joyce8/EMBER2024-capa huggingface dataset:
Function at 0x462acc
Capabilities:
Get file system object information

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff178
mov ebx, eax
cmp dword [0x4bc1a8], 0
je 0x462ae8
mov edx, str.ArcSort
jmp 0x462aed
mov edx, str.FileSort
mov eax, 0x49f84b
xor ecx, ecx
call fcn.004659b8
mov edi, eax
mov eax, edi
and eax, 0x1f
cmp eax, 2
jne 0x462c2c
xor esi, esi
mov dword [esp + 8], esi
xor eax, eax
mov dword [esp + 0xc], eax
lea edx, [esp + 4]
mov dword [esp + 4], 4
push edx
push 0
push 0x1005
push dword [ebx]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x462c2c
mov eax, 0x4c244c
mov edx, dword [esp + 0x24]
call fcn.0046524c
mov ebp, esi
mov dword [eax + 8], ebp
mov eax, dword [0x4bc1a8]
test eax, eax
jne 0x462c26
mov byte [esp + 0x2c], 0
add eax, 2
lea edx, [esp + 0x2c]
mov dword [esp + 0x84], eax
lea ecx, [esp + 0x7c]
mov dword [esp + 0x94], 0x50
mov dword [esp + 0x90], edx
push ecx
push ebp
push 0x102d
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp byte [esp + 0x2c], 0
jne 0x462c26
lea ecx, [esp + 0xa4]
mov eax, 0x4c244c
mov edx, dword [esp + 0x24]
call fcn.004650b0
push 0x400
push 0x160
lea eax, [esp + 0xcdc]
push eax
push 0
lea edx, [esp + 0xb4]
push edx
call sub.SHELL32.DLL_SHGetFileInfoA
test eax, eax
je 0x462c26
cmp byte [esp + 0xde4], 0
jne 0x462bf3
lea ecx, [esp + 0xde4]
lea edx, [esp + 0xa4]
mov eax, ebx
call fcn.00462798
mov ecx, dword [0x4bc1a8]
lea eax, [esp + 0xde4]
add ecx, 2
lea edx, [esp + 0xe34]
mov dword [esp + 0xe3c], ecx
mov dword [esp + 0xe48], eax
push edx
push ebp
push 0x102e
push dword [ebx]
call sub.USER32.DLL_SendMessageA
inc esi
jmp 0x462b0b
mov edx, 0x49fa65
mov eax, 0x49f84b
mov ecx, 1
call fcn.004659b8
test eax, eax
je 0x462c47
or edi, 0x40
mov edx, str.FlatView
mov eax, 0x49f84b
xor ecx, ecx
call fcn.004659b8
test eax, eax
je 0x462c62
or edi, 0x80
push 0x45db17
push edi
push 0x1030
push dword [ebx]
call sub.USER32.DLL_SendMessageA
cmp dword [ebx + 4], 0
je 0x462d7e
test edi, 0x20
setne al
and eax, 1
and edi, 0x1f
or ebp, 0xffffffff
mov byte [esp], al
xor eax, eax
mov edx, eax
shl edx, 3
sub edx, eax
cmp edi, dword [edx*4 + 0x49f6d8]
jne 0x462cae
mov ebp, dword [edx*4 + 0x49f6d4]
jmp 0x462cb4
inc eax
cmp eax, 7
jl 0x462c95
push 0
push ebp
push 0x108c
push dword [ebx]
call sub.USER32.DLL_SendMessageA
mov dword [esp + 0xe5c], 0x24
xor esi, esi
lea eax, [esp + 0xe5c]
push eax
mov edi, esi
push edi
push 0x1203
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
test eax, eax
je 0x462d1f
test byte [esp + 0xe71], 8
je 0x462d19
and dword [esp + 0xe70], 0xffffe7ff
lea eax, [esp + 0xe5c]
push eax
push edi
push 0x1204
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
jmp 0x462d1f
inc esi
cmp esi, 0x10
jl 0x462cd0
push dword [ebx + 0xc]
push 0
push 0x1208
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
lea edx, [esp + 0xe5c]
push edx
push ebp
push 0x1203
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
or dword [esp + 0xe70], 0x1800
cmp byte [esp], 0
je 0x462d5f
mov ecx, 1
jmp 0x462d61
xor ecx, ecx
mov dword [esp + 0xe78], ecx
lea eax, [esp + 0xe5c]
push eax
push ebp
push 0x1204
push dword [ebx + 4]
call sub.USER32.DLL_SendMessageA
add esp, 0xe88
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4639fc
Capabilities:
Get common file path

Disassembly:
push ebx
push esi
add esp, 0xfffff800
mov ebx, eax
mov eax, ebx
call fcn.00463eb8
cmp dword [0x4bc1a8], 0
je 0x463ab3
push esp
push 0x400
call sub.KERNEL32.DLL_GetCurrentDirectoryA
mov eax, esp
call fcn.0040ba38
mov esi, eax
cmp esi, 0xffffffff
je 0x463a76
call fcn.00468158
mov ecx, esi
mov edx, 1
shl edx, cl
and eax, edx
jne 0x463a76
lea edx, [esp + 0x400]
mov eax, 0x4ba564
xor ecx, ecx
call fcn.0045d0fc
lea eax, [esp + 0x400]
call fcn.0040bb00
lea edx, [esp + 0x400]
push edx
call fcn.0048f15c
pop ecx
xor eax, eax
jmp 0x463ab5
mov eax, dword [0x4b9824]
test eax, eax
je 0x463a85
push eax
call sub.USER32.DLL_DestroyWindow
mov eax, ebx
call fcn.00463968
xor edx, edx
mov eax, ebx
mov dword [0x4bc1a8], edx
call fcn.004633c4
mov eax, ebx
call fcn.00463b40
mov byte [0x4b9db8], 0
mov eax, 0x4b9d8c
call fcn.0044546c
mov al, 1
add esp, 0x800
pop esi
pop ebx
ret
Function at 0x4645b5
Capabilities:
Get file system object information

Disassembly:
add esp, 0xfffffea0
push edx
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.SHELL32.DLL_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
ret

Function at 0x4649b0
Capabilities:
Get disk information
Get file system object information

Disassembly:
push ebx
push esi
add esp, 0xfffffaa0
mov esi, eax
mov dword [0x4c2d60], esi
push 0x4001
push 0x160
lea eax, [esp + 8]
push eax
push 0
push 0x49fd00
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
test ebx, ebx
jne 0x464a13
lea eax, [esp + 0x160]
push eax
push 0x400
call sub.KERNEL32.DLL_GetLogicalDriveStringsA
push 0x4001
push 0x160
lea edx, [esp + 8]
push edx
push 0
lea ecx, [esp + 0x170]
push ecx
call sub.SHELL32.DLL_SHGetFileInfoA
mov ebx, eax
push ebx
push 0
push 0x1109
push esi
call sub.USER32.DLL_SendMessageA
call fcn.00464321
add esp, 0x560
pop esi
pop ebx
ret

Function at 0x464ec8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x28], eax
mov eax, 0x49fd6c
call fcn.0048dbf8
mov word [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
mov edx, 1
add eax, 0xf8
call fcn.00465000
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
imul edx, dword [eax + 0x104], 0x38
mov esi, dword [ecx + 0xf8]
add esi, edx
cmp word [ebx + 0x400], 0
je 0x464f1f
lea ecx, [ebx + 0x400]
jmp 0x464f21
xor ecx, ecx
mov edx, ebx
mov eax, dword [ebp - 0x28]
call fcn.0040efd4
mov word [ebp - 0x14], 0
jmp 0x464f71
mov edx, dword [ebx + 0xc2c]
mov dword [esi + 8], edx
mov ecx, dword [ebx + 0xc00]
mov dword [esi + 0xc], ecx
mov ecx, dword [ebx + 0xc04]
mov dword [esi + 0x10], ecx
mov eax, dword [ebx + 0xc08]
mov dword [esi + 0x14], eax
mov eax, dword [ebx + 0xc0c]
mov dword [esi + 0x18], eax
mov edx, dword [ebx + 0xc10]
mov dword [esi + 0x1c], edx
mov ecx, dword [ebx + 0xc14]
mov dword [esi + 0x20], ecx
mov ecx, dword [ebx + 0xc18]
mov dword [esi + 0x24], ecx
mov eax, dword [ebx + 0xc1c]
mov dword [esi + 0x28], eax
mov edx, dword [ebx + 0xc20]
mov dword [esi + 0x2c], edx
mov ecx, dword [ebx + 0xc24]
mov dword [esi + 0x30], ecx
mov eax, dword [ebx + 0xc28]
mov dword [esi + 0x34], eax
mov edx, dword [ebp - 0x28]
mov eax, dword [edx + 0x104]
inc dword [edx + 0x104]
mov edx, dword [ebp - 0x24]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x465258
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffff664
mov esi, edx
mov edi, eax
mov ebp, 0x49fd84
push esp
push 0x20019
push 0
push edi
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
je 0x465289
xor eax, eax
jmp 0x4653f2
mov edx, esi
mov eax, 0x80000001
call fcn.004653fd
lea edx, [esp + 8]
push edx
lea ecx, [esp + 8]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push esi
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
je 0x4652ca
mov eax, dword [esp]
call fcn.00465584
xor eax, eax
jmp 0x4653f2
xor ebx, ebx
mov dword [esp + 0x10], 0xc8
mov dword [esp + 0x14], 0x3e8
lea eax, [esp + 0x14]
push eax
lea edx, [esp + 0xf0]
push edx
lea ecx, [esp + 0x14]
push ecx
push 0
lea eax, [esp + 0x20]
push eax
lea edx, [esp + 0x38]
push edx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumValueA
test eax, eax
jne 0x46532b
push dword [esp + 0x14]
lea ecx, [esp + 0xf0]
push ecx
push dword [esp + 0x14]
push 0
lea eax, [esp + 0x34]
push eax
push dword [esp + 0x18]
call sub.ADVAPI32.DLL_RegSetValueExA
inc ebx
jmp 0x4652cc
xor ebx, ebx
mov dword [esp + 0x18], 0xc8
lea eax, [esp + 0x1c]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x28]
push edx
lea ecx, [esp + 0x4e8]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x4653df
lea eax, [esp + 0x4d4]
lea edx, [ebp + 0x17]
push eax
push edi
push edx
lea ecx, [esp + 0x5a8]
push ecx
call fcn.00490628
add esp, 0x10
lea edx, [ebp + 0x17]
lea eax, [esp + 0x4d4]
push eax
push esi
push edx
lea ecx, [esp + 0x7a8]
push ecx
call fcn.00490628
add esp, 0x10
lea eax, [esp + 8]
push eax
lea edx, [esp + 8]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea ecx, [esp + 0x7b8]
push ecx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
test eax, eax
jne 0x4653df
lea edx, [esp + 0x79c]
lea eax, [esp + 0x59c]
call fcn.00465258
inc ebx
jmp 0x46532d
mov eax, dword [esp]
call fcn.00465584
mov eax, dword [esp + 4]
call fcn.00465584
mov al, 1
add esp, 0x99c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x465433
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov esi, edx
push edi
add esp, 0xfffffd28
mov edi, eax
cmp byte [esi], 0
je 0x4654ce
push esp
push 0x20019
push 0
push esi
push edi
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x4654ce
xor ebx, ebx
mov dword [esp + 4], 0xc8
lea eax, [esp + 8]
push eax
push 0
push 0
push 0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x24]
push ecx
push ebx
push dword [esp + 0x1c]
call sub.ADVAPI32.DLL_RegEnumKeyExA
test eax, eax
jne 0x4654b5
lea eax, [esp + 0x10]
push eax
push esi
push str._s_s
lea edx, [esp + 0xe4]
push edx
call fcn.00490628
add esp, 0x10
mov eax, edi
lea edx, [esp + 0xd8]
call fcn.00465433
inc ebx
jmp 0x46545e
mov eax, dword [esp]
call fcn.00465584
push esi
push edi
call sub.ADVAPI32.DLL_RegDeleteKeyA
test eax, eax
jne 0x4654ce
inc dword [0x4c3170]
add esp, 0x2d8
pop edi
pop esi
pop ebx
ret
Function at 0x465674
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff58
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov esi, dword [ebp + 8]
call fcn.0040f818
test eax, eax
je 0x4656df
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.004654d8
mov ebx, eax
test ebx, ebx
je 0x465717
lea edx, [ebp - 0xa8]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040f890
mov eax, esi
call fcn.0040f90c
add eax, eax
lea edx, [ebp - 0xa8]
add eax, 2
push eax
push esi
push 1
push 0
push edx
push ebx
call sub.ADVAPI32.DLL_RegSetValueExW
mov eax, ebx
call fcn.00465584
jmp 0x465717
mov eax, esi
call fcn.0040f90c
add eax, eax
add eax, 2
push eax
call fcn.0048bf34
pop ecx
mov ebx, eax
mov ecx, 0x10000000
mov edx, ebx
mov eax, esi
call fcn.0040f86c
push ebx
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, edi
call fcn.00465628
push ebx
call fcn.0048bd5c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x465810
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp - 4]
call fcn.0046553a
mov ebx, eax
mov esi, 1
test ebx, ebx
je 0x465852
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.00465584
test esi, esi
je 0x465866
push dword [ebp + 0xc]
push edi
call fcn.0048d758
add esp, 8
xor eax, eax
jmp 0x465868
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x465890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff54
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 0x10]
call fcn.0040f818
test eax, eax
je 0x465903
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.0046553a
mov ebx, eax
lea edx, [ebp - 0xac]
mov ecx, 0x10000000
mov eax, dword [ebp - 8]
call fcn.0040f890
mov esi, 1
test ebx, ebx
je 0x4658f9
lea eax, [ebp + 8]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
lea ecx, [ebp - 0xac]
push 0
push ecx
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExW
mov esi, eax
mov eax, ebx
call fcn.00465584
test esi, esi
sete bl
and ebx, 1
jmp 0x46593b
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.0048bf34
pop ecx
mov esi, eax
push esi
push 0x49fd84
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00465810
mov ebx, eax
mov ecx, dword [ebp + 8]
mov edx, edi
mov eax, esi
call fcn.0040f890
push esi
call fcn.0048bd5c
pop ecx
test bl, bl
jne 0x465949
mov edx, dword [ebp + 0xc]
mov eax, edi
call fcn.0040f920
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x465954
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
call fcn.0046553a
mov ebx, eax
mov esi, 1
mov dword [ebp - 0x10], 4
test ebx, ebx
je 0x46599d
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xc]
push eax
push edi
push edx
push 0
push dword [ebp - 8]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov esi, eax
mov eax, ebx
call fcn.00465584
test esi, esi
je 0x4659aa
mov edx, dword [ebp + 8]
xor eax, eax
mov dword [edi], edx
jmp 0x4659ac
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x465a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
call fcn.0046553a
mov ebx, eax
mov dword [ebp - 0xc], esi
mov edi, 1
test ebx, ebx
je 0x465a41
lea eax, [ebp - 0xc]
lea edx, [ebp - 8]
push eax
push dword [ebp + 0x10]
push edx
push 0
push dword [ebp - 4]
push ebx
call sub.ADVAPI32.DLL_RegQueryValueExA
mov edi, eax
mov eax, ebx
call fcn.00465584
test edi, edi
je 0x465a6e
cmp dword [ebp + 0xc], 0
je 0x465a5c
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.0048d568
add esp, 0xc
jmp 0x465a6a
push esi
push 0
push dword [ebp + 0x10]
call fcn.0048d5d8
add esp, 0xc
xor eax, eax
jmp 0x465a71
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x465a8c
Capabilities:
Delete registry key

Disassembly:
push ebx
add esp, 0xffffff00
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 4]
call fcn.004655a0
test al, al
je 0x465ab0
push esp
push ebx
call sub.ADVAPI32.DLL_RegDeleteKeyA
add esp, 0x100
pop ebx
ret

Function at 0x465ac8
Capabilities:
Delete registry value

Disassembly:
push ebx
push esi
add esp, 0xfffffefc
mov esi, ecx
mov ebx, eax
mov eax, ebx
push 0x100
lea ecx, [esp + 8]
call fcn.004655a0
test al, al
je 0x465b11
push esp
push 0x20006
push 0
lea edx, [esp + 0x10]
push edx
push ebx
call sub.ADVAPI32.DLL_RegOpenKeyExA
test eax, eax
jne 0x465b11
push esi
push dword [esp + 4]
call sub.ADVAPI32.DLL_RegDeleteValueA
mov eax, dword [esp]
call fcn.00465584
add esp, 0x104
pop esi
pop ebx
ret
Function at 0x467644
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdec
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 4], edx
mov edi, eax
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push 0x4a2f88
push 1
push 0
push 0x4a2fb8
call sub.OLE32.DLL_CoCreateInstance
test eax, eax
jl 0x46770f
push edi
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x50]
test esi, esi
je 0x467690
push esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [eax]
call dword [edx + 0x1c]
cmp dword [ebp + 0xc], 0
je 0x4676a4
push 0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x44]
cmp dword [ebp + 8], 0
je 0x4676b6
push dword [ebp + 8]
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x2c]
lea eax, [ebp - 0xc]
push eax
push 0x4a2fe8
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [edx]
call dword [ecx]
test eax, eax
jl 0x467706
push 0x104
lea eax, [ebp - 0x214]
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_MultiByteToWideChar
push 1
lea edx, [ebp - 0x214]
push edx
mov ecx, dword [ebp - 0xc]
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
test eax, eax
jl 0x4676fd
mov bl, 1
mov eax, dword [ebp - 0xc]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov ecx, dword [ebp - 8]
push ecx
mov eax, dword [ecx]
call dword [eax + 8]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x46771c
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
push esp
call sub.SHELL32.DLL_SHGetMalloc
lea eax, [esp + 4]
push eax
push 0x10
push 0
call sub.SHELL32.DLL_SHGetSpecialFolderLocation
push ebx
push dword [esp + 8]
call sub.SHELL32.DLL_SHGetPathFromIDListA
push dword [esp + 4]
mov edx, dword [esp + 4]
push edx
mov ecx, dword [edx]
call dword [ecx + 0x14]
pop ecx
pop edx
pop ebx
ret

Function at 0x467754
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebx
add esp, 0xffffffe0
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x467769
xor eax, eax
jmp 0x4677a7
push ebx
call fcn.0048d788
pop ecx
mov byte [ebx + eax + 1], 0
push 0x1e
push 0
lea edx, [esp + 8]
push edx
call fcn.0048d5d8
add esp, 0xc
mov dword [esp + 4], 3
mov word [esp + 0x10], 0x14
mov dword [esp + 8], ebx
push esp
call sub.SHELL32.DLL_SHFileOperationA
test eax, eax
sete al
and eax, 1
add esp, 0x20
pop ebx
ret

Function at 0x467cd4
Capabilities:
Create directory

Disassembly:
push ebx
push esi
add esp, 0xfffffc00
mov esi, edx
mov ebx, eax
mov eax, esp
mov edx, 0x400
call fcn.00468100
mov eax, esp
call fcn.0040ba60
push ebx
lea edx, [esp + 4]
push edx
call fcn.0048d67c
add esp, 8
mov eax, esp
call fcn.0040a64c
test eax, eax
je 0x467d1c
push 0
lea edx, [esp + 4]
push edx
call sub.KERNEL32.DLL_CreateDirectoryA
test eax, eax
jne 0x467d3e
push esp
mov eax, 0x1f7
call fcn.004116e0
push eax
call fcn.0044a170
add esp, 8
mov eax, 0x4a6984
call fcn.0042981c
xor eax, eax
jmp 0x467d4a
push esp
push esi
call fcn.0048d758
add esp, 8
mov al, 1
add esp, 0x400
pop esi
pop ebx
ret
Function at 0x467e0c
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffffac
mov edi, ecx
mov esi, edx
mov ebx, eax
push 0x44
push 0
lea eax, [esp + 8]
push eax
call fcn.0048d5d8
add esp, 0xc
mov dword [esp], 0x44
lea edx, [esp + 0x44]
push edx
lea ecx, [esp + 4]
push ecx
push esi
push 0
push 0
push 0
push 0
push 0
push ebx
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x467e75
test edi, edi
je 0x467e5f
push edi
push dword [esp + 0x48]
call sub.KERNEL32.DLL_WaitForSingleObject
push dword [esp + 0x48]
call sub.KERNEL32.DLL_CloseHandle
push dword [esp + 0x44]
call sub.KERNEL32.DLL_CloseHandle
mov al, 1
jmp 0x467e77
xor eax, eax
add esp, 0x54
pop edi
pop esi
pop ebx
ret

Function at 0x467f34
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffd8
mov dword [esp], eax
call sub.USER32.DLL_GetDesktopWindow
mov ebp, eax
push ebp
call sub.USER32.DLL_GetDC
mov edi, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov ebx, eax
push edi
call sub.GDI32.DLL_CreateCompatibleDC
mov esi, eax
lea eax, [esp + 0x10]
push eax
push 0x18
push dword [esp + 8]
call sub.GDI32.DLL_GetObjectA
push dword [esp + 0x18]
push dword [esp + 0x18]
push edi
call sub.GDI32.DLL_CreateCompatibleBitmap
mov dword [esp + 4], eax
push dword [esp]
push ebx
call sub.GDI32.DLL_SelectObject
mov dword [esp + 8], eax
push dword [esp + 4]
push esi
call sub.GDI32.DLL_SelectObject
mov dword [esp + 0xc], eax
push 0xcc0020
mov edx, dword [esp + 0x1c]
push edx
mov eax, dword [esp + 0x1c]
mov ecx, eax
neg ecx
push ecx
mov ecx, eax
dec ecx
push 0
push ecx
push ebx
push edx
push eax
push 0
push 0
push esi
call sub.GDI32.DLL_StretchBlt
push 0xcc0020
push 0
push 0
push esi
push dword [esp + 0x28]
push dword [esp + 0x28]
push 0
push 0
push ebx
call sub.GDI32.DLL_BitBlt
push dword [esp + 8]
push ebx
call sub.GDI32.DLL_SelectObject
push dword [esp + 0xc]
push esi
call sub.GDI32.DLL_SelectObject
push dword [esp + 4]
call sub.GDI32.DLL_DeleteObject
push ebx
call sub.GDI32.DLL_DeleteDC
push esi
call sub.GDI32.DLL_DeleteDC
push edi
push ebp
call sub.USER32.DLL_ReleaseDC
add esp, 0x28
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x468100
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebx
push esi
mov esi, edx
mov ebx, eax
push 0x4a068c
push esi
mov edx, 0x4a06a4
mov eax, 0x4a069e
mov ecx, ebx
call fcn.004657f4
cmp byte [ebx], 0
je 0x46812d
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x46814b
push ebx
push esi
call sub.KERNEL32.DLL_GetTempPathA
test eax, eax
je 0x46813d
cmp byte [ebx], 0
jne 0x46814b
push str._rartemp
push ebx
call fcn.0048d758
add esp, 8
mov eax, ebx
call fcn.0040ba60
pop esi
pop ebx
ret

Function at 0x468288
Capabilities:
Check os version

Disassembly:
add esp, 0xffffff6c
mov dword [esp], 0x94
push esp
call sub.KERNEL32.DLL_GetVersionExA
cmp dword [esp + 0x10], 2
jne 0x4682b7
cmp dword [esp + 4], 5
ja 0x4682bb
cmp dword [esp + 4], 5
jne 0x4682b7
cmp dword [esp + 8], 0
ja 0x4682bb
xor eax, eax
jmp 0x4682c0
mov eax, 1
add esp, 0x94
ret
Function at 0x468854
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 3
add esp, 0xfffff004
push eax
dec eax
jne 0x46885d
mov eax, dword [ebp - 4]
add esp, 0xfffffaf4
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x2454], edx
mov edi, eax
mov eax, 0x4a078c
call fcn.0048dbf8
call fcn.00495aec
mov dword [ebp - 0x2458], eax
xor ebx, ebx
mov word [ebp - 0x2440], 8
push 0
push 0
lea eax, [ebp - 0x242c]
mov ecx, dword [ebp - 0x2454]
mov edx, edi
call fcn.0041232c
inc dword [ebp - 0x2434]
mov word [ebp - 0x2440], 0x14
lea eax, [ebp - 0x28fc]
call fcn.00412df4
lea eax, [ebp - 0x28d0]
call fcn.00412df4
lea eax, [ebp - 0x28a4]
call fcn.00412df4
inc dword [0x4bc1b0]
jmp 0x468981
test bl, bl
jne 0x468917
call fcn.00495aec
sub eax, dword [ebp - 0x2458]
cmp eax, 0x3e8
jle 0x468917
push 0
xor ecx, ecx
xor edx, edx
mov eax, 5
call fcn.00475d6c
mov bl, 1
test bl, bl
je 0x46892b
lea eax, [ebp - 0x3510]
call fcn.00477874
call fcn.00476dec
call fcn.00444258
cmp byte [ebp + 0x14], 0
je 0x46894b
lea eax, [ebp - 0x3510]
call fcn.0040b578
lea edx, [ebp - 0x3510]
cmp eax, edx
jne 0x46894f
xor eax, eax
jmp 0x468954
mov eax, 1
mov word [ebp - 0x2440], 0x14
push esi
push eax
mov dl, byte [ebp + 0x10]
lea eax, [ebp - 0x3510]
push edx
lea edx, [ebp - 0x3110]
mov cl, byte [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x3510]
push dword [ebp + 8]
call fcn.00468a24
lea edx, [ebp - 0x3510]
lea eax, [ebp - 0x242c]
call fcn.00412460
test eax, eax
jne 0x4689a3
cmp dword [0x4bc1b4], 0
je 0x4688ef
dec dword [0x4bc1b0]
mov eax, dword [0x4bc1b4]
test eax, eax
sete dl
and edx, 1
mov byte [ebp - 0x2459], dl
mov word [ebp - 0x2440], 0x14
test eax, eax
je 0x4689da
mov eax, esi
call fcn.00464e68
xor edx, edx
mov dword [0x4bc1b4], edx
jmp 0x4689e1
mov eax, esi
call fcn.0046517c
test bl, bl
je 0x4689f0
push dword [0x4b982c]
call sub.USER32.DLL_DestroyWindow
mov al, byte [ebp - 0x2459]
mov edx, 2
push eax
lea eax, [ebp - 0x242c]
dec dword [ebp - 0x2434]
call fcn.00412404
pop eax
mov edx, dword [ebp - 0x2450]
mov dword fs:[0], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x469777
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffff4
push 0x1000000
call fcn.0048bf34
pop ecx
mov edi, eax
test edi, edi
jne 0x46979a
mov eax, 1
xor edx, edx
jmp 0x46982d
mov dword [esp], 0
mov dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
mov dword [esp + 8], eax
xor ebx, ebx
mov esi, 0x800000
jmp 0x4697f1
mov eax, 0x10000
and esi, 0xffffff
and ebx, 0xffffff
mov dl, byte [edi + esi]
mov byte [edi + ebx], dl
sub ebx, 0x100
xor byte [edi + esi], dl
sub esi, 0x100
dec eax
test eax, eax
jg 0x4697c0
dec ebx
dec esi
add dword [esp], 1
adc dword [esp + 4], 0
call sub.KERNEL32.DLL_GetTickCount
sub eax, dword [esp + 8]
cmp eax, 0xc8
jb 0x4697bb
push edi
call fcn.0048bd5c
pop ecx
push 0
push 0x64
mov eax, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.00491bd0
add eax, 1
adc edx, 0
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp]
mov edx, dword [esp + 4]
add esp, 0xc
pop edi
pop esi
pop ebx
ret