joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4318a5
Capabilities:
Get common file path

Disassembly:
sub esp, 0x18
lea eax, [esp + 8]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
mov ebp, dword [esi + 4]
xor ebx, ebx
mov dword [esi + 0x454], ebx
cmp dword [0x4b0d18], ebx
lea edi, [esi + 0x41c]
jne 0x4318db
mov dword [0x4b0d18], ebx
lea eax, [edi + 0x1c]
push eax
push 0x4b0ce8
push 0x4c69a0
call fcn.0040f7b4
push ebx
push eax
push ebx
push ebx
push 0x54000000
lea eax, [esp + 0x2c]
push ebx
push eax
push ebp
mov ecx, edi
call fcn.0040f90b
push 0x403
lea ecx, [esi + 0x4ac]
push dword [esi + 4]
call fcn.0048d4eb
mov ecx, dword [esi + 4]
mov dword [esi + 0x498], eax
neg edi
mov dword [esi + 0x538], ecx
lea ecx, [esi + 0x420]
sbb edi, edi
mov dword [esp + 0x14], ebx
and edi, ecx
mov dword [esp + 0x10], edi
push dword [edi]
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov eax, dword [esi + 0x498]
lea ebp, [esi + 0x43c]
mov ecx, ebp
mov dword [ebp], eax
call fcn.00418dc0
mov eax, dword [esi + 4]
mov edi, 0x5600094c
push 0xe800
push edi
push ebx
push 0x100
push eax
call fcn.004098df
push 0xe800
mov dword [esi + 0x4a0], eax
mov eax, dword [esi + 4]
push edi
push ebx
push 0x104
push eax
call fcn.004098df
add esp, 0x28
mov edi, 0x416
mov dword [esi + 0x49c], eax
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 1
push edi
push dword [esi + 0x4a0]
call ebx
push 0
push 1
push edi
push dword [esi + 0x4a0]
call ebx
push 0
push 1
push edi
push dword [esi + 0x4a0]
call ebx
push 0
push 1
push edi
push dword [esi + 0x4a0]
call ebx
xor eax, eax
cmp dword [esi + 0x5cc], eax
jne 0x4319f8
push eax
push eax
push edi
push dword [esi + 0x49c]
call ebx
push 0
push 0
push edi
push dword [esi + 0x4a0]
call ebx
mov eax, dword [esp + 0x10]
push 0
lea ebx, [esi + 0x24]
push dword [eax]
mov ecx, ebx
call fcn.00428368
mov eax, dword [esp + 0x10]
lea edi, [esi + 0x28]
push dword [eax]
push dword [edi]
call dword [sym.imp.USER32.dll_SetParent]
neg ebx
sbb ebx, ebx
mov ecx, ebp
and ebx, edi
mov eax, dword [ebx]
mov dword [ebp + 4], eax
call fcn.00418dc0
push 1
push 0
mov ecx, ebp
call fcn.00418bcb
push 0
mov ecx, ebp
call fcn.00418c2d
lea edi, [esi + 0x420]
push 0xffffffffffffffec
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, eax
or ecx, 0x10000
cmp eax, ecx
je 0x431a68
push ecx
push 0xffffffffffffffec
push dword [edi]
call dword [sym.imp.USER32.dll_SetWindowLongW]
push dword [ebx]
call fcn.00404ad3
pop ecx
lea eax, [esp + 0x14]
xor ebp, ebp
push eax
push ebp
push ebp
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
push 1
mov edi, dword [sym.imp.USER32.dll_SetTimer]
pop ebx
push ebp
push 0x3e8
push 0x7d0
mov dword [esi + 0x5b0], ebx
push dword [esi + 4]
call edi
push ebp
push 0xfa
push 0x7d2
push dword [esi + 4]
call edi
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x18
ret 0x10
Function at 0x4324c5
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
movzx ebx, word [ebp + 0xc]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
mov esi, ecx
push ebx
push 0x419
push dword [esi + 0x49c]
call edi
lea ecx, [ebp - 0x20]
push ecx
push eax
push 0x41d
push dword [esi + 0x49c]
call edi
