joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430310
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4038
call fcn.00436e60
mov eax, dword [0x483004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x1290], 0
je 0x43048d
cmp dword [esi + 0x149c], 0
je 0x43048d
lea eax, [ebp - 0x4038]
mov dword [ebp - 0x4030], 0
push eax
call fcn.0043ddac
lea eax, [ebp - 0x4038]
push eax
lea eax, [ebp - 0x402c]
push eax
call fcn.0043dd22
push dword [ebp - 0x402c]
lea eax, [ebp - 0x4008]
push dword [ebp - 0x4028]
push dword [ebp - 0x4024]
push str._02d:_02d:_02d
push 0x2000
push eax
call fcn.00404760
lea ecx, [ebp - 0x4008]
mov dword [ebp - 0x4030], 0
add esp, 0x24
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4303b0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea eax, [ebp - 0x4030]
sub ecx, edx
push 0
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x4008]
push eax
push dword [esi + 0x149c]
call edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x4008]
push 0x1fff
push eax
call fcn.00404610
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.0043da29
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x430422
cmp eax, 0x1fff
ja 0x430422
jne 0x430428
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x4008]
mov dword [ebp - 0x4030], 0
lea edx, [eax + 2]
nop dword [eax + eax]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x430440
sub eax, edx
lea ecx, [ebp - 0x4030]
push 0
sar eax, 1
push ecx
add eax, eax
push eax
lea eax, [ebp - 0x4008]
push eax
push dword [esi + 0x149c]
call edi
push 0
lea eax, [ebp - 0x4030]
mov dword [ebp - 0x4030], 0
push eax
push 4
push 0x468b34
push dword [esi + 0x149c]
call edi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004369c2
mov esp, ebp
pop ebp
ret

Function at 0x430810
Capabilities:
Write file on windows

Disassembly:
cmp byte [ecx + 0x1290], 0
jne fcn.0042f0b0
ret

Function at 0x430890
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
mov eax, dword [0x483004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp dword [esi + 0x14a0], 0xffffffff
je 0x43095f
push 0x200
lea eax, [ebp - 0x204]
push 0
push eax
call fcn.004398f0
mov eax, dword [ebp + 8]
add esp, 0xc
add dword [esi + 0x14a4], eax
cmp dword [esi + 0x14a4], 0x64
jle 0x4308e9
mov dword [esi + 0x14a4], 0x64
push edi
push dword [esi + 0x14a4]
lea eax, [ebp - 0x204]
push str._d_t_s
push 0x100
push eax
call fcn.00430ab0
lea ecx, [ebp - 0x204]
add esp, 0x14
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x430912
sub ecx, edx
lea eax, [ebp - 0x208]
push 0
sar ecx, 1
push eax
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x204]
push eax
push dword [esi + 0x14a0]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x43095f
push dword [esi + 0x14a0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x14a0], 0xffffffff
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004369c2
mov esp, ebp
pop ebp
ret 8
Function at 0x432120
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x483004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0x10]
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 0x214]
push eax
push 0x470358
push 1
push 0
push 0x470408
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x4321b0
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x218]
push edx
push 0x4703f8
push eax
mov ecx, dword [eax]
call dword [ecx]
test eax, eax
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
js 0x4321a6
push esi
push eax
call dword [ecx + 0x50]
test eax, eax
jns 0x4321c3
mov eax, dword [ebp - 0x218]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp - 0x214]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004369c2
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x210]
mov edx, 0x103
mov eax, ecx
sub esi, eax
lea eax, [edx + 0x7ffffefb]
test eax, eax
je 0x4321f0
movzx eax, word [esi + ecx]
test ax, ax
je 0x4321f0
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x4321d2
lea eax, [ecx - 2]
test edx, edx
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov eax, dword [ebp - 0x214]
lea edx, [ebp - 0x210]
push edx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x24]
test eax, eax
js 0x432192
test edi, edi
je 0x432244
mov eax, dword [ebp - 0x214]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x2c]
test eax, eax
js 0x432192
mov eax, dword [ebp - 0x218]
push 1
push ebx
push eax
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov ecx, dword [ebp - 0x218]
mov esi, eax
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
mov ecx, dword [ebp - 0x214]
push ecx
mov edx, dword [ecx]
call dword [edx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, dword [ebp - 4]
test esi, esi
pop edi
setns al
xor ecx, ebp
pop esi
pop ebx
call fcn.004369c2
mov esp, ebp
pop ebp
ret
Function at 0x433210
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466f1d
mov eax, dword fs:[0]
push eax
sub esp, 0x3dc
mov eax, dword [0x483004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x3c8], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x3e4], esi
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x14], 7
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], 0
jb 0x43327e
mov eax, dword [esi]
jmp 0x433280
mov eax, esi
xor ecx, ecx
push ecx
mov word [eax], cx
mov ecx, esi
push 0x4719ec
call fcn.00403220
push 0x104
lea eax, [ebp - 0x3a8]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x3c8], 1
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x4333c7
lea eax, [ebp - 0x3c4]
mov dword [ebp - 0x3c4], 0
push eax
lea eax, [ebp - 0x3a8]
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x4333c7
lea eax, [ebx + 1]
push eax
lea ecx, [ebp - 0x3e0]
call fcn.00431c70
mov edi, dword [ebp - 0x3e0]
lea eax, [ebp - 0x3a8]
push edi
push ebx
push dword [ebp - 0x3c4]
mov dword [ebp - 4], 1
push eax
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x4333ac
lea eax, [ebp - 0x3e8]
push eax
lea eax, [ebp - 0x3cc]
push eax
push str.VarFileInfoTranslation
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4333ac
mov ecx, dword [ebp - 0x3cc]
movzx eax, word [ecx + 2]
push eax
movzx eax, word [ecx]
push eax
push str.StringFileInfo_04X_04XFileVersion
lea eax, [ebp - 0x1a0]
push 0xc8
push eax
call fcn.00404760
add esp, 0x14
lea eax, [ebp - 0x3d0]
push eax
lea eax, [ebp - 0x3d4]
push eax
lea eax, [ebp - 0x1a0]
push eax
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x4333ac
push dword [ebp - 0x3d0]
lea ecx, [ebp - 0x3c0]
push dword [ebp - 0x3d4]
call fcn.00431bb0
push eax
mov ecx, esi
call fcn.00402d90
lea ecx, [ebp - 0x3c0]
call fcn.00402d50
test edi, edi
je 0x4333c7
mov ecx, dword [ebp - 0x3d8]
sub ecx, edi
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x3e0]
call fcn.00403390
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004369c2
mov esp, ebp
pop ebp
ret
Function at 0x4333f0
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx ecx, ax
mov ax, cx
and ecx, 0x3ff
shr ax, 0xa
dec ecx
movzx eax, ax
cmp ecx, 0x1e
ja case.0x433416.2
jmp dword [ecx*4 + 0x433654]
cmp eax, 1
jne 0x433434
push 0x468e04
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468df8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e10
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e1c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e28
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
cmp eax, 2
jne 0x433493
push 0x468e34
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e40
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e4c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e58
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e64
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e70
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e7c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468e88
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push str.ja_JP
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468ea0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push str.no_NO
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468eb8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
cmp eax, 1
jne 0x433570
push 0x468ec4
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468ed0
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468edc
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
cmp eax, 2
jne 0x4335ab
push 0x468ef4
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468ee8
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468f00
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468f18
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468f0c
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
push 0x468f24
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00430820
pop ebp
ret
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x433651
cmp edx, 0x7fffffff
ja 0x433651
mov ecx, dword [ebp + 8]
push esi
push edi
mov esi, SysReAllocString
mov edi, 0x468e40
sub esi, edx
sub edi, ecx
lea eax, [esi + edx]
test eax, eax
je 0x433642
movzx eax, word [edi + ecx]
test ax, ax
je 0x433642
mov word [ecx], ax
add ecx, 2
sub edx, 1
jne 0x433627
test edx, edx
lea eax, [ecx - 2]
pop edi
cmovne eax, ecx
xor ecx, ecx
pop esi
mov word [eax], cx
pop ebp
ret
Function at 0x4336d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x483004]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x483d9c], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x230], 0
jne 0x433727
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
test eax, eax
je 0x433727
push str.SHGetKnownFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x483d98], eax
mov byte [0x483d9c], 1
jmp 0x43372c
mov eax, dword [0x483d98]
test eax, eax
je 0x4337bc
lea ecx, [ebp - 0x228]
push ecx
push 0
push 0
push edi
call eax
test eax, eax
js 0x433872
push dword [ebp - 0x228]
