joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454198
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x454343
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x454324
mov dl, 1
mov eax, dword [0x412508]
call fcn.004032ac
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004040b0
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x454313
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.004421a4
test al, al
je 0x454306
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x454354
lea eax, [ebp - 0x254]
call fcn.00409030
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x454306
xor eax, eax
push ebp
push 0x4542ff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x45438c
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4542e8
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404320
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4542e8
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404320
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x454306
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x454209
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416444
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45434a
lea eax, [ebp - 0x260]
call fcn.004040b0
ret

Function at 0x454c78
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x467be8]
cmp byte [eax + 0xa5], 0
jne 0x454ce9
cmp dword [0x467c00], 0
jne 0x454caa
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x454c34
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x467c00], eax
cmp dword [0x467bfc], 0
jne 0x454cc5
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x467bfc], eax
cmp dword [0x467c04], 0
jne 0x454ce9
push esp
push 0
push 0
push 0x454bd8
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread_1
mov dword [0x467c04], eax
pop edx
ret
Function at 0x454de0
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x454df7
add esp, 0xfffffff0
call fcn.00403600
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a85c
mov eax, dword [0x4667f8]
cmp word [eax + 2], 0
jne 0x454e1f
mov eax, dword [0x4667f8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004564d0
mov eax, dword [0x4668f0]
cmp word [eax + 2], 0
jne 0x454e39
mov eax, dword [0x4668f0]
mov dword [eax + 4], ebx
mov dword [eax], fcn.004566c8
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412034]
call fcn.004032ac
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412034]
call fcn.004032ac
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41cda8]
call fcn.00424120
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x454fc0
mov eax, dword [0x4666b8]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.004244f0
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x456c68
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4666b8]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040c95c
test eax, eax
je 0x454f2e
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408a24
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040c984
test eax, eax
je 0x454f42
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404320
mov eax, dword [0x466508]
cmp byte [eax], 0
jne 0x454f76
mov eax, ebx
call fcn.004550e8
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00456e44
mov eax, ebx
call fcn.00457808
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x454fb6
call fcn.00403658
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x455368
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x467be8]
cmp dword [eax + 0x30], 0
je 0x455412
cmp dword [ebx + 0x94], 0
jne 0x45540c
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4552f8
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45540c
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4553d2
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45540c
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004144b0
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4553e1
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x455f74
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x455fa9
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004041a0
jmp 0x455fb6
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00404104
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x457020
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x457061
mov eax, esi
call fcn.0043d7d0
test al, al
je 0x457061
mov eax, dword [ebx + 0x84]
call fcn.0043d4cc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x457061
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043d4cc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x457c30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x457c38
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x457ec5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x467c08]
call fcn.00404370
test eax, eax
je 0x457eaa
mov dl, 1
mov eax, dword [0x42b08c]
call fcn.0042b18c
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
xor eax, eax
push ebp
push 0x457ea3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x104
call fcn.004026cc
mov ebx, eax
mov edx, 0x80000001
mov eax, dword [ebp - 4]
call fcn.0042b22c
lea eax, [ebp - 0xc]
mov ecx, dword [0x467c08]
mov edx, 0x457ee0
call fcn.004043bc
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0042b3b4
test al, al
jne 0x457cc8
call fcn.00403b14
jmp 0x457eaa
lea ecx, [ebp - 0x10]
mov edx, 0x457f0c
mov eax, dword [ebp - 4]
call fcn.0042b610
mov edx, dword [ebp - 0x10]
mov eax, 0x467c14
call fcn.00404104
mov edx, 0x457f1c
mov eax, dword [ebp - 4]
call fcn.0042b69c
mov dword [0x467c18], eax
lea ecx, [ebp - 0x14]
mov edx, 0x457f2c
mov eax, dword [ebp - 4]
call fcn.0042b610
mov edx, dword [ebp - 0x14]
mov eax, 0x467c1c
call fcn.00404104
lea ecx, [ebp - 0x18]
mov edx, 0x457f40
mov eax, dword [ebp - 4]
call fcn.0042b610
mov edx, dword [ebp - 0x18]
mov eax, 0x467c0c
call fcn.00404104
lea ecx, [ebp - 0x1c]
mov edx, 0x457f54
mov eax, dword [ebp - 4]
call fcn.0042b610
mov edx, dword [ebp - 0x1c]
mov eax, 0x467c10
call fcn.00404104
lea ecx, [ebp - 0x20]
mov edx, 0x457f68
mov eax, dword [ebp - 4]
call fcn.0042b610
mov edx, dword [ebp - 0x20]
mov eax, 0x467c20
call fcn.00404104
push ebp
xor edx, edx
mov eax, 0x457f7c
call fcn.00457bb0
pop ecx
mov byte [0x467c2d], al
push ebp
xor edx, edx
mov eax, 0x457f94
call fcn.00457b30
pop ecx
mov dword [0x467c30], eax
mov eax, dword [0x467c0c]
call fcn.00404370
test eax, eax
jne 0x457daf
mov eax, 0x467c0c
mov edx, dword [0x467c08]
call fcn.00404104
mov eax, dword [0x467c1c]
call fcn.00404370
test eax, eax
je 0x457dcb
mov eax, dword [0x467c10]
call fcn.00404370
test eax, eax
jne 0x457dd5
call fcn.00403b14
jmp 0x457eaa
mov edx, dword [0x467c1c]
mov eax, 0x457fa8
call fcn.00408818
mov esi, eax
mov eax, dword [0x467c1c]
call fcn.00404370
cmp esi, eax
je 0x457e04
mov eax, 0x467c1c
mov edx, 0x457fb4
call fcn.00404378
mov edx, 0x104
mov eax, ebx
call fcn.00406ab0
push ebx
push 0x104
call sub.kernel32.dll_GetTempPathA
lea eax, [ebp - 0x24]
mov edx, ebx
call fcn.004042a8
push dword [ebp - 0x24]
push 0x457fc0
push dword [0x467c08]
push 0x457fb4
mov eax, 0x467c24
mov edx, 4
call fcn.00404430
mov eax, dword [0x467c24]
call fcn.004086e8
test al, al
jne 0x457e66
mov dword [0x467c34], 2
call fcn.00403b14
jmp 0x457eaa
mov eax, 0x467c28
mov ecx, 0x457fd4
mov edx, dword [0x467c24]
call fcn.004043bc
mov byte [ebp - 5], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457eaa
cmp dword [ebp - 4], 0
je 0x457e9a
mov eax, dword [ebp - 4]
call fcn.0042b1fc
lea eax, [ebp - 4]
call fcn.0040d744
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x457ecc
lea eax, [ebp - 0x24]
mov edx, 7
call fcn.004040d4
ret
Function at 0x45b00c
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404560
xor eax, eax
push ebp
push 0x45b096
push dword fs:[eax]
mov dword fs:[eax], esp
cmp word [ebx + 0x8a], 0
je 0x45b057
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebx + 0x90]
mov edx, ebx
mov eax, dword [ebx + 0x8c]
call dword [ebx + 0x88]
jmp 0x45b07b
cmp byte [ebx + 0x3f], 0
je 0x45b07b
lea eax, [ebp - 8]
mov ecx, 0x45b0ac
mov edx, dword [ebp - 4]
call fcn.004043bc
mov eax, dword [ebp - 8]
call fcn.00404570
push eax
call sub.kernel32.dll_OutputDebugStringA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b09d
lea eax, [ebp - 8]
mov edx, 2
call fcn.004040d4
ret

Function at 0x46105c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb4
push ebx
xor ebx, ebx
mov dword [ebp - 0x4c], ebx
mov dword [ebp - 0x48], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404560
mov eax, dword [ebp - 8]
call fcn.00404560
xor eax, eax
push ebp
push 0x461172
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
mov edx, 0x3c
call fcn.00406ab0
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x40], 0x40
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, 0x461180
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.00404570
mov dword [ebp - 0x34], eax
lea edx, [ebp - 0x48]
mov eax, dword [ebp - 4]
call fcn.00408868
mov eax, dword [ebp - 0x48]
call fcn.00404570
mov dword [ebp - 0x2c], eax
lea edx, [ebp - 0x4c]
mov eax, dword [ebp - 8]
call fcn.00407f64
mov eax, dword [ebp - 0x4c]
call fcn.00404370
test eax, eax
jle 0x4610fc
mov eax, dword [ebp - 8]
call fcn.00404570
mov dword [ebp - 0x30], eax
test bl, bl
je 0x461107
xor eax, eax
mov dword [ebp - 0x28], eax
jmp 0x46110e
mov dword [ebp - 0x28], 5
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExA
test eax, eax
jne 0x46111f
xor ebx, ebx
jmp 0x46114a
mov bl, 1
push 0x64
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_WaitForSingleObject
sub eax, 1
jb 0x46114a
sub eax, 0x101
je 0x46113a
jmp 0x461148
mov eax, dword [0x4668c8]
mov eax, dword [eax]
call fcn.00456224
jmp 0x461121
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461179
lea eax, [ebp - 0x4c]
mov edx, 2
call fcn.004040d4
lea eax, [ebp - 8]
mov edx, 2
call fcn.004040d4
ret
Function at 0x4612ac
Capabilities:
Parse url

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff2b8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404560
xor eax, eax
push ebp
push 0x46140e
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x141]
mov edx, 0x101
call fcn.00406ab0
lea eax, [ebp - 0x242]
mov edx, 0x101
call fcn.00406ab0
lea eax, [ebp - 0x343]
mov edx, 0x101
call fcn.00406ab0
lea eax, [ebp - 0x444]
mov edx, 0x101
call fcn.00406ab0
lea eax, [ebp - 0xd46]
mov edx, 0x801
call fcn.00406ab0
lea eax, [ebp - 0x545]
mov edx, 0x101
call fcn.00406ab0
mov dword [ebp - 0x40], 0x3c
lea eax, [ebp - 0x141]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x242]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x343]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x444]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xd46]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x545]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x38], 0xff
mov dword [ebp - 0x2c], 0xff
mov dword [ebp - 0x20], 0xff
mov dword [ebp - 0x18], 0xff
mov dword [ebp - 0x10], 0x800
mov dword [ebp - 8], 0xff
lea eax, [ebp - 0x40]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404370
push eax
mov eax, dword [ebp - 4]
call fcn.00404570
push eax
call sub.wininet.dll_InternetCrackUrlA
test eax, eax
je 0x4613f8
mov eax, esi
lea edx, [ebp - 0x141]
mov ecx, 0x101
call fcn.00404320
mov eax, edi
lea edx, [ebp - 0x242]
mov ecx, 0x101
call fcn.00404320
mov eax, dword [ebp + 8]
lea edx, [ebp - 0xd46]
mov ecx, 0x801
call fcn.00404320
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461415
lea eax, [ebp - 4]
call fcn.004040b0
ret

Function at 0x461c1c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404560
xor eax, eax
push ebp
push 0x461cc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004086b4
test al, al
je 0x461c61
mov eax, dword [ebp - 4]
call fcn.00404570
push eax
call sub.kernel32.dll_DeleteFileA
test eax, eax
je 0x461ca6
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.00461a3c
push 0xffff
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x412708]
call fcn.004169a8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
call fcn.00404370
push eax
lea eax, [ebp - 0xc]
call fcn.004045c8
mov edx, eax
mov eax, dword [ebp - 8]
pop ecx
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea eax, [ebp - 8]
call fcn.0040d744
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x461ccb
lea eax, [ebp - 0xc]
call fcn.004040b0
lea eax, [ebp - 4]
call fcn.004040b0
ret

Function at 0x4625c8
Capabilities:
Hash data with md5

Disassembly:
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
xor edx, edx
mov dword [eax + 0x10], edx
xor edx, edx
mov dword [eax + 0x14], edx
add eax, 0x18
mov edx, 0x40
call fcn.00406ab0
ret
Function at 0x4626f0
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00404560
xor eax, eax
push ebp
push 0x46283e
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x6c]
call fcn.004625c8
push 0
push 0x8000080
push 3
push 0
push 3
push 0x80000000
mov eax, dword [ebp - 4]
call fcn.00404570
push eax
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x46281d
xor eax, eax
push ebp
push 0x462816
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 2
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CreateFileMappingA
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4627ff
xor eax, eax
push ebp
push 0x4627f8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 4
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_MapViewOfFile
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4627e1
xor eax, eax
push ebp
push 0x4627da
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetFileSize
mov ecx, eax
lea eax, [ebp - 0x6c]
mov edx, dword [ebp - 0x14]
call fcn.004625fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4627e1
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_UnmapViewOfFile
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4627ff
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46281d
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_CloseHandle
ret
mov edx, dword [ebp - 8]
lea eax, [ebp - 0x6c]
call fcn.0046267c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x462845
lea eax, [ebp - 4]
call fcn.004040b0
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x3d7a2aa6
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x430024
nop
nop
nop
nop
mov eax, str.__c
nop
mov ebx, 0x42e3d0
nop
nop
mov ecx, 0x247c07d3
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x409e20
Capabilities:
Get common file path
Move file

Disassembly:
sub esp, 0x200
lea eax, [esp]
push 0xff
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x409ecb
push ebx
push esi
lea ecx, [esp + 8]
push edi
push ecx
lea edx, [esp + 0x110]
push 0x40e244
push edx
call dword [sym.imp.MSVCRT.dll_sprintf]
mov edi, 0x40e23c
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x210]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
test eax, eax
pop ebx
je 0x409eb5
lea eax, [esp + 0x100]
lea ecx, [esp]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret
lea edx, [esp]
lea eax, [esp + 0x100]
push edx
push eax
call dword [sym.imp.MSVCRT.dll_rename]
add esp, 8
add esp, 0x200
ret

Function at 0x414496
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, 0x401000
call 0x414496
lcall 0x5de5, 0x8b10c483
jmp loc.007b1904
Function at 0x414610
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x47281b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00467017
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x414692
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00464d8d
mov eax, dword [eax]
push 0x4a31e0
push eax
call fcn.00457b84
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004672a2
test bl, bl
je 0x414692
push 0x4a31e0
lea ecx, [esp + 0xc]
call fcn.00467632
push 0x4a6d5c
lea ecx, [esp + 0xc]
call fcn.00467632
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4146ce
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004672a2
jmp 0x414799
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x414752
lea edx, [esp + 0x7c]
push 0x4a6d58
push edx
call fcn.00457b84
add esp, 8
test eax, eax
je 0x414752
lea eax, [esp + 0x7c]
push 0x4a6d54
push eax
call fcn.00457b84
add esp, 8
test eax, eax
je 0x414752
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4146e2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004672a2
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x414fb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x415012
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc