joyce8/EMBER2024-capa huggingface dataset:
Function at 0x434f90
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1480
call fcn.0045d5a0
mov eax, dword [0x481a58]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x818]
push eax
call fcn.00459040
add esp, 8
mov ecx, dword [ebp + 0x10]
imul ecx, ecx, 0x401
add ecx, 0x48058a
push ecx
lea edx, [ebp - 0x410]
push edx
call fcn.0045ad80
add esp, 8
push 0x20
mov eax, dword [ebp + 8]
push eax
call fcn.0045b9f0
add esp, 8
test eax, eax
jne 0x435023
push 0x20
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0045b9f0
add esp, 8
test eax, eax
jne 0x435023
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x410]
push ecx
push str._s__s__s
lea edx, [ebp - 0x1480]
push edx
call fcn.0045b942
add esp, 0x14
jmp 0x435046
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x410]
push edx
push str._s___s____s_
lea eax, [ebp - 0x1480]
push eax
call fcn.0045b942
add esp, 0x14
lea ecx, [ebp - 0x1480]
push ecx
push str.FindExecutable____s
call fcn.00456e80
add esp, 8
push 0x44
push 0
lea edx, [ebp - 0x860]
push edx
call fcn.0045b070
add esp, 0xc
mov dword [ebp - 0x860], 0x44
mov eax, 5
mov word [ebp - 0x830], ax
lea ecx, [ebp - 0x818]
push ecx
push 0x400
call fcn.004386a0
add esp, 8
test eax, eax
jbe 0x43512e
push 0x400
lea edx, [ebp - 0xc68]
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jbe 0x43512e
lea eax, [ebp - 0xc68]
push eax
call fcn.00438720
add esp, 4
test eax, eax
je 0x43512e
lea ecx, [ebp - 0xc78]
push ecx
lea edx, [ebp - 0x860]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x1480]
push eax
push 0
call fcn.00439860
add esp, 0x28
test eax, eax
jne 0x43511f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str..__ERROR_d_
call fcn.00456c30
add esp, 8
lea ecx, [ebp - 0x1480]
push ecx
push str.___s
call fcn.00456c30
add esp, 8
lea edx, [ebp - 0x818]
push edx
call fcn.00438720
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045a968
mov esp, ebp
pop ebp
ret
Function at 0x4357f0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
push 0x48bf98
call fcn.00436ca0
add esp, 0x1c
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x43594d
push 0
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.0045b1c7
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x435943
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x435937
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call fcn.0044ebf0
add esp, 0xc
mov dword [ebp - 8], 0
jmp 0x435897
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 5
jge 0x4358b6
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + ecx*4 - 0x28]
push edx
call fcn.0045ef46
add esp, 4
mov ecx, dword [ebp - 8]
mov dword [ebp + ecx*4 - 0x28], eax
jmp 0x43588e
push 0x14
push 0x490d40
lea edx, [ebp - 0x28]
push edx
call fcn.0045be6a
add esp, 0xc
test eax, eax
je 0x435909
push 0x14
push 0x4770e0
lea eax, [ebp - 0x28]
push eax
call fcn.0045be6a
add esp, 0xc
test eax, eax
je 0x435909
push 0
push 0x43ce40
call fcn.00431b60
push eax
push 0xc0
call fcn.00431b80
push eax
call fcn.0043a6f0
add esp, 0x14
cmp eax, 1
jne 0x435937
push 0x14
lea ecx, [ebp - 0x28]
push ecx
push 0x490d40
call fcn.0045a980
add esp, 0xc
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00454770
add esp, 8
test eax, eax
je 0x435937
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 4]
push ecx
call fcn.0045b0ea
add esp, 4
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x437030
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
shl eax, 2
push eax
call fcn.00435e10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
shl edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00435cd0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00435b40
add esp, 8
mov dword [ebp - 8], eax
xor edx, edx
jne 0x437044
mov eax, dword [ebp - 4]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x4386a0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
shl eax, 2
push eax
call fcn.00435e10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
shl edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00435a30
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00435b40
add esp, 8
mov dword [ebp - 8], eax
xor edx, edx
jne 0x4386b4
mov eax, dword [ebp - 4]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x438720
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [ebp - 8], eax
xor edx, edx
jne 0x438734
mov eax, dword [ebp - 4]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x438770
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
shl eax, 2
push eax
call fcn.00435e10
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
shl edx, 2
push edx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call fcn.00435a30
add esp, 0x10
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00435b40
add esp, 8
mov dword [ebp - 8], eax
xor edx, edx
jne 0x438784
mov eax, dword [ebp - 4]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4387f0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 8], eax
xor edx, edx
jne 0x438804
mov eax, dword [ebp - 4]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x4389b0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 8], eax
xor eax, eax
jne 0x4389c4
