joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005b000
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov eax, dword [0x1009f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x100a3d98]
lea eax, [ebp - 0x30]
push esi
push edi
push eax
push dword [0x100a3e38]
xorps xmm0, xmm0
movups xmmword [ebp - 0x30], xmm0
call dword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [ebp - 0x28]
sub eax, dword [ebp - 0x30]
movd xmm1, eax
mov eax, dword [ebp - 0x24]
sub eax, dword [ebp - 0x2c]
cvtdq2ps xmm1, xmm1
movd xmm0, eax
lea eax, [ebp - 0x18]
cvtdq2ps xmm0, xmm0
push eax
movss dword [ebx + 0x10], xmm1
movss dword [ebx + 0x14], xmm0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x18]
mov ecx, edi
sub ecx, dword [0x100a3e40]
mov esi, dword [ebp - 0x14]
mov edx, esi
sbb edx, dword [0x100a3e44]
call fcn.10088300
mov edx, dword [0x100a3e4c]
mov ecx, dword [0x100a3e48]
movss dword [ebp - 8], xmm0
call fcn.10088300
movss xmm1, dword [ebp - 8]
divss xmm1, xmm0
push 0x11
movss dword [ebx + 0x18], xmm1
mov dword [0x100a3e44], esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
mov dword [0x100a3e40], edi
call esi
shr eax, 0xf
and al, 1
push 0x10
mov byte [ebx + 0xfc], al
call esi
shr eax, 0xf
and al, 1
push 0x12
mov byte [ebx + 0xfd], al
call esi
mov esi, dword [0x100a3d98]
shr eax, 0xf
and al, 1
mov byte [ebx + 0xff], 0
mov byte [ebx + 0xfe], al
cmp byte [esi + 0x357], 0
je 0x1005b130
cvttss2si eax, dword [esi + 0xe4]
mov dword [ebp - 0xc], eax
cvttss2si eax, dword [esi + 0xe8]
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
push eax
push dword [0x100a3e38]
call dword [sym.imp.USER32.dll_ClientToScreen]
test eax, eax
je 0x1005b130
push dword [ebp - 8]
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_SetCursorPos]
mov dword [esi + 0xe4], 0xff7fffff
mov dword [esi + 0xe8], 0xff7fffff
call dword [sym.imp.USER32.dll_GetForegroundWindow]
test eax, eax
je 0x1005b1a6
mov ecx, dword [0x100a3e38]
cmp eax, ecx
je 0x1005b164
push ecx
push eax
call dword [sym.imp.USER32.dll_IsChild]
test eax, eax
je 0x1005b1a6
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
test eax, eax
je 0x1005b1a6
lea eax, [ebp - 0x20]
push eax
push dword [0x100a3e38]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x1005b1a6
movd xmm0, dword [ebp - 0x20]
movd xmm1, dword [ebp - 0x1c]
cvtdq2ps xmm0, xmm0
cvtdq2ps xmm1, xmm1
movss dword [esi + 0xe4], xmm0
movss dword [esi + 0xe8], xmm1
cmp byte [ebx + 0xb0], 0
je 0x1005b1b4
or eax, 0xffffffff
jmp 0x1005b1bf
mov eax, dword [0x100a3d98]
mov eax, dword [eax + 0x1e40]
cmp dword [0x1009f46c], eax
je 0x1005b1d1
mov dword [0x1009f46c], eax
call fcn.1005ac30
call fcn.1005ad60
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10086e3f
mov esp, ebp
pop ebp
ret
Function at 0x100779c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1009f040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x100a3d98]
push edi
mov dword [ebp - 0x10], edx
mov edx, dword [ebp + 0xc]
mov eax, dword [esi + 0x1b9c]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
mov byte [eax + 0x8c], 1
mov edi, dword [esi + 0x1b9c]
cmp byte [edi + 0x8f], 0
je 0x10077a14
xor al, al
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10086e3f
mov esp, ebp
pop ebp
ret
push edx
push ecx
lea ebx, [esi + 0x3128]
mov edx, 0xc01
push ecx
mov ecx, ebx
call fcn.10002670
add esp, 0xc
test ebx, ebx
je 0x10077a45
cmp eax, 0xffffffff
je 0x10077a3c
cmp eax, 0xc01
jl 0x10077a41
mov eax, 0xc00
mov byte [eax + ebx], 0
mov ecx, dword [edi + 0xcc]
add esi, 0x3128
add eax, esi
lea esi, [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
mov eax, dword [edi + 0xc4]
mov edi, 4
mov ecx, dword [ecx + eax*4 - 4]
not ecx
movzx eax, byte [esi]
lea esi, [esi + 1]
movzx edx, cl
xor edx, eax
shr ecx, 8
xor ecx, dword [edx*4 + 0x1008b860]
sub edi, 1
jne 0x10077a70
mov eax, dword [0x100a3d98]
not ecx
cmp dword [eax + 0x1bd4], ecx
jne 0x10077a9f
mov dword [eax + 0x1bd8], ecx
cmp dword [eax + 0x1c0c], ecx
jne 0x10077aae
mov byte [eax + 0x1c10], 1
push dword [ebp - 0xc]
mov edx, dword [ebp - 0x10]
push ebx
call fcn.10077ad0
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.10086e3f
mov esp, ebp
pop ebp
ret
Function at 0x1007a690
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
mov edi, dword [0x100a3d98]
xorps xmm5, xmm5
or edx, 0xffffffff
mov esi, 0x1008a6d1
movss xmm4, dword [edi + 0x1554]
movss xmm1, dword [edi + 0x15c8]
mov eax, dword [edi + 0x1cfc]
subss xmm1, xmm4
movss xmm0, dword [edi + 0x15c4]
addss xmm4, xmm4
mov ebx, dword [eax]
mov al, 0x23
maxss xmm1, xmm5
mov dword [ebp - 4], ebx
addss xmm4, dword [edi + 0x1930]
movss dword [edi + 0x1c78], xmm0
or ebx, 0xffffffff
movss dword [edi + 0x1c7c], xmm1
cmp al, 0x23
jne 0x1007a704
cmp byte [esi], al
jne 0x1007a704
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x1008b860]
test al, al
jne 0x1007a6f6
not edx
mov ecx, edx
call fcn.1000aeb0
mov ebx, dword [ebp - 4]
test eax, eax
je 0x1007a73b
cmp word [eax + 0x96], 0
jne 0x1007a7e0
test ebx, ebx
jne 0x1007a747
mov eax, dword [edi + 0x1cfc]
mov ebx, dword [eax]
movss xmm1, dword [ebx + 0x88]
movss xmm0, dword [ebx + 0xc]
movaps xmm3, xmm1
addss xmm3, dword [ebx + 4]
movss xmm2, dword [ebx + 0x8c]
subss xmm0, xmm1
addss xmm2, dword [ebx + 8]
addss xmm0, dword [ebx + 0x90]
or dword [edi + 0x1c20], 3
movss dword [edi + 0x1c30], xmm3
movss dword [edi + 0x1c34], xmm2
mov dword [edi + 0x1c38], 0
maxss xmm5, xmm0
mov dword [edi + 0x1c3c], 0
mov dword [edi + 0x1c24], 1
movss dword [edi + 0x1c44], xmm4
mov dword [edi + 0x1c28], 1
addss xmm5, xmm3
subss xmm5, xmm3
movss dword [edi + 0x1c40], xmm5
addss xmm4, dword [ebx + 0x8c]
movss dword [ebx + 0x8c], xmm4
movss xmm0, dword [edi + 0x1524]
lea eax, [ebp - 0x10]
push eax
lea ecx, [edi + 0x1ca0]
mov dword [ebp - 0x10], 2
movss dword [ebp - 0xc], xmm0
call fcn.1001c020
mov esi, dword [0x100a3d98]
lea eax, [ebp - 0x10]
mov dword [edi + 0x1524], 0
push eax
mov dword [ebp - 0x10], 4
movss xmm1, dword [esi + 0x152c]
lea ecx, [esi + 0x1ca0]
movss xmm0, dword [esi + 0x1530]
movss dword [ebp - 0xc], xmm1
movss dword [ebp - 8], xmm0
call fcn.1001c020
push 0x50f
xor edx, edx
mov dword [esi + 0x152c], 0
mov ecx, str.MainMenuBar
mov dword [esi + 0x1530], 0
call fcn.1000d430
add esp, 4
mov ecx, 2
mov bl, al
call fcn.100054d0
mov dword [edi + 0x1c78], 0
mov dword [edi + 0x1c7c], 0
test bl, bl
je 0x1007a89d
call fcn.1007a200
mov al, bl
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1000f980
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007ca80
Capabilities:
Hash data with crc32

Disassembly:
test dword [ecx + 0xc], 0x100000
push esi
push edi
mov edi, edx
je 0x1007caf0
mov cl, byte [edi]
lea esi, [edi + 1]
or eax, 0xffffffff
test cl, cl
je 0x1007cac8
or edi, 0xffffffff
nop dword [eax]
cmp cl, 0x23
jne 0x1007caaf
cmp byte [esi], cl
jne 0x1007caaf
cmp byte [esi + 1], cl
cmove eax, edi
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1008b860]
test cl, cl
jne 0x1007caa0
mov ecx, dword [0x100a3d98]
not eax
cmp dword [ecx + 0x1bd4], eax
jne 0x1007cade
mov dword [ecx + 0x1bd8], eax
cmp dword [ecx + 0x1c0c], eax
jne 0x1007cb35
pop edi
mov byte [ecx + 0x1c10], 1
pop esi
ret
mov esi, dword [0x100a3d98]
xor edx, edx
mov eax, dword [esi + 0x1b9c]
mov ecx, dword [eax + 0xc4]
mov eax, dword [eax + 0xcc]
push dword [eax + ecx*4 - 4]
mov ecx, edi
call fcn.10004270
add esp, 4
cmp dword [esi + 0x1bd4], eax
jne 0x1007cb26
mov dword [esi + 0x1bd8], eax
cmp dword [esi + 0x1c0c], eax
jne 0x1007cb35
mov byte [esi + 0x1c10], 1
pop edi
pop esi
ret
Function at 0x10086da0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x10086e33
sub eax, 1
jne 0x10086e2a
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
cmp dword [0x1009f2b4], 0
mov esi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
je 0x10086dd8
push str.d3d12.dll
call esi
test eax, eax
jne 0x10086e14
cmp dword [0x1009f2b0], 0
je 0x10086dec
push str.d3d11.dll
call esi
test eax, eax
jne 0x10086e14
cmp dword [0x1009f2ac], 0
je 0x10086e00
push str.d3d10.dll
call esi
test eax, eax
jne 0x10086e14
cmp dword [0x1009f2a8], 0
je 0x10086e29
push str.d3d9.dll
call esi
test eax, eax
je 0x10086e29
push 0
push 0
push 0
push 0x10086b00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov eax, 1
pop ebp
ret 0xc
push 1
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]

Function at 0x430001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x166d4dbd
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x456e3ab9
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1012c3d
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push 0xa
lea ecx, [esi + 0x24]
call fcn.01012a74
test eax, eax
jge 0x1012c5b
mov eax, 0x8007000e
jmp 0x1012cbc
push edi
xor edi, edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x1c], eax
cmp eax, edi
jne 0x1012c85
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x1012cbb
and eax, 0xffff
or eax, 0x80070000
jmp 0x1012cbb
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x1012c25
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 0x18], eax
cmp eax, edi
je 0x1012cb2
push 0xffffffffffffffff
push dword [esi + 0x1c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [esi + 0x20], edi
jne 0x1012cb9
mov eax, 0x8007000e
jmp 0x1012cbb
xor eax, eax
pop edi
pop esi
leave
ret

Function at 0x1012cc4
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
mov esi, ecx
push edi
lea eax, [esi + 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x80
xor edi, edi
lea ebx, [esi + 4]
push edi
push ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 4], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
add esp, 0xc
mov dword [esi], 1
push 0x154
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x1012d28
mov ecx, eax
call fcn.010128dc
jmp 0x1012d2a
xor eax, eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
test eax, eax
je 0x1012d66
mov ecx, eax
call fcn.01012c3d
test eax, eax
jl 0x1012d49
add dword [ebp - 4], 4
inc edi
cmp edi, dword [esi]
jl 0x1012d0b
jmp 0x1012d66
lea edi, [esi + edi*4 + 4]
mov ecx, dword [edi]
push 0
call fcn.01012a8f
push dword [edi]
push 0
call ebx
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
and dword [edi], 0
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0xcdd914
Capabilities:
Encode data using xor

Disassembly:
jmp 0xcdd91e
pushal
call 0xcdd924
pop ebp
sub ebp, 0x10
sub ebp, 0x8dd914
jmp 0xcdd93a
mov eax, 0x8dd914
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b1
mov edx, 0x114a1e36
xor byte [eax], dl
inc eax
dec ecx
jne 0xcdd951
jmp 0xcdd964
mov ebp, 0xabfbdfb
mov bh, 0xf7
into
xor eax, 0x36328efb
mov word ss:[esi], ds
rcl esp, 0x35
invalid
Function at 0x4060b6
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004021ba
and dword [ebp - 4], 0
cmp dword [0x40b654], 0
mov ebx, eax
jne 0x406167
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x406218
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x406218
push eax
call fcn.00402148
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x40b654], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x40b658], eax
call esi
push eax
call fcn.00402148
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x40b65c], eax
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b664], eax
test eax, eax
je 0x406167
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00402148
pop ecx
mov dword [0x40b660], eax
mov eax, dword [0x40b660]
cmp eax, ebx
je 0x4061bf
cmp dword [0x40b664], ebx
je 0x4061bf
push eax
call fcn.004021c3
push dword [0x40b664]
mov esi, eax
call fcn.004021c3
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4061bf
test edi, edi
je 0x4061bf
call esi
test eax, eax
je 0x4061b6
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4061b6
test byte [ebp - 0xc], 1
jne 0x4061bf
or dword [ebp + 0x10], 0x200000
jmp 0x4061f8
mov eax, dword [0x40b658]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4061f8
mov eax, dword [0x40b65c]
cmp eax, ebx
je 0x4061f8
push eax
call fcn.004021c3
pop ecx
test eax, eax
je 0x4061f8
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x40b654]
call fcn.004021c3
pop ecx
test eax, eax
je 0x406218
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40621a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
mov ecx, 0x784c7257
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x398b689d
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x447742
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
mov ecx, dword [ebx + 0xe4]
mov dword [ebp - 4], ebx
test ecx, ecx
je 0x447883
push esi
push edi
push 0x53b8d0
call fcn.00417f1a
mov edi, eax
neg edi
sbb edi, edi
inc edi
cmp dword [ebp + 8], 0
je 0x4477d2
mov esi, dword [ebx + 0x168]
jmp 0x4477be
mov eax, esi
mov edi, dword [eax + 8]
mov esi, dword [esi]
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4477be
push edi
call fcn.0040c7f8
push eax
push 0x57a080
call fcn.00417f38
pop ecx
pop ecx
test eax, eax
je 0x4477be
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x178]
test eax, eax
jle 0x4477be
push 4
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
test esi, esi
jne 0x44777e
lea ecx, [ebx + 0x164]
call fcn.00487498
jmp 0x447881
mov eax, dword [ebx + 0xcc]
mov dword [ebp - 8], eax
test eax, eax
je 0x447881
jmp 0x4477e8
mov ebx, dword [ebp - 4]
lea eax, [ebp - 8]
push eax
lea ecx, [ebx + 0xc8]
call fcn.0041c13c
mov esi, dword [eax]
test esi, esi
jne 0x447801
xor ebx, ebx
jmp 0x447804
mov ebx, dword [esi + 0x20]
push ebx
mov dword [ebp + 8], ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x447877
push ebx
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x447877
test edi, edi
je 0x447849
push esi
push 0x57a080
call fcn.00417f38
mov edx, dword [eax]
pop ecx
pop ecx
mov ecx, eax
call dword [edx + 0x180]
push eax
push 0x543aa4
call fcn.00417f38
pop ecx
pop ecx
test eax, eax
je 0x447877
push 0
push ebx
call dword [sym.imp.USER32.dll_ShowWindow]
mov esi, dword [ebp - 4]
push 0
lea eax, [ebp + 8]
add esi, 0x164
push eax
mov ecx, esi
call fcn.00446cf9
test eax, eax
jne 0x447877
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.00446c28
cmp dword [ebp - 8], 0
jne 0x4477e5
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x44be8c
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x57c6c0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 4]
or ecx, 0x2001f
push ecx
push eax
push dword [edi]
xor esi, esi
lea ecx, [ebp - 0x10c]
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x10c], esi
mov dword [ebp - 0x108], esi
call fcn.0044b94c
mov ebx, eax
cmp ebx, esi
je 0x44bef9
lea ecx, [ebp - 0x10c]
call fcn.0041e01b
mov eax, ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00508877
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x44bf17
lea eax, [ebp - 0x104]
push eax
lea ecx, [ebp - 0x10c]
call fcn.0044be8c
cmp eax, esi
jne 0x44bf5e
lea eax, [ebp - 0x11c]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push esi
push dword [ebp - 0x10c]
mov dword [ebp - 0x110], 0x100
call ebx
test eax, eax
je 0x44bf01
lea ecx, [ebp - 0x10c]
call fcn.0041e01b
push dword [ebp - 0x114]
mov ecx, edi
call fcn.0044b8ed
lea ecx, [ebp - 0x10c]
mov esi, eax
call fcn.0041e01b
mov eax, esi
jmp 0x44bee8
Function at 0x472dbb
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x529425
call fcn.0050a183
mov esi, ecx
mov dword [ebp - 0x1c], esi
mov ecx, dword [ebp + 0xc]
call fcn.0043b3a0
test eax, eax
je 0x472f8a
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp + 8]
lea ecx, [esi + 4]
xor edi, edi
push eax
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], ecx
call fcn.004406c0
test eax, eax
je 0x472e01
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x18]
call fcn.00404360
mov esi, 0x104
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 4], edi
call fcn.00404030
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0040c6ea
lea ecx, [ebp - 0x14]
call fcn.00404360
xor ebx, ebx
inc ebx
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00404030
push eax
push edi
push 0x53e21c
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0040c6ea
push edi
push 0x4000100
push 2
push edi
push edi
push 0xc0000000
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
mov dword [ebp - 0x20], esi
cmp esi, 0xffffffff
je 0x472f74
push esi
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0042056c
push edi
push 0x1000
push edi
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 3
call fcn.0042b766
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x88]
mov dword [eax + 0x20], ebx
mov eax, dword [ecx]
push edx
mov byte [ebp - 4], 4
call dword [eax + 8]
lea ecx, [ebp - 0x88]
call fcn.0042b075
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x88]
mov dword [eax + 0x20], edi
mov byte [ebp - 4], 3
call fcn.0042b728
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.0042064f
mov ecx, dword [ebp - 0x24]
lea eax, [ebp + 8]
push eax
mov dword [ebp - 4], ebx
call fcn.00472cb3
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
mov dword [eax], esi
call fcn.00404320
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404320
mov eax, ebx
jmp 0x472f8c
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404320
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.00404320
xor eax, eax
call fcn.0050a228
ret 8
Function at 0x481c3c
Capabilities:
Get file system object information

Disassembly:
push 0x270
mov eax, 0x529b10
call fcn.0050a1b9
mov esi, ecx
lea edi, [esi + 0x14]
push edi
lea ecx, [ebp - 0x278]
call fcn.004042e0
xor ebx, ebx
push ebx
push 0x55b3a4
lea ecx, [ebp - 0x278]
mov dword [ebp - 4], ebx
call fcn.00403420
cmp eax, 0xffffffff
jne 0x481d1f
push ebx
push 0x53a274
lea ecx, [ebp - 0x278]
call fcn.00403420
cmp eax, 0xffffffff
jne 0x481d1f
push ebx
push 0x53a270
lea ecx, [ebp - 0x278]
call fcn.00403420
cmp eax, 0xffffffff
jne 0x481d1f
push edi
lea ecx, [ebp - 0x27c]
call fcn.004042e0
mov edi, dword [ebp - 0x27c]
push ebx
lea eax, [ebp - 0x114]
push eax
push 0x104
push ebx
push edi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_SearchPathA]
test eax, eax
jne 0x481d02
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov esi, eax
call fcn.00404320
mov ecx, dword [ebp - 0x278]
add ecx, 0xfffffff0
call fcn.00404320
mov eax, esi
call fcn.0050a23c
ret
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x278]
call fcn.00404120
lea ecx, [edi - 0x10]
mov byte [ebp - 4], bl
call fcn.00404320
push 0x105
push 0x160
lea eax, [ebp - 0x274]
push eax
push ebx
push dword [ebp - 0x278]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
test eax, eax
je 0x481d49
mov esi, dword [ebp - 0x274]
jmp 0x481cec
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x14]
mov esi, eax
jmp 0x481cec