joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40e840
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x451e21
mov eax, dword fs:[0]
push eax
sub esp, 0x284
mov eax, dword [0x46e560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xorps xmm0, xmm0
mov dword [ebp - 0x270], 0
lea ecx, [ebp - 0x288]
movq qword [ebp - 0x278], xmm0
movdqu xmmword [ebp - 0x288], xmm0
call fcn.0041fa9e
push str.C:TL_DATA
lea eax, [ebp - 0x1a0]
mov dword [ebp - 4], 0
push str._s.
push eax
call fcn.00413880
add esp, 0xc
lea eax, [ebp - 0x1a0]
lea ecx, [ebp - 0x288]
push 0
push eax
call fcn.0041fce8
test eax, eax
je 0x40ea5e
lea ecx, [ebp - 0x288]
call fcn.0041fe9c
lea ecx, [ebp - 0x288]
mov edi, eax
call fcn.0042022d
test eax, eax
jne 0x40ea56
lea eax, [ebp - 0x290]
push eax
lea ecx, [ebp - 0x288]
call fcn.0041ff50
mov esi, eax
mov byte [ebp - 4], 1
mov edx, 1
mov ecx, dword [esi]
sub edx, dword [ecx - 4]
mov ecx, dword [ecx - 8]
sub ecx, 0xc8
or ecx, edx
jge 0x40e92c
push 0xc8
mov ecx, esi
call fcn.00402800
push dword [esi]
lea eax, [ebp - 0xd8]
push 0xc8
push eax
call fcn.0043a28a
mov byte [ebp - 4], 0
add esp, 0xc
mov edx, dword [ebp - 0x290]
or ecx, 0xffffffff
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40e966
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x288]
lea ecx, [ebp - 0x288]
push 0x10
mov eax, dword [eax + 0x38]
call eax
test eax, eax
jne 0x40ea56
lea eax, [ebp - 0xd8]
push eax
push str.C:TL_DATA
lea eax, [ebp - 0x268]
push str._s_s
push eax
call fcn.00413880
add esp, 0x10
call fcn.00414dfd
xor ecx, ecx
mov edx, eax
test edx, edx
setne cl
test ecx, ecx
je 0x40eab0
mov eax, dword [edx]
mov ecx, edx
mov eax, dword [eax + 0xc]
call eax
add eax, 0x10
mov dword [ebp - 0x26c], eax
lea eax, [ebp - 0xd8]
mov byte [ebp - 4], 2
push eax
push str.C:TL_DATA
lea eax, [ebp - 0x26c]
push str._s_s
push eax
call fcn.00402960
mov esi, dword [ebp - 0x26c]
add esp, 0x10
cmp dword [esi - 0xc], 0
jl 0x40ea38
push str..jpg
push esi
call fcn.00438b81
add esp, 8
test eax, eax
je 0x40ea12
sub eax, esi
cmp eax, 0xffffffff
jne 0x40ea31
cmp dword [esi - 0xc], 0
jl 0x40ea38
push str..bmp
push esi
call fcn.00438b81
add esp, 8
test eax, eax
je 0x40ea38
sub eax, esi
cmp eax, 0xffffffff
je 0x40ea38
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 0xfffffff0
mov byte [ebp - 4], 0
or ecx, 0xffffffff
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x40ea56
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
test edi, edi
jne 0x40e8d1
lea ecx, [ebp - 0x288]
call fcn.0041fc9c
push str.C:TL_DATA
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x288]
setne byte [ebp - 0x289]
call fcn.0041fc4c
mov al, byte [ebp - 0x289]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387e7
mov esp, ebp
pop ebp
ret
push 0x80004005
call fcn.00402a40
int3
Function at 0x40ebb0
Capabilities:
Allocate or change rwx memory
Create thread
Execute shellcode via indirect call
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x467660
push 0x43a740
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x46e560]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 4], 0
push 0
push 0
push 0x2b1f
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push 0
push 0x43a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x40ec32
push 0x30
push 0x4607e8
push 0x4627d4
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40ed6f
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
push ebx
call fcn.0040e720
test eax, eax
je 0x40ed61
push 0x474818
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebx, [eax*2 + 2]
push 0x40
push 0x3000
push ebx
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov edi, eax
test edi, edi
jne 0x40ec88
push 0x30
push 0x4607e8
push 0x4627f0
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40ed6f
push 0
push ebx
push 0x474818
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x40ecb4
push 0x30
push 0x4607e8
push 0x462808
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40ed6f
lea eax, [ebp - 0x20]
push eax
push 0
push edi
push dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x40eceb
push 0x30
push 0x4607e8
push 0x462820
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40ed6f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x24]
push dword [sym.imp.KERNEL32.dll_FreeLibraryAndExitThread]
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov dword [ebp - 0x28], eax
test eax, eax
jne 0x40ed37
push 0x30
push 0x4607e8
push 0x462838
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40ed6f
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x4000
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push dword [ebp - 0x28]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
mov ebx, dword [ebp - 0x2c]
jmp 0x40ec38
push esi
call edi
jmp 0x40ed6f
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004387e7
mov esp, ebp
pop ebp
ret 8
Function at 0x4105d0
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x4520e0
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x46e560]
xor eax, esp
mov dword [esp + 8], eax
push ebx
push esi
push edi
mov eax, dword [0x46e560]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
push 0x4608c2
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], 0
call fcn.00402630
lea eax, [esp + 0x14]
mov dword [esp + 0x28], 0
push eax
call fcn.00410d60
or edi, 0xffffffff
test al, al
jne 0x410653
push 0x30
push 0x4615e0
push 0x46294c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x41073a
push 0x4608c2
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], 0
call fcn.00402630
lea eax, [esp + 0x10]
mov byte [esp + 0x28], 1
push eax
lea eax, [esp + 0x18]
mov ecx, esi
push eax
push 1
call fcn.00410340
mov eax, dword [esp + 0x10]
mov ecx, 0x4608c2
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4106b0
test dl, dl
je 0x4106ac
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4106b0
add eax, 2
add ecx, 2
test dl, dl
jne 0x410690
xor eax, eax
jmp 0x4106b5
sbb eax, eax
or eax, 1
test eax, eax
jne 0x4106d0
push 0x30
push 0x4607e8
push 0x462960
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor bl, bl
jmp 0x410718
push 0x407
mov ecx, esi
call fcn.0041c43c
push dword [esp + 0x10]
mov ecx, eax
call fcn.0041cca0
push str.C:TL_DATA
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x410708
push 0
push str.C:TL_DATA
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x410716
lea edx, [esp + 0x10]
mov ecx, str.c:TL_DATAGamePath.cfg
call fcn.0040a390
mov bl, 1
mov byte [esp + 0x28], 0
mov ecx, edi
mov edx, dword [esp + 0x10]
add edx, 0xfffffff0
lea eax, [edx + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x41073a
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [esp + 0x28], 0xffffffff
mov esi, dword [esp + 0x14]
add esi, 0xfffffff0
lea eax, [esi + 0xc]
lock xadd dword [eax], edi
dec edi
test edi, edi
jg 0x41075d
mov ecx, dword [esi]
push esi
mov edx, dword [ecx]
call dword [edx + 4]
mov al, bl
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.004387e7
mov esp, ebp
pop ebp
ret
Function at 0x411f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452328
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x46e560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
call fcn.0041d6a6
mov edi, dword [eax + 8]
test edi, edi
jne 0x411f6c
push 0x30
push 0x4607e8
push 0x462d00
push edi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x412075
push 0x462d24
push 0x8a
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov dword [ebp - 0x24], eax
test eax, eax
jne 0x411f9e
push 0x30
push 0x4607e8
push 0x462d2c
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x412075
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
push dword [ebp - 0x24]
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push 0x461c1c
push eax
push esi
call dword [0x4742ec]
test eax, eax
jg 0x411fe5
push 0x30
push 0x4607e8
push 0x462d4c
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
jmp 0x412075
lea ecx, [ebp - 0x20]
xorps xmm0, xmm0
push ecx
push dword [ebp - 0x30]
movdqu xmmword [ebp - 0x20], xmm0
push eax
call dword [0x4741e4]
test al, al
je 0x411f65
lea eax, [ebp - 0x20]
push eax
call fcn.00438adc
mov esi, dword [ebp - 0x28]
lea ecx, [ebp - 0x24]
add esp, 4
mov dword [ebp - 0x24], 0
mov dword [esi], eax
call fcn.00403dc0
mov dword [ebp - 4], 0
lea eax, [ebp - 0x24]
push dword [esi]
push 0x462d70
push eax
call fcn.00402960
mov esi, dword [ebp - 0x24]
add esp, 0xc
mov ecx, dword [ebp - 0x2c]
mov edx, esi
call fcn.00412920
add esi, 0xfffffff0
mov dword [ebp - 4], 0xffffffff
xorps xmm0, xmm0
or ecx, 0xffffffff
movdqu xmmword [ebp - 0x20], xmm0
lea eax, [esi + 0xc]
lock xadd dword [eax], ecx
dec ecx
test ecx, ecx
jg 0x412073
mov ecx, dword [esi]
push esi
mov eax, dword [ecx]
call dword [eax + 4]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387e7
mov esp, ebp
pop ebp
ret
Function at 0x414150
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46e560]
xor eax, ebp
mov dword [ebp - 4], eax
mov edx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push esi
lea eax, [ebp - 8]
mov dword [edi], 0
push eax
push 0
push edx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4141cb
mov eax, dword [ebp - 8]
cmp eax, 1
je 0x41419b
cmp eax, 2
jne 0x4141ad
mov eax, dword [ebp - 0xc]
test esi, esi
je 0x4141c7
test eax, eax
je 0x4141c4
cmp byte [esi + eax - 1], 0
je 0x4141c7
pop edi
mov eax, 0xd
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004387e7
mov esp, ebp
pop ebp
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004387e7
mov esp, ebp
pop ebp
ret 0xc

Function at 0x418185
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x4181ca
call fcn.0041d6a6
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x4181ca
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x4181e6
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.004145df
mov ebx, eax
test edi, edi
je 0x4181e4
test esi, esi
je 0x4181e4
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x422452
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x452da7
mov eax, dword fs:[0]
push eax
mov eax, 0x101c
call fcn.0043dae0
mov eax, dword [0x46e560]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x10]
xor ebx, ebx
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
mov dword [ebp - 0x101c], edx
mov dword [ebp - 0x1028], ebx
cmp dword [ecx + 0x58], ebx
je 0x422586
push ebx
push eax
call fcn.004225d5
mov ebx, eax
test ebx, ebx
jne 0x4224ba
push esi
jmp 0x4225ae
call fcn.00414dfd
push eax
lea ecx, [ebp - 0x1014]
call fcn.00402a60
xor ecx, ecx
lea eax, [ebp - 0x1018]
push eax
push ecx
lea eax, [ebp - 0x1020]
mov dword [ebp - 4], ecx
push eax
push ecx
push dword [ebp - 0x101c]
mov dword [ebp - 0x1020], ecx
push ebx
mov dword [ebp - 0x1018], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [ebp - 0x1024], eax
test eax, eax
jne 0x422545
push dword [ebp - 0x1018]
lea ecx, [ebp - 0x1014]
call fcn.00402870
lea ecx, [ebp - 0x1018]
push ecx
push eax
lea eax, [ebp - 0x1020]
push eax
push 0
push dword [ebp - 0x101c]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x1014]
mov dword [ebp - 0x1024], eax
call fcn.00413d00
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x1024], 0
jne 0x422573
mov esi, dword [ebp - 0x1014]
add esi, 0xfffffff0
push esi
call fcn.004029b0
pop ecx
add eax, 0x10
mov ecx, esi
mov dword [edi], eax
call fcn.00402a90
jmp 0x4225b5
push esi
mov ecx, edi
call fcn.00402630
mov ecx, dword [ebp - 0x1014]
lea ecx, [ecx - 0x10]
jmp 0x42256c
test esi, esi
jne 0x42258f
mov esi, 0x4608c2
push dword [ecx + 0x6c]
lea ecx, [ebp - 0x1010]
push 0x1000
push ecx
push esi
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1010]
push eax
mov ecx, edi
call fcn.00402630
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004387e7
mov esp, ebp
pop ebp
ret 0x10

Function at 0x428a60
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x46e560]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x428af2
test esi, esi
je 0x428af2
push esi
call fcn.0043a520
push 0xff
mov ebx, eax
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x103]
push 0
push eax
call fcn.0043a490
mov eax, pe_nt_image_headers32
add esp, 0x10
cmp ebx, eax
ja 0x428ad7
push eax
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp eax, ebx
jne 0x428ad7
push esi
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x428adf
push esi
push edi
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004387e7
mov esp, ebp
pop ebp
ret 8
call fcn.004155f7
int3
Function at 0x43241a
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x230
mov eax, 0x453acd
call fcn.0043a9fd
mov edi, ecx
xor ebx, ebx
mov dword [ebp - 0x230], ebx
call fcn.0041d6a6
push ebx
mov ecx, dword [eax + 4]
call fcn.004221f8
mov esi, eax
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x23c], esi
mov dword [ebp - 0x234], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov dword [ebp - 0x224], ebx
mov eax, dword [edi]
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, edi
mov byte [ebp - 4], 1
call dword [eax + 0x20]
push 0x2001f
lea ecx, [ebp - 0x22c]
push dword [eax]
push esi
call fcn.00414240
mov ecx, dword [ebp - 0x21c]
mov ebx, eax
neg ebx
sbb bl, bl
lea ecx, [ecx - 0x10]
call fcn.00402a90
inc bl
je 0x4325c8
xor ebx, ebx
lea eax, [ebp - 0x113]
push 0x103
push ebx
push eax
mov esi, ebx
mov byte [ebp - 0x114], bl
call fcn.0043a490
add esp, 0xc
mov dword [ebp - 0x21c], 0x104
lea eax, [ebp - 0x21c]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x114]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
jmp 0x432584
push 0x103
lea eax, [ebp - 0x217]
mov dword [ebp - 0x21c], 0x104
push 0
push eax
inc esi
mov byte [ebp - 0x218], 0
call fcn.0043a490
add esp, 0xc
mov dword [ebp - 0x220], 0x104
lea eax, [ebp - 0x220]
lea ecx, [ebp - 0x22c]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
call fcn.00414150
test eax, eax
jne 0x43256f
lea eax, [ebp - 0x114]
push eax
lea ecx, [edi + 4]
call fcn.00431459
lea ecx, [ebp - 0x218]
push ecx
mov ecx, eax
call fcn.004025b0
mov dword [ebp - 0x230], 1
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x114]
push eax
push esi
push dword [ebp - 0x22c]
call ebx
test eax, eax
je 0x4324f2
lea ecx, [ebp - 0x22c]
call fcn.00414310
mov eax, dword [edi]
lea ecx, [ebp - 0x220]
push ecx
mov ecx, edi
call dword [eax + 0x20]
lea ecx, [ebp - 0x23c]
push dword [eax]
call fcn.00431a1f
mov ecx, dword [ebp - 0x220]
add ecx, 0xfffffff0
call fcn.00402a90
lea ecx, [ebp - 0x22c]
call fcn.00414310
lea ecx, [ebp - 0x23c]
call fcn.00414310
mov eax, dword [ebp - 0x230]
call fcn.0043a9ac
ret

Function at 0x434b01
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
test esi, esi
je 0x434b4f
push esi
mov ebx, 0x811c9dc5
xor edi, edi
call fcn.0043a520
xor edx, edx
mov dword [ebp + 8], 0xa
pop ecx
mov ecx, eax
div dword [ebp + 8]
inc eax
test ecx, ecx
je 0x434b44
mov edx, ecx
movsx ecx, byte [edi + esi]
add edi, eax
imul ebx, ebx, 0x1000193
xor ebx, ecx
cmp edi, edx
jb 0x434b32
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.004155f7
int3
Function at 0x4354f5
Capabilities:
Get disk information

Disassembly:
push 0x158
mov eax, 0x453da9
call fcn.0043a9fd
mov esi, dword [ebp + 8]
xor eax, eax
mov ebx, dword [ebp + 0xc]
test esi, esi
mov edi, dword [ebp + 0x10]
setne al
mov dword [ebp - 0x158], esi
test eax, eax
jne 0x435523
call fcn.004155f7
xor eax, eax
test ebx, ebx
setne al
test eax, eax
je 0x43551e
lea eax, [ebp - 0x154]
push eax
push esi
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
test eax, eax
jne 0x43556b
push 0xffffffffffffffff
push ebx
push 0x104
push esi
call fcn.00439788
push eax
call fcn.00402180
add esp, 0x14
push ebx
push edi
call fcn.004354c8
xor eax, eax
jmp 0x43568c
cmp eax, 0x104
jb 0x435588
test edi, edi
je 0x435564
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.004025b0
jmp 0x435564
call fcn.00414dfd
push eax
lea ecx, [ebp - 0x15c]
call fcn.00402a60
and dword [ebp - 4], 0
lea eax, [ebp - 0x15c]
push eax
push esi
call fcn.00434ebe
mov esi, dword [ebp - 0x15c]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsUNCA]
test eax, eax
jne 0x435681
xor ecx, ecx
lea eax, [ebp - 0x160]
push ecx
push ecx
push eax
lea eax, [ebp - 0x164]
push eax
push ecx
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
jne 0x4355f3
push ebx
push edi
call fcn.004354c8
lea ecx, [esi - 0x10]
call fcn.00402a90
jmp 0x435564
mov eax, dword [ebp - 0x160]
test al, 2
jne 0x43560f
push dword [ebp - 0x158]
call dword [sym.imp.USER32.dll_CharUpperA]
mov eax, dword [ebp - 0x160]
test al, 4
jne 0x435681
lea eax, [ebp - 0x150]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x435681
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x154]
test eax, eax
je 0x4355df
cmp eax, dword [ebp - 0x158]
jbe 0x4355df
lea eax, [ebp - 0x124]
push eax
call fcn.0043a520
mov edx, dword [ebp - 0x154]
sub edx, dword [ebp - 0x158]
pop ecx
add eax, edx
mov ecx, 0x104
cmp eax, ecx
jge 0x435694
lea eax, [ebp - 0x124]
sub ecx, edx
push eax
push ecx
push dword [ebp - 0x154]
call fcn.0043a28a
push eax
call fcn.00402180
add esp, 0x10
lea ecx, [esi - 0x10]
call fcn.00402a90
xor eax, eax
inc eax
call fcn.0043a9ac
ret 0xc
test edi, edi
je 0x4355e6
push ebx
lea ecx, [edi + 0x10]
mov dword [edi + 8], 3
call fcn.004025b0
jmp 0x4355e6
Function at 0x44ad7e
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x46e560]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004432f4
mov dword [ebp - 0x14], eax
cmp dword [0x4740b8], esi
jne 0x44ae71
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x44adfe
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x44af51
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x44af51
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44af51
push eax
call ebx
push 0x45bce4
push edi
mov dword [0x4740b8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x45bcf4
push edi
mov dword [0x4740bc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4740c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4740c8], eax
test eax, eax
je 0x44ae6e
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4740c4], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x44ae96
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x44ae89
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x44aeab
push 4
pop eax
jmp 0x44af53
cmp dword [ebp - 0x14], esi
je 0x44aeab
push dword [0x4740b8]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x44ae90
mov eax, dword [0x4740c4]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x44af09
cmp dword [0x4740c8], edi
je 0x44af09
push eax
call ebx
push dword [0x4740c8]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x44af09
test eax, eax
je 0x44af09
call ecx
test eax, eax
je 0x44aefe
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x44aefe
test byte [ebp - 8], 1
jne 0x44af09
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x44af39
mov eax, dword [0x4740bc]
cmp eax, edi
je 0x44af36
push eax
call ebx
test eax, eax
je 0x44af36
call eax
mov esi, eax
test esi, esi
je 0x44af36
mov eax, dword [0x4740c0]
cmp eax, edi
je 0x44af36
push eax
call ebx
test eax, eax
je 0x44af36
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4740b8]
call ebx
test eax, eax
je 0x44af51
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x44af53
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004387e7
mov esp, ebp
pop ebp
ret