mov ecx, dword [ebp - 4]
push ecx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x438a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 8], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 0x10], eax
push 0
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x438b20
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
cmp dword [ebp - 0x18], 0
jbe 0x438afd
cmp dword [ebp - 0x18], 2
jbe 0x438a6d
cmp dword [ebp - 0x18], 7
je 0x438a6d
jmp 0x438afd
cmp dword [ebp + 0x1c], 0
je 0x438afb
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
shl eax, 2
push eax
call fcn.00435e10
add esp, 4
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x1c]
mov edx, dword [ecx]
shl edx, 2
mov dword [ebp - 4], edx
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0x18], 0
je 0x438ae0
mov eax, dword [ebp - 4]
shr eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 0x1c]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call fcn.00435a30
add esp, 0x10
mov edx, dword [ebp + 0x1c]
mov dword [edx], eax
jmp 0x438afb
mov eax, dword [ebp - 4]
shr eax, 1
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
call fcn.00435a30
add esp, 0x10
mov edx, dword [ebp + 0x1c]
mov dword [edx], eax
jmp 0x438b1e
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
jmp 0x438b41
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0x14], eax
xor eax, eax
jne 0x438a1b
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.00436960
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret
Function at 0x438b70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
mov dword [ebp - 0x14], ecx
cmp dword [ebp - 0x14], 0
jbe 0x438c08
cmp dword [ebp - 0x14], 2
jbe 0x438bb6
cmp dword [ebp - 0x14], 7
je 0x438bb6
jmp 0x438c08
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
push 0
push 0
call fcn.004359d0
add esp, 0x10
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.00435e10
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x1c]
push edx
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.004359d0
add esp, 0x10
mov eax, dword [ebp - 4]
shl eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 8]
mov dword [ebp + 0x18], ecx
mov edx, dword [ebp - 4]
mov dword [ebp + 0x1c], edx
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x10], eax
xor eax, eax
jne 0x438b8b
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.00436960
add esp, 4
mov edx, dword [ebp - 8]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x439b40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 0xc]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 0xc], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0x10]
push ecx
call fcn.00435e70
add esp, 8
mov dword [ebp - 8], eax
push 0xffffffffffffffff
mov edx, dword [ebp + 0x14]
push edx
call fcn.00435e70
add esp, 8
mov dword [ebp - 0x14], eax
push 0xffffffffffffffff
mov eax, dword [ebp + 0x18]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x1c]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
xor ecx, ecx
jne 0x439b69
mov edx, dword [ebp - 0xc]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00436960
add esp, 4
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.00436960
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret
Function at 0x439c10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 0x50], 0
mov dword [ebp - 0x48], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x54], 0
mov dword [ebp - 4], 0
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x44], 0x3c
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
mov dword [ebp - 0x40], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov dword [ebp - 0x3c], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0xc]
push edx
call fcn.00435e70
add esp, 8
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x38], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x10]
push edx
call fcn.00435e70
add esp, 8
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x14]
push edx
call fcn.00435e70
add esp, 8
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x30], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x18]
push edx
call fcn.00435e70
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x1c]
mov dword [ebp - 0x28], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x20]
mov dword [ebp - 0x24], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x24]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
and edx, 1
je 0x439d01
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x28]
push ecx
call fcn.00435e70
add esp, 8
mov dword [ebp - 0x4c], eax
mov edx, dword [ebp - 0x4c]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x2c]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x30]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x34]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x38]
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x44]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
mov dword [eax + 0x20], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0xc]
mov dword [edx + 0x38], eax
xor ecx, ecx
jne 0x439c40
mov edx, dword [ebp - 0x48]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
push eax
call fcn.00436960
add esp, 4
mov ecx, dword [ebp - 0x54]
push ecx
call fcn.00436960
add esp, 4
mov edx, dword [ebp - 4]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0x4c]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0x50]
mov esp, ebp
pop ebp
ret
Function at 0x439fe0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c4
mov eax, dword [0x481a58]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c4], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
call fcn.00435f80
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
lea eax, [ebp - 0x2c0]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [ebp - 0x2c4], eax
cmp dword [ebp - 0x2c4], 0
je 0x43a09b
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x2c0]
mov dword [eax], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x2bc]
mov dword [edx + 4], eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x2b8]
mov dword [ecx + 8], edx
push 0xffffffffffffffff
lea eax, [ebp - 0x2b4]
push eax
push 0x104
mov ecx, dword [ebp + 0x10]
add ecx, 0xc
push ecx
call fcn.00435a30
add esp, 0x10
push 0xffffffffffffffff
lea edx, [ebp - 0xac]
push edx
push 0x50
mov eax, dword [ebp + 0x10]
add eax, 0x110
push eax
call fcn.00435a30
add esp, 0x10
xor ecx, ecx
jne 0x43a004
mov edx, dword [ebp - 4]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0x2c4]
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0045a968
mov esp, ebp
pop ebp
ret

Function at 0x43a870
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 8], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00435e70
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov dword [ebp - 0xc], eax
xor edx, edx
jne 0x43a88b
mov eax, dword [ebp - 8]
push eax
call fcn.00436960
add esp, 4
mov ecx, dword [ebp - 4]
push ecx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x43a8f0
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 8], eax
push 0xffffffffffffffff
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00435e70
add esp, 8
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov dword [ebp - 0xc], eax
xor ecx, ecx
jne 0x43a90b
mov edx, dword [ebp - 8]
push edx
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 4]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret
Function at 0x43a970
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
push 0xffffffffffffffff
mov eax, dword [ebp + 8]
push eax
call fcn.00435e70
add esp, 8
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 8], eax
xor edx, edx
jne 0x43a984
mov eax, dword [ebp - 4]
push eax
call fcn.00436960
add esp, 4
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x43ae50
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 0x14], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp + 8]
mov dword [edx], 0x67452301
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0xefcdab89
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], 0x98badcfe
mov edx, dword [ebp + 8]
mov dword [edx + 0xc], 0x10325476
pop ebp
ret
Function at 0x443d30
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x481a58]
xor eax, ebp
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0
mov byte [ebp - 0x18], 0xe9
mov byte [ebp - 0x17], 0
mov byte [ebp - 0x16], 0
mov byte [ebp - 0x15], 0
mov byte [ebp - 0x14], 0
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp + 8]
sub eax, 5
mov dword [ebp - 0xc], eax
push 4
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 0x17]
push edx
call fcn.0045a980
add esp, 0xc
cmp dword [ebp + 0x14], 0
je 0x443dc4
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x443dc2
push 5
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0045a980
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], 1
jmp 0x443e1f
cmp dword [ebp + 0x10], 0
je 0x443ddc
push 5
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp + 0x10]
push edx
call fcn.0045a980
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x40
push 5
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x443e1f
push 5
lea edx, [ebp - 0x18]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0045a980
add esp, 0xc
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 5
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045a968
mov esp, ebp
pop ebp
ret
Function at 0x444290
Capabilities:
Create new key via cryptacquirecontext
Hash data using sha1
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
push 0
push 1
push 0
push 0
lea eax, [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x4442cd
push 8
push 1
push 0
push 0
lea ecx, [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x44436e
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x8004
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x444362
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x444358
lea edx, [ebp - 4]
push edx
push 0x444270
push 4
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.imagehlp.dll_ImageGetDigestStream]
test eax, eax
je 0x44434e
mov dword [ebp - 0xc], 0x14
push 0
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 2
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x44434e
mov dword [ebp - 0x14], 1
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
push 0
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret