joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a8f3
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
add byte [ebp + 0x4e], al
push eax
dec ebx
inc edi
dec edi
add esp, 4
or esi, 0x5ce7
and esi, 0x11398
pop esi
mov eax, dword fs:[0x18]
mov dword [ebp - 0x198c], eax
mov ecx, dword [ebp - 0x198c]
mov edx, dword [ecx + 0x30]
mov dword [ebp - 0x1990], edx
mov eax, dword [ebp - 0x1990]
mov dword [ebp - 0x160c], eax
push edx
sub edx, 0x6f44
xor edx, 0x12b9
and edx, 0x11d37
pop edx
push eax
push esi
add esp, 4
sub eax, 0x147d6
and eax, 0x136c0
add eax, 0xde5e
or eax, 0x17d38
pop eax
cmp dword [ebp - 0x160c], 0
jne 0x40a631
mov dword [ebp - 0x314], 0
jmp 0x40a8d8
mov ecx, dword [ebp - 0x160c]
mov edx, dword [ecx + 0xc]
mov eax, dword [edx + 0xc]
mov dword [ebp - 0xcc4], eax
push ecx
push edi
add esp, 4
xor ecx, 0x34ea
pop ecx
push edi
push ecx
add esp, 4
or edi, 0x16dd4
and edi, 0x5b44
pop edi
push eax
sub eax, 0x10be7
add eax, 0x262a
xor eax, 0x319f
pop eax
cmp dword [ebp - 0xcc4], 0
jne 0x40a68d
mov dword [ebp - 0x314], 0
jmp 0x40a8d8
mov ecx, dword [ebp - 0xcc4]
mov dword [ebp - 0x514], ecx
push edi
push esi
add esp, 4
or edi, 0xf1a9
pop edi
push esi
jmp 0x40a6ad
or esi, 0x4d15
call 0x40a6c1
add byte [edi], bh
inc edi
cmp dword [ebp + esi - 0x7d], ecx
les eax, [ecx + eax*4]
test byte [ecx + 0x5e000159], 0x8d
xchg ebp, eax
int3
push eax
add eax, 0x2aa8
pop eax
push ecx
push edi
add esp, 4
call 0x40a8f3
add byte [eax + 0x3f], al
aaa
inc ebx
dec esp
inc edx
aaa
dec edx
add esp, 4
sub ecx, 0x2a83
jmp 0x40a904
jmp 0x40a909
pop ecx
cmp dword [ebp - 0x314], 0
jne 0x40b20f
mov eax, 0x6b
mov word [ebp - 0x178c], ax
mov ecx, 0x65
mov word [ebp - 0x178a], cx
mov edx, 0x72
mov word [ebp - 0x1788], dx
mov eax, 0x6e
mov word [ebp - 0x1786], ax
mov ecx, 0x65
mov word [ebp - 0x1784], cx
mov edx, 0x6c
mov word [ebp - 0x1782], dx
mov eax, 0x33
mov word [ebp - 0x1780], ax
mov ecx, 0x32
mov word [ebp - 0x177e], cx
mov edx, 0x2e
mov word [ebp - 0x177c], dx
mov eax, 0x64
mov word [ebp - 0x177a], ax
mov ecx, 0x6c
mov word [ebp - 0x1778], cx
mov edx, 0x6c
mov word [ebp - 0x1776], dx
xor eax, eax
mov word [ebp - 0x1774], ax
push esi
add esi, 0xbc0b
sub esi, 0xf317
or esi, 0x6470
pop esi
push edx
push esi
add esp, 4
xor edx, 0x6e69
pop edx
push esi
push edi
add esp, 4
or esi, 0x38d1
or esi, 0x158d5
pop esi
mov byte [ebp - 0x8a4], 0x4c
mov byte [ebp - 0x8a3], 0x6f
mov byte [ebp - 0x8a2], 0x61
mov byte [ebp - 0x8a1], 0x64
invalid
Function at 0x40acdc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop edx
mov edx, dword [ebp - 0x518]
mov dword [ebp - 0x774], edx
jmp 0x40ad56

Function at 0x40ade0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push edi
and edi, 0x13c5b
and edi, 0x142f7
xor edi, 0x14032
jmp 0x40adfb
pop edi
push esi
or esi, 0x360d
pop esi
mov ecx, dword [ebp - 0x774]
mov edx, dword [ecx + 0x18]
mov dword [ebp - 0x3a4], edx
mov dword [ebp - 0x784], 0
mov eax, dword [ebp - 0x3a4]
mov dword [ebp - 0x1664], eax
cmp dword [ebp - 0x1664], 0
jne 0x40ae43
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x40b134
mov edx, dword [ebp - 0x1664]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x3c]
mov dword [ebp - 0x1668], eax
jne 0x40ae6b
mov ecx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], ecx
jmp 0x40b134
mov edx, 8
imul eax, edx, 0
mov ecx, dword [ebp - 0x1668]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x166c], edx
cmp dword [ebp - 0x166c], 0
jne 0x40ae9d
mov eax, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], eax
jmp 0x40b134
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [ebp - 0x166c]
mov dword [ebp - 0x778], ecx
jne 0x40aec2
mov edx, dword [ebp - 0x784]
mov dword [ebp - 0x3f4], edx
jmp 0x40b134
mov eax, dword [ebp - 0x778]
mov ecx, dword [ebp - 0x3a4]
add ecx, dword [eax + 0x20]
mov dword [ebp - 0x199c], ecx
mov edx, dword [ebp - 0x778]
mov eax, dword [ebp - 0x3a4]
add eax, dword [edx + 0x24]
mov dword [ebp - 0x19a0], eax
mov ecx, dword [ebp - 0x778]
mov edx, dword [ebp - 0x3a4]
add edx, dword [ecx + 0x1c]
mov dword [ebp - 0x19a4], edx
mov dword [ebp - 0x77c], 0
cmp dword [ebp - 0x3f4], 0
je 0x40b20f
push eax
xor eax, 0x629e
or eax, 0x152e
add eax, 0x174ba
pop eax
push ebx
push edx
add esp, 4
xor ebx, 0xb599
jmp 0x40b166
pop ebx
push edx
push edi
add esp, 4
add edx, 0x11eb6
pop edx
mov ecx, dword [ebp - 0x3f4]
mov dword [ebp - 0x19ac], ecx
push esi
or esi, 0x48a6
or esi, 0x1357c
or esi, 0x3c69
or esi, 0x13d47
pop esi
push edi
push edx
add esp, 4
sub edi, 0xe73d
add edi, 0x20cc
sub edi, 0x5e5b
pop edi
mov edx, dword [ebp - 0x19ac]
mov dword [ebp - 0x19b0], edx
lea eax, [ebp - 0x1734]
push eax
call dword [ebp - 0x19b0]
test eax, eax
jne 0x40b20f
push edi
call 0x40b1db
add byte [ecx + 0x34], al
dec esp
dec esi
dec ecx
inc edx
add esp, 4
jmp 0x40b1e7
add edi, 0x159b
pop edi
push edx
push ebx
add esp, 4
or edx, 0xcb29
sub edx, 0xc6b0
pop edx
mov dword [ebp - 0xab0], 0
jmp 0x40b8fa
push esi
xor esi, 0x61a9
add esi, 0x178bf
Function at 0x42b064
Capabilities:
Get common file path
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4bc
push ebx
push esi
mov esi, ecx
cmp byte [esi + 0x54], 0
push edi
je 0x42b08b
push 0x42987f
push 0x10
push 0x10
push 3
call fcn.0042af77
mov dword [esi + 0x48], eax
push 0x42ae4a
push 9
push 9
push 2
mov ecx, esi
call fcn.0042af77
mov dword [esi + 0x4c], eax
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
test eax, eax
jne 0x42b0bd
mov word [ebp - 0x208], ax
mov edi, dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push 0x4011
mov ebx, 0x2b4
push ebx
lea eax, [ebp - 0x4bc]
push eax
push 0x10
lea eax, [ebp - 0x208]
push eax
call edi
mov dword [esi + 0x44], eax
mov eax, dword [ebp - 0x4b8]
push 0x4013
mov dword [esi + 0x58], eax
push ebx
lea eax, [ebp - 0x4bc]
push eax
push 0x10
lea eax, [ebp - 0x208]
push eax
call edi
mov eax, dword [ebp - 0x4b8]
pop edi
mov dword [esi + 0x5c], eax
pop esi
pop ebx
leave
ret

Function at 0x42b2e5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp dword [esi + 0x3c], ebx
je 0x42b3bb
mov eax, dword [esi + 4]
mov dword [ebp + 8], eax
test eax, eax
je 0x42b30b
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 0x38]
mov dword [esi + 0x3c], ebx
mov eax, dword [eax + ebx*4]
mov dword [esi + 4], eax
test eax, eax
jne 0x42b37b
push edi
push 0x18
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, eax
pop ecx
test edi, edi
je 0x42b345
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
and dword [edi + 8], 0
mov dword [edi + 0xc], esi
mov dword [edi], 0x503350
mov dword [edi + 0x10], esi
mov dword [edi + 0x14], eax
jmp 0x42b347
xor edi, edi
mov eax, dword [esi + 0x30]
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x34]
push edi
push fcn.0046763b
push eax
mov eax, ebx
shl eax, 4
mov edx, dword [ecx + eax]
mov ecx, dword [0x548870]
call fcn.00468bb6
cmp byte [esi + 0x40], 0
mov dword [esi + 4], eax
pop edi
je 0x42b37b
mov ecx, eax
call fcn.00467f00
mov ecx, dword [esi + 0x30]
mov eax, dword [ecx]
push ebx
push esi
or edx, 0xffffffff
call dword [eax + 0x18]
mov eax, dword [esi + 0x24]
mov edx, dword [esi + 0x2c]
mov ecx, dword [esi + 0x20]
push 0x250
sub edx, eax
push edx
mov edx, dword [esi + 0x28]
sub edx, ecx
push edx
push eax
push ecx
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp + 0xc]
test ecx, ecx
je 0x42b3bb
mov edx, dword [ebp + 8]
call fcn.00429bbc
pop esi
pop ebx
pop ebp
ret 8
Function at 0x42e870
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
cmp byte [0x547944], 0
je 0x42e886
mov al, 1
leave
ret
lea eax, [ebp - 0x190]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x42e8bc
mov eax, dword [ebp - 0x190]
cmp al, 2
jne 0x42e8b6
shr eax, 8
cmp al, 2
jne 0x42e8b6
mov byte [0x547944], 1
jmp 0x42e882
call dword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
leave
ret

Function at 0x42e8c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor edi, edi
lea eax, [ebp - 0x5c]
push edi
push eax
mov dword [ebp - 4], edx
mov dword [ebp - 8], ecx
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp + 0xc]
add esp, 0xc
mov dword [ebp - 0x5c], esi
cmp ebx, edi
je 0x42e926
mov esi, dword [sym.imp.KERNEL32.DLL_GetCurrentProcess]
push 2
push 1
push edi
lea eax, [ebp + 0xc]
push eax
call esi
push eax
push ebx
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_DuplicateHandle]
test eax, eax
je 0x42e90f
mov eax, dword [ebp + 0xc]
or dword [ebp - 0x30], 0x100
or dword [ebp - 0x30], 1
mov dword [ebp - 0x1c], eax
xor eax, eax
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x2c], ax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x5c]
push eax
push dword [ebp + 8]
xor eax, eax
push edi
cmp ebx, edi
setne al
push edi
push eax
push edi
push edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov dword [ebp + 0xc], eax
cmp eax, edi
je 0x42e96e
mov eax, dword [ebp + 0x10]
cmp eax, edi
je 0x42e964
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x42e969
push dword [ebp - 0x18]
call esi
push dword [ebp - 0x14]
call esi
cmp ebx, edi
je 0x42e977
push dword [ebp - 0x1c]
call esi
xor eax, eax
cmp dword [ebp + 0xc], edi
pop edi
pop esi
setne al
pop ebx
leave
ret 0xc

Function at 0x42ecad
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 0xc], 0
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x10], ecx
call fcn.0048fdce
cmp byte [eax + 0x135], 0
je 0x42ecda
xor ebx, ebx
push esi
inc ebx
push str._AUTOUPDATE___s___1
lea eax, [ebp - 0xc]
jmp 0x42ece6
push 2
pop ebx
push esi
push str._AUTOUPDATE___s_
lea eax, [ebp - 8]
push eax
call fcn.0048ee25
add esp, 0xc
push eax
lea ecx, [ebp - 4]
call fcn.0048ee78
test bl, 2
je 0x42ed08
lea ecx, [ebp - 8]
and ebx, 0xfffffffd
call fcn.0048e50a
test bl, 1
je 0x42ed15
lea ecx, [ebp - 0xc]
call fcn.0048e50a
push 1
push 0
lea ecx, [ebp - 4]
call fcn.0048e806
push eax
push dword [ebp - 0x10]
push 0x4f6aac
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
lea ecx, [ebp - 4]
setg bl
call fcn.0048e50a
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x42ed77
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
push esi
push 0x104
lea eax, [ebp - 0x61c]
push eax
push str.COMSPEC
mov esi, ecx
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
test eax, eax
je 0x42ee90
xor eax, eax
movzx ecx, word [eax + str.ping__n_2_127.0.0.1_r_n]
mov word [ebp + eax - 0x20c], cx
inc eax
inc eax
test cx, cx
jne 0x42eda4
push edi
mov eax, esi
lea ecx, [ebp - 0x20c]
call fcn.004720ae
xor edx, edx
xor ecx, ecx
call fcn.00472575
lea edi, [ebp - 0x414]
mov edx, eax
sub edi, eax
movzx esi, word [edx]
mov word [edi + edx], si
inc edx
inc edx
test si, si
jne 0x42eddb
mov dl, 1
mov ecx, eax
call fcn.0046b197
mov eax, str..bat
lea ecx, [ebp - 0x414]
call fcn.004720ae
push 0
push 0x80
push 7
pop edx
lea ecx, [ebp - 0x414]
call fcn.0047246a
mov dword [ebp - 4], eax
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
pop edi
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x42ee24
sub eax, edx
sar eax, 1
push eax
lea ecx, [ebp - 0x20c]
call fcn.0048c02d
mov ecx, dword [ebp - 4]
mov edx, eax
call fcn.004a3a50
lea ecx, [ebp - 4]
call fcn.004720fd
mov eax, 0x4f6b20
lea ecx, [ebp - 0x61c]
call fcn.004720ae
lea eax, [ebp - 0x414]
lea ecx, [ebp - 0x61c]
call fcn.004720ae
push 0
lea ecx, [ebp - 0x61c]
call fcn.0048c02d
push eax
call dword [sym.imp.KERNEL32.DLL_WinExec]
push 0x1f
pop ecx
cmp ecx, eax
sbb eax, eax
neg eax
jmp 0x42ee92
xor al, al
pop esi
leave
ret
Function at 0x42f722
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], ecx
mov ecx, edi
mov ebx, edx
call fcn.0048e540
xor edx, edx
xor ecx, ecx
call fcn.00472575
mov esi, eax
lea eax, [ebp - 0x20c]
mov ecx, esi
sub eax, esi
movzx edx, word [ecx]
mov word [eax + ecx], dx
inc ecx
inc ecx
test dx, dx
jne 0x42f752
mov eax, 0x4f6cb0
lea ecx, [ebp - 0x20c]
call fcn.004720ae
mov dl, 1
mov ecx, esi
call fcn.0046b197
mov edx, dword [ebp - 4]
push ebx
lea ecx, [ebp - 0x20c]
call fcn.004a4926
test al, al
jne 0x42f79e
push dword [0x5521d4]
mov ecx, edi
call fcn.0048e82b
jmp 0x42f8c9
mov edx, dword [ebp + 8]
mov ecx, edx
and ecx, 0xffffefff
mov eax, 0x621681a
cmp ecx, eax
ja 0x42f7d7
push edx
push eax
push dword [0x5521d0]
lea eax, [ebp + 0xc]
push eax
call fcn.0048ee25
add esp, 0x10
push dword [eax]
mov ecx, edi
call fcn.0048e82b
lea ecx, [ebp + 0xc]
jmp 0x42f8c4
lea ecx, [ebp - 0x20c]
call fcn.004a82f5
test al, al
jne 0x42f7ee
push dword [0x5521dc]
jmp 0x42f792
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.00425e70
test eax, eax
je 0x42f8c9
xor esi, esi
push esi
mov edx, edi
lea ecx, [ebp - 0x20c]
call fcn.0042617d
test al, al
je 0x42f8c9
push 0x104
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
lea edx, [ebp - 0x414]
lea ecx, [ebp - 0x20c]
call fcn.0042ecad
test al, al
jne 0x42f861
lea eax, [ebp - 0x20c]
push eax
push dword [0x5521c8]
lea eax, [ebp + 0xc]
push eax
call fcn.0048ee25
add esp, 0xc
jmp 0x42f7c6
mov ebx, 0x4f6c3c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_OpenMutexA]
mov dword [ebp + 8], 0x12c
mov edi, 0x1f0001
jmp 0x42f88c
push 0x64
call dword [sym.imp.KERNEL32.DLL_Sleep]
dec dword [ebp + 8]
je 0x42f89e
push ebx
push 0
push edi
call esi
test eax, eax
je 0x42f87c
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov al, 1
jmp 0x42f8d8
lea eax, [ebp - 0x20c]
push eax
push dword [0x5521cc]
lea eax, [ebp + 8]
push eax
call fcn.0048ee25
mov ecx, dword [ebp + 0xc]
add esp, 0xc
push dword [eax]
call fcn.0048e82b
lea ecx, [ebp + 8]
call fcn.0048e50a
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileW]
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x43988a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 8]
push edx
push ecx
call dword [sym.imp.KERNEL32.DLL_ReadFile]
test eax, eax
jne 0x4398d4
mov esi, dword [sym.imp.KERNEL32.DLL_GetLastError]
call esi
test eax, eax
je 0x4398d0
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0xffffffffffffffff
push 0xffffffffffffff9d
push 0xffffffffffffff9d
push 0x14f
call esi
push eax
push str.IO_Error:_d_line:_d_align:_d_pos:_Ld_count:_d_actual:_d
call fcn.0041ff68
add esp, 0x20
call esi
jmp 0x439904
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0xc]
jae 0x439902
push eax
push dword [ebp + 0xc]
mov esi, 0x490
push 0xffffffffffffffff
push 0xffffffffffffff9d
push 0xffffffffffffff9d
push 0x153
push esi
push str.IO_Error:_d_line:_d_align:_d_pos:_Ld_count:_d_actual:_d
call fcn.0041ff68
add esp, 0x20
mov eax, esi
jmp 0x439904
xor eax, eax
pop esi
pop ebp
ret 8
Function at 0x441b52
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
mov ecx, dword [esi + 0x1c]
xor ebx, ebx
call fcn.004a391c
mov ecx, dword [esi + 0x1c]
test al, al
je 0x441b74
call fcn.00422199
jmp 0x441b79
call fcn.004887e3
lea ecx, [ebp - 4]
mov dword [ebp - 4], eax
call fcn.0048e812
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 4]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.0048e806
push eax
mov ecx, esi
call fcn.00440fdc
xor esi, esi
cmp dword [ebp - 8], ebx
jbe 0x441bfc
mov eax, dword [ebp - 0x10]
lea eax, [eax + esi*4]
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, dword [ebp - 8]
cmp eax, 0xffffffff
je 0x441bd7
test al, 0x10
jne 0x441bde
lea edx, [ecx - 1]
cmp esi, edx
je 0x441be2
test eax, 0x1000
jne 0x441bfc
test eax, 0x400
jne 0x441bfc
inc esi
cmp esi, ecx
jb 0x441ba8
jmp 0x441bfc
mov bl, 1
jmp 0x441bfc
mov eax, dword [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [eax + esi*4]
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationW]
test eax, eax
setne bl
lea ecx, [ebp - 0x10]
call fcn.0041d0c7
lea ecx, [ebp - 4]
call fcn.0048e50a
pop esi
mov al, bl
pop ebx
leave
ret

Function at 0x442388
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
xor edi, edi
push edi
mov esi, ecx
call fcn.00441541
cmp byte [esi + 0x28], 0
mov ecx, esi
jne 0x4423f6
call fcn.00441b52
mov ebx, 0x70000001
test al, al
je 0x4423d4
mov eax, dword [esi]
mov cl, byte [eax + 0x26]
shr cl, 3
push 1
and cl, 1
movzx ecx, cl
push ecx
push dword [ebp + 8]
push dword [esi + 0x1c]
push dword [eax + 0x1c]
push dword [ebp + 0xc]
call fcn.00440d36
mov edi, eax
jmp 0x4423d6
mov edi, ebx
test edi, edi
je 0x4423e2
cmp edi, ebx
jne 0x442490
mov ecx, dword [ebp + 0xc]
call fcn.00422199
push eax
push dword [esi]
mov ecx, esi
call fcn.00441722
jmp 0x442474
call fcn.00441b52
test al, al
je 0x44246f
lea ecx, [ebp + 0xc]
call fcn.0044502c
push dword [ebp + 8]
push dword [esi + 0x1c]
push str.Moving_files_from__s_to__s
call fcn.0041ff68
mov ebx, dword [sym.imp.KERNEL32.DLL_MoveFileW]
add esp, 0xc
push dword [ebp + 8]
push dword [esi + 0x1c]
call ebx
test eax, eax
jne 0x442465
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x442451
push dword [ebp + 8]
mov ecx, esi
call fcn.00441a10
mov edi, eax
test edi, edi
je 0x442465
lea ecx, [ebp + 0xc]
call fcn.0048e50a
jmp 0x442490
mov ecx, dword [ebp + 8]
call fcn.004a49fb
push dword [ebp + 8]
push dword [esi + 0x1c]
call ebx
test eax, eax
je 0x442437
lea ecx, [ebp + 0xc]
call fcn.0048e50a
jmp 0x442474
mov edi, 0x70000001
call fcn.0046e3c9
mov edx, dword [ebp + 8]
lea ecx, [esi + 0x1c]
call fcn.0048d7ba
mov ecx, esi
call fcn.004416da
call fcn.0046e3e5
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 8
Function at 0x444a94
Capabilities:
Write file on windows

Disassembly:
push esi
push edi
mov esi, ecx
call fcn.0044502c
mov ecx, 0x4f9bac
mov byte [esi + 4], 0
mov byte [esi + 5], 0
call fcn.0048880a
mov edx, 0x4f9ba4
mov ecx, eax
call fcn.004a29a8
mov edi, eax
push edi
mov ecx, esi
call fcn.0048e82b
mov dl, 1
mov ecx, edi
call fcn.0046b197
push 0x4f9ba0
mov ecx, esi
call fcn.0048e806
mov ecx, eax
call fcn.0048c02d
push eax
call sub.MSVCRT.dll_fopen
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x444b17
push edi
push dword [esp + 0x14]
mov byte [esi + 4], 1
push 1
push dword [esp + 0x18]
call sub.MSVCRT.dll_fwrite
add esp, 0x10
cmp dword [esp + 0x10], eax
jne 0x444b10
mov byte [esi + 5], 1
push edi
call sub.MSVCRT.dll_fclose
pop ecx
pop edi
mov eax, esi
pop esi
ret 8

Function at 0x445047
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 8]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp + 0x10]
test eax, eax
jne 0x44507a
cmp dword [ebp + 0x14], ecx
jne 0x44507a
xor eax, eax
inc eax
jmp 0x44507c
xor eax, eax
cmp ecx, 1
jne 0x44508c
xor ecx, ecx
cmp dword [ebp + 0x14], 2
sete cl
or eax, ecx
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x445098
mov edx, dword [ebp - 4]
mov dword [ecx], edx
test eax, eax
setne al
leave
ret 0x14

Function at 0x4450a1
Capabilities:
Set registry value

Disassembly:
cmp byte [0x54afd4], 0
je 0x4450af
or eax, 0xffffffff
jmp 0x4450c9
push dword [esp + 0x10]
push dword [esp + 0xc]
push dword [esp + 0x14]
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0x10

Function at 0x4451ac
Capabilities:
Set registry value

Disassembly:
cmp byte [0x54afd4], 0
jne 0x4451e6
push 4
lea eax, [esp + 0xc]
push eax
push 4
push 0
push dword [esp + 0x14]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4451e6
push eax
push dword [esp + 0xc]
push dword [esp + 0xc]
push str.RegKey:_Could_not_write_DWORD_valuename__s_value__d__Error__d_n
call fcn.0042ebe6
add esp, 0x10
ret 8

Function at 0x4451e9
Capabilities:
Delete registry value

Disassembly:
cmp byte [0x54afd4], 0
jne 0x445214
push dword [esp + 4]
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
je 0x445214
push dword [esp + 4]
push eax
push str.RegKey:_Could_not_delete_value__d:__s_n
call fcn.0042ebe6
add esp, 0xc
ret 4

Function at 0x445248
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x54afd4], 0
je 0x445258
mov eax, 0x80004005
jmp 0x44527c
push dword [esp + 8]
push dword [esp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x44527c
push dword [esp + 8]
push eax
push str.RegKey:_Could_not_delete_subkey__d:__s_n
call fcn.0042ebe6
add esp, 0xc
ret 8
Function at 0x44527f
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov ecx, dword [0x54b1e8]
mov esi, eax
call fcn.00422199
mov edi, dword [sym.imp.USER32.dll_AppendMenuW]
mov ecx, eax
mov dword [esp + 0x18], ecx
xor ebx, ebx
jmp 0x4452af
mov ecx, dword [esp + 0x14]
mov dword [esp + 0x10], ecx
call fcn.0048d78c
mov ecx, dword [esp + 0x10]
push 0x7c
pop edx
mov dword [esp + 0x14], eax
call fcn.00422241
mov eax, dword [esp + 0x10]
xor ecx, ecx
cmp word [eax], cx
je 0x4452d9
push eax
inc ebx
push ebx
push ecx
jmp 0x4452e0
push ecx
push ecx
push 0x800
push esi
call edi
cmp dword [esp + 0x14], 0
jne 0x4452ab
push 0
push 0
push 0x800
push esi
call edi
push dword [0x551150]
inc ebx
inc ebx
push ebx
push 0
push esi
call edi
mov eax, dword [0x54b1ec]
xor edi, edi
push edi
inc eax
push eax
push ebx
push 1
push esi
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
mov ecx, dword [esp + 0x18]
mov dl, 1
call fcn.0046b197
push edi
push dword [0x548880]
push edi
push dword [ebp + 4]
push dword [ebp]
push 0x18a
push esi
call dword [sym.imp.USER32.dll_TrackPopupMenu]
push esi
mov ebp, eax
call dword [sym.imp.USER32.dll_DestroyMenu]
cmp ebp, ebx
jne 0x445369
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x44535f
push 0xf
pop ecx
call fcn.004d22ce
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
cmp ebp, edi
je 0x44535f
push 0x10
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jl 0x44535f
mov eax, ebp
jmp 0x445361

Function at 0x4454a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
push ebx
mov byte [ebp - 4], cl
push edi
mov ecx, edx
mov dword [ebp - 8], edx
call fcn.004a1fd0
mov ecx, eax
call fcn.004a21c8
xor edi, edi
xor ebx, ebx
inc edi
test al, al
jne 0x44551d
push dword [ebp - 8]
lea eax, [ebp - 0x48c]
cmp byte [ebp - 4], bl
je 0x4454de
push dword [0x551208]
jmp 0x4454e4
push dword [0x5511f8]
push 0x230
push eax
call fcn.0048d35b
add esp, 0x10
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x2c]
push 0x4f715c
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0x34
call fcn.004693e3
add esp, 0xc
cmp eax, 6
jne 0x4455ad
push esi
mov esi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
push edi
push ebx
push ebx
push dword [ebp - 8]
push ebx
push ebx
call esi
cmp eax, 0x20
jg 0x4455a4
push dword [ebp - 8]
push str.shell32.dll_OpenAs_RunDLL__s
call fcn.0048d3ca
pop ecx
pop ecx
push edi
push ebx
push eax
push str.RUNDLL32.EXE
push ebx
push ebx
mov dword [ebp - 0xc], eax
call esi
cmp eax, 0x20
jg 0x44559c
push str.Error_occurred_opening_the_file.
call fcn.0041ff68
push dword [ebp - 8]
lea eax, [ebp - 0x48c]
push dword [0x5511fc]
push 0x230
push eax
call fcn.0048d35b
lea eax, [ebp - 0x48c]
push eax
lea eax, [ebp - 0x2c]
push 0x4f715c
push eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], 0x30
call fcn.004693e3
add esp, 0x20
lea ecx, [ebp - 0xc]
call fcn.0048e540
lea ecx, [ebp - 8]
call fcn.0048e540
pop esi
pop edi
pop ebx
leave
ret