joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4182f1
Capabilities:
Hide graphical window

Disassembly:
push dword [0x49ed98]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41831d
push esi
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [0x49ed98]
call esi
push 0
push dword [0x49ed90]
call esi
pop esi
ret

Function at 0x41831e
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [0x49ed98]
call esi
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.0042e489
cmp dword [eax], 1
je 0x418388
cmp dword [eax + 4], ebx
je 0x4183dd
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4183dd
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0x46
push eax
push edi
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
sub esi, ebx
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov edi, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 4]
sub ecx, edi
push 5
push 0
push 0
sub ebx, eax
mov eax, ecx
cdq
idiv dword [ebp - 4]
sub ebx, dword [ebp - 8]
add ebx, esi
push ebx
sub edi, eax
sub edi, dword [ebp - 0xc]
add edi, ecx
push edi
push 0
push dword [0x49ed98]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x419289
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
push ebx
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0x3ee
push dword [ebp + 8]
call edi
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x419416
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextLengthW]
push esi
call ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x150]
push 0xff
push eax
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowTextW]
call esi
push 0x3ef
push dword [ebp + 8]
call edi
mov edi, eax
test edi, edi
mov dword [ebp - 0x10], edi
je 0x419416
push edi
call ebx
cmp dword [ebp - 4], eax
jge 0x419301
lea eax, [ebp - 0x150]
push 0xff
push eax
push edi
call esi
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetDC]
mov esi, eax
test esi, esi
je 0x419416
lea eax, [ebp - 0x150]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
lea eax, [ebp - 0x150]
push eax
push esi
call fcn.00419b4a
push 1
push 0x493500
push esi
mov edi, eax
call fcn.00419b4a
push esi
push dword [ebp - 8]
movzx ebx, ax
call dword [sym.imp.USER32.dll_ReleaseDC]
and dword [ebp + 8], 0
movzx esi, di
add esi, ebx
shr edi, 0x10
test esi, esi
mov dword [ebp - 0x14], edi
je 0x419416
test edi, edi
je 0x419416
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
sub eax, dword [ebp - 0x24]
sub ecx, dword [ebp - 0x20]
cmp eax, esi
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], ecx
jge 0x4193a0
mov edi, esi
push 1
sub edi, eax
add edi, ebx
add esi, ebx
pop ebx
mov dword [ebp - 4], esi
mov dword [ebp + 8], ebx
jmp 0x4193a6
mov edi, dword [ebp + 8]
push 1
pop ebx
mov eax, dword [ebp - 0x14]
cmp ecx, eax
jge 0x4193b6
add eax, 4
mov dword [ebp + 8], ebx
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x419416
mov esi, dword [sym.imp.USER32.dll_GetWindowPlacement]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x50], 0x2c
push dword [ebp - 0x10]
call esi
mov eax, dword [ebp - 0x34]
push ebx
push dword [ebp - 0xc]
mov ebx, dword [sym.imp.USER32.dll_MoveWindow]
sub eax, edi
push dword [ebp - 4]
push dword [ebp - 0x30]
push eax
push dword [ebp - 0x10]
call ebx
lea eax, [ebp - 0x50]
mov dword [ebp - 0x50], 0x2c
push eax
push dword [ebp - 8]
call esi
mov ecx, dword [ebp - 0x34]
push 1
push dword [ebp - 0xc]
lea eax, [edi + edi]
sub ecx, eax
push dword [ebp - 4]
push dword [ebp - 0x30]
push ecx
push dword [ebp - 8]
call ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41e296
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x4771c7
call fcn.004461a8
sub esp, 0xad4
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0xade]
mov word [ebp - 0xae0], bx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0xae0]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea eax, [ebp - 0xae0]
mov edi, 0x47e5a0
mov esi, 0x47e598
mov dword [ebp - 0x68], edi
test eax, eax
mov dword [ebp - 0x48], esi
lea eax, [ebp - 0xae0]
jne 0x41e2fa
mov eax, 0x49cc4c
lea ecx, [ebp - 0xf]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x68]
call fcn.00408d43
mov eax, str..mst
mov dword [ebp - 4], ebx
mov ecx, eax
mov dword [ebp - 0x3c], edi
test ecx, ecx
mov dword [ebp - 0x1c], esi
jne 0x41e321
mov eax, 0x49cc4c
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.00408d43
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x68]
push eax
mov byte [ebp - 4], 1
call fcn.004147fe
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.00401bc7
mov eax, dword [ebp - 0x60]
mov byte [ebp - 4], 2
cmp eax, ebx
jne 0x41e35a
mov eax, 0x47e5b8
lea ecx, [ebp - 0x2e0]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x41e452
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x2d4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x41e42c
lea eax, [ebp - 0xae0]
mov dword [ebp - 0x3c], edi
test eax, eax
mov dword [ebp - 0x1c], esi
lea eax, [ebp - 0xae0]
jne 0x41e3aa
mov eax, 0x49cc4c
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.00408d43
lea eax, [ebp - 0x2b4]
mov byte [ebp - 4], 3
test eax, eax
mov dword [ebp - 0x90], edi
mov dword [ebp - 0x70], esi
lea eax, [ebp - 0x2b4]
jne 0x41e3da
mov eax, 0x49cc4c
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x90]
call fcn.00408d43
lea eax, [ebp - 0x90]
lea ecx, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 4
call fcn.004147fe
lea ecx, [ebp - 0x90]
mov byte [ebp - 4], 3
call fcn.00401bc7
mov eax, dword [ebp - 0x34]
cmp eax, ebx
jne 0x41e419
mov eax, 0x47e5b8
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00401bc7
lea eax, [ebp - 0x2e0]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41e377
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
cmp eax, ebx
je 0x41e452
push dword [ebp - 0x14]
call eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.00401bc7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x424d49
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x477e46
call fcn.004461a8
sub esp, 0x290
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x10], edi
lea eax, [ebp - 0x12]
mov ebx, 0x47e5a0
mov esi, 0x47e598
push edi
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 1
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x24], esi
call fcn.004017e6
push dword [ebp + 0xc]
lea eax, [ebp - 0x6c]
mov byte [ebp - 4], 2
push eax
call fcn.00424f23
mov eax, dword [eax + 8]
pop ecx
cmp eax, edi
pop ecx
jne 0x424da6
mov eax, 0x47e5b8
push 0x20019
push eax
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x10]
call fcn.00417d10
neg eax
sbb al, al
lea ecx, [ebp - 0x6c]
inc al
mov byte [ebp + 0xf], al
call fcn.00401bc7
cmp byte [ebp + 0xf], 0
je 0x424edb
mov word [ebp - 0x29c], di
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x29a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x1c]
and dword [ebp + 0xc], 0
push eax
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp + 0xc]
push eax
push 0
push str.Version
mov dword [ebp - 0x1c], 0x104
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x424e3b
mov edi, dword [ebp + 8]
lea eax, [ebp + 0xf]
push 0
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.004017e6
mov dword [ebp - 0x18], 1
jmp 0x424ef7
lea eax, [ebp - 0x29c]
mov edi, 0x49cc4c
test eax, eax
lea eax, [ebp - 0x29c]
jne 0x424e52
mov eax, edi
push eax
lea ecx, [ebp - 0x44]
call fcn.00401969
mov eax, 0x492ecc
mov dword [ebp - 0x6c], ebx
mov ecx, eax
mov dword [ebp - 0x4c], esi
test ecx, ecx
jne 0x424e6e
mov eax, edi
lea ecx, [ebp + 0xf]
push 0
push ecx
push eax
lea ecx, [ebp - 0x6c]
call fcn.00408d43
mov eax, 0x4934c0
mov byte [ebp - 4], 3
mov ecx, eax
mov dword [ebp - 0x94], ebx
test ecx, ecx
mov dword [ebp - 0x74], esi
jne 0x424e97
mov eax, edi
lea ecx, [ebp - 0x11]
push 0
push ecx
push eax
lea ecx, [ebp - 0x94]
call fcn.00408d43
lea eax, [ebp - 0x6c]
lea ecx, [ebp - 0x44]
