joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423920
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x10030
call fcn.00454e20
mov eax, dword [0x467168]
mov ecx, dword [0x464c98]
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x458f24
mov dword [ebp - 0xc], eax
call fcn.0040152b
push dword [ebp + 0xc]
call fcn.00401a01
mov edi, edx
cmp edi, ebx
pop ecx
mov dword [ebp - 0x14], eax
jg 0x423971
jl 0x423a4b
cmp eax, esi
jb 0x423a4b
push 0x45a3e4
push dword [ebp + 8]
call fcn.0043dace
cmp eax, ebx
pop ecx
pop ecx
mov dword [ebp + 0xc], eax
je 0x423a4b
cmp edi, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
jl 0x423a0b
jg 0x42399c
cmp dword [ebp - 0x14], ebx
jbe 0x423a0b
push dword [ebp + 0xc]
lea eax, [ebp - 0x10030]
push 0xffff
push eax
call fcn.0043da4d
add esp, 0xc
test eax, eax
je 0x423a42
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
sub eax, dword [0x4652cc]
cmp eax, dword [0x464360]
jbe 0x4239f6
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x4239eb
push esi
push 0xffffffffffffffff
call fcn.0040be3b
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov dword [0x4652cc], eax
add dword [ebp - 8], esi
adc dword [ebp - 4], ebx
cmp dword [ebp - 4], edi
jl 0x42399c
jg 0x423a0b
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 8], eax
jb 0x42399c
push dword [ebp + 0xc]
call fcn.0043d956
lea eax, [ebp - 0x10030]
push eax
call fcn.00454880
cmp eax, ebx
pop ecx
pop ecx
je 0x423a3b
cmp byte [ebp + eax - 0x10031], 0xa
jne 0x423a37
dec eax
mov byte [ebp + eax - 0x10030], bl
cmp eax, ebx
jne 0x423a4f
push esi
push ebx
push 0xffffffffffffffff
push ebx
jmp 0x423a59
push dword [ebp + 0xc]
call fcn.0043d956
pop ecx
mov eax, esi
jmp 0x423a79
push esi
push ebx
push eax
lea eax, [ebp - 0x10030]
push eax
mov ecx, dword [ebp - 0xc]
call fcn.0040152b
test eax, eax
je 0x423a79
mov ecx, dword [0x464c98]
push esi
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x424e56
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
mov esi, dword [0x467168]
xor ebx, ebx
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push ebx
push ebx
push dword [ebp + 8]
call fcn.00413c75
add esp, 0x14
cmp al, bl
mov byte [ebp - 4], al
jne 0x424ed3
push ebx
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.00422348
add esp, 0xc
cmp eax, ebx
jne 0x424ea7
push 1
push ebx
push 0xffffffffffffffff
push 0x4575d8
jmp 0x424f15
lea ecx, [ebp - 0x114]
mov dword [ebp - 0x14], ecx
push ebx
lea ecx, [ebp - 0x14]
push ecx
push dword [ebp + 8]
mov dword [ebp - 0xc], ebx
push eax
call fcn.004186ee
fstp st(0)
add esp, 0x10
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.0040178c
jmp 0x424f1c
mov eax, dword [ebp + 0xc]
movsx eax, byte [eax]
push eax
call fcn.004418c7
cmp eax, 0x50
pop ecx
je 0x424ef3
cmp eax, 0x54
je 0x424eee
xor eax, eax
jmp 0x424ef6
push 2
pop eax
jmp 0x424ef6
xor eax, eax
inc eax
push eax
push dword [ebp - 4]
call fcn.00418ac0
pop ecx
test al, al
pop ecx
mov eax, 0x45c4b4
jne 0x424f0f
mov eax, 0x45c4b0
push 1
push ebx
push 0xffffffffffffffff
push eax
mov ecx, esi
call fcn.0040152b
pop esi
pop ebx
leave
ret 8
Function at 0x42a93a
Capabilities:
Create shortcut via ishelllink
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov ecx, dword [0x464c98]
push ebx
push edi
xor edi, edi
inc edi
push edi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x458f24
call fcn.0040152b
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x45d8c4
push edi
push ebx
push 0x45d8d4
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x42aa9e
mov eax, dword [ebp - 4]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp + 0x10]
cmp byte [eax], bl
je 0x42a9a0
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push ecx
call dword [edx + 0x24]
mov ecx, dword [ebp + 0x14]
cmp byte [ecx], bl
je 0x42a9b1
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x2c]
mov ecx, dword [ebp + 0x18]
cmp byte [ecx], bl
je 0x42a9c2
mov eax, dword [ebp - 4]
mov edx, dword [eax]
push ecx
push eax
call dword [edx + 0x1c]
push esi
mov esi, dword [ebp + 0x1c]
cmp byte [esi], bl
je 0x42a9e8
mov eax, dword [ebp + 0x24]
cmp byte [eax], bl
je 0x42a9db
push eax
call fcn.00401993
pop ecx
dec eax
jmp 0x42a9dd
xor eax, eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
push eax
push esi
push ecx
call dword [edx + 0x44]
mov esi, dword [ebp + 0x20]
cmp byte [esi], bl
je 0x42aa1a
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push edi
push ebx
push ebx
push esi
call fcn.00413c75
add esp, 0x14
cmp al, bl
je 0x42aa1a
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
movzx ax, al
or eax, 0x600
push eax
push ecx
call dword [edx + 0x34]
mov eax, dword [ebp + 0x28]
cmp byte [eax], bl
je 0x42aa34
mov ecx, dword [ebp - 4]
mov esi, dword [ecx]
push eax
call fcn.00401993
pop ecx
push eax
push dword [ebp - 4]
call dword [esi + 0x3c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp + 8]
push edx
push 0x45d8f4
push eax
call dword [ecx]
test eax, eax
pop esi
jl 0x42aa95
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push edi
lea edx, [ebp - 0x20c]
push edx
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x42aa8c
mov ecx, dword [0x464c98]
push edi
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, edi
pop edi
pop ebx
leave
ret 0x24
Function at 0x42ad9d
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
mov ecx, dword [0x464c98]
push ebx
push esi
push edi
xor esi, esi
inc esi
push esi
xor ebx, ebx
push ebx
push 0xffffffffffffffff
push 0x458f24
call fcn.0040152b
mov ecx, dword [0x467168]
push esi
push ebx
push 0xffffffffffffffff
push ebx
call fcn.0040152b
mov edi, dword [ebp + 8]
cmp edi, ebx
je 0x42ae9e
cmp byte [edi], bl
je 0x42ae9e
lea eax, [ebp - 8]
push eax
push edi
call sub.VERSION.dll_GetFileVersionInfoSizeA
cmp eax, ebx
mov dword [ebp + 8], eax
je 0x42ae9e
push eax
call fcn.0043e5d0
pop ecx
mov esi, eax
push esi
push dword [ebp + 8]
push ebx
push edi
call sub.VERSION.dll_GetFileVersionInfoA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x459b44
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x42ae31
push esi
call fcn.0043db8d
xor eax, eax
pop ecx
inc eax
jmp 0x42aea0
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov edi, ecx
mov edx, 0xffff
and edi, edx
push edi
shr ecx, 0x10
push ecx
mov ecx, eax
and ecx, edx
push ecx
shr eax, 0x10
push eax
push str._u._u._u._u
lea eax, [ebp - 0x8c]
push 0x80
push eax
call fcn.0040aa6c
push esi
call fcn.0043db8d
mov ecx, dword [0x464c98]
add esp, 0x20
push 1
push ebx
push 0xffffffffffffffff
push 0x45771c
call fcn.0040152b
mov ecx, dword [0x467168]
push 1
push ebx
push 0xffffffffffffffff
lea eax, [ebp - 0x8c]
push eax
call fcn.0040152b
jmp 0x42aea0
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x42aea7
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
je 0x42af26
cmp byte [eax], bl
je 0x42af26
lea ecx, [ebp - 0x128]
push ecx
push eax
call fcn.0042b48f
lea eax, [ebp - 0x128]
push eax
call fcn.00454880
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x54
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
test eax, eax
mov eax, 0x458f24
jne 0x42af1e
mov eax, 0x45771c
push 1
push ebx
push 0xffffffffffffffff
push eax
jmp 0x42af30
push 1
push ebx
push 0xffffffffffffffff
push 0x458f24
mov ecx, dword [0x464c98]
call fcn.0040152b
pop ebx
leave
ret 4
Function at 0x42b4d4
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0042b48f
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 0xc]
call fcn.0042b48f
lea eax, [ebp - 0x128]
push eax
call fcn.0042bb34
add esp, 0x14
test al, al
je 0x42b536
lea eax, [ebp - 0x230]
push eax
call fcn.0042bb34
test al, al
pop ecx
je 0x42b525
cmp byte [ebp + 0x10], 0
jmp 0x42b534
lea eax, [ebp - 0x230]
push eax
call fcn.0042b7d8
pop ecx
test al, al
jne 0x42b53a
xor al, al
leave
ret
push edi
lea eax, [ebp - 0x128]
push str..
push eax
call fcn.00454660
lea eax, [ebp - 0x128]
push eax
call fcn.00454880
mov byte [ebp + eax - 0x127], 0
lea eax, [ebp - 0x230]
push eax
call fcn.00454880
and dword [ebp - 0x20], 0
add esp, 0x10
mov byte [ebp + eax - 0x22f], 0
push 6
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x1c], 2
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop edi
leave
ret
Function at 0x42b5b8
Capabilities:
Check for time delay via gettickcount
Copy file
Delete file
Enumerate files on windows
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9a4
push esi
lea eax, [ebp - 0x33c]
push eax
push dword [ebp + 8]
call fcn.0042b48f
lea eax, [ebp - 0x584]
push eax
push dword [ebp + 0xc]
call fcn.0042b48f
lea eax, [ebp - 0x33c]
push eax
call fcn.0042bb34
add esp, 0x14
test al, al
mov esi, str..
je 0x42b607
lea eax, [ebp - 0x33c]
push esi
push eax
call fcn.00454660
pop ecx
pop ecx
lea eax, [ebp - 0x584]
push eax
call fcn.0042bb34
test al, al
pop ecx
je 0x42b627
lea eax, [ebp - 0x584]
push esi
push eax
call fcn.00454660
pop ecx
pop ecx
lea eax, [ebp - 0x47c]
push eax
lea eax, [ebp - 0x33c]
push eax
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
jne 0x42b64a
xor eax, eax
jmp 0x42b7d5
push ebx
push edi
lea eax, [ebp - 0x9a4]
push eax
lea eax, [ebp - 0x89c]
push eax
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x68c]
push eax
lea eax, [ebp - 0x33c]
push eax
call fcn.00440c37
lea eax, [ebp - 0x794]
push eax
lea eax, [ebp - 0x68c]
push eax
push str._s_s
lea eax, [ebp - 0x12c]
push 0x105
push eax
call fcn.0040aa6c
lea eax, [ebp - 0x12c]
push eax
call fcn.00454880
mov edi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
mov esi, 0x104
add esp, 0x2c
sub esi, eax
and dword [ebp - 4], 0
lea ebx, [ebp + eax - 0x12c]
call edi
sub eax, dword [0x4652cc]
cmp eax, dword [0x464360]
jbe 0x42b6f5
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x42b6ee
push 1
push 0xffffffffffffffff
call fcn.0040be3b
pop ecx
pop ecx
call edi
mov dword [0x4652cc], eax
test byte [ebp - 0x47c], 0x10
jne 0x42b7af
lea eax, [ebp - 0x450]
push eax
call fcn.00454880
cmp eax, esi
pop ecx
ja 0x42b7ac
lea eax, [ebp - 0x450]
push eax
push ebx
call fcn.00454650
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x584]
push eax
lea eax, [ebp - 0x450]
push eax
call fcn.0042b8b4
add esp, 0x14
cmp byte [ebp + 0x14], 0
je 0x42b78b
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
test eax, eax
jne 0x42b7af
cmp byte [ebp + 0x10], al
je 0x42b7ac
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
test eax, eax
je 0x42b7ac
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_MoveFileA]
jmp 0x42b7a8
xor eax, eax
cmp byte [ebp + 0x10], al
sete al
push eax
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x12c]
push eax
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
test eax, eax
jne 0x42b7af
inc dword [ebp - 4]
lea eax, [ebp - 0x47c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42b6bf
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
leave
ret
Function at 0x42b7d8
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x42b848
call dword [sym.imp.KERNEL32.DLL_GetLastError]
dec eax
dec eax
je 0x42b838
dec eax
jne 0x42b850
push edi
call fcn.00454880
cmp eax, 0x104
pop ecx
ja 0x42b850
add eax, 4
and eax, 0xfffffffc
call fcn.00454e20
mov esi, esp
push edi
push esi
call fcn.00454650
push 0x5c
push esi
call fcn.004550c0
add esp, 0x10
test eax, eax
je 0x42b850
push esi
mov byte [eax], 0
call fcn.0042b7d8
test al, al
pop ecx
je 0x42b850
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryA]
test eax, eax
setne al
jmp 0x42b852
test al, 0x10
je 0x42b850
mov al, 1
jmp 0x42b852
xor al, al
lea esp, [ebp - 8]
pop edi
pop esi
pop ebp
ret

Function at 0x42b859
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
push esi
mov esi, dword [ebp + 8]
push 0x2a
push esi
call fcn.004549b0
test eax, eax
pop ecx
pop ecx
jne 0x42b891
push 0x3f
push esi
call fcn.004549b0
test eax, eax
pop ecx
pop ecx
jne 0x42b891
push esi
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
setne al
jmp 0x42b8b1
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x42b8a8
xor al, al
jmp 0x42b8b1
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, 1
pop esi
leave
ret

Function at 0x42bb34
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42bb4b
test al, 0x10
je 0x42bb4b
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x42bb4e
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0042b48f
lea eax, [ebp - 0x230]
push eax
push dword [ebp + 0xc]
call fcn.0042b48f
lea eax, [ebp - 0x128]
push eax
call fcn.0042bb34
add esp, 0x14
test al, al
jne 0x42bb8a
leave
ret
push esi
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
xor esi, esi
inc esi
cmp eax, 0xffffffff
je 0x42bbb6
test al, 0x10
je 0x42bbaf
cmp dword [ebp + 0x10], esi
je 0x42bbb6
cmp dword [ebp + 0x10], 2
je 0x42bbb6
xor al, al
jmp 0x42bc6d
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0042ba9a
test al, al
pop ecx
pop ecx
je 0x42bbfb
push esi
lea eax, [ebp - 0x230]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.0042b4d4
add esp, 0xc
test al, al
je 0x42bbaf
lea eax, [ebp - 0x128]
push esi
push eax
call fcn.0042bc70
pop ecx
pop ecx
jmp 0x42bc6d
lea eax, [ebp - 0x128]
push edi
push eax
call fcn.00454880
mov byte [ebp + eax - 0x127], 0
lea eax, [ebp - 0x230]
push eax
call fcn.00454880
and dword [ebp - 0x20], 0
pop ecx
pop ecx
mov byte [ebp + eax - 0x22f], 0
push 6
xor eax, eax
cmp dword [ebp + 0x10], 2
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
mov word [ebp - 0x10], 0x614
pop edi
jne 0x42bc5e
mov word [ebp - 0x10], 0x615
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop esi
leave
ret

Function at 0x42bc70
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
lea eax, [ebp - 0x128]
push eax
push dword [ebp + 8]
call fcn.0042b48f
lea eax, [ebp - 0x128]
push eax
call fcn.0042bb34
add esp, 0xc
test al, al
jne 0x42bc9d
leave
ret
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
lea eax, [ebp - 0x128]
push eax
jne 0x42bcb9
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
test eax, eax
setne al
jmp 0x42bcfa
call fcn.00454880
mov byte [ebp + eax - 0x127], bl
lea eax, [ebp - 0x128]
mov dword [ebp - 0x18], eax
pop ecx
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xa], ebx
mov dword [ebp - 6], ebx
mov dword [ebp - 0xe], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], 3
mov word [ebp - 0x10], 0x614
call dword [sym.imp.SHELL32.dll_SHFileOperationA]
neg eax
sbb eax, eax
inc eax
pop ebx
leave
ret
Function at 0x42bcfd
Capabilities:
Enumerate gui resources
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
xor ebx, ebx
cmp byte [0x4654b8], bl
je 0x42bd62
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x42bd5e
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.DLL_GetLastError]
test eax, eax
je 0x42bd62
xor al, al
jmp 0x42bd8f
cmp byte [0x4654b9], bl
je 0x42bd80
test byte [ebp + 8], 4
je 0x42bd80
xor dword [ebp + 8], 4
push ebx
push 0x42bd92
call dword [sym.imp.USER32.dll_EnumWindows]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
setne al
pop ebx
leave
ret

Function at 0x42bdb1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x1f4
push 2
xor esi, esi
push esi
push esi
push 0x10
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SendMessageTimeoutA]
test eax, eax
jne 0x42be0a
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp eax, esi
je 0x42bdf4
push eax
push esi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov edi, eax
jmp 0x42bdf6
xor edi, edi
cmp edi, esi
je 0x42be09
push esi
push edi
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop edi
pop esi
leave
ret
Function at 0x42e4c9
Capabilities:
Hide graphical window

Disassembly:
cmp dword [ecx + 0x1c], 0
jne 0x42e4d4
jmp fcn.0042e4b6
push 0
push 0x2af80006
push 0x414
push dword [ecx]
call dword [sym.imp.USER32.dll_PostMessageA]
xor eax, eax
inc eax
ret
Function at 0x42ee60
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
movzx eax, byte [esi + 4]
sub eax, 9
push edi
push 0
mov dword [ebp - 0x10], CreateStatusWindowA
pop ebx
je 0x42eef3
dec eax
je 0x42eec8
dec eax
je 0x42eea2
sub eax, 6
jne 0x42ef20
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x419
push dword [esi]
call dword [sym.imp.USER32.dll_SendMessageA]
jmp 0x42ef17
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 9
push 0x110a
push dword [esi]
call edi
cmp eax, ebx
je 0x42ef17
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0x1104
jmp 0x42ef13
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 1
push 0xffffffffffffffff
push 0x100c
push dword [esi]
call edi
cmp eax, 0xffffffff
je 0x42ef17
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 0x10], 2
push 0x100e
jmp 0x42ef13
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push ebx
push 0x19f
push dword [esi]
call edi
cmp eax, 0xffffffff
je 0x42ef17
lea ecx, [ebp - 0x10]
push ecx
push eax
push 0x198
push dword [esi]
call edi
cmp dword [ebp - 0x10], 0x80000000
jne 0x42ef2e
lea eax, [ebp - 0x10]
push eax
push dword [esi]
call dword [sym.imp.USER32.dll_GetWindowRect]
jmp 0x42ef3d
push 2
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [esi]
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
sub eax, esi
cdq
sub eax, edx
sar eax, 1
pop edi
lea eax, [eax + esi + 2]
pop esi
mov dword [ecx + 4], eax
pop ebx
leave
ret 8
Function at 0x431492
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
cmp eax, 0x63
jb 0x43149e
xor eax, eax
ret
push ebx
push ebp
lea ebx, [eax*4 + 0x464aa0]
push esi
mov esi, dword [ebx]
xor ebp, ebp
cmp esi, ebp
mov dword [esp + 0x10], ebx
je 0x431609
cmp dword [esi], ebp
push edi
je 0x431563
xor edi, edi
mov eax, dword [edi*4 + 0x464aa0]
test eax, eax
je 0x4314e5
mov eax, dword [eax + 0x40]
cmp eax, dword [esi]
jne 0x4314dc
push edi
call fcn.00431492
pop ecx
inc ebp
cmp dword [0x468448], ebp
je 0x4314eb
inc edi
cmp edi, 0x63
jb 0x4314c3
mov eax, dword [esi + 4]
test eax, eax
je 0x43152d
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0x406
push eax
call edi
mov ebx, eax
xor ebp, ebp
test ebx, ebx
jle 0x431529
push 0
push ebp
push 0x414
push dword [esi + 4]
call edi
test eax, eax
je 0x431524
push eax
call dword [sym.imp.USER32.dll_DestroyIcon]
inc ebp
cmp ebp, ebx
jl 0x43150c
mov ebx, dword [esp + 0x14]
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x431563
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi]
call dword [sym.imp.USER32.dll_SetMenu]
lea eax, [esi + 0xb7]
cmp byte [eax], 0
jne 0x431563
push dword [esi]
mov byte [eax], 1
call dword [sym.imp.USER32.dll_DestroyWindow]
mov eax, dword [esi + 0x60]
test eax, eax
je 0x431571
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 0x68]
test eax, eax
je 0x43157f
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [esi + 0x6c]
test eax, eax
je 0x43158d
push eax
call dword [sym.imp.SHELL32.dll_DragFinish]
xor ebp, ebp
xor edi, edi
cmp dword [esi + 0xc], ebp
jbe 0x4315d8
mov eax, dword [esi + 0x14]
add eax, ebp
mov dl, byte [eax + 4]
cmp dl, 2
jne 0x4315c1
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x4315c1
test byte [eax + 5], 0x80
push ecx
je 0x4315b9
call dword [sym.imp.USER32.dll_DestroyIcon]
jmp 0x4315cf
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4315cf
cmp dl, 0xa
jne 0x4315cf
push dword [eax + 0x10]
call fcn.0043db8d
pop ecx
inc edi
add ebp, 0x14
cmp edi, dword [esi + 0xc]
jb 0x431596
push dword [esi + 0x14]
mov edi, dword [esi + 0x70]
call fcn.0043db8d
push dword [ebx]
call fcn.0043d6c9
and dword [ebx], 0
dec dword [0x468448]
test edi, edi
pop ecx
pop ecx
je 0x431608
cmp edi, dword [0x4652dc]
je 0x431608
push edi
call fcn.00431610
pop ecx
pop edi
pop esi
xor eax, eax
pop ebp
inc eax
pop ebx
ret