joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45aa90
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45aad2
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00403bf0
mov eax, dword [ebp - 0x10]
call fcn.0045a5f8
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x45a9bb
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404018
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045af6c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x45aa90
xor eax, eax
push ebp
push 0x45aa89
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0045a724
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.0045aae4
test al, al
je 0x45aa67
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00403c3c
mov ebx, dword [ebp - 0x38]
dec ebx
test ebx, ebx
jl 0x45aa67
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00403f98
push eax
push esi
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x45aa63
mov eax, dword [ebp - 0x14]
call fcn.00403f98
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.00403d0c
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.0045a968
inc esi
dec ebx
jne 0x45aa1c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45aa90
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0045a724
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00403f98
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.0045a710
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45aad9
lea eax, [ebp - 0x3c]
call fcn.00403b58
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403b7c
ret

Function at 0x45aae4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.00402cd8
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4a476c]
cmp byte [edx + 8], 0
je 0x45ab48
mov edx, dword [0x4a4768]
cmp dword [edx], 2
jne 0x45ab48
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x45ab4c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x45ac04
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
lea edx, [ebp - 0x28]
mov eax, edi
call fcn.0045aae4
test al, al
je 0x45abe6
mov ecx, dword [ebp - 0x24]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00403c3c
mov ebx, dword [ebp - 0x28]
dec ebx
test ebx, ebx
jl 0x45abe6
inc ebx
xor esi, esi
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00403f98
push eax
push esi
mov eax, dword [edi + 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov eax, dword [ebp - 0xc]
call fcn.00403f98
mov edx, eax
lea eax, [ebp - 0x2c]
call fcn.00403d0c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc esi
dec ebx
jne 0x45ab9f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ac0b
lea eax, [ebp - 0x2c]
call fcn.00403b58
lea eax, [ebp - 0xc]
call fcn.00403b58
ret

Function at 0x45af08
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403f98
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x45af44
push ebp
call fcn.0045ae98
pop ecx
mov eax, dword [ebp - 8]
call fcn.0045a60c
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, dword [ebp + 0xc]
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret 8

Function at 0x45b624
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc00
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, dword [ebx + 4]
call fcn.00403f98
push eax
push 0x400
lea eax, [ebp - 0x400]
push eax
mov eax, dword [ebp + 0xc]
call fcn.00403f98
push eax
mov eax, edi
call fcn.00403f98
push eax
mov eax, esi
call fcn.00403f98
push eax
call sub.kernel32.dll_GetPrivateProfileStringA
mov ecx, eax
lea edx, [ebp - 0x400]
mov eax, dword [ebp + 8]
call fcn.00403c3c
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x45c670
Capabilities:
Open clipboard

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 4], 0
jne 0x45c6a9
mov eax, dword [0x4a4664]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebx + 8], eax
test eax, eax
jne 0x45c69c
push ebx
push 0x45c6b0
call fcn.0042c7e4
mov dword [ebx + 8], eax
mov byte [ebx + 0xc], 1
mov eax, dword [ebx + 8]
push eax
call sub.user32.dll_OpenClipboard
mov byte [ebx + 0xd], 0
inc dword [ebx + 4]
pop ebx
ret
Function at 0x45c6d0
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebp - 4]
call fcn.0045c670
xor edx, edx
push ebp
push 0x45c79f
push dword fs:[edx]
mov dword fs:[edx], esp
push ebx
push 2
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 8], eax
xor edx, edx
push ebp
push 0x45c771
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
xor edx, edx
push ebp
push 0x45c760
push dword fs:[edx]
mov dword fs:[edx], esp
mov edx, eax
mov eax, edi
mov ecx, ebx
call fcn.004028f4
mov eax, dword [ebp - 4]
call fcn.0045c628
mov eax, dword [ebp - 8]
push eax
movzx eax, si
push eax
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c767
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
ret

Function at 0x45c7b0
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045c670
push 1
call sub.user32.dll_GetClipboardData
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x45c822
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebp - 8], 0
je 0x45c7f6
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalLock
mov edx, eax
mov eax, ebx
call fcn.00403d0c
jmp 0x45c7fd
mov eax, ebx
call fcn.00403b58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c829
cmp dword [ebp - 8], 0
je 0x45c819
mov eax, dword [ebp - 8]
push eax
call sub.kernel32.dll_GlobalUnlock
mov eax, dword [ebp - 4]
call fcn.0045c644
ret

Function at 0x45c858
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x45c936
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045c670
xor edx, edx
push ebp
push 0x45c919
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
je 0x45c8e2
mov edx, ebx
mov eax, dword [0x4166fc]
call fcn.0041af98
test al, al
je 0x45c8d2
movzx eax, bx
push eax
call sub.user32.dll_GetClipboardData
mov esi, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, esi
mov edx, ebx
mov eax, edi
call fcn.0041ae6c
call fcn.00403650
jmp 0x45c920
movzx eax, bx
push eax
call sub.user32.dll_EnumClipboardFormats
mov ebx, eax
test bx, bx
jne 0x45c89d
lea edx, [ebp - 8]
mov eax, dword [0x4a4554]
call fcn.00404db4
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x40676c]
call fcn.0040ac38
call fcn.004035b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c920
mov eax, dword [ebp - 4]
call fcn.0045c644
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c93d
lea eax, [ebp - 8]
call fcn.00403b58
ret
Function at 0x45c944
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045c670
xor eax, eax
push ebp
push 0x45c99c
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
mov esi, eax
push esi
mov ecx, ebx
mov dx, 2
mov eax, edi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45c9a3
mov eax, dword [ebp - 4]
call fcn.0045c644
ret

Function at 0x45c9ac
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045c670
xor edx, edx
push ebp
push 0x45ca01
push dword fs:[edx]
mov dword fs:[edx], esp
push 3
call sub.user32.dll_GetClipboardData
mov ebx, eax
push 9
call sub.user32.dll_GetClipboardData
push eax
mov ecx, ebx
mov dx, 3
mov eax, esi
mov ebx, dword [eax]
call dword [ebx + 0x58]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45ca08
mov eax, dword [ebp - 4]
call fcn.0045c644
ret

Function at 0x45ca78
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045c670
xor eax, eax
push ebp
push 0x45caed
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045c628
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
call fcn.0041af6c
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x45cad7
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45caf4
mov eax, dword [ebp - 4]
call fcn.0045c644
ret

Function at 0x45cafc
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0045c670
xor eax, eax
push ebp
push 0x45cb71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0045c628
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
lea edx, [ebp - 0xa]
mov eax, ebx
mov ebx, dword [eax]
call dword [ebx + 0x5c]
mov eax, dword [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
call sub.user32.dll_SetClipboardData
cmp dword [ebp - 0x10], 0
je 0x45cb5b
mov eax, dword [ebp - 0x10]
push eax
push 9
call sub.user32.dll_SetClipboardData
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45cb78
mov eax, dword [ebp - 4]
call fcn.0045c644
ret
Function at 0x45df78
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x204], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x45e10f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0045dad0
mov eax, dword [ebp - 0x204]
lea edx, [esi + 1]
call fcn.0040b4a8
cmp al, 2
jne 0x45dfbe
dec esi
mov eax, ebx
call fcn.0045dd94
test al, al
je 0x45e0af
test esi, esi
jge 0x45dfd3
xor esi, esi
lea edi, [esi + 1]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0045dad0
mov eax, dword [ebp - 0x204]
call fcn.00403dd4
cmp edi, eax
jge 0x45e01a
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0045dad0
mov eax, dword [ebp - 0x204]
mov al, byte [eax + edi - 1]
mov edx, dword [0x4a4758]
and eax, 0xff
bt dword [edx], eax
jae 0x45e01a
inc edi
mov eax, dword [ebx + 0x138]
cmp esi, eax
jl 0x45e028
mov esi, eax
mov edi, esi
mov ecx, edi
mov edx, edi
mov eax, ebx
call fcn.0045df54
cmp edi, esi
je 0x45e0a7
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x200]
mov byte [eax], 0
inc eax
dec edx
jne 0x45e04e
mov byte [ebp - 0x1f0], 0x81
mov byte [ebp - 0x1db], 0x81
lea eax, [ebp - 0x200]
push eax
call sub.user32.dll_SetKeyboardState
push 1
push 0x25
push pe_nt_image_headers32
mov eax, ebx
call fcn.0042627c
push eax
call sub.user32.dll_SendMessageA
push 1
push 0x25
push 0x101
mov eax, ebx
call fcn.0042627c
push eax
call sub.user32.dll_SendMessageA
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
mov dword [ebx + 0x140], esi
jmp 0x45e0f6
test esi, esi
jge 0x45e0b5
xor esi, esi
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0045dad0
mov eax, dword [ebp - 0x204]
call fcn.00403dd4
cmp esi, eax
jl 0x45e0eb
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0045dad0
mov eax, dword [ebp - 0x204]
call fcn.00403dd4
mov esi, eax
mov ecx, esi
mov edx, esi
mov eax, ebx
call fcn.0045df54
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45e116
lea eax, [ebp - 0x204]
call fcn.00403b58
ret

Function at 0x461714
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f88
xor eax, eax
push ebp
push 0x461765
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403f98
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x461749
test al, 0x10
jne 0x46174d
xor ebx, ebx
jmp 0x46174f
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x46176c
lea eax, [ebp - 4]
call fcn.00403b58
ret
Function at 0x475edc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea0
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 4], edx
mov ebx, eax
lea eax, [ebp - 0x15c]
mov edx, dword [0x40674c]
call fcn.00404314
xor eax, eax
push ebp
push 0x475fe6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00403dd4
cmp eax, 3
jne 0x475f63
cmp byte [ebx + 1], 0x3a
jne 0x475f63
cmp byte [ebx + 2], 0x5c
jne 0x475f63
call sub.kernel32.dll_GetLogicalDrives
mov esi, eax
lea eax, [ebp - 0x160]
mov dl, byte [ebx]
call fcn.00403cfc
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 4]
call fcn.0040735c
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
sub eax, 0x41
cmp eax, 0x1f
ja 0x475f5e
bt esi, eax
setb bl
jmp 0x475fb4
lea edx, [ebp - 0x160]
mov eax, ebx
call fcn.00475ea4
mov eax, dword [ebp - 0x160]
lea ecx, [ebp - 0x15c]
mov edx, 0x10
call fcn.00407ad0
test eax, eax
jne 0x475f8e
test ebx, ebx
jne 0x475f92
xor eax, eax
jmp 0x475f94
mov al, 1
mov ebx, eax
test bl, bl
je 0x475fa9
mov eax, dword [ebp - 0x154]
and eax, 0x10
cmp eax, 0x10
sete bl
lea eax, [ebp - 0x15c]
call fcn.00407b40
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x475fed
lea eax, [ebp - 0x160]
call fcn.00403b58
lea eax, [ebp - 0x15c]
mov edx, dword [0x40674c]
call fcn.004043dc
lea eax, [ebp - 4]
call fcn.00403b58
ret
Function at 0x476034
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffcc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x34], ebx
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov esi, dword [ebp + 0x20]
xor eax, eax
push ebp
push 0x4761fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
mov eax, ebx
call fcn.00403b58
mov eax, ebx
mov edx, 0x104
call fcn.00404104
test esi, esi
je 0x476080
mov eax, esi
call fcn.0042627c
mov esi, eax
jmp 0x476082
xor esi, esi
push 0x104
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4761e8
xor eax, eax
push ebp
push 0x4761e1
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
push eax
mov al, byte [ebp + 0x18]
call fcn.00475a50
push eax
push esi
call sub.shell32.dll_SHGetSpecialFolderLocation
xor eax, eax
push ebp
push 0x4761bf
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x30], esi
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
call fcn.00403f98
mov dword [ebp - 0x24], eax
mov al, byte [ebp + 0x14]
call fcn.00475a90
mov dword [ebp - 0x20], eax
cmp byte [ebp + 0x10], 0
je 0x4760fb
or dword [ebp - 0x20], 4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x30]
push eax
call sub.shell32.dll_SHBrowseForFolderA
mov esi, eax
mov dword [edi], esi
test esi, esi
je 0x476186
test byte [ebp + 0x14], 8
je 0x476161
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0xc]
call fcn.00403d0c
mov ecx, dword [ebp - 0x34]
mov eax, ebx
mov edx, 0x47621c
call fcn.00403e20
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.shell32.dll_SHGetPathFromIDListA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x47615b
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00403d0c
mov byte [ebp - 5], 1
jmp 0x47617e
mov eax, dword [ebp - 0xc]
push eax
push esi
call sub.shell32.dll_SHGetPathFromIDListA
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov eax, ebx
mov edx, dword [ebp - 0xc]
call fcn.00403d0c
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp - 0x14]
mov dword [eax], edx
cmp byte [ebp - 5], 0
jne 0x476193
cmp dword [edi], 0
setne byte [ebp - 5]
cmp byte [ebp - 5], 0
je 0x4761a4
mov eax, dword [ebp + 0x24]
mov edx, dword [ebp - 0x28]
call fcn.00403d0c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4761c6
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x476205
lea eax, [ebp - 0x34]
call fcn.00403b58
ret

Function at 0x479e44
Capabilities:
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403f98
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
setne al
pop ebx
ret
Function at 0x47e628
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f88
xor eax, eax
push ebp
push 0x47e673
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403f98
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47e67a
lea eax, [ebp - 4]
call fcn.00403b58
ret

Function at 0x47fd44
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f88
xor eax, eax
push ebp
push 0x47fe29
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, edi
call fcn.00403b58
mov eax, dword [ebp - 4]
call fcn.00403dd4
test eax, eax
je 0x47fe0b
mov eax, dword [ebp - 4]
call fcn.00403dd4
sar eax, 1
jns 0x47fd93
adc eax, 0
add eax, 0xde0
mov edx, dword [0x4a4730]
mov dword [edx], eax
mov eax, dword [ebp - 4]
call fcn.00403dd4
mov esi, eax
sar esi, 1
jns 0x47fdb1
adc esi, 0
dec esi
test esi, esi
jb 0x47fe0b
inc esi
xor ebx, ebx
mov eax, 0xf0
call fcn.00402cf8
mov dword [ebp - 8], eax
mov eax, ebx
add eax, eax
mov edx, dword [ebp - 4]
movzx edx, byte [edx + eax]
sub edx, 0x62
mov ecx, edx
shl edx, 4
sub edx, ecx
mov dword [ebp - 0xc], edx
mov edx, dword [ebp - 4]
movzx eax, byte [edx + eax + 1]
sub eax, 0x62
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 0xc]
add dl, byte [ebp - 0x10]
xor dl, byte [ebp - 8]
call fcn.00403cfc
mov edx, dword [ebp - 0x14]
mov eax, edi
call fcn.00403ddc
inc ebx
dec esi
jne 0x47fdb9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47fe30
lea eax, [ebp - 0x14]
call fcn.00403b58
lea eax, [ebp - 4]
call fcn.00403b58
ret
Function at 0x4864b8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f88
xor eax, eax
push ebp
push 0x4865b0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403b58
mov eax, dword [ebp - 4]
call fcn.00403dd4
add eax, 0x3f8a7a
mov edx, dword [0x4a4730]
mov dword [edx], eax
mov eax, dword [ebp - 4]
call fcn.00403dd4
mov edi, eax
test edi, edi
jbe 0x48657f
mov ebx, 1
mov eax, 0xfa
call fcn.00402cf8
mov ecx, eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
xor eax, ecx
push ecx
mov ecx, 0xf
cdq
idiv ecx
pop ecx
add eax, 0x61
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax + ebx - 1]
xor eax, ecx
mov ecx, 0xf
cdq
idiv ecx
add edx, 0x61
mov dword [ebp - 0xc], edx
push dword [esi]
lea eax, [ebp - 0x10]
mov dl, byte [ebp - 8]
call fcn.00403cfc
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
mov dl, byte [ebp - 0xc]
call fcn.00403cfc
push dword [ebp - 0x14]
mov eax, esi
mov edx, 3
call fcn.00403e94
inc ebx
dec edi
jne 0x486513
mov ecx, dword [esi]
mov eax, esi
mov edx, 0x4865c8
call fcn.00403e20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4865b7
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.00403b7c
lea eax, [ebp - 4]
call fcn.00403b58
ret

Function at 0x4865cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0xc], ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403f88
xor eax, eax
push ebp
push 0x4866e6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403b58
mov edx, dword [ebp - 4]
mov eax, 0x4866fc
call fcn.004040bc
dec eax
jne 0x4866b5
lea eax, [ebp - 4]
push eax
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00403fd8
mov eax, dword [ebp - 4]
call fcn.00403dd4
test eax, eax
je 0x4866c8
mov eax, dword [ebp - 4]
call fcn.00403dd4
sar eax, 1
jns 0x486645
adc eax, 0
add eax, 0x3f8a7a
mov edx, dword [0x4a4730]
mov dword [edx], eax
mov eax, dword [ebp - 4]
call fcn.00403dd4
mov edi, eax
sar edi, 1
jns 0x486663
adc edi, 0
dec edi
test edi, edi
jb 0x4866c8
inc edi
xor ebx, ebx
mov eax, 0xfa
call fcn.00402cf8
mov dword [ebp - 8], eax
mov eax, ebx
add eax, eax
mov edx, dword [ebp - 4]
mov al, byte [edx + eax]
sub al, 0x61
mov edx, eax
shl edx, 4
sub edx, eax
mov eax, ebx
add eax, eax
mov ecx, dword [ebp - 4]
mov al, byte [ecx + eax + 1]
sub al, 0x61
add dl, al
xor dl, byte [ebp - 8]
lea eax, [ebp - 0xc]
call fcn.00403cfc
mov edx, dword [ebp - 0xc]
mov eax, esi
call fcn.00403ddc
inc ebx
dec edi
jne 0x48666b
jmp 0x4866c8
push esi
mov ecx, 0x7fffffff
mov edx, 3
mov eax, dword [ebp - 4]
call fcn.00403fd8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4866ed
lea eax, [ebp - 0xc]
call fcn.00403b58
lea eax, [ebp - 4]
call fcn.00403b58
ret