joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4328d9
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00432068

Function at 0x4328e4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004322af

Function at 0x4334c6
Capabilities:
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00433393
Function at 0x4026f4
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403648
test esi, esi
jne 0x40272a
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.KERNEL32.DLL_GetModuleFileNameA_1
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403738
jmp 0x402748
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402608
mov edi, eax
test esi, esi
je 0x402748
cmp dword [ebx], 0
je 0x402748
dec esi
jmp 0x402731
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402b68
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x407008], 0x8088405
inc edx
mov dword [ebx + 0x407008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x402dec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x407018]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402e84
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x402e64
xor eax, eax
push ebp
push 0x402e5d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ea0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402e64
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov ax, word [0x407018]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x407018], ax
mov esp, ebp
pop ebp
ret

Function at 0x4034cc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x408034], 0
je 0x40352d
cmp word [0x408208], 0xd7b2
jne 0x4034f5
cmp dword [0x408210], 0
jbe 0x4034f5
mov eax, 0x408204
call dword [0x408220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x407064
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403554
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x407024], 0
jne 0x403549
push 0
push 0x40705c
push 0x407064
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x4040d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x404136
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004037a8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402b84
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x404120
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40413d
lea eax, [ebp - 0x10]
call fcn.00403648
ret
Function at 0x404698
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 0xc]
xor ecx, ecx
push ebp
push 0x4046fe
push dword fs:[ecx]
mov dword fs:[ecx], esp
call fcn.0040466c
mov ebx, eax
lea eax, [ebp - 8]
mov edx, esi
call fcn.00403778
mov eax, dword [ebp - 8]
call fcn.004037c0
push eax
push esi
push 1
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegSetValueExA
push ebx
call sub.advapi32.dll_RegCloseKey
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404705
lea eax, [ebp - 8]
call fcn.00403648
ret

Function at 0x404a2c
Capabilities:
Create process on windows
Create process suspended
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor eax, eax
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x238], eax
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x230], eax
mov dword [ebp - 0x228], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x404c20
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 0x404c2c
mov edx, 0x404c38
mov eax, 0x80000001
call fcn.00404710
lea eax, [ebp - 0x228]
call fcn.00404e0c
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 4]
mov ecx, 0x404c80
call fcn.0040380c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402a34
lea eax, [ebp - 0x1d0]
call fcn.004027d0
call fcn.00402598
mov edx, 0x404c98
lea eax, [ebp - 0x1d0]
call fcn.00403b54
call fcn.00402d6c
call fcn.00402598
push 0x404ca8
lea edx, [ebp - 0x230]
xor eax, eax
call fcn.004026f4
push dword [ebp - 0x230]
push 0x404cb8
lea eax, [ebp - 0x22c]
mov edx, 3
call fcn.00403880
mov edx, dword [ebp - 0x22c]
lea eax, [ebp - 0x1d0]
call fcn.00403b54
call fcn.00402d6c
call fcn.00402598
push 0x404cc4
lea edx, [ebp - 0x238]
xor eax, eax
call fcn.004026f4
push dword [ebp - 0x238]
push 0x404cb8
push 0x404cd8
lea eax, [ebp - 0x234]
mov edx, 4
call fcn.00403880
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 0x1d0]
call fcn.00403b54
call fcn.00402d6c
call fcn.00402598
mov edx, 0x404cec
lea eax, [ebp - 0x1d0]
call fcn.00403b54
call fcn.00402d6c
call fcn.00402598
lea eax, [ebp - 0x1d0]
call fcn.00402af0
call fcn.00402598
lea eax, [ebp - 0x224]
xor ecx, ecx
mov edx, 0x44
call fcn.00402b48
mov dword [ebp - 0x1f8], 1
mov word [ebp - 0x1f4], 0
lea eax, [ebp - 0x1e0]
push eax
lea eax, [ebp - 0x224]
push eax
push 0
push 0
push 0x40
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004039c0
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x404bfa
mov eax, dword [ebp - 0x1dc]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x1e0]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c27
lea eax, [ebp - 0x238]
mov edx, 5
call fcn.0040366c
lea eax, [ebp - 4]
call fcn.00403648
ret
Function at 0x405a24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
mov dword [ebp - 4], ecx
mov esi, dword [ebp + 8]
mov dword [ebp - 8], 1
call fcn.00405a08
mov ebx, eax
mov dword [ebp - 0xc], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push 0
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x405a83
mov eax, esi
lea edx, [ebp - 0x10c]
mov ecx, pe_nt_image_headers32
call fcn.004037a8
push ebx
call sub.advapi32.dll_RegCloseKey
jmp 0x405a90
mov eax, esi
call fcn.00403648
push ebx
call sub.advapi32.dll_RegCloseKey
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405a98
Capabilities:
Terminate process

Disassembly:
push ebx
push eax
push 0xffffffffffffffff
push 0x1f0fff
call sub.KERNEL32.DLL_OpenProcess
mov ebx, eax
push 0
push ebx
call sub.KERNEL32.DLL_TerminateProcess
cmp eax, 1
sbb eax, eax
inc eax
pop ebx
ret
Function at 0x405bfc
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe98
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x168], eax
mov dword [ebp - 0x164], eax
mov dword [ebp - 0x160], eax
mov dword [ebp - 0x158], eax
mov dword [ebp - 0x15c], eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
mov dword [ebp - 0x14c], eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x405e3f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
push eax
mov ecx, 0x405e4c
mov edx, 0x405e5c
mov eax, 0x80000002
call fcn.00405a24
cmp dword [ebp - 8], 0
je 0x405e14
mov edx, dword [ebp - 8]
mov eax, 0x405eac
call fcn.00403aa8
test eax, eax
je 0x405c8e
lea edx, [ebp - 8]
mov ecx, 0x7fffffff
xchg edx, eax
call fcn.00403a60
lea edx, [ebp - 0x14c]
mov eax, dword [ebp - 8]
call fcn.004058d4
mov edx, dword [ebp - 0x14c]
lea eax, [ebp - 8]
call fcn.004036e0
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
mov ecx, 0x405eb8
mov edx, dword [ebp - 8]
call fcn.0040380c
mov eax, dword [ebp - 0x150]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_FindFirstFileA
mov esi, eax
lea eax, [ebp - 4]
call fcn.00403648
cmp esi, 0xffffffff
setne al
jmp 0x405e06
mov bl, byte [ebp - 0x11c]
cmp bl, 0x30
jb 0x405cfa
cmp bl, 0x39
jbe 0x405d28
lea eax, [ebp - 0x154]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004037a8
mov eax, dword [ebp - 0x154]
mov edx, 0x405ec8
call fcn.0040581c
test eax, eax
jne 0x405df3
push 0
push 0x80
push 3
push 0
push 0
push 0x40000000
lea eax, [ebp - 0x15c]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004037a8
mov ecx, dword [ebp - 0x15c]
lea eax, [ebp - 0x158]
mov edx, dword [ebp - 8]
call fcn.0040380c
mov eax, dword [ebp - 0x158]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_CreateFileA
cmp eax, 0xffffffff
jne 0x405ded
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004037a8
mov eax, dword [ebp - 0x160]
lea edx, [ebp - 4]
call fcn.00405854
mov eax, dword [ebp - 4]
call fcn.00405ab8
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.004037a8
mov eax, dword [ebp - 0x164]
mov edx, 0x405ec8
call fcn.0040581c
test eax, eax
jne 0x405df3
lea edx, [ebp - 0x168]
mov eax, 0x405ee4
call fcn.00405854
mov eax, dword [ebp - 0x168]
call fcn.00405ab8
jmp 0x405df3
push eax
call sub.KERNEL32.DLL_CloseHandle
lea eax, [ebp - 0x148]
push eax
push esi
call sub.KERNEL32.DLL_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x405cea
push esi
call sub.KERNEL32.DLL_FindClose
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405e46
lea eax, [ebp - 0x168]
mov edx, 8
call fcn.0040366c
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040366c
ret
Function at 0x405ef4
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
xor eax, eax
mov dword [ebp - 0x70], eax
mov dword [ebp - 0x6c], eax
lea edi, [ebp - 0x65]
xor eax, eax
push ebp
push 0x4060c9
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00405bfc
mov eax, 0x4060e0
call fcn.00405ab8
mov eax, 0x4060f4
call fcn.00405ab8
push 0x406100
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x405f4d
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
push 0x40611c
push 0
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x405f6b
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
push 0x40613c
push 0x406148
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x405f8c
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
push 0
push 0x406154
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x405faa
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
push 0x406164
push 0x406170
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x405fcb
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
push 0x40617c
push 0x406190
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x405fec
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
push 0x4061a0
push 0x406190
call sub.user32.dll_FindWindowA
mov ebx, eax
test ebx, ebx
je 0x40600d
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
xor ebx, ebx
call sub.user32.dll_GetDesktopWindow
mov esi, eax
push 0
push 0x4061b4
push ebx
push esi
call sub.user32.dll_FindWindowExA
mov ebx, eax
push 7
push edi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x6c]
mov edx, edi
mov ecx, 0x65
call fcn.004037a8
mov eax, dword [ebp - 0x6c]
mov edx, 0x4061c4
call fcn.0040390c
jne 0x406059
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
push 9
push edi
push ebx
call sub.user32.dll_GetWindowTextA
lea eax, [ebp - 0x70]
mov edx, edi
mov ecx, 0x65
call fcn.004037a8
mov eax, dword [ebp - 0x70]
mov edx, 0x4061d4
call fcn.0040390c
jne 0x40608c
push 0
push 0
push 0x12
push ebx
call sub.user32.dll_PostMessageA
test ebx, ebx
jne 0x406016
mov eax, 0x4061e8
call fcn.00405ab8
mov eax, 0x4061fc
call fcn.00405ab8
mov eax, 0x406210
call fcn.00405ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4060d0
lea eax, [ebp - 0x70]
mov edx, 2
call fcn.0040366c
ret
Function at 0x406318
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
call fcn.004039b0
mov eax, dword [ebp - 0x18]
call fcn.004039b0
mov eax, dword [ebp - 0x1c]
call fcn.004039b0
xor eax, eax
push ebp
push 0x40641c
push dword fs:[eax]
mov dword fs:[eax], esp
push ebp
mov eax, dword [ebp - 0x14]
call fcn.004039c0
push eax
mov eax, dword [ebp - 0x18]
call fcn.004039c0
mov edx, eax
mov eax, dword [0x408650]
pop ecx
call fcn.004062a0
pop ecx
test al, al
je 0x406401
mov eax, dword [ebp - 0x1c]
call fcn.00404cf4
test al, al
je 0x406392
mov eax, dword [ebp - 0x1c]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_DeleteFileA
xor eax, eax
push ebp
push 0x4063e6
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
mov eax, dword [ebp - 0x1c]
call fcn.004039c0
push eax
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
push 0
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4063f0
mov eax, dword [ebp - 0x10]
call fcn.004045b4
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406423
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040366c
ret
Function at 0x401491
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42e9b0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x401526
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014e3
cmp dword [ebp + 0x10], ebx
jne 0x40151a
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401491
test eax, eax
jne 0x4014f5
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014ca
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405880
cmp eax, ebx
je 0x40152d
push ebx
push dword [0x42e9b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x401526
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42e9b0], ebx
jne 0x401523
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x401523
jmp 0x401526
Function at 0x40540b
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x42ad38
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x42ad38], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405446
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4055e7
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, 0xffffffff
je 0x405607
and eax, 0xfffffffe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, esi
pop esi
ret 4

Function at 0x40560d
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x40563c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405680
test edi, edi
jne 0x405647
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x40567a

Function at 0x405684
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4056f5
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x400
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4056e4
cmp dword [ebp + 0x14], 1
je 0x4056e6
cmp dword [ebp + 0x14], 2
je 0x4056e6
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x4058f0
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004055e7
mov edi, eax
cmp edi, 0xffffffff
je 0x405931
test byte [esp + 0x10], 1
push esi
je 0x40591a
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
je 0x405922
xor eax, eax
inc eax
jmp 0x405933
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x405911
test byte [esp + 0x10], 4
jne 0x405931
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x40598c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42ad80
push esi
call fcn.0040579d
push esi
call fcn.00405518
mov edi, eax
test edi, edi
jne 0x4059ad
xor eax, eax
jmp 0x405a05
push edi
call fcn.004057bf
test byte [0x42e928], 0x80
je 0x4059c6
mov al, byte [edi]
test al, al
je 0x4059a9
cmp al, 0x5c
je 0x4059a9
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x4059e6
push esi
call fcn.00405859
test eax, eax
je 0x4059e0
test byte [eax], 0x10
je 0x405a0a
push esi
call fcn.00405965
push esi
call ebx
cmp eax, edi
jg 0x4059d1
push esi
call fcn.00405938
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405a04
Function at 0x405c60
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x40763c
mov edi, 0x42b180
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [esp + 0x1c]
mov ebp, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov ebx, 0x400
test esi, esi
je 0x405caf
push 1
push 0
push esi
call fcn.0040560d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push edi
push esi
call ebp
test eax, eax
je 0x405de8
cmp eax, ebx
jg 0x405de8
push ebx
mov esi, 0x42bec0
push esi
push dword [esp + 0x20]
call ebp
test eax, eax
je 0x405de8
cmp eax, ebx
jg 0x405de8
push esi
push edi
push str._s_s_r_n
push 0x42b6c0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42e8cc]
push dword [eax + 0x128]
push esi
call fcn.00405a0e
push 4
push 0xc0000000
push esi
call fcn.0040560d
mov ebp, eax
mov dword [esp + 0x1c], ebp
cmp ebp, 0xffffffff
je 0x405de8
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405de1
push 0
lea eax, [esp + 0x14]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405de1
cmp edi, dword [esp + 0x10]
jne 0x405de1
push str._Rename__r_n
push esi
call fcn.0040556d
test eax, eax
jne 0x405d77
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x405dac
push 0x407624
add eax, 0xa
push eax
call fcn.0040556d
mov ebp, eax
test ebp, ebp
je 0x405da8
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x405d99
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x405d93
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x1c]
jmp 0x405dae
mov ebp, dword [esp + 0x1c]
mov eax, edi
push ebx
push 0x42b6c0
add eax, esi
push eax
call fcn.004055c3
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x405e21
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
and esi, 4
push ebx
mov dword [ebp - 4], esi
call fcn.0040598c
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
test cl, 8
je 0x405e60
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42e988], eax
jmp 0x405feb
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push edi
je 0x405e7b
test eax, eax
je 0x405f99
test cl, 2
je 0x405f99
push ebx
mov esi, 0x42bac0
push esi
call fcn.0040579d
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405e9d
push str..
push esi
call edi
jmp 0x405ea3
push ebx
call fcn.00405965
cmp byte [ebx], 0
jne 0x405eb1
cmp byte [0x42bac0], 0x5c
jne 0x405eb9
push 0x407298
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x14c]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
je 0x405f8c
lea esi, [ebp - 0x120]
push 0x3f
mov eax, esi
push eax
call fcn.004054d2
cmp byte [eax], 0
je 0x405efc
cmp byte [ebp - 0x1c], 0
je 0x405efc
lea esi, [ebp - 0x1c]
cmp byte [esi], 0x2e
jne 0x405f12
mov al, byte [esi + 1]
test al, al
je 0x405f6b
cmp al, 0x2e
jne 0x405f12
cmp byte [esi + 2], 0
je 0x405f6b
push esi
push edi
call fcn.0040579d
test byte [ebp - 0x14c], 0x10
je 0x405f37
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405f6b
push dword [ebp + 0xc]
push ebx
call fcn.00405e21
jmp 0x405f6b
push dword [ebp - 4]
push ebx
call fcn.004058f0
test eax, eax
jne 0x405f63
cmp dword [ebp - 4], eax
je 0x405f5b
push ebx
push 0xfffffffffffffff1
call fcn.004047d5
push 0
push ebx
call fcn.00405dee
jmp 0x405f6b
inc dword [0x42e988]
jmp 0x405f6b
push ebx
push 0xfffffffffffffff2
call fcn.004047d5
lea eax, [ebp - 0x14c]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405ede
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
mov esi, dword [ebp - 4]
je 0x405f99
mov byte [edi - 1], 0
xor edi, edi
cmp dword [ebp + 8], edi
je 0x405fea
cmp dword [ebp - 0xc], edi
je 0x405fda
push ebx
call fcn.00405859
test eax, eax
je 0x405fea
push ebx
call fcn.00405938
mov eax, esi
or eax, 1
push eax
push ebx
call fcn.004058f0
test eax, eax
jne 0x405fe2
cmp esi, edi
je 0x405fda
push ebx
push 0xfffffffffffffff1
call fcn.004047d5
push edi
push ebx
call fcn.00405dee
jmp 0x405fea
inc dword [0x42e988]
jmp 0x405fea
push ebx
push 0xffffffffffffffe5
call fcn.004047d5
pop edi
pop esi
pop ebx
leave
ret 8