push eax
lea eax, [ebp - 0x94]
push eax
mov byte [ebp - 4], 4
call fcn.00425d73
lea ecx, [ebp - 0x94]
mov byte [ebp - 4], 3
call fcn.00401bc7
lea ecx, [ebp - 0x6c]
mov byte [ebp - 4], 2
call fcn.00401bc7
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x44]
push 0
push eax
mov ecx, edi
mov dword [edi], ebx
mov dword [edi + 0x20], esi
call fcn.0040e384
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 1
call fcn.00401bc7
cmp dword [ebp - 0x10], 0
je 0x424f12
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x429b61
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x4785ea
call fcn.004461a8
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.00447d64
mov eax, 0x47fca8
lea edi, [ebx + 0x10]
mov esi, eax
and dword [ebp - 4], 0
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebx + 0x20]
mov esi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea ecx, [ebx + 0x30]
lea eax, [ebp - 0xd]
mov edi, 0x47e5a0
mov esi, 0x47e598
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.004017e6
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.004017e6
mov eax, dword [ebp + 8]
mov ecx, ebx
mov byte [ebp - 4], 2
mov dword [ebx], 0x47e7d0
mov dword [ebx + 0xc], eax
call fcn.00429d1f
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x429bf3
Capabilities:
Access peb ldr_data

Disassembly:
mov eax, 0x478612
call fcn.004461a8
push ecx
push ecx
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call fcn.00447d64
and dword [ebp - 4], 0
lea edi, [ebx + 0x30]
lea eax, [ebp - 0xd]
mov esi, 0x47e598
push 0
push eax
mov ecx, edi
mov dword [edi], 0x47e5a0
mov dword [edi + 0x20], esi
call fcn.004017e6
lea ecx, [ebx + 0x58]
lea eax, [ebp - 0xe]
push 0
push eax
mov byte [ebp - 4], 1
mov dword [ecx], 0x47e5a0
mov dword [ecx + 0x20], esi
call fcn.004017e6
mov esi, dword [ebp + 8]
mov dword [ebx], 0x47e7d0
mov ecx, edi
mov byte [ebp - 4], 2
mov eax, dword [esi + 0xc]
mov dword [ebx + 0xc], eax
lea eax, [esi + 0x30]
push eax
call fcn.004095a6
lea eax, [esi + 0x58]
lea ecx, [ebx + 0x58]
push eax
call fcn.004095a6
add esi, 0x20
lea edi, [ebx + 0x20]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x10]
lea edi, [ebx + 0x10]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x42beee
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
and dword [ebp - 0x14], 0
push esi
push edi
mov edi, ecx
call fcn.0040104e
push 1
lea eax, [ebp - 0x150]
pop esi
mov dword [ebp - 0x150], 0x114
push eax
mov dword [ebp - 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x14c]
mov ecx, dword [ebp - 0x144]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x148]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x140]
mov dword [ebp - 4], eax
sub eax, 0
mov dword [ebp - 8], ecx
je 0x42bf9e
dec eax
je 0x42bf93
dec eax
jne 0x42bfa5
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x18], 2
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
movzx eax, word [ebp - 0x3c]
push 4
dec eax
pop ecx
je 0x42bf83
dec eax
je 0x42bf7a
dec eax
jne 0x42bf86
mov dword [ebp - 0x18], 5
jmp 0x42bf86
mov dword [ebp - 0x18], 3
jmp 0x42bf86
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x14c], ecx
jb 0x42bfa5
mov dword [ebp - 0x14], esi
jmp 0x42bfa5
movzx eax, cx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], eax
jmp 0x42bfa5
mov dword [ebp - 0x18], 7
lea eax, [ebp - 0x18]
mov ecx, edi
push eax
call fcn.0040104a
mov ecx, eax
call fcn.0042e490
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x42c3a1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
mov eax, edx
dec edx
test eax, eax
je 0x42c3de
mov eax, dword [ecx + 0xd4]
push esi
lea esi, [edx + 1]
mov edx, dword [ebp + 8]
push edi
mov ecx, dword [ebp + 0x10]
movzx edi, byte [edx]
and ecx, 0xff
xor ecx, edi
mov edi, dword [ebp + 0x10]
shr edi, 8
mov ecx, dword [eax + ecx*4]
inc edx
xor edi, ecx
dec esi
mov dword [ebp + 0x10], edi
jne 0x42c3bc
pop edi
pop esi
mov eax, dword [ebp + 0x10]
pop ebp
ret 0xc
Function at 0x431e33
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x431ee9
lea eax, [ebp - 0x22c]
push 0xff
push eax
push dword [ebp + 0xc]
call fcn.00441041
add esp, 0xc
cmp dword [ebp + 0xc], 0x452
jne 0x431ed9
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x431e95
lea eax, [ebp - 0x22c]
push 0x4925fc
push eax
call fcn.00448225
pop ecx
test eax, eax
pop ecx
jne 0x431eb1
mov eax, 0x486
push eax
mov dword [0x4a1c0c], eax
call fcn.00440f54
pop ecx
push dword [0x4a1c0c]
call fcn.00447560
lea eax, [ebp - 0x2c]
push eax
push 0
call fcn.004426b9
pop ecx
lea eax, [ebp - 0x2c]
pop ecx
push eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x22c]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetWindowTextW]
leave
ret 8
Function at 0x432675
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x90
push ebx
push esi
mov esi, str.SetupBitmapCls
push edi
lea eax, [ebp - 0x68]
push esi
mov edi, ecx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 4
xor ebx, ebx
pop eax
mov dword [ebp - 0x28], 3
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov eax, dword [edi + 0xb18]
push 0x7f00
push ebx
mov dword [ebp - 0x24], 0x4327d3
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.USER32.dll_LoadCursorW]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x68]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x90]
push eax
push esi
push dword [edi + 0xb18]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.USER32.dll_GetClassInfoW]
test eax, eax
jne 0x4326fe
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.USER32.dll_RegisterClassW]
test ax, ax
je 0x4327a0
push 0xd0
call fcn.004461c7
mov esi, eax
pop ecx
cmp esi, ebx
je 0x4327a0
mov eax, dword [ebp + 8]
push 1
pop ecx
mov dword [esi + 4], ecx
mov edx, dword [eax]
mov dword [esi], edx
mov edx, dword [eax + 4]
mov dword [esi + 8], edx
mov eax, dword [eax]
mov dword [esi + 0x78], eax
lea eax, [ebp - 0x40]
push eax
push 0x18
push dword [esi]
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetSystemMetrics]
call ebx
sub eax, dword [ebp - 0x3c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [ebp + 8], eax
call ebx
sub eax, dword [ebp - 0x38]
push esi
push dword [edi + 0xb18]
xor ecx, ecx
cdq
push ecx
push ecx
push dword [ebp - 0x38]
sub eax, edx
sar eax, 1
push dword [ebp - 0x3c]
mov dword [edi + 0x2d4], ecx
push eax
push dword [ebp + 8]
push 0x86000000
push str.SetupBitmapWin
push str.SetupBitmapCls
push 0x80
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, eax
test ebx, ebx
jne 0x4327a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor eax, eax
jmp 0x4327cc
push esi
push 0
push ebx
call dword [sym.imp.USER32.dll_SetWindowLongW]
push 5
push ebx
mov dword [edi + 0x2d4], ebx
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 0x2d4]
call dword [sym.imp.USER32.dll_UpdateWindow]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x432bec
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x479292
call fcn.004461a8
sub esp, 0x8a4
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x1ff
xor eax, eax
lea edi, [ebp - 0x8ae]
mov word [ebp - 0x8b0], bx
push 0x400
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x8b0]
lea ecx, [esi + 0x28]
push eax
push 0x49cc4c
push str.ClickOncePackage
push str.Startup
call fcn.004027b0
cmp word [ebp - 0x8b0], bx
jne 0x432c4e
xor eax, eax
jmp 0x432d70
mov ecx, esi
call fcn.0042e55c
mov edi, 0x47e5a0
mov esi, 0x47e598
cmp eax, ebx
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x18], esi
jne 0x432c6e
mov eax, 0x49cc4c
lea ecx, [ebp - 0xe]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x38]
call fcn.00408d43
lea eax, [ebp - 0x8b0]
mov dword [ebp - 4], ebx
test eax, eax
mov dword [ebp - 0x60], edi
mov dword [ebp - 0x40], esi
lea eax, [ebp - 0x8b0]
jne 0x432c9a
mov eax, 0x49cc4c
lea ecx, [ebp - 0xd]
push ebx
push ecx
push eax
lea ecx, [ebp - 0x60]
call fcn.00408d43
push ebx
lea eax, [ebp - 0x88]
push ebx
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.0040dd3e
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], 2
push ecx
lea ecx, [ebp - 0xb0]
push ecx
mov ecx, eax
call fcn.0040dc89
push eax
lea ecx, [ebp - 0x38]
mov byte [ebp - 4], 3
call fcn.004095a6
lea ecx, [ebp - 0xb0]
mov byte [ebp - 4], 2
call fcn.00401bc7
lea ecx, [ebp - 0x88]
mov byte [ebp - 4], 1
call fcn.00401bc7
lea ecx, [ebp - 0x60]
mov byte [ebp - 4], bl
call fcn.00401bc7
mov eax, dword [ebp - 0x30]
mov esi, 0x47e5b8
cmp eax, ebx
jne 0x432d17
mov eax, esi
push eax
call fcn.00441b9a
test eax, eax
jne 0x432d3f
lea eax, [ebp - 0x8b0]
test eax, eax
lea eax, [ebp - 0x8b0]
jne 0x432d36
mov eax, 0x49cc4c
push eax
lea ecx, [ebp - 0x38]
call fcn.00401969
mov eax, dword [ebp - 0x30]
cmp eax, ebx
jne 0x432d48
mov eax, esi
push 1
push ebx
push ebx
push eax
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x20
pop ecx
cmp ecx, eax
lea ecx, [ebp - 0x38]
sbb esi, esi
or dword [ebp - 4], 0xffffffff
neg esi
call fcn.00401bc7
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x438cd4
Capabilities:
Get common file path
Set current directory

Disassembly:
mov eax, 0x479e44
call fcn.004461a8
sub esp, 0x14
push esi
mov esi, ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
lea eax, [ebp - 0xd]
push 0
push eax
mov dword [esi], 0x47e5e0
mov dword [esi + 0x20], 0x47e5d8
call fcn.004029f5
lea eax, [ebp - 0x20]
push 0x105
push eax
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.004023dd
mov ecx, dword [eax]
mov byte [ebp - 4], 2
mov byte [eax + 4], 1
call fcn.00402a6a
push dword [eax]
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 1
call fcn.004024ef
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x438d4b
mov eax, 0x47e608
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401f6c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
leave
ret 0x28

Function at 0x438d6f
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0xc], 0
je 0x438d8b
mov eax, dword [esi + 8]
test eax, eax
jne 0x438d84
mov eax, 0x47e608
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ecx, esi
call fcn.00401f6c
pop esi
ret

Function at 0x43a0f6
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x479fa0
call fcn.004461a8
sub esp, 0x38
push ebx
push esi
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov edi, ecx
push esi
call fcn.0043a32c
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push esi
mov ecx, edi
mov ebx, eax
call fcn.0043a32c
push str.SYSTEMCurrentControlSetControlSession_ManagerFileRenameOperations
push esi
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.0043a32c
push str.PendingFileRenameOperations
push str.SYSTEMCurrentControlSetControlSession_Manager
push esi
mov ecx, edi
mov dword [ebp - 0x18], eax
call fcn.0043a3c8
push str.rename
push 0x496c64
mov ecx, edi
mov esi, eax
call fcn.0043a21d
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xd]
push 0
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0x47e5a0
mov dword [ebp - 0x24], 0x47e598
call fcn.004017e6
and dword [ebp - 4], 0
cmp ebx, dword [edi + 0x3f0]
jle 0x43a191
push str.RunOnce
jmp 0x43a1d4
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x3f4]
jle 0x43a1a3
push str.RunOnceEx
jmp 0x43a1d4
cmp esi, dword [edi + 0x3f8]
jle 0x43a1b2
push str.PendingFileRenameOperations
jmp 0x43a1d4
mov eax, dword [ebp - 0x18]
cmp eax, dword [edi + 0x3fc]
jle 0x43a1c4
push str.FileRenameOperations
jmp 0x43a1d4
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edi + 0x400]
jle 0x43a1e5
push str.Wininit.ini_rename
lea eax, [ebp - 0x44]
push str.Reboot_required____s_key_added
push eax
call fcn.00414a68
add esp, 0xc
cmp dword [ebp - 0x38], 0
je 0x43a1fe
push 0
push 1
pop ebx
lea eax, [ebp - 0x44]
push ebx
push eax
mov ecx, edi
call fcn.0043a540
jmp 0x43a200
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00401bc7
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret