joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431b06
Capabilities:
Get common file path

Disassembly:
mov eax, 0x45defd
call fcn.0044e550
sub esp, 0x10
cmp byte [0x47412d], 0
jne 0x431b23
xor al, al
jmp 0x431bd8
test byte [0x4759dc], 1
push esi
mov esi, 0x4759bc
jne 0x431b4f
or dword [0x4759dc], 1
and dword [ebp - 4], 0
push 0x20
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [0x4759b8], eax
or dword [ebp - 4], 0xffffffff
push ebx
mov ebx, dword [ebp + 8]
push 1
push dword [0x4759b8]
push esi
push ebx
call sym.qmmacro.exe_StrCompareN
add esp, 0x10
test eax, eax
jne 0x431bd4
mov eax, dword [0x4759b8]
cmp byte [eax + ebx], 0x5c
jne 0x431bd4
push ebx
call fcn.004317e6
pop ecx
test al, al
jne 0x431bd4
push edi
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], 1
mov esi, dword [ebp + 0xc]
pop edi
test esi, esi
jne 0x431b9b
lea esi, [ebp - 0x1c]
mov eax, dword [0x4759b8]
add eax, ebx
push eax
push str._windows__sysnative
mov ecx, esi
call fcn.00422147
push 0
push 0
mov ecx, esi
call fcn.0043811a
push dword [esi]
call fcn.004317e6
pop ecx
mov bl, al
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.0042b651
mov al, bl
jmp 0x431bd6
xor al, al
pop ebx
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x432a28
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x45cd91
call fcn.0044e550
push ecx
push esi
mov esi, ecx
xor ecx, ecx
push edi
mov dword [ebp - 0x10], esi
mov dword [esi], ecx
mov dword [esi + 4], ecx
mov dword [esi + 8], ecx
mov dword [ebp - 4], ecx
xor eax, eax
lea edi, [esi + 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 1
mov dword [esi + 0x1c], ecx
mov byte [ebp - 4], 2
xor eax, eax
lea edi, [esi + 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 3
xor eax, eax
lea edi, [esi + 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 4
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call fcn.0043294f
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 8
Function at 0x43361f
Capabilities:
Get disk size

Disassembly:
push ebp
sub esp, 0x40
mov eax, 0x45e036
call fcn.0044e550
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 0x4c]
push esi
xor esi, esi
push edi
cmp ebx, esi
je 0x4336f2
cmp byte [ebx], 0
je 0x4336f2
xor eax, eax
lea edi, [ebp + 0x34]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 4], esi
push esi
push ebx
lea ecx, [ebp + 0x34]
call fcn.0043811a
push 0x5c
lea ecx, [ebp + 0x34]
call fcn.00430934
push esi
push 3
push ebx
call fcn.004312b5
add esp, 0xc
cmp eax, esi
je 0x433709
test al, 2
jne 0x433720
push 0x5c
lea ecx, [ebp + 0x34]
call fcn.0042b9b8
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push 5
call ebx
mov dword [ebp + 0x4c], eax
mov byte [ebp - 4], 1
push esi
lea eax, [ebp + 0x24]
push eax
lea eax, [ebp + 0x2c]
push eax
push dword [ebp + 0x34]
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x4336dd
mov esi, dword [ebp + 0x24]
sub esi, dword [ebp + 0x2c]
mov edi, dword [ebp + 0x28]
sbb edi, dword [ebp + 0x30]
mov byte [ebp - 4], 0
push dword [ebp + 0x4c]
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.0042b651
mov eax, esi
mov edx, edi
jmp 0x4336f7
mov byte [ebp - 4], 0
push dword [ebp + 0x4c]
call ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x34]
call fcn.0042b651
or eax, 0xffffffff
or edx, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x44
leave
ret
lea eax, [ebp]
push eax
push esi
push dword [ebp + 0x34]
call fcn.00437036
test eax, eax
je 0x4336e6
test byte [ebp], 0x10
je 0x433760
push 0x20000024
push dword [ebp + 0x34]
lea ecx, [ebp - 0x54]
xor edi, edi
call fcn.00432a28
mov byte [ebp - 4], 2
jmp 0x433744
lea ecx, [ebp - 0x54]
call fcn.00431941
add esi, eax
adc edi, edx
lea ecx, [ebp - 0x54]
call fcn.00433250
test eax, eax
jne 0x433738
mov byte [ebp - 4], al
lea ecx, [ebp - 0x54]
call fcn.004049ed
jmp 0x4336cb
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x1c]
mov dword [ebp + 0x30], esi
xor ecx, ecx
xor esi, esi
or ecx, edx
or eax, esi
mov esi, ecx
mov edi, eax
jmp 0x4336cb

Function at 0x43382e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, dword [esp + 8]
movzx eax, bl
test byte [eax + 0x473e60], 8
je 0x433848
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x43386b
cmp ebx, 1
je 0x433852
cmp ebx, 2
jne 0x433861
push 0x17
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x433861
xor ebx, 3
movzx eax, bl
push eax
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor ecx, ecx
test ax, ax
setl cl
mov al, cl
pop ebx
ret 4

Function at 0x433879
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push edi
push 0x10
xor edi, edi
call esi
test ax, ax
jge 0x43388d
inc edi
push 0x11
call esi
test ax, ax
jge 0x433899
or edi, 2
push 0x12
call esi
test ax, ax
jge 0x4338a5
or edi, 4
mov eax, edi
pop edi
pop esi
ret
Function at 0x433b7f
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x45e048
call fcn.0044e550
push ebx
mov bl, byte [ebp + 0xc]
test bl, 2
je 0x433b9f
mov ecx, dword [ebp + 0x10]
push str.Ctrl
call fcn.00401c29
test bl, 1
je 0x433bb1
mov ecx, dword [ebp + 0x10]
push str.Shift
call fcn.00401c29
test bl, 4
je 0x433bc3
mov ecx, dword [ebp + 0x10]
push str.Alt
call fcn.00401c29
test bl, 8
je 0x433bd5
mov ecx, dword [ebp + 0x10]
push str.Win
call fcn.00401c29
cmp byte [ebp + 8], 0
je 0x433d13
cmp byte [ebp + 8], 0x5b
je 0x433d06
push esi
push edi
push 0
push dword [ebp + 8]
call fcn.004338aa
movzx edi, byte [ebp + 8]
mov bl, byte [edi + 0x473e60]
movzx esi, al
shr bl, 1
pop ecx
shl esi, 0x10
and bl, 1
pop ecx
je 0x433c14
or esi, 0x1000000
push 0x64
lea ecx, [ebp + 0xc]
or esi, 0x2000000
call fcn.004311d6
and dword [ebp - 4], 0
push 0x64
push dword [ebp + 0xc]
push esi
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
test eax, eax
je 0x433c89
mov eax, dword [ebp + 0xc]
test bl, bl
je 0x433c55
cmp word [eax + 2], 0
jne 0x433c55
movzx ecx, word [eax]
cmp cx, 0x41
jb 0x433c55
cmp cx, 0x5a
jbe 0x433c89
mov cl, byte [ebp + 8]
add cl, 0x60
cmp cl, 5
ja 0x433c7c
test byte [ebp + 8], 1
mov eax, str.Right
jne 0x433c70
mov eax, str.Left
mov ecx, dword [ebp + 0x10]
push eax
call fcn.00401c29
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
push eax
call fcn.00433b03
jmp 0x433cf2
mov al, byte [ebp + 8]
mov cl, al
add cl, 0x5a
cmp cl, 0x11
ja 0x433cba
add al, 0x5a
movzx eax, al
mov eax, dword [eax*4 + 0x464670]
lea ecx, [eax + 1]
movsx eax, byte [eax]
push ecx
push dword [eax*4 + 0x46465c]
mov ecx, dword [ebp + 0x10]
call fcn.0042c705
jmp 0x433cf2
mov ecx, dword [ebp + 0x10]
sub al, 0x7c
cmp al, 0xb
ja 0x433cd8
push 0x46
call fcn.0042b9b8
mov ecx, dword [ebp + 0x10]
add edi, 0xffffff91
push edi
call fcn.004311c9
jmp 0x433cf2
push 0x28
call fcn.0042b9b8
mov ecx, dword [ebp + 0x10]
push edi
call fcn.004311c9
mov ecx, dword [ebp + 0x10]
push 0x29
call fcn.0042b9b8
or dword [ebp - 4], 0xffffffff
push dword [ebp + 0xc]
call fcn.0043d2ed
and dword [ebp + 0xc], 0
pop edi
pop esi
jmp 0x433d13
mov ecx, dword [ebp + 0x10]
push 0x464658
call fcn.00401c29
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4344d0
Capabilities:
Hide graphical window

Disassembly:
push 0
push dword [esp + 8]
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4355c8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
mov edi, ecx
xor bl, bl
call esi
mov dword [ebp - 4], eax
test bl, bl
jne 0x4355ec
xor ecx, ecx
lea eax, [edi + 8]
inc ecx
lock xadd dword [eax], ecx
mov ecx, dword [ebp + 8]
mov edx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x435628
or ecx, 0xffffffff
cmp dword [ebp + 0xc], ecx
je 0x435612
call esi
sub eax, dword [ebp - 4]
cmp dword [ebp + 0xc], eax
jbe 0x43562c
mov ecx, dword [ebp + 0xc]
sub ecx, eax
push dword [edi + 4]
push ecx
call fcn.004305bf
dec eax
pop ecx
pop ecx
je 0x435624
mov bl, 1
jmp 0x4355de
xor bl, bl
jmp 0x4355de
mov al, 1
jmp 0x43562e
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x435fe1
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 2
mov esi, ecx
call edi
movzx ebx, ax
push 1
shl ebx, 0x10
call edi
movzx eax, ax
or eax, ebx
and eax, 0x10001
cmp eax, dword [esi + 8]
je 0x436029
push 0xffffffffffffffe0
push 0
mov dword [esi + 8], eax
call fcn.00435164
pop ecx
push eax
call dword [sym.imp.USER32.dll_GetClassLongW]
cmp eax, 0x8000
setne al
test al, al
jne 0x436039
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [esi + 4]
setne al
test al, al
je 0x436042
pop edi
pop esi
pop ebx
jmp dword [sym.imp.USER32.dll_EndMenu]
pop edi
pop esi
pop ebx
ret

Function at 0x436046
Capabilities:
Write clipboard data

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 4]
inc eax
push edi
inc eax
push eax
push 0x2002
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
jne 0x436067
xor al, al
jmp 0x4360af
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x43607b
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x436063
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x436093
add ecx, 2
push ecx
push dword [esi]
push eax
call fcn.0044ea40
add esp, 0xc
jmp 0x436098
xor ecx, ecx
mov word [eax], cx
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push edi
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
setne al
pop edi
pop esi
ret

Function at 0x43690c
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
push esi
mov esi, ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebp, dword [esp + 0xc]
mov dword [esi + 4], eax
test ebp, ebp
je 0x436964
push eax
call fcn.004347b4
pop ecx
test al, al
jne 0x436964
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 2
mov dword [esi], ebp
call edi
movzx ebx, ax
push 1
shl ebx, 0x10
call edi
movzx eax, ax
push 0x436799
push 0x32
or eax, ebx
push esi
and eax, 0x10001
push ebp
mov dword [esi + 8], eax
call dword [sym.imp.USER32.dll_SetTimer]
pop edi
pop ebx
jmp 0x43696b
and dword [esi], 0
and dword [esi + 8], 0
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x436f46
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
cmp dword [ebp + 0xc], 0
push ebx
lea eax, [ebp - 0x250]
push eax
je 0x436f6e
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ebx, eax
test ebx, ebx
jne 0x436f87
jmp 0x436fd7
push dword [ebp + 8]
call fcn.00439648
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x436fd7
push esi
mov esi, dword [ebp + 0x10]
push 0x2c
lea eax, [ebp - 0x250]
push eax
push esi
call fcn.0044ea40
add esp, 0xc
push 0
push 0
push 0x30c
lea eax, [esi + 0x2c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x224]
push eax
push 0
push dword [0x473fcc]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
xor eax, eax
mov cl, byte [ebp + eax*2 - 0x1c]
mov byte [esi + eax + 0x338], cl
inc eax
cmp eax, 0xe
jl 0x436fc3
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc

Function at 0x4377e6
Capabilities:
Clear file content

Disassembly:
mov eax, 0x45e19e
call fcn.0044e550
sub esp, 0xc
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp - 0x18]
call fcn.00401974
xor ebx, ebx
mov dword [ebp - 4], ebx
test dword [ebp + 0x14], 0x300
mov esi, dword [ebp + 0xc]
setne byte [ebp - 0xd]
cmp esi, ebx
jne 0x437820
test byte [ebp + 0x14], 4
mov byte [ebp + 0xc], bl
je 0x437824
mov byte [ebp + 0xc], 1
push ebx
lea ecx, [ebp - 0x18]
push ebx
cmp byte [ebp - 0xd], bl
je 0x43783b
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004362e5
jmp 0x437850
xor eax, eax
cmp byte [ebp + 0xc], bl
setne al
lea eax, [eax + eax + 2]
push eax
push dword [ebp + 8]
call fcn.004362c8
test eax, eax
setne al
cmp al, bl
jne 0x437878
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040199e
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0x10
cmp esi, ebx
je 0x43789f
cmp esi, 0xffffffff
jne 0x437887
push 2
push ebx
push ebx
jmp 0x43788a
push ebx
push ebx
push esi
push dword [ebp - 0x18]
call fcn.00431770
add esp, 0x10
cmp edx, ebx
jg 0x43789f
jl 0x437859
cmp eax, ebx
jb 0x437859
mov eax, dword [edi + 4]
mov ecx, dword [ebp + 0x10]
cmp ecx, eax
jbe 0x4378ab
mov ecx, eax
cmp ecx, ebx
je 0x4378be
push ecx
push dword [edi]
lea ecx, [ebp - 0x18]
call fcn.00435a91
test al, al
je 0x437859
mov eax, dword [ebp + 0x14]
test al, 1
je 0x4378db
push 2
push 0x460eac
lea ecx, [ebp - 0x18]
call fcn.00435a91
test al, al
je 0x437859
mov eax, dword [ebp + 0x14]
test al, 2
je 0x4378f0
cmp byte [ebp + 0xc], bl
je 0x4378f0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 0xd], bl
je 0x43791d
shr eax, 9
and al, 1
movzx eax, al
push eax
lea ecx, [ebp - 0x18]
call fcn.00436363
test al, al
jne 0x43791d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0040199e
mov al, bl
jmp 0x437867
mov bl, 1
jmp 0x43790a
Function at 0x437e97
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x45d21a
call fcn.0044e550
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
test esi, esi
jne 0x437eb4
mov esi, dword [ebx]
push esi
call fcn.0042e7b0
mov edi, eax
test edi, edi
jne 0x437ecb
push eax
push eax
mov ecx, ebx
call fcn.0042b85f
jmp 0x437f49
mov eax, edi
cdq
sub eax, edx
sar eax, 1
push esi
lea ecx, [ebp - 0x10]
lea edi, [edi + eax + 0x32]
call fcn.0040478c
and dword [ebp - 4], 0
push edi
lea ecx, [ebp + 8]
call fcn.004311d6
mov byte [ebp - 4], 1
mov ebx, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea eax, [edi + 1]
push eax
push dword [ebp + 8]
push dword [ebp - 0x10]
call ebx
mov esi, eax
dec esi
cmp esi, edi
jle 0x437f1d
push esi
lea ecx, [ebp + 8]
call fcn.0043d435
inc esi
push esi
push eax
push dword [ebp - 0x10]
call ebx
dec eax
mov esi, eax
mov ecx, dword [ebp - 0x14]
push esi
push dword [ebp + 8]
call fcn.0042a8c4
mov byte [ebp - 4], 0
push dword [ebp + 8]
call fcn.0043d2ed
and dword [ebp + 8], 0
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x10]
call fcn.0043d2ed
and dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x437f5a
Capabilities:
Get common file path

Disassembly:
mov eax, 0x45e1f2
call fcn.0044e550
push ecx
push ebx
mov ebx, dword [ebp + 8]
movzx eax, byte [ebx]
cmp byte [eax + 0x474d68], 1
push edi
mov edi, ecx
jne 0x437fa3
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.0043b370
mov ecx, dword [ebp - 0x10]
cmp byte [ecx], 0
jne 0x437f9f
cmp eax, 0xffff
ja 0x437f9f
push 0
push edi
push eax
call fcn.0043e7a5
add esp, 0xc
jmp 0x437fc7
xor al, al
jmp 0x437fc7
push esi
xor esi, esi
push dword [esi*8 + 0x464974]
push ebx
call sym.qmmacro.exe_q_stricmp
pop ecx
pop ecx
test eax, eax
je 0x437fbf
inc esi
cmp esi, 0x34
jl 0x437fa6
cmp esi, 0x34
jne 0x437fd7
xor al, al
pop esi
mov ecx, dword [ebp - 0xc]
pop edi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
mov esi, dword [esi*8 + 0x464970]
xor ebx, ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 4], ebx
mov eax, pe_nt_image_headers32
cmp esi, eax
jge 0x43802f
push 0x104
lea ecx, [ebp + 8]
call fcn.0043d435
push ebx
push esi
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
jne 0x438020
xor bl, bl
or dword [ebp - 4], 0xffffffff
push dword [ebp + 8]
call fcn.0043d2ed
and dword [ebp + 8], 0
mov al, bl
jmp 0x437fc6
push dword [ebp + 8]
mov ecx, edi
call fcn.0042c1fe
jmp 0x43810f
sub esi, eax
je 0x4380fc
dec esi
je 0x4380ee
dec esi
je 0x4380b9
dec esi
je 0x4380a5
dec esi
je 0x438061
dec esi
jne 0x43810f
push edi
push dword [0x474160]
call fcn.00431425
pop ecx
pop ecx
jmp 0x43810f
mov ecx, 0x474128
call fcn.0042d133
cmp eax, 1
jne 0x438087
cmp byte [0x4741e0], 0
je 0x438080
mov eax, str._temp_LowQM_portable
jmp 0x43809a
mov eax, str._temp_LowQM
jmp 0x43809a
cmp byte [0x4741e0], 0
mov eax, str._temp_QM_portable
jne 0x43809a
mov eax, str._temp_QM
push ebx
push eax
mov ecx, edi
call fcn.0043811a
jmp 0x43810f
push ebx
push str._windows_Media
mov ecx, edi
call fcn.0043811a
mov bl, 1
jmp 0x43800c
mov esi, 0x104
push esi
lea ecx, [ebp + 8]
call fcn.0043d435
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push dword [ebp + 8]
mov ecx, edi
call fcn.0042c1fe
push 0x5c
mov ecx, edi
call fcn.00430934
push 1
push ebx
mov ecx, edi
call fcn.00438596
jmp 0x43810f
mov eax, dword [0x4741a4]
dec eax
push eax
push 0x4741a0
jmp 0x438108
mov eax, dword [0x474164]
dec eax
push eax
push 0x474160
mov ecx, edi
call fcn.0042c859
cmp dword [edi + 4], ebx
setne bl
jmp 0x43800c
Function at 0x4390aa
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x45e27e
call fcn.0044e550
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x20]
call fcn.00401974
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov byte [ebp - 4], 1
test byte [ebp + 0x14], 2
jne 0x439148
cmp dword [ebp + 0xc], ebx
jne 0x439148
cmp dword [ebp + 0x10], 0xffffffff
jne 0x439148
mov ecx, dword [0x473e5c]
mov eax, dword [ecx]
lea edx, [ebp + 8]
push edx
call dword [eax + 0x24]
cmp eax, ebx
je 0x439148
mov ecx, dword [0x473e5c]
mov edx, dword [ecx]
push esi
push dword [ebp + 8]
push eax
call dword [edx + 0x2c]
test al, al
je 0x43924c
mov esi, dword [esi + 4]
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x30]
call fcn.0042b651
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0040199e
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 0x10
test byte [ebp + 0x14], 1
je 0x439169
push ebx
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x30]
call fcn.004383ba
test al, al
je 0x43924c
mov eax, dword [ebp - 0x30]
mov dword [ebp + 8], eax
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x20]
call fcn.004362a2
test eax, eax
je 0x43924c
push dword [ebp - 0x20]
call fcn.0043174b
pop ecx
mov edi, eax
mov esi, edx
mov ecx, dword [ebp + 0xc]
cmp ecx, ebx
je 0x4391c6
xor eax, eax
cmp eax, esi
ja 0x4391c3
jb 0x43919d
cmp ecx, edi
jae 0x4391c3
sub edi, ecx
sbb esi, eax
push ebx
push eax
push ecx
push dword [ebp - 0x20]
call fcn.00431770
add esp, 0x10
cmp edx, ebx
jl 0x43924c
jg 0x4391c6
cmp eax, ebx
jb 0x43924c
jmp 0x4391c6
mov dword [ebp + 0x10], ebx
xor eax, eax
cmp eax, esi
jb 0x4391d6
ja 0x4391d3
cmp dword [ebp + 0x10], edi
jb 0x4391d6
mov dword [ebp + 0x10], edi
cmp dword [ebp + 0x10], 0x80000000
jb 0x4391e9
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x43924c
mov byte [ebp - 4], 2
push dword [ebp + 0x10]
mov esi, dword [ebp - 0x18]
mov ecx, esi
call fcn.0042b74c
mov dword [ebp - 4], 1
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x43921d
push ebx
lea eax, [ebp - 0x14]
push eax
push edi
push dword [esi]
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43924c
cmp dword [ebp - 0x14], edi
je 0x43922d
push ebx
push dword [ebp - 0x14]
mov ecx, esi
call fcn.0042b85f
mov esi, dword [ebp - 0x14]
jmp 0x43911e
mov ecx, dword [ebp - 0x18]
call fcn.0042b75a
or esi, 0xffffffff
jmp 0x43911e
Function at 0x43925c
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x45e293
call fcn.0044e550
sub esp, 0x40c
push ebx
push esi
lea eax, [ebp - 0x414]
push edi
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x418], eax
and dword [ebp - 4], 0
test byte [ebp + 0xc], 1
mov ebx, dword [ebp + 8]
mov esi, 0x200
jne 0x4392de
mov edi, dword [sym.imp.USER32.dll_InternalGetWindowText]
jmp 0x4392b1
lea ecx, [esi - 1]
cmp eax, ecx
jne 0x4393a6
add esi, esi
push esi
lea ecx, [ebp - 0x418]
call fcn.00438fd4
push esi
push dword [ebp - 0x418]
push ebx
call edi
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x439298
test byte [ebp + 0xc], 2
jne 0x4393a6
push ebx
call fcn.0043441b
pop ecx
test eax, 0x40000000
je 0x4393a6
push ebx
call fcn.004347b4
pop ecx
test al, al
je 0x439320
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov dword [ebp - 0x10], eax
test eax, eax
jle 0x43937b
lea esi, [eax + 1]
push 0x400
lea eax, [esi + esi]
push eax
lea ecx, [ebp - 0x418]
call fcn.00437bc9
push esi
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x10], eax
jmp 0x43937b
push 0
lea eax, [ebp - 0x10]
push eax
mov edi, 0x3e8
push edi
push 0
push 0
push 0xe
push ebx
call fcn.00433ebb
add esp, 0x1c
test eax, eax
jne 0x439342
and dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
test eax, eax
jle 0x43937b
lea esi, [eax + 1]
push 0x400
lea eax, [esi + esi]
push eax
lea ecx, [ebp - 0x418]
call fcn.00437bc9
push 0
lea ecx, [ebp - 0x10]
push ecx
push edi
push eax
push esi
push 0xd
push ebx
call fcn.00433ebb
add esp, 0x1c
test eax, eax
jne 0x43937b
and dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jge 0x439385
and dword [ebp - 0x10], 0
dec esi
cmp dword [ebp - 0x10], esi
jle 0x4393a6
mov ecx, dword [ebp - 0x418]
xor eax, eax
mov word [ecx + esi*2], ax
push dword [ebp - 0x418]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
push dword [ebp - 0x418]
mov ecx, esi
call fcn.0042a8c4
mov esi, dword [esi + 4]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x418]
call fcn.00418577
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8

Function at 0x439c31
Capabilities:
Encode data using xor

Disassembly:
push edi
mov edi, dword [esp + 0xc]
mov eax, edi
and eax, 3
dec edi
mov dl, byte [eax + 0x464efc]
js 0x439c65
push esi
mov eax, dword [esp + 0xc]
lea esi, [eax + edi]
mov al, byte [esi]
mov ecx, edi
and ecx, 3
mov cl, byte [ecx + 0x464efc]
add cl, al
xor al, dl
dec edi
mov byte [esi], al
mov dl, cl
jns 0x439c45
pop esi
pop edi
ret