joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x440
mov eax, dword [0x4a7ea0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x440]
push edi
mov edi, dword [ebp + 8]
xorps xmm0, xmm0
push 0x44
push 0
push eax
movdqu xmmword [ebp - 0x3fc], xmm0
call fcn.00452db0
add esp, 0xc
mov dword [ebp - 0x440], 0x44
cmp dword [ebp + 0x10], 0
mov dword [ebp - 0x414], 0x40
jne 0x41d769
mov eax, 7
mov dword [ebp - 0x414], 0x41
mov word [ebp - 0x410], ax
push 0x1f4
lea eax, [ebp - 0x3ec]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
lea eax, [ebp - 0x3ec]
test esi, esi
je 0x41d79e
push esi
push eax
lea eax, [ebp - 0x1f8]
push str._s__s
push eax
call fcn.00452c8a
add esp, 0x10
jmp 0x41d7b3
push eax
lea eax, [ebp - 0x1f8]
push 0x48657c
push eax
call fcn.00452c8a
add esp, 0xc
lea eax, [ebp - 0x3fc]
push eax
lea eax, [ebp - 0x440]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea eax, [ebp - 0x1f8]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x41d815
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push edi
lea eax, [ebp - 0x1f8]
push str.Unable_to_run__s._Error_Code_d
push eax
call fcn.00452c8a
add esp, 0x10
lea eax, [ebp - 0x1f8]
push 0x2010
push str.Execution_Error
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004520a4
mov esp, ebp
pop ebp
ret
Function at 0x420610
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
push dword [ecx + 0x4d]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 4]
xor edx, edx
shld edx, ecx, 4
shl ecx, 4
add eax, ecx
adc edx, 0
mov esp, ebp
pop ebp
ret

Function at 0x4208c0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
push dword [edi + 0x40]
push dword [ebx + 0x40]
call fcn.004542aa
add esp, 8
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x4208f4
mov ecx, dword [0x4aad70]
test ecx, ecx
je 0x4208f4
push edi
push ebx
call fcn.00415d30
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret

Function at 0x420a10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x4aad70], 0
push esi
mov esi, ecx
mov dword [ebp - 4], 0
je 0x420a8c
cmp byte [esi + 0x51], 0
jne 0x420a8c
push 1
xorps xmm0, xmm0
lea eax, [ebp - 0xc]
push eax
movlpd qword [ebp - 0x14], xmm0
push dword [ebp - 0x10]
movlpd qword [ebp - 0xc], xmm0
push dword [ebp - 0x14]
push dword [esi + 0x4d]
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x4d]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x420aa1
push dword [ebp - 4]
mov ecx, dword [0x4aad70]
push dword [ebp + 8]
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.00415ef0
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x4d]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x424c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48149e
mov eax, dword fs:[0]
push eax
sub esp, 0x204
mov eax, dword [0x4a7ea0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
mov edx, str.stdout
mov byte [ebp - 0x1f8], 0
mov eax, dword [esi + 0x40]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x424c72
test cl, cl
je 0x424c6e
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x424c72
add eax, 2
add edx, 2
test cl, cl
jne 0x424c52
xor eax, eax
jmp 0x424c77
sbb eax, eax
or eax, 1
test eax, eax
je 0x424e36
lea ecx, [ebp - 0x64]
call fcn.004203d0
push esi
lea ecx, [ebp - 0xb4]
mov dword [ebp - 4], 0
call fcn.00425930
push 0
push 0x484760
push 0x484b04
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 1
call fcn.00426130
lea eax, [ebp - 0x1f4]
xor edi, edi
push eax
push dword [ebp - 0x74]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x424d6f
mov ecx, dword [ebx + 8]
mov edi, 1
cmp dword [ebp - 0x1d4], ecx
jne 0x424d68
push 0x1000
lea ecx, [ebp - 0x210]
call fcn.00424710
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 2
push eax
lea ecx, [ebp - 0x210]
call fcn.00424960
test al, al
je 0x424d59
lea eax, [ebp - 0x210]
mov ecx, ebx
push eax
call fcn.004247c0
test al, al
je 0x424d59
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x210]
call fcn.004247b0
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.00425a30
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.004203f0
mov al, 1
jmp 0x424e5e
lea ecx, [ebp - 0x210]
mov byte [ebp - 4], 1
call fcn.004247b0
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x64]
call fcn.00420560
test eax, eax
je 0x424db6
push dword [ebx + 8]
lea ecx, [ebp - 0x64]
push dword [ebx + 4]
call fcn.00420a10
mov edx, dword [ebp - 0x1f8]
mov ecx, 1
cmp eax, dword [ebx + 8]
movzx edx, dl
mov ebx, edx
mov dword [ebp - 0x1f8], edx
cmove ebx, ecx
lea ecx, [ebp - 0x64]
call fcn.00420450
jmp 0x424de8
test edi, edi
je 0x424de2
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push 0x1f4
call edi
lea eax, [ebp - 0xb4]
push eax
lea ecx, [ebp - 0x64]
call fcn.00420560
test eax, eax
jne 0x424e08
inc esi
cmp esi, 6
jl 0x424dc2
mov ebx, dword [ebp - 0x1f8]
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0
call fcn.00425a30
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.004203f0
jmp 0x424e5c
push dword [ebx + 8]
lea ecx, [ebp - 0x64]
push dword [ebx + 4]
call fcn.00420a10
mov edx, dword [ebp - 0x1f8]
cmp eax, dword [ebx + 8]
movzx ecx, dl
mov edx, 1
cmove ecx, edx
mov bl, cl
lea ecx, [ebp - 0x64]
call fcn.00420450
jmp 0x424de8
call fcn.00454611
add eax, 0x20
push eax
push 1
push dword [ebx + 8]
push dword [ebx + 4]
call fcn.00454984
mov ebx, dword [ebp - 0x1f8]
dec eax
add esp, 0x10
neg eax
sbb al, al
and bl, al
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004520a4
mov esp, ebp
pop ebp
ret 4
Function at 0x426310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4814e3
mov eax, dword fs:[0]
push eax
sub esp, 0xa8
mov eax, dword [0x4a7ea0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
xor bl, bl
mov edx, str.stdout
mov eax, dword [esi + 0x40]
lea ecx, [ecx]
mov cl, byte [eax]
cmp cl, byte [edx]
jne 0x426370
test cl, cl
je 0x42636c
mov cl, byte [eax + 1]
cmp cl, byte [edx + 1]
jne 0x426370
add eax, 2
add edx, 2
test cl, cl
jne 0x426350
xor eax, eax
jmp 0x426375
sbb eax, eax
or eax, 1
test eax, eax
je 0x4263f5
lea ecx, [ebp - 0x64]
call fcn.004203d0
push dword [esi + 0x40]
lea ecx, [ebp - 0xb4]
mov dword [ebp - 4], 0
call fcn.00425970
lea eax, [ebp - 0xb4]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x64]
call fcn.00420560
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 0
mov esi, eax
call fcn.00425a30
test esi, esi
je 0x4263e2
push dword [edi + 0x45]
lea ecx, [ebp - 0x64]
push dword [edi + 0x40]
call fcn.00420a10
cmp eax, dword [edi + 0x45]
mov ecx, 1
movzx ebx, bl
cmove ebx, ecx
lea ecx, [ebp - 0x64]
call fcn.00420450
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 0xffffffff
call fcn.004203f0
mov al, bl
jmp 0x42641d
call fcn.00454611
add eax, 0x20
push eax
push 1
push dword [edi + 0x45]
push dword [edi + 0x40]
call fcn.00454984
mov edx, 1
movzx ecx, bl
add esp, 0x10
cmp eax, edx
cmove ecx, edx
mov al, cl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004520a4
mov esp, ebp
pop ebp
ret 4

Function at 0x4272a0
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
lea esi, [edi + 0xd]
mov eax, dword [edi + 4]
lea ebx, [edi + 8]
mov dword [esi], ebx
mov dword [edi + 0x11], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push esi
push 0
push dword [edi]
mov dword [edi + 0x15], eax
mov byte [ebx], 1
call fcn.00455e43
add esp, 0xc
mov dword [edi + 9], eax
cmp eax, 0xffffffff
jne 0x4272dd
pop edi
pop esi
mov byte [ebx], 0
xor eax, eax
pop ebx
ret
pop edi
pop esi
mov eax, 1
pop ebx
ret
Function at 0x428e70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x481893
mov eax, dword fs:[0]
push eax
sub esp, 0xa4
mov eax, dword [0x4a7ea0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xb0]
push str.http:__online.xebra.com_xebraonlinehelp_
call fcn.00425970
cmp dword [esi + 0x45], 0
mov dword [ebp - 4], 0
je 0x428ee8
push str.index.html_
lea ecx, [ebp - 0xb0]
call fcn.004266e0
push esi
lea ecx, [ebp - 0xb0]
call fcn.00426690
push str..htm
lea ecx, [ebp - 0xb0]
call fcn.004266e0
push 5
push 0
push 0
push dword [ebp - 0x70]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x428f66
lea ecx, [ebp - 0x60]
call fcn.00425a20
push str.The_Xebra_system_online_help_at_
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 1
call fcn.004266e0
lea eax, [ebp - 0xb0]
push eax
lea ecx, [ebp - 0x60]
call fcn.00426690
push str.could_not_be_loaded._r_n_r_n
lea ecx, [ebp - 0x60]
call fcn.004266e0
push str.In_order_to_view_the_online_help_you_must_have_internet_access_and_a_default_browser.
lea ecx, [ebp - 0x60]
call fcn.004266e0
push 0x2040
push str.Unable_to_open_default_browser
push dword [ebp - 0x20]
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 0
call fcn.00425a30
lea ecx, [ebp - 0xb0]
mov dword [ebp - 4], 0xffffffff
call fcn.00425a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004520a4
mov esp, ebp
pop ebp
ret 4
Function at 0x42cb70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
cmp edi, 1
jne 0x42cb92
push edi
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x3c], edi
pop edi
pop esi
pop ebp
ret 4
push 0
push dword [esi + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov dword [esi + 0x3c], edi
pop edi
pop esi
pop ebp
ret 4

Function at 0x42d300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jne 0x42d318
push 1
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
push 0
push dword [ecx + 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x42ed70
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
mov esi, ecx
push 0
push 0xe
push dword [esi + 0x155]
call dword [sym.imp.USER32.dll_SendMessageA]
test eax, eax
je 0x42eda4
push dword [ebp + 8]
inc eax
push eax
push 0xd
push dword [esi + 0x155]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop ebp
ret 4
mov eax, dword [ebp + 8]
pop esi
mov byte [eax], 0
pop ebp
ret 4
Function at 0x439970
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
cmp dword [esi + 0x90], 1
jne 0x439a08
cmp dword [ebp + 8], 1
jne 0x4399f4
mov eax, dword [esi + 0xc]
test eax, eax
je 0x4399d1
mov ecx, dword [esi]
push eax
call fcn.00428c90
cmp eax, 0xffffffff
je 0x4399d1
push dword [esi + 0xc]
mov ecx, dword [esi]
call fcn.00428c90
mov ecx, dword [esi]
mov ecx, dword [ecx + 0x28]
mov eax, dword [ecx + eax*4]
test eax, eax
je 0x4399d1
cmp dword [eax + 0xa8], 1
jne 0x4399d1
push 0
push 0xf120
push 0x112
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp + 0xc]
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebp
ret 8
push 0
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_UpdateWindow]
pop esi
pop ebp
ret 8

Function at 0x439a10
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
cmp dword [eax + 4], 0x100
mov edi, ecx
jne 0x439a6e
mov eax, dword [eax + 8]
xor esi, esi
mov dword [ebp + 8], eax
cmp dword [edi + 0x6c], esi
jle 0x439a6e
xor ebx, ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
test eax, 0x10000
je 0x439a65
mov ecx, dword [edi + 0x68]
movzx eax, word [ecx + ebx + 1]
cmp dword [ebp + 8], eax
jne 0x439a65
movzx eax, word [ecx + ebx + 3]
push 0
push eax
push dword [edi + 0x64]
call dword [sym.imp.USER32.dll_GetMenuState]
test al, 3
je 0x439a77
inc esi
add ebx, 5
cmp esi, dword [edi + 0x6c]
jl 0x439a33
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 4
mov eax, dword [edi + 0x68]
lea ecx, [esi + esi*4]
push 0
movzx eax, word [eax + ecx + 3]
push eax
push 0x111
push dword [edi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageA]
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret 4

Function at 0x43ac60
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jne 0x43ac78
push 1
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
push 0
push dword [ecx + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
Function at 0x441760
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jne 0x441778
push 1
push dword [ecx + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
push 0
push dword [ecx + 0x18]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
Function at 0x443c70
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jne 0x443c88
push 1
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
push 0
push dword [ecx + 0xc]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4

Function at 0x445cb0
Capabilities:
Get graphical window text

Disassembly:
push ebx
mov ebx, ecx
cmp dword [ebx + 0x63], 0
je 0x445cfd
mov eax, dword [ebx + 0x7b]
test eax, eax
je 0x445cc9
push eax
call fcn.00452d4e
add esp, 4
push esi
push 0
push 0
push 0xe
push dword [ebx + 0x63]
call dword [sym.imp.USER32.dll_SendMessageA]
mov esi, eax
lea ecx, [esi + 2]
push ecx
push 1
call fcn.00452d0e
add esp, 8
mov dword [ebx + 0x7b], eax
push eax
lea eax, [esi + 1]
push eax
push 0xd
push dword [ebx + 0x63]
call dword [sym.imp.USER32.dll_SendMessageA]
pop esi
pop ebx
ret

Function at 0x4472c0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov esi, ecx
test eax, eax
jne 0x4472d5
cmp dword [esi + 0x125], eax
jne 0x447324
cmp dword [esi + 0x93], eax
je 0x447324
cmp dword [esi + 0x9b], 9
mov dword [esi + 0x93], eax
jne 0x44731d
test eax, eax
je 0x44730f
mov eax, dword [esi + 0xf5]
test eax, eax
je 0x44730f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00444ac0
pop esi
pop ebp
ret 4
push 1
push dword [esi + 0xf5]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, esi
call fcn.00444ac0
pop esi
pop ebp
ret 4

