joyce8/EMBER2024-capa huggingface dataset:
Function at 0x440f68
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x440f7f
add esp, 0xfffffff0
call fcn.00403080
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.004124e4
mov byte [ebx + 0x28], 0
mov dl, 1
mov eax, dword [0x40c510]
call fcn.00402d64
mov dword [ebx + 0x78], eax
mov dl, 1
mov eax, dword [0x40c510]
call fcn.00402d64
mov dword [ebx + 0x90], eax
xor eax, eax
mov dword [ebx + 0x48], eax
xor eax, eax
mov dword [ebx + 0x6c], eax
mov dword [ebx + 0x44], 0x80000018
mov dword [ebx + 0x60], 0x1f4
mov byte [ebx + 0x64], 1
xor eax, eax
mov dword [ebx + 0x68], eax
mov dword [ebx + 0x5c], 0x9c4
mov byte [ebx + 0x70], 0
mov byte [ebx + 0x85], 1
mov dl, 1
mov eax, dword [0x414270]
call fcn.0041b348
mov esi, eax
mov dword [ebx + 0x80], esi
push 0x4410f0
mov eax, dword [0x44ed44]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0041b6ec
mov eax, dword [ebx + 0x80]
mov dword [eax + 8], ebx
mov dword [eax + 4], 0x4428a0
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x44ed44]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_2
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040a09c
test eax, eax
je 0x44106f
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004082d8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040a0c4
test eax, eax
je 0x441083
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x74]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00403b60
mov eax, dword [0x44ec28]
cmp byte [eax], 0
jne 0x4410b4
mov eax, ebx
call fcn.004411dc
mov byte [ebx + 0x41], 1
mov byte [ebx + 0x42], 1
mov byte [ebx + 0x43], 1
mov byte [ebx + 0x86], 1
xor eax, eax
mov dword [ebx + 0x88], eax
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x4410e6
call fcn.004030d8
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x441438
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x44f7a8]
cmp dword [eax + 0x24], 0
je 0x4414c8
cmp dword [ebx + 0x7c], 0
jne 0x4414c5
mov eax, dword [ebx + 0x24]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4413cc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x78]
cmp dword [eax + 8], 0
je 0x4414c5
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x441494
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x78]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4414c5
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x78]
call fcn.0040db34
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4414a0
inc dword [ebx + 0x7c]
pop ecx
pop edx
pop esi
pop ebx
ret
Function at 0x441e18
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0x8c], 0
je 0x441e4d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x24]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00403a18
jmp 0x441e57
mov eax, esi
mov edx, dword [ebx + 0x74]
call fcn.004039cc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x442bd0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x6c]
test esi, esi
je 0x442c08
mov eax, esi
call fcn.0042c660
test al, al
je 0x442c08
mov eax, dword [ebx + 0x6c]
call fcn.0042c238
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x442c08
push 0
mov eax, dword [ebx + 0x6c]
call fcn.0042c238
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x445d30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
mov eax, ebx
call fcn.00403d74
push eax
call sub.kernel32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x445d49
test al, 0x10
jne 0x445d4d
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret

Function at 0x446ba4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x446c35
push dword fs:[eax]
mov dword fs:[eax], esp
mov al, byte [ebp + 8]
call fcn.004468e8
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00403d74
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x446c1f
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x44ee20]
call fcn.004053f8
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4467a0]
call fcn.00409698
call fcn.0040342c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446c3c
lea eax, [ebp - 0x10]
call fcn.00403934
ret
Function at 0x446c48
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x446ce3
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00403d74
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x446cbd
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
lea edx, [ebp - 0x10]
mov eax, dword [0x44efd4]
call fcn.004053f8
mov ecx, dword [ebp - 0x10]
mov dl, 1
mov eax, dword [0x4467a0]
call fcn.00409698
call fcn.0040342c
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00446918
mov edx, dword [ebp + 8]
mov byte [edx], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x446cea
lea eax, [ebp - 0x10]
call fcn.00403934
ret

Function at 0x4486b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeb0
push ebx
push esi
push edi
mov edi, edx
push 0x190
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
test ebx, ebx
jne 0x4486e2
mov dl, 1
mov eax, dword [0x447aa0]
call fcn.00447b00
call fcn.0040342c
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov esi, eax
test esi, esi
jne 0x448701
mov dl, 1
mov eax, dword [0x447b58]
call fcn.00447bbc
call fcn.0040342c
push ebx
push 0
call sub.kernel32.dll_LoadResource
test eax, eax
jne 0x44871e
mov dl, 1
mov eax, dword [0x447b58]
call fcn.00447bbc
call fcn.0040342c
push eax
call sub.kernel32.dll_LockResource
mov ebx, eax
test ebx, ebx
jne 0x44873b
mov dl, 1
mov eax, dword [0x447c18]
call fcn.00447c7c
call fcn.0040342c
mov edx, edi
lea eax, [ebp - 0x150]
call fcn.0040573a
mov edx, 1
lea eax, [ebp - 0x150]
call fcn.00405a48
xor eax, eax
push ebp
push 0x4487a8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov edx, ebx
mov ecx, esi
lea eax, [ebp - 0x150]
call fcn.00405840
cmp esi, dword [ebp - 4]
je 0x44878f
mov dl, 1
mov eax, dword [0x446fac]
call fcn.00447008
call fcn.0040342c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4487af
lea eax, [ebp - 0x150]
call fcn.004058a4
ret

Function at 0x448cd8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
mov eax, edi
mov edx, ebx
call fcn.004039cc
mov eax, dword [0x44ef7c]
mov dword [eax], esi
mov eax, ebx
call fcn.00403bb0
mov esi, eax
test esi, esi
jle 0x448d27
mov ebx, 1
mov eax, 0xff
call fcn.00402ab4
mov edx, dword [edi]
movzx edx, byte [edx + ebx - 1]
xor eax, edx
push eax
mov eax, edi
call fcn.00403d80
pop edx
mov byte [eax + ebx - 1], dl
inc ebx
dec esi
jne 0x448d03
pop edi
pop esi
pop ebx
ret
Function at 0x449280
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x449335
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
mov edx, 0x104
call fcn.00403e84
push 0
push 0
call sub.kernel32.dll_GetTempPathA
mov esi, eax
lea eax, [esi + 1]
call fcn.004026b4
mov ebx, eax
push ebx
push esi
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 0xc]
call fcn.00403d74
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403d74
push eax
mov eax, edi
call fcn.00403d74
push eax
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 0xc]
call fcn.00403d74
call fcn.00408270
mov edx, eax
lea eax, [ebp - 0xc]
call fcn.00403e84
mov eax, ebx
call fcn.004026cc
mov eax, dword [ebp - 0xc]
call fcn.00408058
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
call fcn.00408124
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44933c
lea eax, [ebp - 0xc]
call fcn.00403934
ret

Function at 0x449344
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44940a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, 0x104
call fcn.00403e84
push 0
push 0
call sub.kernel32.dll_GetTempPathA
mov esi, eax
lea eax, [esi + 1]