lea eax, [ebp - 0x20]
push 2
push eax
push 0
push dword [esi + 0x49c]
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov eax, dword [ebp - 0x20]
push 1
push ebx
push 0x403
push dword [esi + 0x49c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
call edi
and dword [ebp - 4], 0
push ecx
mov eax, esp
lea ecx, [ebp - 4]
mov dword [eax], 0xd9
call fcn.00409e82
push ecx
lea ecx, [ebp - 4]
mov eax, esp
mov dword [eax], 0x80
call fcn.00409e82
mov ebx, dword [sym.imp.USER32.dll_GetSubMenu]
push 4
push dword [ebp - 4]
call ebx
push 3
push eax
mov dword [ebp - 8], eax
call ebx
mov ebx, eax
push 0
push 1
push ebx
call fcn.0044283a
push ebx
call fcn.0043d0d1
mov eax, dword [esi + 4]
add esp, 0x10
push 0
push eax
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0x100
push ebx
call dword [sym.imp.USER32.dll_TrackPopupMenu]
test eax, eax
jle 0x4325aa
push 0
push eax
push 0x111
push dword [0x4c3228]
call edi
movzx eax, word [ebp + 0xc]
push 0
push eax
push 0x403
push dword [esi + 0x49c]
call edi
mov esi, dword [sym.imp.USER32.dll_DestroyMenu]
test ebx, ebx
je 0x4325cb
push ebx
call esi
cmp dword [ebp - 8], 0
je 0x4325d6
push dword [ebp - 8]
call esi
cmp dword [ebp - 4], 0
je 0x4325e1
push dword [ebp - 4]
call esi
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x433eb5
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
movzx ecx, ax
shr eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x18], ecx
push dword [esi + 0x4aa8]
call dword [sym.imp.USER32.dll_ScreenToClient]
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
lea eax, [ebp - 0x18]
push eax
push edi
push 0x445
push dword [esi + 0x4aa8]
call ebx
cmp eax, edi
mov dword [ebp - 0x10], eax
jl 0x434029
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
mov dword [ebp + 0x10], 0x8497
jmp 0x433f1d
xor edi, edi
push edi
push dword [ebp + 0x10]
push 0x419
push dword [esi + 0x4aa8]
call ebx
cmp dword [ebp - 0x10], eax
push 1
pop edi
je 0x433f44
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0x84a3
jl 0x433f1b
jmp 0x433fbc
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov eax, dword [ebp + 0x10]
cmp eax, 0x8497
je 0x433fa6
cmp eax, 0x849c
je 0x433fa6
cmp eax, 0x849d
je 0x433fa6
cmp eax, 0x8498
je 0x433fa1
cmp eax, 0x8499
je 0x433fa9
cmp eax, 0x849e
je 0x433fa9
cmp eax, 0x849f
je 0x433fa9
cmp eax, 0x849a
jne 0x433f8c
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
jmp 0x433faf
cmp eax, 0x849b
je 0x433fac
cmp eax, 0x84a0
je 0x433fa9
cmp eax, 0x84a1
jne 0x433faf
mov dword [ebp - 0xc], edi
jmp 0x433fac
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
push 0
push eax
push 0x111
push dword [esi + 4]
call ebx
mov eax, dword [ebp + 0x14]
xor ebx, ebx
cmp dword [eax], ebx
je 0x434029
cmp dword [ebp + 0x10], 0x849e
je 0x433fec
cmp dword [ebp + 0x10], 0x849f
je 0x433fec
cmp dword [ebp - 4], ebx
je 0x434003
push edi
push 0xffffffffffffffff
lea ecx, [esi + 0x6a30]
call fcn.00418f56
jmp 0x434003
push edi
push ebx
lea ecx, [esi + 0x6a30]
mov dword [esi + 0x6a6c], 0x19c8
call fcn.00418bcb
cmp dword [ebp - 8], ebx
je 0x434016
push edi
push 0xffffffffffffffff
lea ecx, [esi + 0x6aa4]
call fcn.00418f56
cmp dword [ebp - 0xc], ebx
je 0x434029
push edi
push 0xffffffffffffffff
lea ecx, [esi + 0x6b18]
call fcn.00418f56
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10
Function at 0x4345ea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
xor edi, edi
cmp dword [0x4c3240], edi
mov dword [ebp - 0x14], ecx
jne 0x4347a8
push str.start.qdr
lea ecx, [ebp - 8]
mov dword [0x4c3240], 0xa
call fcn.00403927
push dword [ebp - 8]
lea eax, [ebp - 0x10]
push 0x4b335c
push 0x4afae4
push eax
call fcn.0044aadb
add esp, 0x10
lea ecx, [ebp - 8]
push eax
call fcn.00403a8c
lea ecx, [ebp - 0x10]
call fcn.004038fb
push ecx
lea eax, [ebp - 8]
mov ecx, esp
push eax
call fcn.004038b5
lea eax, [ebp - 0xc]
push eax
call fcn.0045fe66
pop ecx
pop ecx
lea ecx, [ebp - 0xc]
call fcn.00403cfb
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_CharLowerW]
push 0x4b3358
lea ecx, [ebp - 0x10]
call fcn.00403927
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.0049c975
mov ebx, eax
pop ecx
neg ebx
pop ecx
sbb bl, bl
lea ecx, [ebp - 0x10]
inc bl
call fcn.004038fb
test bl, bl
mov esi, 0x4c3120
je 0x4346ab
lea eax, [ebp - 8]
mov ecx, esi
push eax
call fcn.00403a8c
lea eax, [ebp - 0x10]
push eax
call fcn.00432fd0
pop ecx
push eax
mov ecx, 0x4c27a0
call fcn.00403a8c
lea ecx, [ebp - 0x10]
call fcn.004038fb
mov eax, dword [0x4c27a0]
cmp dword [eax - 0xc], edi
jl 0x4346e1
mov dword [ebp - 4], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x4346f3
mov ecx, dword [0x4af550]
push eax
mov dword [ebp - 4], ecx
lea ecx, [ebp - 4]
call fcn.0040a750
push esi
lea eax, [ebp - 0x10]
push 0x4afefc
push eax
call fcn.0040a9a2
mov eax, dword [eax]
lea ecx, [ebp - 4]
push eax
push dword [eax - 8]
call fcn.00403bd8
lea ecx, [ebp - 0x10]
call fcn.004038fb
push edi
push ecx
mov esi, str.StartCrash
mov ecx, esp
push esi
call fcn.0040a529
mov ebx, dword [ebp - 0x14]
mov ecx, ebx
call fcn.004351ef
cmp eax, 1
jne 0x434752
push edi
push ecx
mov ecx, esp
push esi
call fcn.0040a529
mov ecx, ebx
call fcn.0043519f
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x434790
push 1
push ecx
mov ecx, esp
push esi
call fcn.0040a529
mov ecx, ebx
call fcn.0043519f
push edi
push edi
push ecx
lea eax, [ebp - 4]
mov ecx, esp
push eax
mov dword [0x4c2c80], edi
call fcn.004038b5
mov ecx, ebx
call fcn.0044112c
push edi
push ecx
mov ecx, esp
push esi
call fcn.0040a529
mov ecx, ebx
call fcn.0043519f
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x435265
Capabilities:
Hide graphical window

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
push 1
mov edi, ecx
pop esi
push 3
mov dword [0x4b3144], esi
pop ebx
push ebx
push ecx
mov ecx, esp
push 0x4b1904
mov dword [0x4b3118], ebx
call fcn.00403927
mov ecx, edi
call fcn.004351ef
mov ebp, dword [sym.imp.USER32.dll_ShowWindow]
xor ecx, ecx
cmp dword [0x4c3208], ecx
mov dword [0x4b3118], eax
mov dword [esp + 0x14], eax
jne 0x435309
cmp eax, ebx
mov dword [esp + 0x10], eax
jne 0x4352de
push ecx
push ecx
mov dword [0x4b3118], ecx
mov ecx, esp
push 0x4b18fc
call fcn.00403927
mov ecx, edi
call fcn.004351ef
xor ecx, ecx
cmp eax, ebx
sete cl
mov eax, ecx
mov dword [0x4b3118], eax
mov ecx, dword [0x4c6978]
cmp eax, esi
jne 0x4352ea