Function at 0x4475b0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 1
jne 0x4475c8
push 1
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
push 0
push dword [ecx + 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop ebp
ret 4
Function at 0x44ac40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x48293b
mov eax, dword fs:[0]
push eax
sub esp, 0xc20
mov eax, dword [0x4a7ea0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0xc2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc28], eax
lea eax, [ebp - 0xc20]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jns 0x44aca6
xor eax, eax
jmp 0x44adb1
lea eax, [ebp - 0xc1c]
push eax
push 0x17
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x44aceb
lea eax, [ebp - 0xc1c]
push eax
push 2
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jns 0x44aceb
push 0x2030
push str.Programs_Path_Error
push str.Could_not_create_start_menu_items.
push esi
call fcn.0040d680
add esp, 0x10
jmp 0x44ada0
lea eax, [ebp - 0xbc8]
push eax
push dword [ebp - 0xc1c]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
push dword [ebp - 0xc2c]
lea eax, [ebp - 0xbc8]
push eax
lea eax, [ebp - 0x3f8]
push str._s_s
push eax
call fcn.00452c8a
add esp, 0x10
lea eax, [ebp - 0x3f8]
lea ecx, [ebp - 0xc18]
push eax
call fcn.00425970
lea eax, [ebp - 0xc18]
mov dword [ebp - 4], 0
push eax
call fcn.00420530
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xc18]
call fcn.00425a30
push ebx
lea eax, [ebp - 0x3f8]
push eax
lea eax, [ebp - 0x7e0]
push str._s_s.lnk
push eax
call fcn.00452c8a
push dword [ebp - 0xc28]
lea eax, [ebp - 0x7e0]
push ebx
push eax
push dword [ebp - 0xc24]
call fcn.0044add0
mov eax, dword [ebp - 0xc20]
add esp, 0x20
push dword [ebp - 0xc1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 0xc20]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004520a4
mov esp, ebp
pop ebp
ret
Function at 0x44c8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, dword [edi + 0x22]
lea esp, [esp]
mov ebx, dword [edi + 0x32]
mov ecx, dword [edi + 0x62]
sub ebx, ecx
mov eax, dword [edi + 0x6a]
sub ebx, eax
jne 0x44c8fb
test ecx, ecx
jne 0x44c907
test eax, eax
jne 0x44c907
mov ebx, esi
jmp 0x44c979
cmp ebx, 0xffffffff
jne 0x44c907
mov ebx, 0xfffffffe
jmp 0x44c979
mov eax, dword [edi + 0x22]
add eax, 0xfffffefa
add eax, esi
cmp ecx, eax
jb 0x44c979
mov ecx, dword [edi + 0x2e]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call fcn.00452510
mov edx, dword [edi + 0x42]
add esp, 0xc
mov eax, dword [edi + 0x3a]
sub dword [edi + 0x66], esi
sub dword [edi + 0x62], esi
sub dword [edi + 0x52], esi
lea ecx, [eax + edx*2]
jmp 0x44c940
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x44c94f
sub eax, esi
jmp 0x44c951
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x44c940
mov eax, dword [edi + 0x36]
mov edx, esi
lea ecx, [eax + esi*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x44c96f
sub eax, esi
jmp 0x44c971
xor eax, eax
mov word [ecx], ax
dec edx
jne 0x44c960
add ebx, esi
mov ecx, dword [edi]
cmp dword [ecx + 4], 0
je 0x44c9d1
mov eax, dword [edi + 0x6a]
add eax, dword [edi + 0x62]
add eax, dword [edi + 0x2e]
push ebx
push eax
push ecx
call fcn.0044cc70
add dword [edi + 0x6a], eax
add esp, 0xc
mov ebx, dword [edi + 0x6a]
cmp ebx, 3
jb 0x44c9bd
mov eax, dword [edi + 0x2e]
add eax, dword [edi + 0x62]
mov ecx, dword [edi + 0x4e]
movzx edx, byte [eax]
mov dword [edi + 0x3e], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x4a]
mov dword [edi + 0x3e], edx
cmp ebx, 0x106
jae 0x44c9d1
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x44c8e0
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x44ccd0
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
movzx ecx, si
shr esi, 0x10
test edi, edi
jne 0x44ccec
lea eax, [edi + 1]
pop edi
pop esi
pop ebp
ret
push ebx
mov ebx, dword [ebp + 0x10]
test ebx, ebx
je 0x44cded
jmp 0x44cd00
mov edx, 0x15b0
cmp ebx, edx
cmovb edx, ebx
sub ebx, edx
mov dword [ebp + 0x10], ebx
cmp edx, 0x10
jl 0x44cdb2
mov ebx, edx
shr ebx, 4
mov eax, ebx
neg eax
shl eax, 4
add edx, eax
movzx eax, byte [edi]
add ecx, eax
movzx eax, byte [edi + 1]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 2]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 3]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 4]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 5]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 6]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 7]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 8]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 9]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xa]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xb]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xc]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xd]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xe]
add esi, ecx
add ecx, eax
movzx eax, byte [edi + 0xf]
add esi, ecx
add edi, 0x10
add ecx, eax
add esi, ecx
dec ebx
jne 0x44cd26
mov ebx, dword [ebp + 0x10]
test edx, edx
je 0x44cdc1
movzx eax, byte [edi]
inc edi
add ecx, eax
add esi, ecx
dec edx
jne 0x44cdb6
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul esi
shr edx, 0xf
imul edx, edx, 0xffff000f
add esi, edx
test ebx, ebx
jne 0x44cd00
shl esi, 0x10
pop ebx
or esi, ecx
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x45865b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret