dword [ebp - 0x114]
mov eax, 0x46293c
call fcn.00404564
lea eax, [ebp - 0x11c]
call fcn.0042b2fc
mov eax, dword [ebp - 0x11c]
lea edx, [ebp - 0x118]
call fcn.0042c140
mov edx, dword [ebp - 0x118]
mov eax, 0x462934
call fcn.00404564
mov eax, 0x462938
mov edx, dword [0x462934]
call fcn.00404564
mov eax, 0x462940
mov edx, dword [0x46293c]
call fcn.00404564
mov eax, 0x462944
mov edx, dword [0x46293c]
call fcn.00404564
mov eax, 0x462948
mov edx, dword [0x46293c]
call fcn.00404564
lea eax, [ebp - 0x105]
push eax
push 0
push 0
push 0x23
push 0
call sub.SHFolder.dll_SHGetFolderPathA
lea edx, [ebp - 0x124]
lea eax, [ebp - 0x105]
call fcn.0040c3d8
mov eax, dword [ebp - 0x124]
lea edx, [ebp - 0x120]
call fcn.0041c754
mov edx, dword [ebp - 0x120]
mov eax, 0x46294c
mov ecx, 0x42d900
call fcn.0040481c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42d8f4
lea eax, [ebp - 0x124]
mov edx, 7
call fcn.00404534
ret
Function at 0x43b854
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov esi, dword [esi + 0xc]
mov edi, dword [ebp + 8]
mov edi, dword [edi + 8]
xor eax, eax
push ebp
push 0x43b9b1
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
xor ebx, ebx
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, esi
mov ecx, 0x43b9c8
call fcn.0040481c
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, esi
call fcn.00404a10
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43b996
xor eax, eax
push ebp
push 0x43b98f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xff
mov eax, esi
mov edx, 0xfe
call fcn.00404b48
mov dword [ebp - 4], 0xff
mov eax, edi
mov edx, 0xfe
call fcn.00404b48
lea eax, [ebp - 4]
push eax
mov eax, edi
call fcn.00404a10
push eax
lea eax, [ebp - 0x10]
push eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.00404a10
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumValueA
cmp eax, 0x103
je 0x43b978
mov eax, esi
call fcn.00404a10
lea ecx, [ebp - 0x14]
mov edx, dword [ebp - 8]
call fcn.0040c36c
mov edx, dword [ebp - 0x14]
mov eax, esi
call fcn.00404564
mov eax, edi
call fcn.00404a10
lea ecx, [ebp - 0x18]
mov edx, dword [ebp - 4]
call fcn.0040c36c
mov edx, dword [ebp - 0x18]
mov eax, edi
call fcn.00404564
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
call fcn.0040ccdc
inc ebx
jmp 0x43b8cf
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b996
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43b9b8
lea eax, [ebp - 0x18]
mov edx, 2
call fcn.00404534
ret
Function at 0x43b9f8
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x10], eax
mov esi, dword [ebp + 8]
mov esi, dword [esi + 8]
lea edi, [ebp - 4]
xor eax, eax
push ebp
push 0x43bb1c
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0xffffffff
xor ebx, ebx
mov eax, dword [ebp + 8]
mov edx, dword [eax - 4]
mov eax, esi
mov ecx, 0x43bb34
call fcn.0040481c
lea eax, [ebp - 0xc]
push eax
push 8
push 0
mov eax, esi
call fcn.00404a10
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 8]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x43bb06
xor eax, eax
push ebp
push 0x43baff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xfe
mov eax, esi
mov edx, 0xff
call fcn.00404b48
mov dword [edi], 0xfe
lea eax, [ebp - 0x10]
mov edx, 0xff
call fcn.00404b48
push 0
push edi
lea eax, [ebp - 0x10]
call fcn.00404a10
push eax
push 0
lea eax, [ebp - 8]
push eax
mov eax, esi
call fcn.00404a10
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp eax, 0x103
je 0x43bae8
mov eax, esi
mov edx, dword [ebp - 8]
call fcn.00404b48
lea eax, [ebp - 0x10]
mov edx, dword [edi]
call fcn.00404b48
mov eax, dword [ebp + 8]
mov eax, dword [eax - 0xc]
mov edx, dword [ebp - 0xc]
mov dword [eax], edx
mov eax, dword [ebp + 8]
add eax, 0xffffffe0
call fcn.0040ccdc
inc ebx
jmp 0x43ba6a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43bb06
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43bb23
lea eax, [ebp - 0x10]
call fcn.00404510
ret

Function at 0x45eed8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov esi, edx
mov ebx, eax
mov eax, esi
call fcn.00404510
lea eax, [ebp - 4]
push eax
push ebx
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov ebx, eax
test ebx, ebx
jne 0x45ef26
lea eax, [ebp - 0x109]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x45ef26
mov eax, esi
lea edx, [ebp - 0x109]
mov ecx, 0x105
call fcn.00404780
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x45ef2c
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404510
lea eax, [ebp - 4]
push eax
push esi
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x45ef80
push 0x208
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, ebx
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00404780
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x430005
Capabilities:
Encode data using xor

Disassembly:
pushal
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
je 0x430072
nop
nop
nop
nop
mov ebx, 0x408ed0
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x65d17f29
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x430060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e1d0
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x5cba593e
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x401790
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x402893
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push 7
push esi
push 0x405280
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], esi
call fcn.00401eb0
cmp eax, esi
jge 0x4017e4
cmp eax, 0x80004002
je 0x4017e4
push eax
call fcn.00402537
mov dword [ebp - 4], esi
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call sub.MFC42.DLL_CString::CString
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push esi
push ebx
lea eax, [ebp - 0x1c]
push str.ProviderMicrosoft.Jet.OLEDB.4.0_Data_Source_s_Jet_OLEDB:Database_Password_s
push eax
mov byte [ebp - 4], 2
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::CString
push 0x104
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 3
call sub.MFC42.DLL_CString::GetBuffer
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.Tmp.mdb
lea ecx, [ebp - 0x18]
call sub.MFC42.DLL_CString::operator
lea ecx, [ebp - 0x24]
call sub.MFC42.DLL_CString::CString
mov ecx, dword [ebp - 0x18]
push esi
push ecx
lea edx, [ebp - 0x24]
push str.ProviderMicrosoft.Jet.OLEDB.4.0_Data_Source_s_Jet_OLEDB:Engine_Type5_Jet_OLEDB:Database_Password_s
push edx
mov byte [ebp - 4], 4
call sub.MFC42.DLL_CString::Format
add esp, 0x10
lea ecx, [ebp - 0x24]
call fcn.00401c80
push ecx
mov esi, eax
mov dword [ebp + 0xc], esp
mov edi, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov ecx, eax
add esp, 4
mov dword [ebp + 8], ecx
test ecx, ecx
mov byte [ebp - 4], 5
je 0x40189d
push esi
call fcn.00401b70
jmp 0x40189f
xor eax, eax
test eax, eax
mov byte [ebp - 4], 4
mov dword [edi], eax
jne 0x4018b3
push 0x8007000e
call fcn.00402537
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 6
call fcn.00401c80
push ecx
mov ecx, esp
mov dword [ebp + 8], esp
push eax
call fcn.00401a80
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 7
call fcn.00401e90
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00401c90
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call esi
mov eax, dword [ebp - 0x18]
push 0
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov ecx, dword [ebp - 0x18]
push ecx
call esi
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x401912
push 0x80004003
call fcn.00402537
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [ebp - 0x20]
push 0
push 0x4051b0
push 0x40518c
mov dword [ebp - 0x14], 0
call sub.MFC42.DLL_CWnd::MessageBoxA
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 3
call fcn.00402030
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00402030
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 1
call fcn.00402030
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x40196b
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8