call fcn.004026b4
mov ebx, eax
push ebx
push esi
call sub.kernel32.dll_GetTempPathA
mov eax, dword [ebp - 8]
call fcn.00403d74
push eax
push 0
mov eax, edi
call fcn.00403d74
push eax
push ebx
call sub.kernel32.dll_GetTempFileNameA
mov eax, dword [ebp - 8]
call fcn.00403d74
call fcn.00408270
mov edx, eax
lea eax, [ebp - 8]
call fcn.00403e84
mov eax, ebx
call fcn.004026cc
mov eax, dword [ebp - 8]
call fcn.00408058
mov eax, dword [ebp - 8]
call fcn.00408254
test al, al
je 0x449372
push 6
mov eax, dword [ebp - 8]
call fcn.00403d74
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.004039cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x449411
lea eax, [ebp - 8]
call fcn.00403934
ret
Function at 0x44951c
Capabilities:
Timestomp file

Disassembly:
push ebx
add esp, 0xffffffd0
mov edx, 0x40
call fcn.00407f88
mov ebx, eax
lea eax, [esp + 0x10]
xor ecx, ecx
mov edx, 0x10
call fcn.00402a94
mov eax, 0x64
call fcn.00402ab4
mov dword [esp + 0x20], eax
fild dword [esp + 0x20]
fstp xword [esp + 0x24]
wait
call fcn.00408e80
fld xword [esp + 0x24]
fsubp st(1)
fadd dword [0x4495c4]
fstp qword [esp]
wait
push dword [esp + 4]
push dword [esp + 4]
lea ecx, [esp + 0x1e]
lea edx, [esp + 0x1a]
lea eax, [esp + 0x18]
call fcn.00408d34
push dword [esp + 4]
push dword [esp + 4]
call fcn.00408e58
dec eax
mov word [esp + 0x14], ax
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x14]
push eax
call sub.kernel32.dll_SystemTimeToFileTime
lea eax, [esp + 8]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x10]
push eax
push ebx
call sub.kernel32.dll_SetFileTime
mov eax, ebx
call fcn.00408050
add esp, 0x30
pop ebx
ret
Function at 0x449f8c
Capabilities:
Check for foreground window switch

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 0xb
push 0
push 0
dec ecx
jne 0x449f95
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x1c]
push ecx
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop ecx
mov ebx, ecx
lea eax, [ebp - 0x1c]
call fcn.00404ddc
xor eax, eax
push ebp
push 0x44a187
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x40c810]
call fcn.00402d64
mov dword [ebp - 0xc], eax
xor edx, edx
push ebp
push 0x44a15f
push dword fs:[edx]
mov dword fs:[edx], esp
push 0
push 0
push 0xffffffffffffffff
push ebx
push 0x44a198
push 0x44a1cc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00404604
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x2c]
push eax
call fcn.00404604
add esp, 0x1c
push 0x44a1e0
push 0x44a1e8
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00404604
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x3c]
push eax
call fcn.00404604
add esp, 0xc
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00449d2c
test al, al
jne 0x44a079
call fcn.00449f70
push eax
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00449d2c
xor al, 1
mov byte [ebp - 5], al
jmp 0x44a134
mov byte [ebp - 5], 0
jmp 0x44a134
mov eax, dword [0x44ee7c]
mov eax, dword [eax]
call fcn.004420f8
push 0x32
call sub.kernel32.dll_Sleep
call sub.user32.dll_GetForegroundWindow
mov ebx, eax
cmp byte [ebp + 8], 0
jne 0x44a0bb
cmp ebx, dword [ebp - 4]
je 0x44a0b2
mov eax, ebx
call fcn.00449d2c
test al, al
je 0x44a0b6
xor eax, eax
jmp 0x44a0b8
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
jne 0x44a134
xor edx, edx
push ebp
push 0x44a103
push dword fs:[edx]
mov dword fs:[edx], esp
push 0x44a200
push 0x44a20c
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x5c]
push eax
call fcn.00404604
add esp, 0xc
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
call fcn.00404604
add esp, 0xc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x44a134
cmp byte [ebp - 5], 0
je 0x44a082
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x1c]
call 0x449db0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a166
mov eax, dword [ebp - 0xc]
call fcn.00402d94
ret
Function at 0x44a228
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov esi, eax
lea edi, [ebp - 0x28]
push ecx
mov ecx, 4
rep movsd dword es:[edi], dword [esi]
pop ecx
mov dword [ebp - 4], ecx
mov ebx, edx
lea eax, [ebp - 0x28]
call fcn.00404ddc
mov eax, dword [ebp - 4]
call fcn.00403d64
lea eax, [ebp - 0x68]
mov edx, dword [0x448328]
call fcn.004040b8
xor eax, eax
push ebp
push 0x44a468
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
call fcn.00406348
mov edx, dword [ebp - 8]
mov dword [eax + 0x10], edx
call fcn.00406348
mov byte [eax + 0x14], 0
mov dl, 1
mov eax, dword [0x40c510]
call fcn.00402d64
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x44a3f8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0
mov al, byte [ebp + 8]
push eax
lea ecx, [ebp - 0x68]
lea edx, [ebp - 4]
mov eax, ebx
call fcn.004495c8
xor eax, eax
push ebp
push 0x44a3df
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x60]
dec edx
mov eax, dword [ebp - 0xc]
call fcn.0040db34
mov ebx, eax
push dword [ebp - 4]
push 0x44a484
push dword [ebx + 8]
lea eax, [ebp - 0x10]
mov edx, 3
call fcn.00403c70
push dword [ebp - 4]
push 0x44a484
lea eax, [ebp - 0x70]
call fcn.004482c4
mov edx, dword [ebp - 0x70]
lea ecx, [ebp - 0x6c]
mov eax, dword [ebp - 4]
call fcn.00449280
push dword [ebp - 0x6c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00403c70
mov edx, dword [ebp - 0x14]
mov eax, 0x191
call fcn.004486b0
push 6
mov eax, dword [ebp - 0x14]
call fcn.00403d74
push eax
call sub.kernel32.dll_SetFileAttributesA
xor eax, eax
push ebp
push 0x44a3ad
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x28]
call fcn.00449b58
mov al, byte [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x28]
call fcn.00449f8c
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x28]
call fcn.00449b58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44a3b4
mov eax, dword [ebp - 0x14]
call fcn.00408058
ret
Function at 0x44be80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 8], ecx
mov esi, edx
xor edx, edx
push ebp
push 0x44befb
push dword fs:[edx]
mov dword fs:[edx], esp
lea edx, [ebp - 4]
push edx
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov eax, 0x104
call fcn.004026b4
mov ebx, eax
push ebx
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
mov eax, esi
mov edx, ebx
call fcn.00403ae8
mov eax, ebx
call fcn.004026cc
lea eax, [ebp - 8]
push eax
call sub.shell32.dll_SHGetMalloc
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [eax]
call dword [eax + 0x14]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44bf02
lea eax, [ebp - 8]
call fcn.00405450
ret
Function at 0x44c684
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 4], edx
mov dword [ebp - 8], edx
mov edi, eax
xor eax, eax
push ebp
push 0x44c858
push dword fs:[eax]
mov dword fs:[eax], esp
mov ebx, dword [edi + 4]
mov eax, ebx
mov edx, dword [0x43860c]
call fcn.00402f0c
test al, al
je 0x44c6c5
mov eax, ebx
call fcn.0042c238
mov dword [ebp - 0x26], eax
jmp 0x44c6d2
mov eax, dword [0x44ee7c]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x26], eax
xor eax, eax
mov al, byte [edi + 0x1f1]
mov eax, dword [eax*4 + 0x44ebfc]
mov dword [ebp - 0x22], eax
mov edx, dword [edi + 0x1f4]
lea eax, [ebp - 4]
mov ecx, 0x44c870
call fcn.00403bfc
mov eax, dword [ebp - 4]
call fcn.00403bb0
mov esi, eax
test esi, esi
jle 0x44c725
mov ebx, 1
mov eax, dword [ebp - 4]
cmp byte [eax + ebx - 1], 0x3b
jne 0x44c721
lea eax, [ebp - 4]
call fcn.00403d80
mov byte [eax + ebx - 1], 0
inc ebx
dec esi
jne 0x44c70a
mov eax, dword [ebp - 4]
call fcn.00403d74
mov dword [ebp - 0x1e], eax
mov edx, dword [edi + 0x1f8]
lea eax, [ebp - 8]
mov ecx, 0x44c870
call fcn.00403bfc
mov eax, dword [ebp - 8]
call fcn.00403bb0
mov esi, eax
test esi, esi
jle 0x44c771
mov ebx, 1
mov eax, dword [ebp - 8]
cmp byte [eax + ebx - 1], 0x3b
jne 0x44c76d
lea eax, [ebp - 8]
call fcn.00403d80
mov byte [eax + ebx - 1], 0
inc ebx
dec esi
jne 0x44c756
mov eax, dword [ebp - 8]
call fcn.00403d74
mov dword [ebp - 0x1a], eax
mov word [ebp - 0x16], 0
test byte [edi + 0x1fc], 1
je 0x44c790
or word [ebp - 0x16], 0x40
test byte [edi + 0x1fc], 2
je 0x44c79e
or word [ebp - 0x16], 2
test byte [edi + 0x1fc], 4
je 0x44c7ad
or word [ebp - 0x16], 0x80
test byte [edi + 0x1fc], 8
je 0x44c7bb
or word [ebp - 0x16], 1
test byte [edi + 0x1fc], 0x10
je 0x44c7c9
or word [ebp - 0x16], 0x10
test byte [edi + 0x1fc], 0x20
je 0x44c7d8
or word [ebp - 0x16], 0x200
test byte [edi + 0x1fc], 0x40
je 0x44c7e6
or word [ebp - 0x16], 8
test byte [edi + 0x1fc], 0x80
je 0x44c7f4
or word [ebp - 0x16], 4
test byte [edi + 0x1fd], 1
je 0x44c803
or word [ebp - 0x16], 0x100
test byte [edi + 0x1fd], 2
je 0x44c812
or word [ebp - 0x16], 0x400
mov eax, dword [edi + 0x200]
call fcn.00403d74
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x26]
push eax
call sub.shell32.dll_SHFileOperationA
mov ebx, eax
xor bl, 1
mov eax, dword [ebp - 0x14]
neg eax
sbb eax, eax
neg eax
mov byte [edi + 0x1fe], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44c85f
lea eax, [ebp - 8]
mov edx, 2
call fcn.00403958
ret
Function at 0x40333c
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x410aa0
call fcn.00406024
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x40323d
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x40323d
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x40323d
cmp dword [eax + 0x400074], 0xe
jbe 0x40323d
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x403241
and dword [ebp - 0x1c], 0
push 1
call main
pop ecx
test eax, eax
jne 0x403255
push 0x1c
call main
pop ecx
call fcn.00407199
test eax, eax
jne 0x403266
push 0x10
call main
pop ecx
call fcn.00406d3d
and dword [ebp - 4], 0
call fcn.00403bed
test eax, eax
jge 0x403280
push 0x1b
call main
pop ecx
call sub.kernel32.dll_GetCommandLineW
mov dword [0x413d00], eax
call fcn.00406ce0
mov dword [0x412ff8], eax
call main
test eax, eax
jge 0x4032a5
push 8
call main
pop ecx
call fcn.00406a03
test eax, eax
jge 0x4032b6
push 9
call main
pop ecx
push 1
call main
pop ecx
test eax, eax
je 0x4032c9
push eax
call main
pop ecx
mov eax, dword [0x413340]
mov dword [0x413344], eax
push eax
push dword [0x413334]
push dword [0x41332c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4032f7
push eax
call main
call fcn.0040428b
jmp 0x40332c
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.00406069
ret
call main
jmp 0x4031eb

Function at 0x4066be
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4066cd
pop dword [ebp - 0x20]
mov eax, 0x25f2aa83
add eax, 0xda4dbc4a
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x37076
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x718b949
add ecx, 0xf8e7857e
xor edx, edx
add edx, eax
mov esi, 0x417800
add esi, dword [ebp - 0x20]
mov ebx, 0xcd27cce3
add ebx, 0x7f10c483
mov dword [ebp - 0x18], 0x2ed75806
mov edi, dword [esi]
sub dword [ebp - 0x18], 0xdbd820c9
sub edi, ebx
sub dword [ebp - 0x18], ecx
mov dword [edx], edi
xor dword [ebp - 0x1c], 0x77f0fc56
add edx, 0xfa348ca3
sub edx, 0xfa348c9f
add esi, 0xad0423dd
sub esi, 0xad0423d9
loop 0x406723
add eax, 0x1b6328fb
add eax, 0xe49dc4f4
xor ebx, ebx
add ebx, eax
add eax, 0x436b469
sub eax, 0x436b464
mov ecx, 0x773e7051
sub ecx, 0x76fe7051
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x430004
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408eac
nop
mov ecx, 0x1270221a
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x1ec27fa9
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret