joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43f388
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x43f5d6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.0043dbf4
xor eax, eax
push ebp
push 0x43f5ac
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043e1a4
test al, al
je 0x43f590
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 4]
xor edx, edx
call fcn.00406de4
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x43f590
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0x10], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
call fcn.00406d34
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegEnumKeyExW
mov edx, eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043db54
test al, al
je 0x43f584
mov eax, dword [ebp - 4]
call fcn.00406d34
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.00406e54
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043eca0
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x43f584
xor eax, eax
push ebp
push 0x43f57d
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0xc]
call fcn.0043dbf4
xor eax, eax
push ebp
push 0x43f55f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00406d34
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.00406e54
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043dbf8
mov eax, dword [ebp - 4]
call fcn.00406d34
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.00406e54
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0043eca0
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x43f53c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0043f250
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.0043f388
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f543
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x14]
dec dword [ebp - 0x28]
jne 0x43f413
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43f5b3
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.0043dbf4
ret
Function at 0x4408dc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00406c90
xor eax, eax
push ebp
push 0x4409db
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004049e4
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004049e4
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
cmp byte [ebp - 2], 0
je 0x44093e
mov word [ebp - 0x18], 1
jmp 0x440944
mov word [ebp - 0x18], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x440961
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x440961
lea eax, [ebp + 8]
mov edx, dword [ebp + 8]
call fcn.00406564
test eax, eax
je 0x44096a
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x440979
mov eax, dword [ebp + 8]
call fcn.00406d34
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, esi
call fcn.00406d34
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x4409c5
cmp byte [ebp - 1], 0
je 0x4409b1
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4409e2
lea eax, [ebp + 8]
call fcn.00406c98
ret

Function at 0x4418f0
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x441973
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e]
xor ecx, ecx
mov edx, 0x1e
call fcn.004049e4
mov dword [ebp - 0x1a], 2
lea eax, [ebp - 0x24]
mov ecx, 0x441990
mov edx, ebx
call fcn.00407158
mov eax, dword [ebp - 0x24]
call fcn.00406d34
mov dword [ebp - 0x16], eax
mov eax, esi
call fcn.00406d34
mov dword [ebp - 0x12], eax
mov word [ebp - 0xe], 0x214
lea eax, [ebp - 0x1e]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44197a
lea eax, [ebp - 0x24]
call fcn.00406c98
ret
Function at 0x441994
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
xor edx, edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c90
xor eax, eax
push ebp
push 0x441a1c
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.004049e4
mov dword [ebp - 0x1e], 3
lea eax, [ebp - 0x28]
mov ecx, 0x441a38
mov edx, dword [ebp - 4]
call fcn.00407158
mov eax, dword [ebp - 0x28]
call fcn.00406d34
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x441a23
lea eax, [ebp - 0x28]
call fcn.00406c98
lea eax, [ebp - 4]
call fcn.00406c98
ret
Function at 0x443c94
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 6
push 0
push 0
dec ecx
jne 0x443c9d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x444050
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x44406c
push ebx
push 0x444090
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x58
mov edx, 3
call fcn.0040723c
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
lea edx, [eax + 0x54]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00444910
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
jne 0x44401a
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x6c
mov cl, 2
mov edx, 0x4440a8
call fcn.004417f8
lea eax, [ebp - 0x18]
mov ecx, ebx
mov edx, 0x4440e0
call fcn.00407158
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x6c
mov cl, 3
call fcn.004417f8
lea eax, [ebp - 4]
mov edx, ebx
call fcn.00406cfc
lea edx, [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0044497c
test al, al
jne 0x443d6e
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x6c
mov cl, 2
mov edx, 0x444100
call fcn.004417f8
jmp 0x44401a
lea edx, [ebp - 8]
mov eax, edi
call fcn.00415a18
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov edx, 0x444130
call fcn.00407158
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x6c
mov cl, 3
call fcn.004417f8
push 0x444150
push dword [ebp - 8]
push ebx
lea eax, [ebp - 0x20]
mov edx, 3
call fcn.0040723c
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
add eax, 0x6c
mov cl, 3
call fcn.004417f8
push 0xffffffffffffffff
lea eax, [ebp - 0x24]
mov ecx, ebx
mov edx, dword [ebp - 8]
call fcn.00407158
mov eax, dword [ebp - 0x24]
call fcn.00406d34
push eax
mov eax, dword [ebp - 4]
call fcn.00406d34
push eax
call sub.kernel32.dll_CopyFileW
push esi
mov ecx, dword [ebp - 4]
mov dl, 1
mov eax, dword [0x43f7e8]
call fcn.0043fcb0
mov dword [ebp - 0x14], eax
xor eax, eax
push ebp
push 0x443e40
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
add eax, 8
mov edx, dword [ebp + 8]
mov edx, dword [edx - 4]
mov edx, dword [edx + 0x60]
call fcn.00406ca8
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0x14]
call fcn.004402d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x443e47
mov eax, dword [ebp - 0x14]
call fcn.00405148
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444057
lea eax, [ebp - 0x38]
mov edx, 9
call fcn.00406ca0
lea eax, [ebp - 0x10]
mov edx, dword [0x43f7b4]
call fcn.00408410
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00406ca0
ret
Function at 0x444c48
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov esi, eax
mov eax, dword [ebp + 8]
call fcn.00406c90
xor eax, eax
push ebp
push 0x444d47
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.004049e4
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.004049e4
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
cmp byte [ebp - 2], 0
je 0x444caa
mov word [ebp - 0x18], 1
jmp 0x444cb0
mov word [ebp - 0x18], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x444ccd
mov edx, eax
sub edx, 0xa
cmp word [edx], 2
je 0x444ccd
lea eax, [ebp + 8]
mov edx, dword [ebp + 8]
call fcn.00406564
test eax, eax
je 0x444cd6
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x444ce5
mov eax, dword [ebp + 8]
call fcn.00406d34
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0x20
push 0xffffffffffffffff
push 0
push 0
mov eax, esi
call fcn.00406d34
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x444d31
cmp byte [ebp - 1], 0
je 0x444d1d
push 0xffffffffffffffff
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x444d4e
lea eax, [ebp + 8]
call fcn.00406c98
ret

Function at 0x4455e4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406c90
xor eax, eax
push ebp
push 0x44564f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x22]
xor ecx, ecx
mov edx, 0x1e
call fcn.004049e4
mov dword [ebp - 0x1e], 3
mov eax, dword [ebp - 4]
call fcn.00406d34
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x12], 0x14
lea eax, [ebp - 0x22]
push eax
call sub.shell32.dll_SHFileOperationW
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x445656
lea eax, [ebp - 4]
call fcn.00406c98
ret
Function at 0x401320
Capabilities:
Packed with generic packer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov dword [ebp - 0x79c], 4
mov dword [ebp - 0x784], 0x80000000
mov dword [ebp - 0x798], 0x20019
mov eax, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x72c], eax
pushal
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12d
mov dword [ebp - 0x28], 0x12
mov dword [ebp - 0x7f4], str.FFFTWAREFFasses
mov dword [ebp - 0x7a4], str.yysid0afaced1_e828_11d1_9187_b532f1e9575dinprocserver32
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x790], 0x12c
mov dword [ebp - 0x28], 0x11
mov dword [ebp - 0x854], 2
mov dword [ebp - 0x850], 3
mov dword [ebp - 0x84c], 0
mov dword [ebp - 0x848], 0
mov dword [ebp - 0x844], 0
mov dword [ebp - 0x840], 0
mov dword [ebp - 0x834], 0
mov dword [ebp - 0x830], 0
mov dword [ebp - 0x82c], str.asdf
lea ecx, [ebp - 0x824]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExW]
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea ecx, [ebp - 0x854]
push ecx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea edx, [ebp - 0x854]
push edx
call dword [sym.imp.USER32.dll_RegisterClassExA]
lea eax, [ebp - 0x854]
push eax
call dword [sym.imp.USER32.dll_RegisterClassExA]
mov ecx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov dword [0x4380c8], ecx
mov edx, dword [ebp - 0x7f4]
mov byte [edx], 0x53
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 1], 0x4f
mov ecx, dword [ebp - 0x7f4]
mov byte [ecx + 2], 0x46
mov edx, dword [ebp - 0x7f4]
mov byte [edx + 9], 0x43
mov eax, dword [ebp - 0x7f4]
mov byte [eax + 0xa], 0x6c
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x7f4]
push edx
push 0x80000002
call dword [0x4380c8]
test eax, eax
je 0x4014c3
xor eax, eax
jmp 0x401765
mov eax, dword [ebp - 0x7a4]
mov byte [eax], 0x63
mov ecx, dword [ebp - 0x7a4]
mov byte [ecx + 1], 0x6c
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x7a4]
push eax
push 0x80000000
call dword [0x4380c8]
test eax, eax
je 0x4014f7
xor eax, eax
jmp 0x401765
push 1
mov ecx, dword [0x4380c4]
push ecx
call fcn.00401a10
add esp, 8
mov dword [0x4380d4], eax
mov edx, dword [0x4380d4]
push edx
jmp 0x45b6d4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], str.55222
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4017ea
cmp dword [ebp - 0x118], 0
je 0x4017ea
jmp 0x40184c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x40184c
mov dword [ebp - 0x120], 0x514337
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x4380b4], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4380d0], edx
mov dword [ebp - 0x120], 0x514337
mov dword [ebp - 0x120], 0x514337
jmp 0x45ba66
mov esp, ebp
pop ebp
ret

Function at 0x401850
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0x19c
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x40186c
xor eax, eax
jmp 0x40194d
push 0x7f00
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
jne 0x401884
xor eax, eax
jmp 0x40194d
push ebp
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
add eax, 0x514337
call fcn.00401320
mov esp, ebp
pop ebp
ret

Function at 0x401b30
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4380c0], 0x24e1
mov eax, dword [0x4380c0]
sub eax, 0x24e1
mov dword [0x4380c0], eax
mov ecx, 1
test ecx, ecx
je 0x401bdb
mov edx, dword [0x4380c0]
cmp edx, dword [ebp + 0xc]
jb 0x401b67
jmp 0x401bdb
cmp dword [0x4380c0], 0
jne 0x401b85
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
test eax, eax
je 0x401b85
xor eax, eax
jmp 0x401bdb
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
mov ecx, dword [eax]
add ecx, dword [0x4380c0]
mov edx, dword [ebp + 8]
add edx, dword [0x4380c0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x85
mov eax, dword [0x4380c0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4380c0]
push eax
call fcn.004011f0
add esp, 8
mov ecx, dword [0x4380c0]
add ecx, 4
mov dword [0x4380c0], ecx
jmp 0x401b4d
mov esp, ebp
pop ebp
ret
Function at 0x4cebb0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x8c000]
push edi
jmp 0x4cebca
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4cebd1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cebc0
mov eax, 1
add ebx, ebx
jne 0x4cebe3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4cebf4
jne 0x4cec13
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cec13
dec eax
add ebx, ebx
jne 0x4cec00
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4cebd8
add ebx, ebx
jne 0x4cec0f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4cec65
xor ecx, ecx
sub eax, 3
jb 0x4cec2b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4cec9a
sar eax, 1
mov ebp, eax
jmp 0x4cec36
add ebx, ebx
jne 0x4cec36
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cec04
inc ecx
add ebx, ebx
jne 0x4cec44
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4cec04
add ebx, ebx
jne 0x4cec51
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4cec46
jne 0x4cec62
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4cec46
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4cec84
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4cec76
jmp 0x4cebc6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4cec84
add edi, ecx
jmp 0x4cebc6
pop esi
mov edi, esi
mov ecx, 0x377e
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4ceca2
cmp byte [edi], 0x11
jne 0x4ceca2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4ceca7
lea edi, [esi + 0xca000]
mov eax, dword [edi]
or eax, eax
je 0x4ced1f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xeb614]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xeb768]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4cecd4
mov ecx, edi
jns 0x4ced03
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xeb76c]
or eax, eax
je 0x4ced19
mov dword [ebx], eax
add ebx, 4
jmp 0x4cecf1
call dword [esi + 0xeb77c]
mov ebp, dword [esi + 0xeb770]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4ced53
sub esp, 0xffffff80
jmp 0x416310
Function at 0x430520
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x49fa6b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00493ca7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4305a2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004919fa
mov eax, dword [eax]
push 0x7a61c0
push eax
call fcn.004846c4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00493f32
test bl, bl
je 0x4305a2
push 0x7a61c0
lea ecx, [esp + 0xc]
call fcn.004942c2
push 0x7a9d78
lea ecx, [esp + 0xc]
call fcn.004942c2
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4305de
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00493f32
jmp 0x4306a9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x430662
lea edx, [esp + 0x7c]
push 0x7a9d74
push edx
call fcn.004846c4
add esp, 8
test eax, eax
je 0x430662
lea eax, [esp + 0x7c]
push 0x7a9d70
push eax
call fcn.004846c4
add esp, 8
test eax, eax
je 0x430662
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4305f2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00493f32
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x430ec0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x430f22
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc