joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4099ab
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x409a00
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
push 1
push dword [ebp - 0x38]
push 0x4e18
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0x3fb1
push dword [ebp - 0x44]
push 0x7055
push 0x2f7c
call fcn.00409baa
add esp, 0x24
jmp 0x409ba6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 8], 0x327439cb
mov dword [ebp - 0xc], 0xfffffff9
mov dword [ebp - 0x48], 0x3700168a
mov dword [ebp - 0x4c], 0xfffffffb
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 8]
cmp dword [ebp - 0xc], eax
jge 0x409a60
mov dword [ebp - 0x18], 1
jmp 0x409a64
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
jne 0x409a81
mov dword [ebp - 0x10], 1
jmp 0x409a85
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0xcd9d75
jle 0x409a97
mov dword [ebp - 0x14], 1
jmp 0x409a9b
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
jge 0x409aac
mov dword [ebp - 0x1c], 1
jmp 0x409ab0
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
je 0x409ac1
mov dword [ebp - 0x20], 1
jmp 0x409ac5
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
cmp dword [ebp - 8], eax
jl 0x409adc
mov dword [ebp - 0x24], 1
jmp 0x409ae0
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x24], eax
jle 0x409af1
mov dword [ebp - 0x28], 1
jmp 0x409af5
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x28], eax
jl 0x409b06
mov dword [ebp - 0x2c], 1
jmp 0x409b0a
and dword [ebp - 0x2c], 0
cmp dword [ebp - 0x2c], 0xcbe9
jne 0x409b1c
mov dword [ebp - 0x30], 1
jmp 0x409b20
and dword [ebp - 0x30], 0
imul eax, dword [ebp - 0x30], 0x9150
cmp eax, 1
je 0x409b35
mov dword [ebp - 0x34], 1
jmp 0x409b39
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x4c], eax
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x409b63
push 0x3a2
push 0
push 0
push 0
push 0
push 0x1761
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x645d
push 0x41bb
push 0x6eb7
push 1
push 0x6050
push dword [ebp - 0x50]
push 0x6073
push 0
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push 0x245b
mov eax, dword [ebp - 0x5c]
movzx eax, byte [eax]
push eax
push dword [ebp - 0x60]
push dword [ebp - 0x64]
push dword [ebp - 0x68]
call fcn.00409ecc
add esp, 0x3c
mov esp, ebp
pop ebp
ret
Function at 0x41a05f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4ca76b
call fcn.004ca220
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 0x71cf
cmp dword [ebp - 0x1c], 0x74cc
jle 0x41a0e6
push 0
push 0x6b3
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
lea ebx, [edi + esi]
mov dword [ebp - 0x14], 0x6a4c
xor esi, esi
mov eax, ebx
xor eax, esi
cdq
push edx
push eax
mov ecx, 0xa9b358
call fcn.0040b8d9
inc esi
cmp esi, 0x1b39
jl 0x41a0ab
dec ebx
dec dword [ebp - 0x14]
jne 0x41a0a9
inc edi
cmp edi, 0x60e4
mov esi, dword [ebp - 0x18]
jl 0x41a09f
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3129
jl 0x41a09d
mov ebx, dword [ebp - 0x20]
dec dword [ebx]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x713c
jge 0x41a104
mov edx, str.yvqe_pxgtbt_xfc
mov ecx, 0xa9b358
call fcn.0040e54d
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41ea4f
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x41ea77
push 0x3a2
push 0
push 0
push 0
push 0
push 0x1761
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esp, ebp
pop ebp
ret
Function at 0x4307a6
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x4308b5
lea eax, [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x430857
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43084d
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x430818
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0x1c
jne 0x43084b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x430849
push 0x354a
push 0xe83
push 1
push 0x1a66
push 0
push 1
call fcn.0045ce9f
add esp, 0x18
jmp 0x43080d
jmp 0x430855
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x4308b3
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push 0x1522
push 0x527
push 0x360
push 0x289
push 0x5835
push 0x2d0b
push 0x1c02
push 0x789e
push 0x139c
push dword [ebp - 0x30]
push 0x6b2f
push 0x2954
push 0
push 1
push 0x7cb4
push 0
call fcn.004264cc
add esp, 0x44
jmp 0x430919
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x4308f1
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
push 0
push 0x534f
push dword [ebp - 0x3c]
call fcn.004686e3
add esp, 0xc
jmp 0x430919
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
push 0x6662
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 0x7d1b
push 0
push 0
call fcn.00428991
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x43bf06
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x43bfd1
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x43bfb7
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x43bfa3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0
je 0x43bf8e
mov eax, 0xffff
test eax, eax
je 0x43bf8e
mov dword [ebp - 4], 1
jmp 0x43bf92
and dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x30]
call fcn.0040bd1c
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x43bfb5
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x43bfcf
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0x754d
push dword [ebp - 0x38]
push 0
call fcn.0046b16c
add esp, 0xc
jmp 0x43c037
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x3c]
push 0x79a
push 0x3e24
push 0x4d44
push 0x60f5
push 0x2d46
push 0x13a5
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x6404
push 0xf8a
push dword [ebp - 0x48]
push 0x3426
push 0
push dword [ebp - 0x4c]
push 1
call fcn.00442495
add esp, 0x40
mov esp, ebp
pop ebp
ret
Function at 0x43c1b7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x43c251
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x43c23e
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x43c22b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x43c229
push 0x2aeb
push 0
push 1
push 1
push 0xdaf
call fcn.00455913
add esp, 0x14
jmp 0x43c23c
push 0
push 0x311
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x43c24f
push 0x4527
push 0
push 1
call fcn.0046e0d2
add esp, 0xc
jmp 0x43c285
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push 0x6f5c
push dword [ebp - 0x20]
push 0x608f
push 1
push 0x7af8
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.00427532
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x442274
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
movzx eax, byte [ebp + 0x30]
test eax, eax
je 0x44236c
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x40]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x442321
mov eax, dword [ebp - 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push 0x1f76
push dword [ebp - 0x2c]
push 0x3a0b
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.004423a8
add esp, 0x28
jmp 0x44236a
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x442359
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x442357
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x44236a
push 0
push 0
push 0x1f05
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x4423a4
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
push 0x7418
push 0x4fd
push 1
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push dword [ebp - 0x64]
call fcn.004355e0
add esp, 0x1c
mov esp, ebp
pop ebp
ret
Function at 0x44f733
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4cab85
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x44f8b2
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x41ef
mov dword [ebp - 0x34], str.erks_sbrnyz_fvicyby_ztzktdub_szjpp_rscvgrygx
cmp dword [ebp - 0x24], 0x43ee
jle 0x44f81b
push 0x15b8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
and dword [ebp - 0x14], 0
jmp 0x44f7a2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x56e3
jge 0x44f81b
and dword [ebp - 0x18], 0
jmp 0x44f7b8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2c5a
jge 0x44f819
and dword [ebp - 0x1c], 0
jmp 0x44f7ce
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x578d
jge 0x44f817
and dword [ebp - 0x20], 0
jmp 0x44f7e4
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x13dc
jge 0x44f815
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x20]
and eax, ecx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0xa9b358
call fcn.0040b8d9
jmp 0x44f7dd
jmp 0x44f7c7
jmp 0x44f7b1
jmp 0x44f79b
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x44f83b
push 0x32c5
push 1
push 0x389d
call fcn.0044f91f
add esp, 0xc
jmp 0x44f870
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
push 0x2264
push 0x435e
push 1
push 1
push 0x2b0
push 0xc89
push 0x2852
push 0x720b
push dword [ebp - 0x30]
push 0
call fcn.004377d7
add esp, 0x28
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3ecd
jge 0x44f88a
mov edx, dword [ebp - 0x34]
mov ecx, 0xa9b358
call fcn.0040e54d
jmp 0x44f8a6
or dword [ebp - 4], 0xffffffff
jmp 0x44f8b0
jmp 0x44f90e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0x2a8a
push 1
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0x1f4f
call fcn.004282a3
add esp, 0x2c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44f9a9
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x44faa6
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x44fa56
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x44fa09
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x44fa54
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x44fa37
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x44fa54
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0040bd1c
mov dword [eax], 0xce3d9786
jmp 0x44fa2c
jmp 0x44faa4
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push 1
push 0x5116
push 0x70c5
push 0x663a
push 0x6dff
push dword [ebp - 0x34]
push 0x6c41
push 0x71a8
push 0x48ec
push 0x6707
push 1
push 0x657b
push 0x510d
push 0x6b5f
push 1
call fcn.0042a41f
add esp, 0x3c
jmp 0x44fac7
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0
push 0x24d4
call fcn.0045cda7
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x451688
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x451745
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x451709
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x4516e6
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
jmp 0x451707
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x451707
push 0x151
call dword [sym.imp.USER32.dll_IsZoomed]
jmp 0x451740
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
push 0x133f
push 0x5dd1
push 1
push 0x2bb5
push 0x3c2f
push dword [ebp - 0x2c]
push 0
push 0x3a7e
push dword [ebp - 0x30]
call fcn.00425c40
add esp, 0x24
jmp 0x45180c
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x45179b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
push 0x66bd
push 0x5caa
push dword [ebp - 0x40]
push 0
push dword [ebp - 0x44]
call fcn.0042a226
add esp, 0x14
jmp 0x45180c
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x4517c1
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x45180c
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x64]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4517ef
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x45180c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x68]
call fcn.0040bd1c
mov dword [eax], 0xe48d327c
jmp 0x4517e4
mov esp, ebp
pop ebp
ret
Function at 0x453755
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
movzx eax, byte [ebp + 0x38]
test eax, eax
je 0x45382f
lea eax, [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x453801
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4537ca
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4537ff
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.0040bd1c
mov esi, eax
mov eax, dword [ebp - 0x2c]
push dword [eax]
mov ecx, dword [ebp - 4]
call fcn.0040bd1c
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x45382d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 1
push 0x1971
push 1
push 0x1d02
push 0
push 1
push dword [ebp - 0x3c]
call fcn.0043d9de
add esp, 0x20
jmp 0x45386f
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
call fcn.00443b44
add esp, 0x1c
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x45593b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x455a29
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x4559f4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x4559de
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x4559bf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x4559dc
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.0040bd1c
mov dword [eax], 0xde1fc657
jmp 0x4559b4
jmp 0x4559f2
push 0x23a3
push 0
push 0x2661
push 0
call dword [sym.imp.USER32.dll_LoadStringA]
jmp 0x455a27
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x455a17
push 0
push 0x311
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x455a27
push 0x63d
push 0xcae
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x455a5b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x4b8d
push 0x7b02
push 0x45a5
push 0
push 1
push 0x3091
call fcn.0046a212
add esp, 0x20
mov esp, ebp
pop ebp
ret