lea ecx, [ebp - 0x224]
call fcn.00402e10
push dword [ebp - 0x228]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x224]
push eax
call fcn.00403320
mov ecx, dword [ebp - 0x210]
cmp ecx, 8
jb 0x433885
inc ecx
push ecx
push dword [ebp - 0x224]
lea ecx, [ebp - 0x224]
call fcn.00403390
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004369c2
mov esp, ebp
pop ebp
ret
push edi
lea eax, [ebp - 0x22c]
mov ecx, 0x483ab8
push eax
call fcn.004311c0
push dword [ebp - 0x228]
push dword [ebp - 0x228]
push dword [ebp - 0x22c]
call fcn.00431150
add esp, 0xc
test eax, eax
je 0x433872
push edi
lea eax, [ebp - 0x22c]
mov ecx, 0x483ab8
push eax
call fcn.00431ac0
lea eax, [ebp - 0x20c]
push eax
mov eax, dword [ebp - 0x22c]
push 0
push 0
push dword [eax + 0x20]
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x433872
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x224]
call fcn.00402e10
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
mov word [esi], ax
lea eax, [ebp - 0x224]
push eax
call fcn.00403320
lea ecx, [ebp - 0x224]
call fcn.00402d50
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004369c2
mov esp, ebp
pop ebp
ret
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov word [esi], ax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.004369c2
mov esp, ebp
pop ebp
ret
Function at 0x433ee0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x466f5c
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x483004]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx esi, word [ebp + 0xc]
mov edi, dword [ebp + 0x10]
push 0
mov byte [ebp - 0x41], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ebx, dword [ebp + 8]
mov ecx, eax
mov eax, ebx
mov dword [ebp - 0x48], ecx
shr eax, 4
and ebx, 0xf
inc eax
push esi
movzx eax, ax
push eax
push 6
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
mov dword [ebp - 0x14], 7
xor eax, eax
mov dword [ebp - 0x18], 0
push eax
push 0x4719ec
lea ecx, [ebp - 0x28]
mov word [ebp - 0x28], ax
call fcn.00403220
lea eax, [ebp - 0x28]
cmp edi, eax
je 0x433fa5
mov eax, dword [edi + 0x14]
cmp eax, 8
jb 0x433f7b
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00403390
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x433f93
mov eax, dword [edi]
jmp 0x433f95
mov eax, edi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x28]
push eax
mov ecx, edi
call fcn.00403320
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
cmp eax, 8
jb 0x433fc1
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.00403390
test esi, esi
je 0x434094
push esi
push dword [ebp - 0x48]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x434094
mov dl, 1
xor eax, eax
mov byte [ebp - 0x41], dl
movzx ecx, word [esi]
add esi, 2
test cx, cx
je 0x433ff6
cmp eax, ebx
je 0x434003
lea esi, [esi + ecx*2]
inc eax
cmp eax, 0x10
jl 0x433fe4
mov al, dl
jmp 0x434097
xor eax, eax
mov dword [ebp - 0x2c], 7
lea ebx, [ecx + 1]
mov dword [ebp - 0x30], 0
push eax
push ebx
lea ecx, [ebp - 0x40]
mov word [ebp - 0x40], ax
call fcn.00436110
lea eax, [ebp - 0x40]
cmp edi, eax
je 0x434068
mov eax, dword [edi + 0x14]
cmp eax, 8
jb 0x43403e
inc eax
mov ecx, edi
push eax
push dword [edi]
call fcn.00403390
mov dword [edi + 0x14], 7
cmp dword [edi + 0x14], 8
mov dword [edi + 0x10], 0
jb 0x434056
mov eax, dword [edi]
jmp 0x434058
mov eax, edi
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x40]
push eax
mov ecx, edi
call fcn.00403320
mov eax, dword [ebp - 0x2c]
cmp eax, 8
jb 0x43407d
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.00403390
cmp dword [edi + 0x14], 8
jb 0x434085
mov edi, dword [edi]
push SysReAllocString
push esi
push 0
push ebx
push edi
call fcn.004357a0
mov al, byte [ebp - 0x41]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004369c2
mov esp, ebp
pop ebp
ret
Function at 0x4340c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x483004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov esi, dword [ebp + 0xc]
push esi
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x434105
push edi
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
jmp 0x43414a
test esi, esi
je 0x43414a
cmp esi, 0x7fffffff
ja 0x43414a
mov edx, SysReAllocString
lea ebx, [ebp - 0x20c]
sub edx, esi
mov ecx, edi
sub ebx, edi
lea eax, [edx + esi]
test eax, eax
je 0x43413d
movzx eax, word [ebx + ecx]
test ax, ax
je 0x43413d
mov word [ecx], ax
add ecx, 2
sub esi, 1
jne 0x434122
test esi, esi
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x434150
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x5c
je 0x4341da
mov esi, 0x104
mov eax, edi
nop
cmp word [eax], 0
je 0x43417e
add eax, 2
sub esi, 1
jne 0x434170
xor eax, eax
mov ecx, 0x80070057
test esi, esi
mov edx, 0x104
cmovne ecx, eax
mov eax, edx
sub eax, esi
xor ebx, ebx
test esi, esi
cmovne ebx, eax
test ecx, ecx
js 0x4341da
lea ecx, [edi + ebx*2]
sub edx, ebx
je 0x4341cd
lea eax, [ebx + 0x7ffffefb]
mov edi, 0x471aac
add eax, edx
sub edi, ecx
test eax, eax
je 0x4341cd
movzx esi, word [edi + ecx]
test si, si
je 0x4341cd
mov word [ecx], si
dec eax
add ecx, 2
sub edx, 1
jne 0x4341b4
test edx, edx
lea eax, [ecx - 2]
cmovne eax, ecx
xor ecx, ecx
mov word [eax], cx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004369c2
mov esp, ebp
pop ebp
ret
Function at 0x435010
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x483004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x21c], esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x43504f
pop esi
mov al, 1
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004369c2
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x218]
push eax
push 0x20219
push 0
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x43507f
cmp eax, 2
pop esi
sete al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004369c2
mov esp, ebp
pop ebp
ret
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov byte [ebp - 0x20d], 0
lea edi, [ebx + eax*2]
cmp edi, ebx
jbe 0x4350b3
cmp word [edi - 2], 0x5c
je 0x4350b3
mov eax, 0x5c
mov byte [ebp - 0x20d], 1
mov word [edi], ax
add edi, 2
xor eax, eax
mov word [edi], ax
lea eax, [ebp - 0x224]
mov dword [ebp - 0x214], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x43518f
lea esi, [ebp - 0x20c]
sub esi, edi
nop word [eax + eax]
mov edx, 0x208
mov eax, edi
nop word [eax + eax]
lea ecx, [edx + 0x7ffffdf6]
test ecx, ecx
je 0x43512e
movzx ecx, word [esi + eax]
test cx, cx
je 0x43512e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x435110
lea ecx, [eax - 2]
test edx, edx
push ebx
push dword [ebp - 0x21c]
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
call fcn.00435010
add esp, 8
test al, al
je 0x435189
lea eax, [ebp - 0x224]
mov dword [ebp - 0x214], 0x104
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x435100
mov esi, dword [ebp - 0x21c]
cmp byte [ebp - 0x20d], 0
lea eax, [edi - 2]
cmove eax, edi
xor ecx, ecx
mov word [eax], cx
push dword [ebp - 0x218]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
test eax, eax
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.004369c2
mov esp, ebp
pop ebp
ret
Function at 0x4470b8
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00446d78

Function at 0x4513d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
xor eax, eax
push edi
mov edi, ecx
test edx, edx
je 0x45144c
push esi
mov esi, dword [ebp + 8]
cmp edx, 0x20
jb 0x451435
movsx ecx, byte [edi + 4]
push ebx
lea ebx, [edi + 4]
movd xmm0, ecx
punpcklbw xmm0, xmm0
punpcklwd xmm0, xmm0
pshufd xmm1, xmm0, 0
cmp esi, ebx
ja 0x45140e
lea ecx, [edx - 1]
add ecx, esi
cmp ecx, ebx
jae 0x451434
mov ecx, edx
and ecx, 0xffffffe0
movups xmm0, xmmword [esi + eax]
pxor xmm0, xmm1
movups xmmword [esi + eax], xmm0
movups xmm0, xmmword [esi + eax + 0x10]
pxor xmm0, xmm1
movups xmmword [esi + eax + 0x10], xmm0
add eax, 0x20
cmp eax, ecx
jb 0x451413
pop ebx
cmp eax, edx
jae 0x45144b
nop dword [eax]
mov cl, byte [edi + 4]
xor byte [eax + esi], cl
inc eax
cmp eax, edx
jb 0x451440
pop esi
pop edi
pop ebp
ret 8

Function at 0x4516d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x481178
push 0x439be0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
push ebx
push esi
push edi
mov eax, dword [0x483004]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
push 0xffffffffffffffff
mov esi, dword [ebp + 8]
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x45177c
cmp eax, 0x80
je 0x4517e8
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x4517e8
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0
lea eax, [ebp - 0x34]
push eax
mov edi, dword [sym.imp.USER32.dll_GetMessageW]
call edi
test eax, eax
je 0x4517e8
mov ebx, dword [sym.imp.USER32.dll_IsWindow]
cmp eax, 0xffffffff
je 0x4517e8
push dword [esi + 0x3c]
call ebx
test eax, eax
je 0x4517c0
lea eax, [ebp - 0x34]
push eax
push dword [esi + 0x3c]
call dword [sym.imp.USER32.dll_IsDialogMessageW]
test eax, eax
je 0x4517c0
cmp dword [ebp - 0x30], 0x10
je 0x4517e8
jmp 0x4517d4
mov dword [ebp - 4], 0
push esi
push 0x451640
push 0
movzx eax, word [esi + 4]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [esi + 0x3c], eax
mov dword [ebp - 4], 0xfffffffe
call fcn.004517b6
jmp 0x45171d
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
push 0
push 0
push 0
lea eax, [ebp - 0x34]
push eax
call edi
test eax, eax
jne 0x451751
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x451a30
Capabilities:
Create thread

Disassembly:
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x451a73
push 0
push 0
push 0
mov dword [esi + 0x3c], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x451a73
push 0
push 0
push esi
push 0x451620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x3e8
mov dword [esi], eax
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
ret
Function at 0x45c742
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0045c5c1