mov ecx, ebx
cmp dword [esp + 0x10], 0
lea esi, [edi + 4]
jne 0x4352fc
push 5
push dword [esi]
call ebp
jmp 0x43532b
push ecx
sub esp, 0x10
mov ecx, esp
push 0x4c2c60
jmp 0x43531c
push dword [0x4c2c5c]
lea esi, [edi + 4]
sub esp, 0x10
mov ecx, esp
push 0x4c2c70
call fcn.00426375
push dword [esi]
call fcn.00440d94
add esp, 0x18
push dword [esi]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x43533c
push ebx
push dword [esi]
call ebp
mov eax, dword [esp + 0x14]
cmp eax, 7
mov dword [0x4b3118], eax
jne 0x43535a
push dword [esi]
call dword [sym.imp.USER32.dll_GetParent]
push eax
mov ecx, esi
call fcn.004035ec
xor ecx, ecx
cmp dword [0x4c318c], ecx
je 0x43539a
push 1
mov dword [0x4c318c], ecx
pop eax
mov ebx, 0x80
push eax
push ecx
push ecx
mov dword [0x4c31f4], eax
mov ecx, esp
push ebx
call fcn.00403927
push dword [edi + 0x30c]
lea ecx, [edi + 0x2ec]
push ebx
call fcn.0049558a
push 0
push dword [esi]
call ebp
and dword [0x4b3144], 0
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x43544a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 1
pop eax
mov esi, ecx
push eax
mov dword [0x4c3260], eax
mov dword [0x4b3144], eax
call fcn.0043bc8b
lea eax, [ebp - 0x18]
xor edi, edi
push eax
lea eax, [esi + 0x6a10]
neg eax
lea ebx, [esi + 0x6a14]
mov dword [0x4b3144], edi
sbb eax, eax
and eax, ebx
push dword [eax]
call dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x18]
push eax
push dword [esi + 0x314]
call dword [sym.imp.USER32.dll_ScreenToClient]
test eax, eax
je 0x4354b2
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x314]
call dword [sym.imp.USER32.dll_ScreenToClient]
push 0x40
push 0x14
push 0x14
push edi
push edi
push edi
push dword [ebx]
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
call edi
mov eax, dword [ebp - 0xc]
push 0x40
sub eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
push dword [ebx]
call edi
push 5
push dword [esi + 0x314]
call dword [sym.imp.USER32.dll_ShowWindow]
call dword [sym.imp.WINMM.dll_timeGetTime]
sub eax, dword [0x4c3258]
mov ecx, dword [0x4af550]
mov dword [ebp - 4], ecx
push eax
lea eax, [ebp - 4]
push str._0d_msek
push eax
call fcn.00403d66
add esp, 0xc
lea ecx, [ebp - 4]
push 0
call fcn.00403c58
push eax
push 1
pop edi
push edi
push 0x40b
push dword [0x4c3220]
call dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0xfa0
push 0x30e26
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SetTimer]
lea ecx, [ebp - 8]
mov dword [0x4c3264], edi
call fcn.00446c2a
lea ecx, [ebp - 8]
call fcn.0042d8eb
lea ecx, [ebp - 8]
call fcn.00446c4f
lea ecx, [ebp - 4]
call fcn.004038fb
pop edi
pop esi
pop ebx
leave
ret
Function at 0x436406
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
cmp dword [0x4c323c], esi
push edi
jne 0x43641d
call fcn.004331d7
cmp dword [0x4c28dc], 6
jb 0x436634
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax - 0xc], esi
jl 0x436443
mov dword [ebp + 8], eax
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x436455
mov ecx, dword [0x4af550]
push eax
mov dword [ebp + 8], ecx
lea ecx, [ebp + 8]
call fcn.0040a750
push esi
push 0x4b3fc0
lea ecx, [ebp + 8]
call fcn.00403d34
test eax, eax
jne 0x4365aa
mov eax, dword [0x4af550]
push 0x3e
push 1
mov dword [ebp - 0x10], eax
push dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 4]
push eax
call fcn.0048e9cf
push 0x3e
push 2
push dword [ebp + 8]
lea eax, [ebp - 4]
push eax
call fcn.0048e9cf
add esp, 0x20
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x14]
push eax
call fcn.00403a8c
mov eax, dword [ebp - 4]
cmp dword [eax - 8], esi
lea eax, [ebp - 4]
jne 0x4364b9
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.00403a8c
push esi
push str._select
lea ecx, [ebp + 8]
call fcn.00403d34
cmp eax, esi
jl 0x43657f
mov ecx, dword [ebp + 8]
add eax, 8
mov ecx, dword [ecx - 8]
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 8]
lea ecx, [ebp + 8]
push eax
call fcn.0040acf3
lea ecx, [ebp - 8]
call fcn.0040ae64
lea ecx, [ebp - 8]
call fcn.0040ae14
push 0x4bc518
push 0x4b18ec
lea ecx, [ebp - 8]
call fcn.004040f7
push esi
lea ecx, [ebp - 0x28]
push dword [ebp - 8]
call fcn.004899c9
lea eax, [ebp - 0x20]
push 0x8000
push eax
lea ecx, [ebp - 0x28]
call fcn.00489a5c
mov esi, 0x4c3118
push eax
mov ecx, esi
call fcn.00403a8c
lea ecx, [ebp - 0x20]
call fcn.004038fb
push esi
mov ecx, 0x4c311c
call fcn.00403a8c
lea ecx, [ebp - 0x28]
call fcn.004893ad
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x10]
jmp 0x436627
push edi
mov ecx, 0x4c311c
call fcn.00403a8c
lea ecx, [ebp - 0x1c]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004038fb
push str.::26EE0668_A00A_44D7_9371_BEB064C98683
lea ecx, [ebp - 0x18]
call fcn.00403927
push edi
lea ecx, [ebp - 0xc]
call fcn.004038b5
lea ecx, [ebp - 0xc]
call fcn.00403cfb
push dword [ebp - 0xc]
call dword [sym.imp.USER32.dll_CharUpperW]
push esi
lea ecx, [ebp - 0xc]
push dword [ebp - 0x18]
call fcn.00403d34
test eax, eax
jl 0x43661c
push 1
push esi
push esi
push dword [edi]
push str.explore
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x4bc550
mov ecx, edi
call fcn.00403adc
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
push 1
pop eax
jmp 0x436636
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 0x18]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x436770
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
lea edx, [ebp - 4]
xor eax, eax
push edx
push eax
push ecx
push 0x43678e
push eax
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
leave
ret
Function at 0x437451
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4af550]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x210]
push 0x104
push eax
push dword [0x4c69a8]
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x210]
lea ecx, [ebp - 4]
push eax
call fcn.0040a529
cmp dword [0x4c3280], 2
jne 0x4374aa
and dword [0x4c3280], 0
push 5
push 0
push dword [ebp - 4]
push str.explorer.exe
jmp 0x4374b4
push 1
push 0
push dword [ebp + 8]
push dword [ebp - 4]
push str.open
push dword [esi + 4]
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 4]
mov esi, eax
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp + 8]
call fcn.004038fb
mov eax, esi
pop esi
leave
ret 4

Function at 0x4375f7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov edi, ecx
mov esi, 0x4bc550
push esi
lea ecx, [ebp - 4]
call fcn.00403927
push esi
lea ecx, [ebp - 8]
call fcn.00403927
call fcn.004828b2
test eax, eax
jne 0x43769b
lea eax, [ebp - 0xc]
push 0x46
push eax
call fcn.00461337
lea eax, [ebp - 0x14]
push 0xbf
push eax
call fcn.00461337
mov eax, dword [eax]
add esp, 0x10
push 0x43
push eax
push dword [ebp - 0xc]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
lea ecx, [ebp - 0x14]
mov esi, eax
call fcn.004038fb
cmp esi, 2
jne 0x43767c
lea ecx, [ebp - 0xc]
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
xor eax, eax
jmp 0x437738
cmp esi, 6
jne 0x437693
call fcn.00433175
cmp eax, 1
jne 0x437693
push 0
call fcn.004828bb
pop ecx
lea ecx, [ebp - 0xc]
call fcn.004038fb
cmp word [ebp + 0xc], 0x8034
jne 0x4376e5
lea eax, [ebp + 0xc]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x4376e5
push dword [ebp + 0xc]
lea ecx, [ebp - 0x10]
call fcn.0048938d
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x10]
push eax
call fcn.00489a02
push eax
lea ecx, [ebp - 8]
call fcn.00403a8c
lea ecx, [ebp - 0x14]
call fcn.004038fb
lea ecx, [ebp - 0x10]
call fcn.004893ad
mov eax, dword [ebp - 4]
push ecx
mov ecx, esp
cmp dword [eax - 0xc], 0
jl 0x437702
mov dword [ecx], eax
mov eax, dword [ebp - 4]
add eax, 0xfffffff4
push eax
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
jmp 0x437711
mov eax, dword [0x4af550]
mov dword [ecx], eax
push dword [ebp - 4]
call fcn.0040a750
push ecx
lea eax, [ebp - 8]
mov ecx, esp
push eax
call fcn.004038b5
mov ecx, edi
call fcn.0043773e
lea ecx, [ebp - 8]
mov esi, eax
call fcn.004038fb
lea ecx, [ebp - 4]
call fcn.004038fb
mov eax, esi
pop edi
pop esi
leave
ret 0x10
Function at 0x4380e6
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, ecx
push 8
push dword [esi + 4]
call edi
test eax, eax
jne 0x438120
push 5
push dword [esi + 4]
call edi
lea ecx, [esi + 0x2ec]
call fcn.004952ca
and dword [0x4c31f4], 0
push dword [esi + 4]
call fcn.0048ea64
pop ecx
jmp 0x438157
push 1
mov ebx, 0x80
pop eax
lea edi, [esi + 0x2ec]
push eax
push 0
push ecx
mov dword [0x4c31f4], eax
mov ecx, esp
push ebx
call fcn.00403927
push dword [esi + 0x30c]
mov ecx, edi
push ebx
call fcn.0049558a
push dword [esi + 4]
mov ecx, edi
call fcn.004954ee
pop edi
pop esi
pop ebx
ret
Function at 0x43a295
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [ebp - 0x6c8]
mov dword [ebp - 0x6cc], eax
push dword [ebp - 0x66c]
call dword [ebp - 0x680]
cmp dword [ebp - 0x6cc], 0
je 0x43b075
push 5
mov eax, dword [ebp - 0x378]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax - 0x1d]
push eax
lea eax, [ebp - 0x394]
push eax
call fcn.00438e53
add esp, 0xc
and dword [ebp - 0x700], 0
jmp 0x43a2ef
mov eax, dword [ebp - 0x700]
inc eax
mov dword [ebp - 0x700], eax
cmp dword [ebp - 0x700], 5
jge 0x43a338
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
movsx ecx, byte [ebp - 0x24]
xor eax, ecx
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
mov eax, dword [ebp - 0x700]
movsx eax, byte [ebp + eax - 0x394]
not eax
mov ecx, dword [ebp - 0x700]
mov byte [ebp + ecx - 0x394], al
jmp 0x43a2e2
call fcn.00438ee2
sub esi, dword [edx - 0x20]

Function at 0x43a340
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
and byte [ebp - 0x72c], 0
and byte [ebp - 0x72b], 0
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
mov byte [ebp - 0x721], 0x6d
mov byte [ebp - 0x720], 0x4f
mov byte [ebp - 0x71f], 0x52
mov byte [ebp - 0x71e], 0x49
mov byte [ebp - 0x71d], 0x58
mov byte [ebp - 0x71c], 0x5e
mov byte [ebp - 0x71b], 0x49
mov byte [ebp - 0x71a], 0x3d
call fcn.00438ee2
lahf
jbe 0x43a35a
invalid
pop es
lea eax, [ebp - 0x72c]
push eax
call fcn.00438ef2
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00438ea7
add esp, 0xc
mov dword [ebp - 0x6e4], eax
call fcn.00438ee2
cli
pop esp
xor bl, 0x8d
test eax, ebp
clc
invalid
Function at 0x43b58a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp dword [0x4c3244], 0
push edi
mov edi, ecx
je 0x43b60e
push ebx
push esi
lea eax, [ebp - 8]
push 0xea60
push eax
call fcn.00461337
mov esi, dword [eax]
lea eax, [ebp - 4]
push 0xb7
push eax
call fcn.00461337
mov eax, dword [eax]
add esp, 0x10
push 0x31
push esi
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
cmp eax, 2
lea ecx, [ebp - 4]
sete bl
call fcn.004038fb
lea ecx, [ebp - 8]
call fcn.004038fb
pop esi
test bl, bl
pop ebx
je 0x43b609
mov ecx, edi
call fcn.004348bf
lea ecx, [edi + 0x2ec]
call fcn.004952ca
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 1
pop eax
jmp 0x43b610
xor eax, eax
pop edi
leave
ret

Function at 0x43bddf
Capabilities:
Capture webcam image

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
test byte [0x4c26ec], 1
push ebx
push esi
push edi
mov esi, ecx
jne 0x43be0f
mov eax, dword [0x4af550]
or byte [0x4c26ec], 1
push 0x43bf42
mov dword [0x4c26e8], eax
call fcn.0049ce21
pop ecx
mov eax, dword [ebp + 8]
mov edi, 0x4c26e8
cmp dword [eax - 8], 0
jne 0x43be26
push edi
lea ecx, [ebp + 8]
call fcn.00403a8c
lea eax, [ebp + 8]
mov ecx, edi
push eax
call fcn.00403a8c
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x8496
push 0x419
push dword [esi + 0x4aa8]
call ebx
cmp eax, 0xffffffff
jne 0x43be57
xor esi, esi
jmp 0x43beed
push 7
xor eax, eax
pop ecx
lea edi, [ebp - 0x1c]
rep stosd dword es:[edi], eax
push 0xff
lea ecx, [ebp + 8]
mov dword [ebp - 0x20], 0x20
mov dword [ebp - 0x1c], 0x4a
call fcn.00403c58
mov dword [ebp - 8], eax
xor eax, eax
cmp dword [0x4b3130], eax
mov word [ebp - 0xe], 0x5a
mov byte [ebp - 0xf], 0x80
jne 0x43beb8
mov edi, 0x4bc518
mov ecx, edi
test ecx, ecx
je 0x43bea5
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push edi
push eax
lea ecx, [ebp + 8]
call fcn.004039ec
and word [ebp - 0xe], 0
mov byte [ebp - 0xf], 0x90
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0x4a
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push 0x8496
push 0x440
push dword [esi + 0x4aa8]
call ebx
cmp dword [ebp + 0x10], 0
je 0x43bef9
push 1
mov ecx, esi
call fcn.0043bc54
push 1
pop esi
lea ecx, [ebp + 8]
call fcn.004038fb
mov eax, esi
jmp 0x43bf3b
mov eax, dword [0x4b314c]
cmp eax, dword [0x4b3130]
je 0x43bf30
lea eax, [esi + 0x9ac]
lea ecx, [esi + 0x9b0]
neg eax
sbb eax, eax
and eax, ecx
cmp dword [eax], 0
je 0x43bf30
push 1
mov ecx, esi
call fcn.0043bc54
mov eax, dword [0x4b3130]
mov dword [0x4b314c], eax
lea ecx, [ebp + 8]
call fcn.004038fb
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0xc