joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4348dc
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x43494f
push dword [0x45ff6e]
pop dword [0x4538e8]
push dword [0x45ff76]
pop dword [0x4538ec]
push 0
push dword [0x45ff72]
call sub.user32.dll_ShowWindow
push 8
push dword [0x453914]
call sub.user32.dll_ShowWindow
push 8
push dword [0x45ff6e]
call sub.user32.dll_ShowWindow
push 0
push dword [0x45ff7a]
call sub.user32.dll_ShowWindow
push 8
push dword [0x45ff76]
call sub.user32.dll_ShowWindow
push 1
push 0
push dword [0x4538e4]
call sub.user32.dll_InvalidateRect
jmp 0x4349b9
push dword [0x45ff72]
pop dword [0x4538e8]
push dword [0x45ff7a]
pop dword [0x4538ec]
push 0
push dword [0x453914]
call sub.user32.dll_ShowWindow
push 0
push dword [0x45ff6e]
call sub.user32.dll_ShowWindow
push 8
push dword [0x45ff72]
call sub.user32.dll_ShowWindow
push 0
push dword [0x45ff76]
call sub.user32.dll_ShowWindow
push 8
push dword [0x45ff7a]
call sub.user32.dll_ShowWindow
push dword [0x4538ec]
push dword [0x453970]
call sub.user32.dll_SetParent
push dword [0x4538ec]
push dword [0x4538f8]
call sub.user32.dll_SetParent
push dword [0x4538ec]
push dword [0x4538f0]
call sub.user32.dll_SetParent
leave
ret 4
Function at 0x4386b3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff80
cmp dword [0x44f39d], 0
je 0x4386e6
push 0x40
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextW
push dword [ebp + 8]
call sub.user32.dll_GetParent
mov edx, eax
lea eax, [ebp - 0x80]
push eax
push edx
call sub.user32.dll_SetWindowTextW
jmp 0x438708
push 0x40
lea eax, [ebp - 0x80]
push eax
push dword [ebp + 8]
call sub.user32.dll_GetWindowTextA
push dword [ebp + 8]
call sub.user32.dll_GetParent
mov edx, eax
lea eax, [ebp - 0x80]
push eax
push edx
call sub.user32.dll_SetWindowTextA
leave
ret 4

Function at 0x4389b2
Capabilities:
Hide graphical window
Read .ini file

Disassembly:
push 0x4adbfa
push 0x104
push 0x45ca0e
push 0x44ef8c
push str.Type
push 0x44f7f1
call sub.kernel32.dll_GetPrivateProfileStringA
mov dword [ebp - 0x84], 0x1ff
mov ebx, 0x10
lea eax, [ebp - 0x80]
push eax
push 0x45ca0e
call fcn.0040cd48
cmp byte [ebp - 0x80], 0
je 0x438a22
push dword [ebp - 0x84]
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
push 5
push eax
call sub.user32.dll_ShowWindow
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x84]
push dword [ebp + 8]
call sub.user32.dll_SetDlgItemTextA
jmp 0x438a38
push dword [ebp - 0x84]
push dword [ebp + 8]
call sub.user32.dll_GetDlgItem
push 0
push eax
call sub.user32.dll_ShowWindow
inc dword [ebp - 0x84]
dec ebx
jne 0x4389e4
push 0x1ff
push 0x20e
push 0x1ff
push dword [ebp + 8]
call sub.user32.dll_CheckRadioButton
push 0x1f
push 0x453240
push 0x1ff
push dword [ebp + 8]
call sub.user32.dll_GetDlgItemTextA
push 0x4adbfa
push 0x104
push 0x45ca0e
push 0x44ef8c
push 0x44f3f6
push str.Paths
call sub.kernel32.dll_GetPrivateProfileStringA
push 0x45ca0e
call fcn.00408490
push 0x45ca0e
push 0x215
push dword [ebp + 8]
call sub.user32.dll_SetDlgItemTextA
push 0x1f
push 0x453240
push 0x1ff
push dword [ebp + 8]
call sub.user32.dll_GetDlgItemTextA
push 1
push 0
push 0x110
push dword [0x4adb6e]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x110
push dword [0x4adb72]
call sub.user32.dll_SendMessageA
push 0
push 0
push 0x110
push dword [0x4adb76]
call sub.user32.dll_SendMessageA
ret
Function at 0x438ef9
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push dword [ebp + 0xc]
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
lea eax, [ebp - 0x104]
push eax
call fcn.004010ef
dec eax
mov al, byte ss:[eax + ebp - 0x104]
cmp al, 0x5c
je 0x438f3b
push 0x44ef92
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
push 0x44efa0
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
push 0x4637e8
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x439095
mov dword [ebp - 0x108], eax
mov eax, dword [0x4637e8]
and eax, 0x10
or eax, eax
je 0x438fe4
mov al, byte [0x463814]
cmp al, 0x2e
je 0x439072
cmp dword [0x4ae5fe], 0
je 0x439072
lea eax, [ebp - 0x104]
push eax
call fcn.004010ef
mov edx, eax
push edx
sub edx, 3
mov al, byte ss:[edx + ebp - 0x104]
cmp al, 0x5c
jne 0x438fb1
inc edx
push 0x463814
lea eax, [edx + ebp - 0x104]
push eax
call fcn.004010a7
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
push dword [ebp + 8]
call fcn.00438ef9
pop edx
mov byte ss:[edx + ebp - 0x104], 0
jmp 0x439072
push 0
push 0
push 0x40f
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
cmp eax, 0x1f4
jge 0x43908a
mov dword [ebp - 0x118], 0
mov dword [ebp - 0x114], 0
mov dword [ebp - 0x110], 0
lea eax, [ebp - 0x104]
push eax
push 0x463932
call fcn.004010a7
push 0x463932
call fcn.004010ef
lea edx, [eax - 3]
push 0x463814
lea eax, [edx + 0x463932]
push eax
call fcn.004010a7
mov eax, dword [ebp + 0x10]
lea eax, [eax + 0x463933]
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x118]
push eax
push 0
push 0x402
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
push 0x4637e8
push dword [ebp - 0x108]
call sub.kernel32.dll_FindNextFileA
or eax, eax
jne 0x438f6c
push dword [ebp - 0x108]
call sub.kernel32.dll_FindClose
leave
ret 0xc
Function at 0x43a36b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push esi
push edi
push 0x45de5e
push 0x45cf22
call fcn.004010a7
push dword [ebp + 8]
push 0x45cf22
call fcn.004010c5
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x43a4ab
mov dword [ebp - 4], eax
push 0x19000
push 0x40
call fcn.00401030
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.kernel32.dll_GlobalLock
push 0
lea eax, [ebp - 0xc]
push eax
push 0x19000
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov esi, dword [ebp - 8]
cmp byte [esi], 0
je 0x43a43a
cmp word [esi + 0x20], 0
je 0x43a43a
lea eax, [esi]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004010a7
lea eax, [ebp - 0x10c]
push eax
call fcn.004010ef
lea edi, [eax + ebp - 0x10c]
mov al, 0x20
stosb byte es:[edi], al
movzx eax, word [esi + 0x20]
push edi
push eax
call fcn.004011b7
lea eax, [ebp - 0x10c]
push eax
call fcn.0043a24c
add esi, 0x28
mov eax, dword [esi]
jmp 0x43a495
lea edi, [ebp - 0x10c]
mov al, byte [esi + 4]
or al, al
je 0x43a490
mov eax, dword [esi + 0x24]
or eax, eax
je 0x43a490
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004010a7
lea eax, [ebp - 0x10c]
push eax
call fcn.004010ef
lea edi, [eax + ebp - 0x10c]
mov al, 0x20
stosb byte es:[edi], al
push edi
push dword [esi + 0x24]
call fcn.004011b7
lea eax, [ebp - 0x10c]
push eax
call fcn.0043a24c
add esi, 0x78
mov eax, dword [esi]
or eax, eax
jne 0x43a441
push dword [ebp - 8]
call sub.kernel32.dll_GlobalUnlock
push dword [ebp - 8]
call sub.kernel32.dll_GlobalFree
jmp 0x43a4e0
push 0x44ecd3
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
pop edi
pop esi
leave
ret 4
Function at 0x43a4e6
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push esi
push edi
push 0x45de5e
push 0x45cf22
call fcn.004010a7
push dword [ebp + 8]
push 0x45cf22
call fcn.004010c5
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x45cf22
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x43a6ef
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 0xc], eax
shr eax, 0xd
inc eax
shl eax, 0xd
push eax
push 0x40
call fcn.00401030
mov dword [ebp - 8], eax
push dword [ebp - 8]
call sub.kernel32.dll_GlobalLock
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov esi, dword [ebp - 8]
mov eax, dword [esi]
cmp eax, 0x64
jne 0x43a5ed
add esi, 0x90
mov eax, dword [esi]
jmp 0x43a5e4
lea edi, [ebp - 0x10c]
mov al, byte [esi + 0x5c]
or al, al
je 0x43a5dc
mov eax, dword [esi + 0x58]
or eax, eax
je 0x43a5dc
lea eax, [esi + 0x5c]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004010a7
lea eax, [ebp - 0x10c]
push eax
call fcn.004010ef
lea edi, [ebp - 0x10c]
add edi, eax
mov al, 0x20
stosb byte es:[edi], al
push edi
push dword [esi + 0x58]
call fcn.004011b7
lea eax, [ebp - 0x10c]
push eax
call fcn.0043a24c
add esi, 0x84
mov eax, dword [esi]
or eax, eax
jne 0x43a58c
jmp 0x43a6dd
cmp eax, 0x65
jne 0x43a666
add esi, 0x90
mov eax, dword [esi]
jmp 0x43a660
lea edi, [ebp - 0x10c]
mov al, byte [esi + 0x12d]
or al, al
je 0x43a658
mov eax, dword [esi + 0x129]
or eax, eax
je 0x43a658
lea eax, [esi + 0x12d]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004010a7
lea eax, [ebp - 0x10c]
push eax
call fcn.004010ef
lea edi, [ebp - 0x10c]
add edi, eax
mov al, 0x20
stosb byte es:[edi], al
push edi
push dword [esi + 0x129]
call fcn.004011b7
lea eax, [ebp - 0x10c]
push eax
call fcn.0043a24c
add esi, 0x155
mov eax, dword [esi]
or eax, eax
jne 0x43a5fc
jmp 0x43a6dd
cmp eax, 0x66
jne 0x43a6dd
add esi, 0x90
mov eax, dword [esi]
jmp 0x43a6d9
lea edi, [ebp - 0x10c]
mov al, byte [esi + 0x12d]
or al, al
je 0x43a6d1
mov eax, dword [esi + 0x129]
or eax, eax
je 0x43a6d1
lea eax, [esi + 0x12d]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.004010a7
lea eax, [ebp - 0x10c]
push eax
call fcn.004010ef
lea edi, [ebp - 0x10c]
add edi, eax
mov al, 0x20
stosb byte es:[edi], al
push edi
push dword [esi + 0x129]
call fcn.004011b7
lea eax, [ebp - 0x10c]
push eax
call fcn.0043a24c
add esi, 0x175
mov eax, dword [esi]
or eax, eax
jne 0x43a675
push dword [ebp - 8]
call sub.kernel32.dll_GlobalUnlock
push dword [ebp - 8]
call sub.kernel32.dll_GlobalFree
jmp 0x43a724
push 0x44ecd3
push 0x467936
call fcn.004010a7
push 0x45cf22
push 0x467936
call fcn.004010c5
push 0x10
push 0x44f25f
push 0x467936
push dword [0x4538b0]
call sub.user32.dll_MessageBoxA
pop edi
pop esi
leave
ret 4
Function at 0x43ac45
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
mov word [ebp - 0x100], 0x30
push 0x45cb12
push 0x100
lea eax, [ebp - 0x100]
push eax
push 0x44ef8c
lea eax, [ebp - 0x100]
push eax
push str.MakeFiles
call sub.kernel32.dll_GetPrivateProfileStringA
lea eax, [ebp - 0x100]
push eax
call fcn.004010ef
sub eax, 4
mov byte ss:[eax + ebp - 0x100], 0
push str.Res_
lea eax, [ebp - 0x200]
push eax
call fcn.004010a7
lea eax, [ebp - 0x100]
push eax
lea eax, [ebp - 0x200]
push eax
call fcn.004010c5
push esi
lea eax, [ebp - 0x200]
push eax
call fcn.004010c5
lea eax, [ebp - 0x200]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x43ad0a
lea eax, [ebp - 0x200]
push eax
push 0
push 0x180
push 0xbb9
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
mov dword [ebp - 0x20c], eax
push 0
push dword [ebp - 0x20c]
push 0x19a
push 0xbb9
push dword [ebp + 8]
call sub.user32.dll_SendDlgItemMessageA
ret

Function at 0x43ad4e
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef0
push dword [ebp + 0x10]
lea eax, [ebp - 0x104]
push eax
call fcn.004010a7
lea eax, [ebp - 0x104]
push eax
call fcn.004010ef
dec eax
mov al, byte ss:[eax + ebp - 0x104]
cmp al, 0x5c
je 0x43ad90
push 0x44ef92
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
push 0x44efa0
lea eax, [ebp - 0x104]
push eax
call fcn.004010c5
push 0x4637e8
lea eax, [ebp - 0x104]
push eax
call sub.kernel32.dll_FindFirstFileA
cmp eax, 0xffffffff
je 0x43ae90
mov dword [ebp - 0x108], eax
mov eax, dword [0x4637e8]
and eax, 0x10
or eax, eax
je 0x43ae44
mov al, byte [0x463814]
cmp al, 0x2e
je 0x43ae6d
push 0x2e
push 0x463814
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043ad0b
mov dword [ebp - 0x10c], eax
lea eax, [ebp - 0x104]
push eax
call fcn.004010ef
mov edx, eax
push edx
sub edx, 3
mov al, byte ss:[edx + ebp - 0x104]
cmp al, 0x5c
jne 0x43ae11
inc edx
push 0x463814
lea eax, [edx + ebp - 0x104]
push eax
call fcn.004010a7
lea eax, [ebp - 0x104]
push eax
push dword [ebp - 0x10c]
push dword [ebp + 8]
call fcn.0043ad4e
pop edx
mov byte ss:[edx + ebp - 0x104], 0
jmp 0x43ae6d
push 0x463814
call fcn.00428ce6
add eax, 0x2e
mov dword [ebp - 0x110], eax
push dword [ebp - 0x110]
push 0x463814
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0043ad0b
push 0x4637e8
push dword [ebp - 0x108]
call sub.kernel32.dll_FindNextFileA
or eax, eax
jne 0x43adc1
push dword [ebp - 0x108]
call sub.kernel32.dll_FindClose
push dword [ebp + 0xc]
push 0
push 0x1113
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
cmp dword [0x45f46a], 0
je 0x43aebd
push dword [ebp + 0xc]
push 2
push 0x1102
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
leave
ret 0xc
Function at 0x43bc27
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
push 0
push 0x8000000
push 3
push 0
push 1
push 0x80000000
push 0x461c42
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 0x14], eax
cmp eax, 0xffffffff
jne 0x43bc5c
mov eax, 0
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x14]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
je 0x43bc82
push dword [ebp - 0x14]
call sub.kernel32.dll_CloseHandle
mov eax, 0
pop esi
pop ebx
leave
ret
push dword [ebp - 8]
push 0x42
call fcn.00401030
mov dword [0x4ae72e], eax
push dword [0x4ae72e]
call sub.kernel32.dll_GlobalLock
mov dword [0x4ae712], eax
mov ebx, eax
cmp dword [0x4ae712], 0
jne 0x43bcbd
push dword [ebp - 0x14]
call sub.kernel32.dll_CloseHandle
mov eax, 0
pop esi
pop ebx
leave
ret
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [0x4ae712]
push dword [ebp - 0x14]
call sub.kernel32.dll_ReadFile
mov dword [ebp - 4], eax
push dword [ebp - 0x14]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 0x10]
mov cx, word [ebx]
mov edx, dword [ebx + 2]
cmp dword [ebp - 4], 0
je 0x43bcff
cmp eax, dword [ebp - 8]
jne 0x43bcff
cmp cx, 0x4d42
jne 0x43bcff
cmp edx, dword [ebp - 8]
je 0x43bd1e
push dword [0x4ae712]
call sub.kernel32.dll_GlobalUnlock
push dword [0x4ae72e]
call sub.kernel32.dll_GlobalFree
mov eax, 0
pop esi
pop ebx
leave
ret
mov ebx, dword [0x4ae712]
mov eax, 0xe
add eax, ebx
mov dword [0x4ae716], eax
mov esi, eax
mov eax, dword [ebx + 0xa]
add eax, ebx
mov dword [0x4ae71a], eax
cmp dword [esi], 0xc
jne 0x43bd57
xor eax, eax
mov ax, word [esi + 4]
mov dword [0x4ae71e], eax
mov ax, word [esi + 6]
mov dword [0x4ae722], eax
jmp 0x43bd6e
mov eax, dword [esi + 4]
mov dword [0x4ae71e], eax
mov eax, dword [esi + 8]
cmp eax, 1
jae 0x43bd69
neg eax
mov dword [0x4ae722], eax
mov eax, 1
pop esi
pop ebx
leave
ret
Function at 0x43bd77
Capabilities:
Check if file exists
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
mov dword [ebp - 8], 1
jmp 0x43be9e
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 8]
call fcn.004011b7
push 0x45da4e
lea eax, [ebp - 0x118]
push eax
call fcn.004010a7
push str.Macro
lea eax, [ebp - 0x118]
push eax
call fcn.004010c5
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004010c5
push str..kbm
lea eax, [ebp - 0x118]
push eax
call fcn.004010c5
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x43be9b
push 0
push 0
lea eax, [ebp - 0x118]
push eax
call fcn.0043c1f8
push 0
push 0x80
push 3
push 0
push 3
push 0x80000000
lea eax, [ebp - 0x118]
push eax
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
je 0x43be92
mov dword [ebp - 4], eax
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
push eax
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
pop eax
or eax, eax
je 0x43be92
push 0x4532a1
lea eax, [ebp - 0x118]
push eax
call fcn.004010a7
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x118]
push eax
call fcn.004010c5
push str..kbm
lea eax, [ebp - 0x118]
push eax
call fcn.004010c5
lea eax, [ebp - 0x118]
push eax
push 0x41a22d
push dword [0x4538b0]
push 0xc80
push dword [0x453904]
call fcn.004019a1
mov dword [ebp - 8], 0
jmp 0x43be9e
inc dword [ebp - 8]
cmp dword [ebp - 8], 0
jne 0x43bd8c
leave
ret

Function at 0x43beaa
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push dword [0x44f3a9]
pop dword [0x4ae75a]
mov dword [0x44f3a9], 0
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_GetKeyboardState
lea eax, [ebp - 0x100]
mov byte [eax + 0x11], 0
mov byte [eax + 0x10], 0
mov byte [eax + 0x12], 0
lea eax, [ebp - 0x100]
push eax
call sub.user32.dll_SetKeyboardState
push 0x45da4e
lea eax, [ebp - 0x100]
push eax
call fcn.004010a7
push 0x44ef92
lea eax, [ebp - 0x100]
push eax
call fcn.004010c5
push dword [ebp + 8]
lea eax, [ebp - 0x100]
push eax
call fcn.004010c5
push 0
push 0
lea eax, [ebp - 0x100]
push eax
call fcn.0043c274
leave
ret 4

Function at 0x43c274
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffffc
pushal
fldz
fistp dword [ebp - 4]
call fcn.0043c1ba
call fcn.0043c1d9
push 0
push 0x20
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x43c2a8
jmp 0x43c2fe
mov dword [0x4ae73a], eax
push 0
push dword [0x4ae73a]
call sub.kernel32.dll_GetFileSize
mov dword [0x4ae752], eax
fild dword [0x4ae752]
mov dword [0x4ae752], 0x14
fidiv dword [0x4ae752]
fistp dword [0x4ae752]
sub dword [0x4ae752], 2
jle 0x43c2fe
push dword [ebp + 0xc]
pop dword [0x4ae756]
call fcn.0043c1a0
cmp dword [0x4ae732], 0
je 0x43c2fe
mov dword [ebp - 4], eax
popal
push dword [ebp - 4]
pop eax
leave
ret 0xc
Function at 0x43d03e
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
xor ebx, ebx
mov eax, dword [ebp + 8]
mov al, byte [eax]
cmp al, 0x2e
je 0x43d05c
lea eax, [ebp - 0x1c]
mov byte [eax], 0x2e
inc eax
jmp 0x43d05f
lea eax, [ebp - 0x1c]
push dword [ebp + 8]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
push 0xf003f
push 0
push ebx
push ebx
lea eax, [ebp - 0x1c]
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyExA
push str.Shell
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_lstrcpyA
push dword [ebp + 0xc]
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_lstrcatA
push str.Command
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_lstrcatA
cmp dword [ebp + 0x14], 0
jne 0x43d103
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push 0xf003f
push 0
push ebx
push ebx
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCreateKeyExA
push dword [ebp + 0x10]
call sub.kernel32.dll_lstrlenA
inc eax
push eax
push dword [ebp + 0x10]
push 1
push ebx
push ebx
push dword [ebp - 8]
call sub.advapi32.dll_RegSetValueExA
push dword [ebp - 8]
call sub.advapi32.dll_RegCloseKey
jmp 0x43d16f
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyA
push str.Shell
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_lstrcpyA
push dword [ebp + 0xc]
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_lstrcatA
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyA
push str.Shell
lea eax, [ebp - 0x120]
push eax
call sub.kernel32.dll_lstrcpyA
lea eax, [ebp - 0x120]
push eax
push dword [ebp - 4]
call sub.advapi32.dll_RegDeleteKeyA
lea eax, [ebp - 0x1c]
push eax
push 0x80000000
call sub.advapi32.dll_RegDeleteKeyA
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x43f093
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp dword [0x461d42], 0
je 0x43f141
call fcn.0043bc27
or eax, eax
je 0x43f141
lea eax, [ebp - 0x10]
push eax
push dword [0x4538c0]
call sub.user32.dll_GetClientRect
mov eax, dword [ebp - 8]
sub eax, dword [ebp - 0x10]
shr eax, 1
mov ecx, dword [0x4ae71e]
shr ecx, 1
sub eax, ecx
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0xc]
shr eax, 1
mov ecx, dword [0x4ae722]
shr ecx, 1
sub eax, ecx
add dword [ebp - 0xc], eax
push 0
push dword [0x453904]
push 0
push dword [0x4538c0]
push dword [0x4ae722]
push dword [0x4ae71e]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x46800000
push 0
push str.RadSplashClass
push 0x88
call sub.user32.dll_CreateWindowExA
mov dword [0x461c3e], eax
push 4
push dword [0x461c3e]
call sub.user32.dll_ShowWindow
push dword [0x461c3e]
call sub.user32.dll_UpdateWindow
leave
ret
Function at 0x4430b7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
cmp eax, 0xa411
jne 0x4430ff
xor dword [0x45f8aa], 1
cmp dword [0x45f8aa], 0
je 0x4430db
mov eax, 8
jmp 0x4430e0
mov eax, 0
push eax
push dword [0x4538b8]
call sub.user32.dll_ShowWindow
push 0
push 0
push 5
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
jmp 0x443320
cmp eax, 0xa412
jne 0x44311a
push 0
push 5
push dword [0x4538e0]
call fcn.00404c14
jmp 0x443320
cmp eax, 0xa413
jne 0x443135
push 0
push 5
push dword [0x4538d8]
call fcn.00404c14
jmp 0x443320
cmp eax, 0xa414
jne 0x443150
push 0
push 5
push dword [0x4538dc]
call fcn.00404c14
jmp 0x443320
cmp eax, 0xa415
jne 0x44316b
push 0
push 5
push dword [0x4538e4]
call fcn.00404c14
jmp 0x443320
cmp eax, 0xa416
jne 0x443186
push 0
push 5
push dword [0x45390c]
call fcn.00404c14
jmp 0x443320
cmp eax, 0xa418
jne 0x4431a1
push 0
push 5
push dword [0x453950]
call fcn.00404c14
jmp 0x443320
cmp eax, 0xa419
jne 0x4431bc
push 0
push 5
push dword [0x453958]
call fcn.00404c14
jmp 0x443320
cmp eax, 0xa41a
jne 0x4431d7
push 0
push 5
push dword [0x45395c]
call fcn.00404c14
jmp 0x443320
cmp eax, 0xa417
jne 0x443219
xor dword [0x45f8ae], 1
cmp dword [0x45f8ae], 0
je 0x4431f5
mov eax, 8
jmp 0x4431fa
mov eax, 0
push eax
push dword [0x4538bc]
call sub.user32.dll_ShowWindow
push 0
push 0
push 5
push dword [ebp + 8]
call sub.user32.dll_SendMessageA
jmp 0x443320
cmp eax, 0xabfa
jne 0x44331c
cmp dword [0x4538c4], 0
je 0x443320
cmp dword [0x4538cc], 0
jne 0x443320
cmp dword [0x453990], 0
jne 0x4432b8
push 0
push dword [0x453904]
push 0
push dword [0x4538b0]
push 0
push 0
push 0
push 0
push 0x91000000
push 0
push str.FullScreenClass
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x453990], eax
push ebx
mov ebx, dword [0x4538c8]
or ebx, ebx
jne 0x443292
mov ebx, dword [0x4538cc]
or ebx, ebx
jne 0x443292
mov ebx, dword [0x453960]
push dword [0x453990]
push ebx
call sub.user32.dll_SetParent
cmp dword [0x4538cc], 0
jne 0x4432af
push 3
push ebx
call sub.user32.dll_ShowWindow
push ebx
call sub.user32.dll_SetFocus
pop ebx
jmp 0x44331a
push ebx
mov ebx, dword [0x4538c8]
or ebx, ebx
jne 0x4432d3
mov ebx, dword [0x4538cc]
or ebx, ebx
jne 0x4432d3
mov ebx, dword [0x453960]
push dword [0x4538c4]
push ebx
call sub.user32.dll_SetParent
push dword [0x453990]
call sub.user32.dll_DestroyWindow
mov dword [0x453990], 0
lea eax, [ebp - 0x10]
push eax
push dword [0x4538c4]
call sub.user32.dll_GetClientRect
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push ebx
call sub.user32.dll_SetWindowPos
pop ebx
jmp 0x443320
leave
ret 4
xor eax, eax
leave
ret 4