joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4604cf
Capabilities:
Get file size
Write clipboard data

Disassembly:
sub esp, 0x24
push ebx
push ebp
push esi
push edi
xor edi, edi
mov dword [esp + 0x10], edi
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov esi, dword [0x4219c0]
sub esi, dword [0x4219cc]
mov ebx, eax
add esi, dword [esp + 0x38]
add ebx, 0x1f4
cmp esi, edi
jle 0x4606a0
push dword [0x4219c8]
call fcn.004604b8
push edi
push edi
push dword [0x4219cc]
push dword [0x409054]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [0x41d9b8], esi
mov dword [0x41d9b0], edi
mov eax, dword [0x4219c4]
sub eax, dword [0x4219c8]
mov ebp, 0x4000
cmp eax, ebp
jg 0x460543
mov ebp, eax
push ebp
mov esi, 0x41d9c0
push esi
call fcn.00460486
test eax, eax
je 0x4606ac
add dword [0x4219c8], ebp
mov dword [0x415940], esi
mov dword [0x415944], ebp
cmp dword [0x424b60], edi
je 0x4605f5
cmp dword [0x424c00], edi
jne 0x4605f5
cmp dword [esp + 0x10], edi
je 0x4605c2
mov eax, dword [0x41d9b8]
sub eax, dword [0x4219c0]
mov esi, dword [sym.imp.USER32.dll_SetTimer]
sub eax, dword [esp + 0x38]
add eax, dword [0x4219cc]
mov dword [0x41d9b0], eax
jmp 0x4605b0
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push 1
push edi
push edi
lea eax, [esp + 0x24]
push edi
push eax
call esi
test eax, eax
jne 0x4605a5
jmp 0x4605f5
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
cmp eax, ebx
jbe 0x4605f5
mov eax, dword [0x425480]
neg eax
sbb eax, eax
not eax
and eax, 0x4079a8
push eax
push 0x40523e
push edi
push 0x6f
push dword [0x425484]
call dword [sym.imp.USER32.dll_CallWindowProcA]
mov dword [esp + 0x10], eax
mov ecx, 0x415928
mov dword [0x415948], 0x4159b0
mov dword [0x41594c], 0x8000
call fcn.004616a9
test eax, eax
jl 0x4606b5
mov esi, dword [0x415948]
mov eax, 0x4159b0
sub esi, eax
je 0x46065c
push edi
lea ecx, [esp + 0x18]
push ecx
push esi
push eax
push dword [0x409054]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x4606b1
cmp esi, dword [esp + 0x14]
jne 0x4606b1
add dword [0x4219cc], esi
cmp dword [0x415944], edi
jne 0x460569
jmp 0x460668
cmp dword [0x415944], edi
jne 0x4606b5
cmp ebp, edi
je 0x4606b5
mov eax, dword [0x4219c0]
mov ecx, eax
sub ecx, dword [0x4219cc]
add ecx, dword [esp + 0x38]
test ecx, ecx
jg 0x46052d
push edi
push edi
push eax
push dword [0x409054]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [esp + 0x10], edi
je 0x4606a0
push dword [esp + 0x10]
call dword [sym.imp.USER32.dll_SetClipboardData]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x24
ret 4
or eax, 0xffffffff
jmp 0x4606a2
push 0xfffffffffffffffe
jmp 0x4606b7
push 0xfffffffffffffffd
pop eax
jmp 0x4606a2
Function at 0x4606ba
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x4606e6
mov ecx, dword [0x424bb8]
push edi
add eax, ecx
push edi
push eax
push dword [0x409054]
mov dword [0x4219c0], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push 4
pop esi
push esi
call fcn.004604cf
cmp eax, edi
jl 0x4607df
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x409054]
call ebx
test eax, eax
je 0x4607db
cmp dword [ebp - 4], esi
jne 0x4607db
push dword [ebp + 8]
add dword [0x4219c0], esi
call fcn.004604cf
cmp eax, edi
mov dword [ebp - 8], eax
jl 0x4607de
cmp dword [ebp + 0x10], edi
jne 0x4607aa
cmp dword [ebp + 8], edi
jle 0x4607d6
mov esi, 0x41d9c0
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x46075a
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x409054]
call ebx
test eax, eax
je 0x4607db
cmp edi, dword [ebp - 4]
jne 0x4607db
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test eax, eax
je 0x4607a6
cmp dword [ebp + 0x14], edi
jne 0x4607a6
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x4219c0], eax
cmp dword [ebp + 8], 0
jg 0x46074d
jmp 0x4607d6
push 0xfffffffffffffffe
jmp 0x4607dd
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x4607b5
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x409054]
call ebx
test eax, eax
je 0x4607db
mov eax, dword [ebp - 4]
add dword [0x4219c0], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x4607de
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x460b10
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0xc]
mov dword [0x4221d0], 0x44
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
cmp eax, 0xffffffff
je 0x460b34
test al, 0x10
jne 0x460b37
mov dword [ebp + 0xc], ecx
lea eax, [ebp - 0x10]
push eax
push 0x4221d0
push dword [ebp + 0xc]
push ecx
push ecx
push ecx
push ecx
push ecx
push dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
test eax, eax
je 0x460b62
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [ebp - 0x10]
leave
ret 8

Function at 0x460c1c
Capabilities:
Get file version info

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push edi
mov edi, dword [esp + 0x10]
push edi
call esi
mov ebx, eax
push ebx
call esi
cmp byte [edi], 0
je 0x460c42
cmp word [ebx], 0x5c3a
jne 0x460c42
push eax
call esi
jmp 0x460c63
cmp word [edi], 0x5c5c
jne 0x460c61
push 2
pop esi
push 0x5c
push eax
dec esi
call fcn.00460bd9
cmp byte [eax], 0
je 0x460c61
inc eax
test esi, esi
jne 0x460c4c
jmp 0x460c63
xor eax, eax
pop edi
pop esi
pop ebx
ret 4

Function at 0x460d00
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x460d64
lea eax, [ebp + 8]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 8], 0x400
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x460d53
cmp dword [ebp + 0x14], 1
je 0x460d55
cmp dword [ebp + 0x14], 2
je 0x460d55
mov byte [esi], bl
push dword [ebp + 0xc]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
pop esi
pop ebx
pop ebp
ret 0x10

Function at 0x460e18
Capabilities:
Get file version info

Disassembly:
push ebx
push ebp
mov ebp, dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
push esi
mov esi, dword [esp + 0x10]
push edi
jmp 0x460e2d
push esi
call ebp
mov esi, eax
cmp byte [esi], 0x20
je 0x460e28
cmp byte [esi], 0x5c
jne 0x460e4c
cmp byte [esi + 1], 0x5c
jne 0x460e4c
cmp byte [esi + 2], 0x3f
jne 0x460e4c
cmp byte [esi + 3], 0x5c
jne 0x460e4c
add esi, 4
cmp byte [esi], 0
je 0x460e5d
push esi
call fcn.00460bf5
test eax, eax
je 0x460e5d
inc esi
inc esi
mov ebx, esi
mov edi, esi
xor eax, eax
jmp 0x460e90
cmp al, 0x1f
jbe 0x460e8b
push eax
push 0x407b14
call fcn.00460bd9
cmp byte [eax], 0
jne 0x460e8b
push esi
call ebp
sub eax, esi
push eax
push esi
push edi
call fcn.00460c69
push edi
call ebp
mov edi, eax
push esi
call ebp
mov esi, eax
mov al, byte [esi]
test al, al
jne 0x460e65
and byte [edi], al
push edi
push ebx
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov edi, eax
mov al, byte [edi]
cmp al, 0x20
je 0x460eac
cmp al, 0x5c
jne 0x460eb3
and byte [edi], 0
cmp ebx, edi
jb 0x460e98
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret 4
Function at 0x460ebc
Capabilities:
Get file size
Read .ini file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x460ee1
mov eax, dword [0x409058]
cmp eax, 0xffffffff
je 0x460ed8
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
or dword [0x409058], 0xffffffff
jmp 0x460f55
cmp dword [0x422f58], ebx
je 0x460f55
cmp byte [0x424760], bl
je 0x460f20
cmp dword [0x409058], 0xffffffff
jne 0x460f29
push 4
push 0x40000000
push 0x424760
call fcn.00460c89
cmp eax, 0xffffffff
mov dword [0x409058], eax
je 0x460f55
push 2
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp dword [0x409058], 0xffffffff
je 0x460f55
push esi
push str.CreateFileA
mov esi, 0x422f60
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
lea eax, [ebp + 8]
push eax
push esi
call sub.KERNEL32.dll_GetExitCodeProcess
push eax
push esi
push dword [0x409058]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
pop esi
pop ebx
pop ebp
ret 4

Function at 0x460f76
Capabilities:
Create directory
Get common file path

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push 0x8001
call esi
mov edi, 0x422a18
push edi
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0
mov ebx, eax
call esi
cmp ebx, 0xffffffff
je 0x460fac
push ebx
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
jmp 0x460fae
xor eax, eax
pop edi
pop esi
pop ebx
ret 4

Function at 0x460fb4
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call sub.KERNEL32.dll_GetExitCodeProcess
add eax, esi
push eax
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
cmp byte [eax], 0x5c
je 0x460fda
push 0x407634
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop esi
ret 4
Function at 0x4610c9
Capabilities:
Delete directory
Get file size
Query environment variable
Read .ini file
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x4073b8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
test eax, eax
mov esi, dword [esp + 0x18]
je 0x461101
push 0x407b4c
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
je 0x461101
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x461246
test esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov dword [0x422618], 0x4c554e
mov edi, 0x400
mov ebp, 0x422618
je 0x461145
push 1
push 0
push esi
call fcn.00460c89
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x46124c
cmp eax, edi
jg 0x46124c
push edi
mov esi, 0x421dd0
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x46124c
cmp eax, edi
jg 0x46124c
push esi
push ebp
push 0x407b44
push 0x4219d0
call dword [sym.imp.USER32.dll_DefWindowProcA]
add esp, 0x10
push 0x3f0
push esi
mov ebp, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0x407b34
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edi, edi
push edi
push 0x8000080
push 4
push edi
push edi
push 0xc0000000
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x461246
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push edi
mov esi, eax
lea eax, [esi + ebp + 0xa]
push eax
push edi
push 4
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, edi
mov dword [esp + 0x14], eax
je 0x46122e
push edi
push edi
push edi
push 2
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x461222
push 0x407b28
push edi
call fcn.0046107d
test eax, eax
jne 0x461253
push 0x407b28
lea eax, [edi + esi]
push eax
call sub.KERNEL32.dll_WaitForSingleObject
add esi, 0xa
mov eax, esi
push ebp
push 0x4219d0
add eax, edi
push eax
call fcn.00460c69
push edi
add esi, ebp
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edi, edi
push edi
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
inc dword [0x424bf0]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x407b24
add eax, 0xa
push eax
call fcn.0046107d
test eax, eax
je 0x461209
inc eax
lea edx, [edi + esi]
cmp eax, edx
mov ecx, eax
jae 0x46127c
mov dl, byte [ecx]
mov byte [ecx + ebp], dl
inc ecx
lea edx, [edi + esi]
cmp ecx, edx
jb 0x46126f
sub eax, edi
jmp 0x46120b
Function at 0x461280
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0xc]
test eax, eax
jge 0x46129e
mov ecx, dword [0x424c68]
lea eax, [eax*4 + 4]
sub ecx, eax
mov eax, dword [ecx]
mov ecx, dword [0x424b98]
push ebx
lea ebx, [eax + ecx]
mov ecx, dword [ebp + 8]
mov eax, 0x423f60
sub ecx, eax
cmp ecx, 0x800
push edi
mov edi, eax
jae 0x4612c4
mov edi, dword [ebp + 8]
and dword [ebp + 8], 0
mov dl, byte [ebx]
test dl, dl
je 0x461497
push esi
mov ecx, edi
sub ecx, eax
cmp ecx, 0x400
jge 0x461496
inc ebx
cmp dl, 0xfc
mov dword [ebp + 0xc], ebx
jbe 0x46147a
movsx eax, byte [ebx + 1]
movsx ecx, byte [ebx]
mov esi, eax
and esi, 0x7f
mov ebx, ecx
and ebx, 0x7f
shl esi, 7
or esi, ebx
mov ebx, 0x8000
mov dword [ebp - 0x10], eax
or eax, ebx
mov dword [ebp - 0x18], ecx
or ecx, ebx
mov ebx, dword [ebp + 0xc]
push 2
mov dword [ebp - 0xc], eax
pop eax
add ebx, eax
cmp dl, 0xfe
mov dword [ebp - 0x14], ecx
jne 0x461426
and dword [ebp - 4], 0
and dword [ebp + 0xc], 0
and byte [edi], 0
cmp dword [ebp - 0x10], 4
jne 0x461343
mov dword [ebp - 4], 0x407bb8
mov dword [ebp + 0xc], eax
mov esi, dword [ebp - 0x18]
cmp esi, 0x2b
jne 0x461360
push edi
push 0x407ba8
push 0x407b7c
push 0x80000002
call fcn.00460d00
cmp esi, 0x26
jne 0x46138e
push edi
push 0x407b6c
push 0x407b7c
push 0x80000002
call fcn.00460d00
cmp byte [edi], 0
jne 0x461409
push 0x407b58
push edi
call sub.KERNEL32.dll_WaitForSingleObject
cmp esi, 0x25
jne 0x46139f
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp esi, 0x24
jne 0x4613b0
push 0x400
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp byte [edi], 0
jne 0x461409
cmp dword [0x424be4], 0
mov dword [ebp + 0xc], 4
jne 0x4613ce
mov dword [ebp + 0xc], 2
jmp 0x461409
dec dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push dword [ebp + eax*4 - 0x18]
push dword [0x425480]
call dword [0x407168]
test eax, eax
jne 0x461406
push edi
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_ScreenToClient]
push dword [ebp - 8]
mov esi, eax
call fcn.00460ae5
test esi, esi
jne 0x46140f
jmp 0x461409
and byte [edi], 0
cmp dword [ebp + 0xc], 0
jne 0x4613ce
cmp byte [edi], 0
je 0x461457
cmp dword [ebp - 4], 0
je 0x461457
push dword [ebp - 4]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x461457
cmp dl, 0xfd
jne 0x461467
cmp esi, 0x1b
jne 0x46143e
push dword [0x425480]
push edi
call fcn.00460d6a
jmp 0x46144f
mov eax, esi
shl eax, 0xa
add eax, 0x426000
push eax
push edi
call sub.KERNEL32.dll_WaitForSingleObject
add esi, 0xffffffeb
cmp esi, 6
jae 0x46145d
push edi
call fcn.00460e18
push edi
call sub.KERNEL32.dll_GetExitCodeProcess
add edi, eax
jmp 0x461487
cmp dl, 0xff
jne 0x461487
or eax, 0xffffffff
sub eax, esi
push eax
push edi
call fcn.00461280
jmp 0x46145d
jne 0x461484
mov al, byte [ebx]
mov byte [edi], al
inc edi
inc ebx
jmp 0x461487
mov byte [edi], dl
inc edi
mov dl, byte [ebx]
test dl, dl
mov eax, 0x423f60
jne 0x4612cf
pop esi
and byte [edi], 0
cmp dword [ebp + 8], 0
pop edi
pop ebx
je 0x4614b1
push 0x400
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
leave
ret 8
Function at 0x4614b5
Capabilities:
Create directory
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00461005
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], eax
mov dword [ebp + 8], ebx
je 0x4614ea
test eax, eax
je 0x461682
test byte [ebp + 0xc], 2
je 0x461619
push edi
mov esi, 0x422b58
push esi
call sub.KERNEL32.dll_WaitForSingleObject
test ebx, ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
je 0x46150a
push 0x407cb0
push esi
call ebx
jmp 0x461510
push edi
call fcn.00460fe0
push 0x407634
push edi
call ebx
push edi
call sub.KERNEL32.dll_GetExitCodeProcess
mov ebx, eax
lea eax, [ebp - 0x144]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esi, eax
cmp esi, 0xffffffff
je 0x46160f
cmp byte [ebp - 0x118], 0x2e
jne 0x46155e
cmp byte [ebp - 0x117], 0x2e
je 0x4615f2
cmp byte [ebp - 0x117], 0
je 0x4615f2
lea eax, [ebp - 0x118]
push eax
push ebx
call sub.KERNEL32.dll_WaitForSingleObject
test byte [ebp - 0x144], 0x10
je 0x461589
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x4615f2
push dword [ebp + 0xc]
push edi
call fcn.004614b5
jmp 0x4615f2
push edi
push 0x407c94
call fcn.00460f5a
mov eax, dword [ebp - 0x144]
pop ecx
pop ecx
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call dword [sym.imp.KERNEL32.dll_MulDiv]
test eax, eax
push edi
jne 0x4615eb
test byte [ebp + 0xc], 4
je 0x4615d7
push 0x407c70
call fcn.00460f5a
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.0045d96f
push 0
push edi
call fcn.004610c9
jmp 0x4615f2
push 0x407c50
call fcn.00460f5a
inc dword [0x424be8]
pop ecx
pop ecx
jmp 0x4615f2
push 0xfffffffffffffff2
call fcn.0045d96f
lea eax, [ebp - 0x144]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x46153b
push esi
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp + 8], 0
je 0x461619
and byte [ebx - 1], 0
xor esi, esi
cmp dword [ebp - 4], esi
je 0x461682
cmp dword [ebp + 8], esi
je 0x461682
push edi
call fcn.00460fb4
push edi
push 0x407c30
call fcn.00460f5a
pop ecx
pop ecx
push edi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
push edi
jne 0x46167b
test byte [ebp + 0xc], 4
je 0x461667
push 0x407c08
call fcn.00460f5a
pop ecx
pop ecx
push edi
push 0xfffffffffffffff1
call fcn.0045d96f
push esi
push edi
call fcn.004610c9
jmp 0x461682
push 0x407be4
call fcn.00460f5a
inc dword [0x424be8]
pop ecx
pop ecx
jmp 0x461682
push 0xffffffffffffffe5
call fcn.0045d96f
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x413bd0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48bf8b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.0047e6d6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x413c52
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.0047bcba
mov eax, dword [eax]
push 0x588210
push eax
call fcn.0046e614
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.0047e961
test bl, bl
je 0x413c52
push 0x588210
lea ecx, [esp + 0xc]
call fcn.0047ed3d
push 0x58bd8c
lea ecx, [esp + 0xc]
call fcn.0047ed3d
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x413c8e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.0047e961
jmp 0x413d59
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x413d12
lea edx, [esp + 0x7c]
push 0x58bd88
push edx
call fcn.0046e614
add esp, 8
test eax, eax
je 0x413d12
lea eax, [esp + 0x7c]
push 0x58bd84
push eax
call fcn.0046e614
add esp, 8
test eax, eax
je 0x413d12
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x413ca2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.0047e961
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x414fb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x415012
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x415020
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x48c0eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x598638]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x415158
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x415086
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047e961
xor eax, eax
jmp 0x4151cf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.0047eaea
push esi
lea ecx, [esp + 0xc]
call fcn.0047ed79
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x4151ad
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.00414fb0
test eax, eax
jne 0x4151ad
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.00414fb0
test eax, eax
jne 0x4151ad
lea eax, [esp + 0x14]
push 0x58bda0
push eax
call fcn.0046f6f0
mov esi, eax
add esp, 8
test esi, esi
jne 0x41518c
lea ecx, [esp + 0x14]
push 0x58bd9c
push ecx
call fcn.0046f670
mov esi, eax
add esp, 8
test esi, esi
jne 0x41518c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x41518f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.0047ea9a
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x41509e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.0047e961
xor eax, eax
jmp 0x4151cf
mov byte [esi], 0
push 0x58bd98
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.0047e961
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4