joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410137
Capabilities:
Get disk size

Disassembly:
mov eax, 0x466a7c
call fcn.00464890
sub esp, 0x6c
push ebx
push esi
push edi
lea eax, [ebp - 0x3c]
mov ebx, 0x73b8f0
push eax
mov ecx, ebx
call fcn.004104e0
xor edi, edi
lea ecx, [ebp - 0x78]
mov dword [ebp - 4], edi
call fcn.00411f12
lea eax, [ebp - 0x78]
push eax
lea ecx, [ebp - 0x3c]
call fcn.0040fe4b
push dword [ebp - 0x78]
lea eax, [ebp - 0x4c]
push edi
push eax
lea ecx, [ebp - 0x3c]
call fcn.004088c3
push eax
lea ecx, [ebp - 0x2c]
call fcn.00415ba3
mov dword [ebp - 0x2c], 0x472a1c
lea ecx, [ebp - 0x4c]
mov byte [ebp - 4], 2
call fcn.00415c2c
lea ecx, [ebp - 0x2c]
mov esi, 0x1000
call fcn.00415cf7
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x1c]
push ecx
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.DLL_GetDiskFreeSpaceA]
test eax, eax
je 0x4101cb
mov esi, dword [ebp - 0x10]
imul esi, dword [ebp - 0x14]
push ecx
push edi
lea ecx, [ebp - 0x60]
call fcn.0040f837
push edi
lea eax, [esi - 1]
mov byte [ebp - 4], 3
push eax
lea eax, [ebp - 0x60]
mov ecx, ebx
push eax
call fcn.00410220
lea ecx, [ebp - 0x60]
mov esi, eax
mov edi, edx
call fcn.0040f8b1
lea ecx, [ebp - 0x2c]
call fcn.00415c2c
lea ecx, [ebp - 0x70]
call fcn.00415c2c
lea ecx, [ebp - 0x3c]
call fcn.00415c2c
mov ecx, dword [ebp - 0xc]
mov edx, edi
pop edi
mov eax, esi
mov dword fs:[0], ecx
pop esi
pop ebx
leave
ret

Function at 0x410dc3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x466bcb
call fcn.00464890
sub esp, 0x24
push esi
mov esi, ecx
mov ecx, str.USERPROFILE
push edi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], edi
call fcn.004195c3
push eax
mov ecx, esi
call fcn.00415bc9
mov dword [esi], 0x472a1c
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], 1
cmp dword [esi + 4], edi
jne 0x410e63
mov ecx, str.HOME
call fcn.004195c3
push eax
mov ecx, esi
call fcn.004160df
cmp dword [esi + 4], edi
jne 0x410e63
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], edi
push eax
push edi
push 0x8000
push 0x46ba54
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
push dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x475090
call fcn.004163d4
lea eax, [ebp - 0x2c]
mov ecx, esi
push eax
call fcn.00401d01
lea ecx, [ebp - 0x2c]
call fcn.00415c2c
push dword [ebp - 0x14]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, esi
call fcn.0041164a
mov ecx, esi
call fcn.00411174
test al, al
je 0x410e85
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret
push ecx
lea ecx, [ebp - 0x30]
call fcn.00410e9d
push 0x733f00
lea eax, [ebp - 0x30]
push eax
call fcn.0043c83d
int3
Function at 0x4119b6
Capabilities:
Get common file path

Disassembly:
mov eax, 0x466cf0
call fcn.00464890
mov eax, 0x102c
call fcn.00464120
push esi
mov esi, ecx
mov ecx, str.TMPDIR
push edi
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x10], edi
call fcn.004195c3
push eax
mov ecx, esi
call fcn.00415bc9
mov dword [esi], 0x472a1c
mov dword [ebp - 4], edi
mov ecx, esi
inc edi
mov dword [ebp - 0x10], edi
call fcn.00411174
test al, al
jne 0x411a3e
lea eax, [ebp - 0x1038]
push eax
push 0x800
call dword [sym.imp.KERNEL32.DLL_GetTempPathW]
lea eax, [ebp - 0x1038]
mov dword [ebp - 0x20], 0x475090
push eax
lea ecx, [ebp - 0x20]
call fcn.004163d4
lea eax, [ebp - 0x20]
mov ecx, esi
push eax
call fcn.00401d01
lea ecx, [ebp - 0x20]
call fcn.00415c2c
mov ecx, esi
call fcn.0041164a
mov ecx, esi
call fcn.00411174
test al, al
je 0x411a92
mov ecx, esi
call fcn.00411138
test al, al
jne 0x411a82
lea ecx, [ebp - 0x20]
call fcn.00410c73
push esi
mov ecx, eax
mov dword [ebp - 4], 2
call fcn.00401e1e
push eax
mov ecx, esi
call fcn.00401d01
lea ecx, [ebp - 0x20]
call fcn.00415c2c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret
push esi
mov edx, str.invalid_temporary_directory:
lea ecx, [ebp - 0x20]
call fcn.004168ec
pop ecx
push eax
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], edi
call fcn.00408dd1
push 0x733f00
lea eax, [ebp - 0x38]
push eax
call fcn.0043c83d
int3

Function at 0x4123f9
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x204
push ebx
push esi
push edi
push 1
mov esi, ecx
call fcn.00412ef7
mov edi, eax
test edi, edi
jne 0x412452
xor ebx, ebx
mov dword [esp + 0xc], 0x100
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, eax
test edi, edi
jne 0x41245e
mov ecx, dword [ebp + 8]
lea eax, [esp + 0x10]
push eax
call fcn.0041611d
inc dword [esi + 4]
test edi, edi
pop edi
pop esi
sete al
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp edi, 0x103
jne 0x41246b
mov dword [esi + 4], ebx
jmp 0x412450
push ebx
push edi
push str.read_next
mov ecx, esi
call fcn.00412be5
int3
Function at 0x41247a
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x466e1a
call fcn.00464890
sub esp, 0x40
push esi
push edi
push 1
mov esi, ecx
call fcn.00412ef7
mov edi, eax
test edi, edi
jne 0x412585
mov ecx, dword [esi + 0x20]
mov eax, dword [esi + 0x1c]
inc ecx
push ebx
mov dword [ebp - 0x14], ecx
inc eax
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], eax
call fcn.004089b4
and dword [ebp - 4], edi
lea ecx, [ebp - 0x2c]
push dword [ebp - 0x10]
call fcn.004089b4
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x24]
add eax, eax
push eax
push edi
push ebx
call fcn.0043a570
add esp, 0xc
lea edi, [ebp - 0x4c]
xor eax, eax
push 8
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x4c]
call fcn.004033e2
mov edi, dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.004125a8
lea ecx, [ebp - 0x48]
call fcn.00415c2c
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test edi, edi
jne 0x412566
push dword [ebp - 0x18]
mov ecx, dword [ebp + 8]
call fcn.0041611d
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
sub eax, 1
je 0x412558
sub eax, 1
je 0x412558
dec eax
sub eax, 1
je 0x412547
sub eax, 7
jne 0x412561
push 8
jmp 0x412549
push 4
lea eax, [ecx + 0x18]
push ebx
push eax
call fcn.00439ff0
add esp, 0xc
jmp 0x412561
push ebx
add ecx, 4
call fcn.0041611d
inc dword [esi + 4]
jmp 0x412572
cmp edi, 0x103
jne 0x412598
and dword [esi + 4], 0
push ebx
call fcn.00430166
push dword [ebp - 0x18]
call fcn.00430166
pop ecx
pop ecx
pop ebx
test edi, edi
mov ecx, dword [ebp - 0xc]
sete al
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 8
push 0
push edi
push str.read_next
mov ecx, esi
call fcn.00412be5
int3
Function at 0x4127af
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x466e65
call fcn.00464890
sub esp, 0x40
push ebx
push esi
push edi
mov ebx, ecx
push 1
mov dword [ebp - 0x18], ebx
call fcn.00412ef7
mov esi, eax
test esi, esi
jne 0x412890
mov eax, dword [ebx + 0x1c]
lea ecx, [ebp - 0x2c]
inc eax
push eax
mov dword [ebp - 0x14], eax
call fcn.004089b4
mov dword [ebp - 4], esi
push dword [ebp - 0x14]
mov ebx, dword [ebp - 0x24]
push esi
push ebx
call fcn.0043a570
add esp, 0xc
lea edi, [ebp - 0x4c]
xor eax, eax
push 8
pop ecx
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x4c]
call fcn.004033e2
mov edi, dword [ebp + 0xc]
mov ecx, edi
push eax
call fcn.004125a8
lea ecx, [ebp - 0x48]
call fcn.00415c2c
cmp dword [ebp + 8], esi
lea ecx, [ebp - 0x20]
mov eax, 0x4744c0
cmovne eax, dword [ebp + 8]
push eax
mov dword [ebp + 8], eax
call fcn.004199db
lea ecx, [ebp - 0x14]
push ecx
push ebx
push edi
push 0x1000ffff
push dword [eax]
mov eax, dword [ebp - 0x18]
push esi
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
push dword [ebp - 0x20]
mov esi, eax
call fcn.00430166
pop ecx
test esi, esi
jne 0x4128af
mov eax, dword [edi]
sub eax, 1
je 0x4128a4
sub eax, 1
je 0x4128a4
dec eax
sub eax, 1
je 0x412878
sub eax, 7
jne 0x412887
push 8
jmp 0x41287a
push 4
lea eax, [edi + 0x18]
push ebx
push eax
call fcn.00439ff0
add esp, 0xc
push ebx
call fcn.00430166
pop ecx
test esi, esi
mov ecx, dword [ebp - 0xc]
sete al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
push ebx
lea ecx, [edi + 4]
call fcn.0041611d
jmp 0x412887
cmp esi, 2
je 0x412887
push dword [ebp + 8]
mov ecx, dword [ebp - 0x18]
push esi
push str.read
call fcn.00412be5
int3

Function at 0x4128c6
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x466e8e
call fcn.00464890
sub esp, 0x38
push esi
mov esi, ecx
lea ecx, [ebp - 0x40]
push edi
call fcn.004033e2
lea eax, [ebp - 0x40]
xor edi, edi
push eax
push dword [ebp + 8]
mov ecx, esi
mov dword [ebp - 4], edi
call fcn.004127af
mov byte [ebp + 0xb], al
test al, al
je 0x412980
mov edx, dword [ebp - 0x40]
cmp edx, 1
je 0x412974
cmp edx, 2
jne 0x41299b
cmp byte [ebp + 0x10], 0
je 0x412974
lea ecx, [ebp - 0x3c]
call fcn.00415cf7
push eax
lea ecx, [ebp - 0x14]
call fcn.004199db
push edi
push edi
mov byte [ebp - 4], 1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov edi, eax
lea ecx, [edi + 1]
push ecx
lea ecx, [ebp - 0x20]
call fcn.004089b4
mov byte [ebp - 4], 2
xor eax, eax
mov esi, dword [ebp - 0x18]
push edi
push esi
push dword [ebp - 0x14]
mov word [esi], ax
call dword [sym.imp.KERNEL32.DLL_ExpandEnvironmentStringsW]
mov ecx, dword [ebp + 0xc]
push esi
call fcn.0041611d
push esi
call fcn.00430166
pop ecx
push dword [ebp - 0x14]
call fcn.00430166
pop ecx
jmp 0x412980
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x3c]
push eax
call fcn.00401d01
lea ecx, [ebp - 0x3c]
call fcn.00415c2c
mov ecx, dword [ebp - 0xc]
mov al, byte [ebp + 0xb]
pop edi
mov dword fs:[0], ecx
pop esi
leave
ret 0xc
mov ecx, str.read_string
call fcn.00412c9f
int3
Function at 0x412a0e
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
push edi
push 2
mov edi, ecx
call fcn.00412ef7
mov esi, eax
test esi, esi
jne 0x412a66
cmp dword [ebp + 8], eax
lea ecx, [esp + 0x10]
mov ebx, 0x4744c0
cmovne ebx, dword [ebp + 8]
push ebx
call fcn.004199db
push dword [eax]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [esp + 0x10]
mov esi, eax
call fcn.00430166
and dword [edi + 4], 0
pop ecx
test esi, esi
jne 0x412a69
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ebx, dword [ebp + 8]
cmp esi, 2
je 0x412a5d
push ebx
push esi
push str.remove
mov ecx, edi
call fcn.00412be5
int3

Function at 0x412a7d
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x466ef3
call fcn.00464890
sub esp, 0x4c
push ebx
push esi
mov ebx, ecx
lea ecx, [ebp - 0x58]
push edi
call fcn.0041216d
and dword [ebp - 4], 0
lea eax, [ebp - 0x58]
xor edi, edi
mov ecx, ebx
push eax
mov dword [ebp - 0x10], edi
call fcn.00412391
test al, al
je 0x412ac2
lea eax, [ebp - 0x58]
mov ecx, ebx
push eax
inc edi
call fcn.00412391
test al, al
jne 0x412aaf
mov dword [ebp - 0x10], edi
lea ecx, [ebp - 0x2c]
call fcn.00401a9c
xor eax, eax
mov dword [ebp - 0x2c], 0x4765e0
inc eax
mov dword [ebp - 0x28], edi
test edi, edi
mov esi, edi
push 0x2c
cmove esi, eax
xor ecx, ecx
pop edx
mov eax, esi
mov dword [ebp - 0x1c], esi
mul edx
seto cl
neg ecx
or ecx, eax
xor eax, eax
add ecx, 4
setb al
neg eax
or eax, ecx
push eax
call fcn.0043016b
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
mov dword [esp], fcn.004122a5
push fcn.0041216d
mov dword [eax], esi
add eax, 4
push esi
push 0x2c
mov esi, eax
mov dword [ebp - 0x14], eax
push esi
call fcn.00431a36
mov dword [ebp - 0x24], esi
mov byte [ebp - 4], 2
test edi, edi
je 0x412b5b
mov dword [ebp - 0x1c], edi
lea eax, [ebp - 0x58]
mov ecx, ebx
push eax
call fcn.00412391
lea eax, [ebp - 0x58]
mov ecx, esi
push eax
call fcn.004125e7
add esi, 0x2c
sub edi, 1
jne 0x412b37
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
lea eax, [ebp - 0x58]
mov ecx, ebx
push eax
call fcn.00412391
test edi, edi
je 0x412b79
mov ecx, esi
call fcn.00412a7d
add esi, 0x2c
sub edi, 1
jne 0x412b6a
mov ecx, ebx
call fcn.00412fe1
mov esi, dword [ebx + 0x28]
lea ecx, [ebx + 0xc]
call fcn.00415cf7
push eax
lea ecx, [ebp - 0x20]
call fcn.004199db
push 0
push esi
push dword [eax]
push dword [ebx + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
push dword [ebp - 0x20]
mov esi, eax
call fcn.00430166
pop ecx
test esi, esi
je 0x412bb6
cmp esi, 2
jne 0x412bd5
lea ecx, [ebp - 0x2c]
call fcn.0041300a
lea ecx, [ebp - 0x58]
call fcn.004122a5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
push 0
push esi
push str.remove
mov ecx, ebx
call fcn.00412be5
int3
Function at 0x412d10
Capabilities:
Set registry value

Disassembly:
mov eax, 0x466f6e
call fcn.00464890
sub esp, 0x48
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 3
mov edi, ecx
call fcn.00412ef7
mov esi, eax
test esi, esi
jne 0x412de0
mov esi, dword [ebp + 0xc]
lea ecx, [esi + 4]
call fcn.00415cf7
push eax
lea ecx, [ebp - 0x1c]
call fcn.004199db
and dword [ebp - 4], 0
mov ecx, dword [esi]
mov eax, ecx
mov dword [ebp - 0x14], ecx
sub eax, 1
je 0x412d86
sub eax, 1
je 0x412d86
dec eax
sub eax, 1
je 0x412d7a
sub eax, 7
jne 0x412dfa
add esi, 0x18
mov dword [ebp + 8], 8
jmp 0x412d9c
add esi, 0x18
mov dword [ebp + 8], 4
jmp 0x412d9c
mov eax, dword [ebp - 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [esi + 8]
mov esi, dword [ebp + 0xc]
lea eax, [eax*2 + 2]
mov dword [ebp + 8], eax
test ebx, ebx
lea ecx, [ebp - 0x24]
mov eax, 0x4744c0
cmovne eax, ebx
mov ebx, eax
push ebx
call fcn.004199db
push dword [ebp + 8]
push esi
push dword [ebp - 0x14]
push 0
push dword [eax]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x24]
mov esi, eax
call fcn.00430166
or dword [ebp - 4], 0xffffffff
pop ecx
push dword [ebp - 0x1c]
call fcn.00430166
pop ecx
test esi, esi
je 0x412de9
mov ecx, edi
cmp esi, 5
je 0x412e12
jmp 0x412e06
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 8
mov edx, ecx
mov ecx, str.write
call fcn.00412c9f
push ebx
push esi
push str.write
call fcn.00412be5
lea eax, [ebp - 0x2c]
push eax
call fcn.00412617
push eax
mov edx, str.cannot_write
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.004168ec
pop ecx
mov edx, ebx
mov byte [ebp - 4], 2
mov ecx, eax
call fcn.00401d4f
push eax
lea ecx, [ebp - 0x50]
call fcn.00408dd1
push 0x733f38
lea eax, [ebp - 0x50]
push eax
call fcn.0043c83d
int3
Function at 0x413c3c
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov eax, 0x4670e7
call fcn.00464890
sub esp, 0x130
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x38], esi
mov edi, edx
mov dword [ebp - 0x10], ebx
call fcn.00401d56
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], 1
call fcn.00401d56
xor eax, eax
inc eax
mov dword [ebp - 4], eax
cmp edi, 0x25
jne 0x413d23
cmp dword [ebp + 8], ebx
je 0x413d23
cmp dword [ebp + 8], eax
jne 0x413cc5
push 0x104
lea eax, [ebp - 0x13c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemWow64DirectoryA]
test eax, eax
je 0x413d7e
lea eax, [ebp - 0x13c]
mov ecx, esi
push eax
call fcn.004160df
push 0x472b70
mov ecx, esi
call fcn.004160b9
jmp 0x413d7e
lea eax, [ebp - 0x20]
push eax
push 0x24
pop edx
lea ecx, [ebp - 0x30]
call fcn.00413db7
pop ecx
push eax
mov ecx, esi
call fcn.00401d01
lea ecx, [ebp - 0x30]
call fcn.00415c2c
cmp dword [esi + 4], ebx
je 0x413d9c
push str.Sysnative_
mov ecx, esi
call fcn.004160b9
mov ecx, esi
call fcn.00415cf7
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x413d11
test al, 0x10
jne 0x413d7e
push str.cannot_find_system_directory
lea ecx, [ebp - 0x20]
mov dword [esi + 4], ebx
call fcn.004160df
jmp 0x413d7e
lea eax, [ebp - 0x20]
mov edx, edi
push eax
lea ecx, [ebp - 0x30]
call fcn.00413db7
pop ecx
push eax
mov ecx, esi
call fcn.00401d01
lea ecx, [ebp - 0x30]
call fcn.00415c2c
cmp dword [esi + 4], ebx
jne 0x413d83
cmp edi, 5
je 0x413d5e
cmp edi, 0x1c
je 0x413d5e
cmp edi, 0x2a
jne 0x413d7e
lea eax, [ebp - 0x20]
push eax
push 0x26
jmp 0x413d64
lea eax, [ebp - 0x20]
push eax
push 0x28
pop edx
lea ecx, [ebp - 0x30]
call fcn.00413db7
pop ecx
push eax
mov ecx, esi
call fcn.00401d01
lea ecx, [ebp - 0x30]
call fcn.00415c2c
cmp dword [esi + 4], ebx
je 0x413d9c
lea ecx, [ebp - 0x20]
call fcn.00415c2c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp - 0x34]
call fcn.00415063
push 0x733e20
lea eax, [ebp - 0x34]
push eax
call fcn.0043c83d
int3
Function at 0x413db7
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x467111
call fcn.00464890
sub esp, 0x22c
push ebx
push esi
mov esi, ecx
xor ebx, ebx
push edi
mov dword [ebp - 0x1c], esi
mov edi, edx
mov dword [ebp - 0x18], ebx
call fcn.00401d56
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], 1
cmp edi, 0x26
jne 0x413e5c
lea eax, [ebp - 0x14]
push eax
push 0x20119
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x413e5c
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0x208
push eax
lea eax, [ebp - 0x238]
push eax
push ebx
push ebx
push str.ProgramFilesDir
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413e53
mov eax, dword [ebp - 0x10]
mov ecx, esi
mov word [ebp + eax - 0x238], bx
lea eax, [ebp - 0x238]
push eax
call fcn.0041611d
push 0x472b70
mov ecx, esi
call fcn.004160b9
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esi + 4], ebx
jne 0x413e7f
push dword [ebp + 8]
mov edx, edi
lea ecx, [ebp - 0x2c]
call fcn.00413e90
pop ecx
push eax
mov ecx, esi
call fcn.00401d01
lea ecx, [ebp - 0x2c]
call fcn.00415c2c
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x413e90
Capabilities:
Get common file path

Disassembly:
mov eax, 0x467153
call fcn.00464890
sub esp, 0x4c
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x14], 0
push edi
call fcn.00401d56
and dword [ebp - 4], 0
lea edi, [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x14], 1
stosd dword es:[edi], eax
lea ecx, [ebp - 0x28]
mov edx, esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea edi, [ebp - 0x38]
call fcn.004167af
mov dword [ebp - 4], 1
cmp esi, 0x24
jg 0x413f48
je 0x413f3c
dec esi
sub esi, 1
je 0x413f30
sub esi, 3
je 0x413f24
sub esi, 0xb
je 0x413f18
sub esi, 7
je 0x413f0c
sub esi, 5
jne 0x413f94
mov edi, 0x46ba94
push str.LocalAppData
jmp 0x413f8c
mov edi, 0x46ba64
push str.CommonPrograms
jmp 0x413f8c
mov edi, 0x46ba04
push str.Desktop
jmp 0x413f8c
mov edi, 0x46ba24
push str.Documents
jmp 0x413f8c
mov edi, 0x46ba34
push str.Programs
jmp 0x413f8c
mov edi, 0x46ba44
push str.Windows
jmp 0x413f8c
sub esi, 0x25
je 0x413f82
sub esi, 1
je 0x413f76
dec esi
sub esi, 1
je 0x413f6a
dec esi
sub esi, 1
jne 0x413f94
mov edi, 0x46ba14
push str.ProgramFilesX86
jmp 0x413f8c
mov edi, 0x46ba54
push str.Profile
jmp 0x413f8c
mov edi, 0x46ba84
push str.ProgramFiles
jmp 0x413f8c
mov edi, 0x46baa4
push 0x727218
lea ecx, [ebp - 0x28]
call fcn.004160df
and dword [ebp - 0x10], 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0x8000
push edi
call dword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
mov edi, eax
test edi, edi
jne 0x413fc8
push dword [ebp - 0x10]
mov ecx, ebx
call fcn.0041611d
push 0x472b70
mov ecx, ebx
call fcn.004160b9
jmp 0x41401c
lea eax, [ebp - 0x28]
mov edx, str.SHGetKnownFolderPath_failed_to_find_the_
push eax
lea ecx, [ebp - 0x58]
call fcn.004168ec
mov byte [ebp - 4], 2
mov ecx, eax
mov dword [esp], str._folder__which_is_required_by_this_application.
call fcn.004160b9
mov edx, edi
lea ecx, [ebp - 0x48]
mov esi, eax
call fcn.004135b6
push eax
mov ecx, esi
mov byte [ebp - 4], 3
call fcn.00401e1e
mov ecx, dword [ebp + 8]
push eax
call fcn.00401d01
lea ecx, [ebp - 0x48]
call fcn.00415c2c
lea ecx, [ebp - 0x58]
call fcn.00415c2c
push dword [ebp - 0x10]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea ecx, [ebp - 0x28]
call fcn.00415c2c
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x414e69
Capabilities:
Encode data using xor
Hash data using crc32b

Disassembly:
cmp dword [0x739a34], 0
push edi
mov edi, ecx
jne 0x414ea9
push ebx
xor edx, edx
push esi
mov esi, edx
push 8
shl esi, 0x18
pop ebx
lea ecx, [esi + esi]
mov eax, ecx
xor eax, 0x4c11db7
test esi, esi
cmovns eax, ecx
mov esi, eax
sub ebx, 1
jne 0x414e81
mov dword [edx*4 + 0x739a30], esi
inc edx
cmp edx, 0x100
jb 0x414e79
pop esi
pop ebx
and dword [edi], 0
mov eax, edi
pop edi
ret

Function at 0x414eb0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
push edi
xor edi, edi
mov edx, dword [esi]
cmp dword [esp + 0x14], edi
jbe 0x414edf
movzx ecx, byte [ebx + edi]
mov eax, edx
shr eax, 0x18
xor ecx, eax
shl edx, 8
xor edx, dword [ecx*4 + 0x739a30]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x414ec3
pop edi
mov dword [esi], edx
pop esi
pop ebx
ret 8

Function at 0x4176c8
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
cmp byte [0x73bf24], 0
jne 0x417765
push ebx
xor ebx, ebx
lea eax, [ebp - 0x203]
push 0x203
push ebx
push eax
mov byte [ebp - 0x204], bl
call fcn.0043a570
add esp, 0xc
lea eax, [ebp - 0x204]
push eax
push 0x204
call dword [sym.imp.KERNEL32.DLL_GetTempPathA]
lea eax, [ebp - 0x204]
push str.789adfadca579dee2f9bd4ab7404b49d10aea3301462565aa096e47683f2e752670cdaf00411606a3be211b748f7819cfbbce22429fd7ed350fe01fb1856ca1cc52ca9a1e1f5e20ead8a93123c7fd52fc825d5dc9864fd5801eb1f29b8c3bba6080c6b980e8ddfece8e6989bcd40d53df1c5e3215713d897ac08505c5541acb
push eax
call fcn.0044b520
pop ecx
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
pop ebx
cmp eax, 0xffffffff
je 0x41775e
push eax
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
lea eax, [ebp - 0x204]
push eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
mov byte [0x73bf25], 1
mov byte [0x73bf24], 1
mov al, byte [0x73bf25]
leave
ret
Function at 0x417826
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x6c
push ebx
push ebp
push esi
push edi
or ebp, 0xffffffff
mov dword [esp + 0x14], ecx
mov bl, dl
or edi, ebp
call fcn.0044dc26
mov ecx, dword [eax]
call fcn.004179a2
mov esi, eax
lea eax, [esp + 0x30]
push 0x44
push 0
push eax
mov dword [esp + 0x28], esi
call fcn.0043a570
add esp, 0xc
mov dword [esp + 0x30], 0x44
mov dword [esp + 0x5c], 0x100
test bl, bl
je 0x417897
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push ebx
push 0xc0000000
push 0x4760b8
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov edi, eax
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
mov dword [esp + 0x70], edi
jmp 0x4178bc
xor ecx, ecx
call fcn.00417815
xor ecx, ecx
mov dword [esp + 0x68], eax
inc ecx
call fcn.00417815
push 2
pop ecx
mov dword [esp + 0x6c], eax
call fcn.00417815
mov dword [esp + 0x70], eax
xor ebx, ebx
push dword [esp + 0x14]
lea ecx, [esp + 0x18]
call fcn.004199db
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x34]
push ecx
push ebx
push esi
push 0x8000400
push 1
push ebx
push ebx
push dword [eax]
push ebx
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
push dword [esp + 0x14]
mov esi, eax
call fcn.00430166
test esi, esi
mov esi, dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ecx
je 0x417963
push dword [esp + 0x24]
call esi
mov edx, dword [0x737c80]
mov eax, dword [0x737c84]
mov ebp, dword [esp + 0x28]
cmp edx, eax
jb 0x417924
add eax, eax
push eax
call fcn.0041975a
mov edx, dword [0x737c80]
mov eax, dword [0x737c7c]
mov ecx, dword [esp + 0x20]
mov dword [eax + edx*4], ecx
inc dword [0x737c80]
mov ecx, dword [0x737c8c]
mov eax, dword [0x737c90]
cmp ecx, eax
jb 0x417953
add eax, eax
push eax
call fcn.004197a8
mov ecx, dword [0x737c8c]
mov eax, dword [0x737c88]
mov dword [eax + ecx*4], ebp
inc dword [0x737c8c]
jmp 0x417986
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 0xce
jne 0x41797d
call fcn.0043e220
mov dword [eax], 7
jmp 0x417986
xor edx, edx
mov ecx, eax
call fcn.00417e3a
cmp edi, 0xffffffff
je 0x41798e
push edi
call esi
push dword [esp + 0x1c]
call fcn.00430166
pop ecx
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
add esp, 0x6c
ret