joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a2200dd
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a2340ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3d
pop eax
mov word [ebp - 0xc], ax
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0xa], ax
push 0x3a
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call fcn.4a212070
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
test edi, edi
je 0x4a229bb1
push edi
call esi
test al, al
je 0x4a229ba7
push 0
push 0x104
push 0x4a235260
call fcn.4a212c56
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4a2113a9
leave
ret 4
Function at 0x4a22270d
Capabilities:
Get geographical location

Disassembly:
xor eax, eax
push eax
push eax
lea ecx, [ebp - 0x144]
push ecx
lea ecx, [ebp - 0x160]
push ecx
push eax
call fcn.4a21756d
push eax
call edi
mov esi, eax
test esi, esi
je 0x4a224edf
inc esi
lea eax, [esi + esi]
push eax
push dword [0x4a2340d8]
call dword [sym.imp.msvcrt.dll_realloc]
pop ecx
pop ecx
test eax, eax
je 0x4a224efb
push esi
push eax
mov dword [0x4a2340d8], eax
lea eax, [ebp - 0x144]
push eax
lea eax, [ebp - 0x160]
push eax
push 0
mov dword [0x4a2340dc], esi
call fcn.4a21756d
push eax
call edi
test eax, eax
jne 0x4a22284d
jmp 0x4a224edf
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x4a2340ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x150], ebx
mov dword [ebp - 0x148], 1
test esi, esi
je 0x4a224e48
push 9
pop ecx
lea eax, [ebp - 0x168]
push eax
lea eax, [ebp - 0x194]
lea edi, [ebp - 0x194]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.4a2230b6
lea eax, [ebp - 0x170]
push eax
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea eax, [ebp - 0x160]
push eax
lea eax, [ebp - 0x170]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
cmp byte [0x4a234081], 0
je 0x4a224f01
and dword [ebp - 0x14c], 0
mov esi, 0x80
push esi
lea eax, [ebp - 0x144]
push eax
push 0x1f
call fcn.4a21756d
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4a224e6e
cmp word [ebp - 0x144], 0
lea esi, [ebp - 0x144]
je 0x4a22280e
mov ebx, dword [sym.imp.msvcrt.dll_memmove]
movzx edx, word [esi]
cmp dx, 0x27
je 0x4a224e86
cmp dword [ebp - 0x14c], 0
jne 0x4a222800
cmp dx, 0x64
je 0x4a2228b4
cmp dx, 0x4d
je 0x4a2228b4
inc esi
inc esi
cmp word [esi], 0
jne 0x4a2227d6
mov ebx, dword [ebp - 0x150]
push dword [0x4a2340dc]
lea eax, [ebp - 0x144]
push dword [0x4a2340d8]
push eax
lea eax, [ebp - 0x160]
push eax
push 0
call fcn.4a21756d
mov edi, dword [sym.imp.KERNEL32.dll_GetDateFormatW]
push eax
call edi
test eax, eax
je 0x4a222696
cmp dword [0x4a2340d8], 0
je 0x4a222696
movzx eax, word [ebp - 0x15c]
push eax
call fcn.4a222b93
push eax
push 0x20
lea eax, [ebp - 0x44]
push eax
call fcn.4a21185a
test ebx, ebx
je 0x4a224fa0
cmp dword [ebp - 0x148], 0
je 0x4a222881
cmp dword [ebp + 0xc], 1
je 0x4a224fed
push dword [0x4a2340d8]
push dword [ebp + 0x14]
push ebx
call fcn.4a21185a
xor ecx, ecx
inc ecx
inc esi
inc esi
cmp word [esi], dx
je 0x4a2228b6
lea eax, [ecx + ecx]
sub esi, eax
cmp ecx, 1
jne 0x4a224e9c
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a2228d1
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea eax, [esi + 2]
push esi
push eax
call ebx
add esp, 0xc
add esi, 4
jmp 0x4a222802
Function at 0x4a222eca
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x4a2340ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x828], eax
mov eax, dword [ebp + 0xc]
push eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x418]
push eax
call fcn.4a21185a
lea eax, [ebp - 0x418]
lea edx, [eax + 2]
xor ebx, ebx
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4a222f0c
sub eax, edx
sar eax, 1
mov esi, 0x106
push esi
lea ecx, [ebp - 0x210]
push ecx
inc eax
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.4a21a2c1
test al, al
je 0x4a22aaa8
push 0x4a212ec8
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4a2120a9
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x830]
push eax
push edi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4a22aaaf
cmp word [ebp - 0x210], 0x5c
je 0x4a22aad1
xor eax, eax
mov word [ebp - 0x20e], ax
cmp word [ebp - 0x624], bx
jne 0x4a22aae7
lea eax, [ebp - 0x210]
push eax
push 1
push 0x235e
push dword [ebp - 0x828]
call fcn.4a22301f
add esp, 0x10
cmp eax, ebx
jne 0x4a222fff
mov ecx, dword [ebp - 0x830]
cmp ecx, ebx
je 0x4a223010
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._04X__04X
lea eax, [ebp - 0x824]
push 0x100
push eax
call fcn.4a21179d
lea eax, [ebp - 0x824]
push eax
push 1
push 0x235b
push dword [ebp - 0x828]
call fcn.4a22301f
add esp, 0x24
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4a2113a9
leave
ret 8
cmp dword [ebp - 0x82c], ebx
jne 0x4a222fc5
jmp 0x4a222fff
xor eax, eax
jmp 0x4a222fff
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x90
je 0x4a22aaa8
push ebx
call esi
push eax
call fcn.4a216d44
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4a222fff
lea eax, [ebp - 0x210]
push eax
call fcn.4a212ed1
xor ecx, ecx
mov word [eax], cx
jmp 0x4a222f8e
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
push 2
push 0x235f
push dword [ebp - 0x828]
call fcn.4a22301f
add esp, 0x14
jmp 0x4a222fb7
Function at 0x4a223185
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4a2340ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.4a21aa4f
push esi
mov esi, 0x106
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4a21185a
lea eax, [ebp - 0x210]
push eax
call fcn.4a222620
test eax, eax
jne 0x4a22abf6
and dword [ebp - 0x214], 0
and dword [ebp - 0x218], 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 6
push edi
call fcn.4a222cb6
push esi
lea eax, [ebp - 0x210]
push eax
push 0xe
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0x10]
call fcn.4a22292f
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x14]
push 0x4a223258
call fcn.4a219a2c
push eax
push 2
push 0x2379
push edi
call fcn.4a22301f
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
xor ecx, ebp
pop esi
call fcn.4a2113a9
leave
ret 0x10
push 0x4a212ec8
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4a2120a9
jmp 0x4a2231cf
Function at 0x4a22d003
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
push 0x4a22d0d8
call fcn.4a21264a
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x4a22d042
cmp word [eax], si
je 0x4a22d042
lea edx, [ebp - 0x1c]
push edx
push 1
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x4a22d042
push eax
jmp 0x4a22d0a5
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
call edi
cmp eax, 2
jne 0x4a22d06c
push 0x4a213afc
call fcn.4a2119d6
mov dword [ebp - 0x20], eax
jmp 0x4a22d0ab
cmp eax, esi
jne 0x4a22d03f
push dword [ebp - 0x24]
call fcn.4a211896
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, esi
je 0x4a22d0a3
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push dword [ebp - 0x1c]
call edi
mov edi, eax
cmp edi, esi
je 0x4a22d0ab
push ebx
call fcn.4a21142e
mov dword [ebp - 0x20], esi
push edi
jmp 0x4a22d0a5
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
call fcn.4a22d0c7
mov eax, dword [ebp - 0x20]
call fcn.4a2113b6
ret 8
Function at 0x4a22d0f9
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4a2340ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x214], esi
cmp eax, ebx
jne 0x4a22d1e5
mov dword [ebp - 0x210], ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
cmp esi, ebx
jne 0x4a22d1be
cmp word [ebp - 0x20c], 0x2e
jne 0x4a22d1a3
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.4a22d003
mov edi, eax
cmp edi, ebx
je 0x4a22d1d1
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4a22d176
sub eax, edx
sar eax, 1
je 0x4a22d19d
push edi
lea eax, [ebp - 0x20c]
push eax
push str._s_s_r_n
call fcn.4a2158f3
add esp, 0xc
mov esi, eax
push edi
call fcn.4a21142e
cmp dword [0x4a2341b4], ebx
jne 0x4a22d1e0
inc dword [ebp - 0x210]
cmp esi, ebx
jne 0x4a22d257
jmp 0x4a22d12d
cmp esi, 0x103
jne 0x4a22d257
xor esi, esi
jmp 0x4a22d257
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4a216d44
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x4a22d259
push ebx
push eax
call fcn.4a212b0d
push eax
call fcn.4a2119d6
mov edi, eax
cmp edi, ebx
je 0x4a22d1e0
push 0x20
push edi
call fcn.4a212148
cmp eax, ebx
je 0x4a22d209
xor ecx, ecx
mov word [eax], cx
push edi
push esi
call fcn.4a22d003
mov ebx, eax
test ebx, ebx
je 0x4a22d239
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4a22d219
sub eax, edx
sar eax, 1
je 0x4a22d239
push ebx
push edi
push str._s_s_r_n
call fcn.4a2158f3
mov esi, eax
jmp 0x4a22d248
xor esi, esi
push edi
inc esi
push esi
push 0x400023a3
call fcn.4a216d44
add esp, 0xc
push ebx
call fcn.4a21142e
push edi
call fcn.4a21142e
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4a2113a9
leave
ret 8
Function at 0x4a22d26f
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push 0xc
push 0x4a22d398
call fcn.4a21264a
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp edi, esi
je 0x4a22d2e6
cmp word [edi], si
je 0x4a22d2e6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4a22d28e
sub eax, edx
sar eax, 1
push eax
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
jne 0x4a22d2cb
push edi
push dword [ebp + 0xc]
push str._s_s_r_n
call fcn.4a2158f3
add esp, 0xc
jmp 0x4a22d355
push esi
push ebx
call fcn.4a216d44
push dword [ebp + 0xc]
push 1
push 0x235d
call fcn.4a216d44
add esp, 0x14
jmp 0x4a22d355
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegDeleteKeyExW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
je 0x4a22d359
lea eax, [ebp + 0xc]
push eax
push 0x2000000
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
je 0x4a22d32c
cmp ebx, 2
je 0x4a22d355
push esi
push ebx
call fcn.4a216d44
pop ecx
pop ecx
jmp 0x4a22d355
push 0x4a213afc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegDeleteValueW]
mov ebx, eax
mov dword [ebp + 0x10], eax
cmp ebx, esi
je 0x4a22d34c
push esi
push ebx
call fcn.4a216d44
pop ecx
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
cmp ebx, esi
jne 0x4a22d389
mov dword [ebp - 4], esi
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x4a22d382
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 0x10]
call fcn.4a2113b6
ret 0xc
Function at 0x4a22d685
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4a2340ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x48], edi
cmp eax, edi
jne 0x4a22d6ab
xor eax, eax
jmp 0x4a22d7b5
push ebx
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x4c], ebx
cmp ebx, 0xffffffff
je 0x4a22d7b0
push esi
lea eax, [ebp - 0x44]
push eax
push ebx
push 0x40
pop esi
call fcn.4a22d3db
test eax, eax
je 0x4a22d6f5
mov eax, 0x5a4d
xor ecx, ecx
cmp ax, word [ebp - 0x44]
sete cl
mov eax, ecx
jmp 0x4a22d6f7
xor eax, eax
cmp eax, edi
je 0x4a22d7a6
push edi
push edi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, edi
je 0x4a22d7a6
lea eax, [ebp - 0x50]
push eax
push ebx
push 4
pop esi
call fcn.4a22d3db
test eax, eax
je 0x4a22d73c
xor eax, eax
cmp dword [ebp - 0x50], 0x4550
sete al
jmp 0x4a22d73e
xor eax, eax
cmp eax, edi
je 0x4a22d7a6
lea eax, [ebp - 0x64]
push eax
push ebx
push 0x14
pop esi
call fcn.4a22d3db
test eax, eax
je 0x4a22d7a6
cmp word [ebp - 0x54], di
jbe 0x4a22d7a6
movzx eax, word [ebp - 0x54]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4a22d7a6
movzx esi, word [ebp - 0x54]
push ebx
push dword [ebp - 0x4c]
call fcn.4a22d3db
test eax, eax
je 0x4a22d79a
mov edx, dword [ebp - 0x64]
mov ecx, ebx
call fcn.4a22d3b9
test eax, eax
je 0x4a22d79a
movzx eax, word [eax]
mov dword [ebp - 0x48], eax
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ax, word [ebp - 0x48]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.4a2113a9
leave
ret 4
Function at 0x4a22db5e
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4a2340ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], ecx
lea edx, [eax + 2]
xor ebx, ebx
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4a22db96
mov edi, str.ShellOpenCommand
sub eax, edx
mov ecx, edi
sar eax, 1
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
cmp dx, bx
jne 0x4a22dbae
sub ecx, esi
sar ecx, 1
lea eax, [ecx + eax + 1]
mov esi, 0x104
cmp eax, esi
jbe 0x4a22dbde
push ebx
push 0x400023db
call fcn.4a216d44
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4a22dd95
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.4a21185a
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4a2120a9
lea eax, [ebp - 0x214]
push eax
mov edi, 0x2000000
push edi
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
je 0x4a22dcec
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0x4a22dcd2
cmp word [eax], bx
je 0x4a22dcd2
lea esi, [ebp - 0x20c]
jmp 0x4a22dc51
cmp word [esi], 0x5c
je 0x4a22dc56
inc esi
inc esi
cmp word [esi], bx
jne 0x4a22dc49
movzx eax, word [esi]
mov dword [ebp - 0x224], eax
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_RegCreateKeyExW]
mov dword [ebp - 0x220], eax
cmp eax, ebx
jne 0x4a22dcb2
mov eax, dword [ebp - 0x224]
cmp ax, bx
je 0x4a22dcec
push dword [ebp - 0x214]
mov word [esi], ax
inc esi
inc esi
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
jmp 0x4a22dc51
push dword [ebp - 0x210]
push 1
push 0x400023a5
call fcn.4a216d44
mov eax, dword [ebp - 0x220]
add esp, 0xc
jmp 0x4a22dd95
push dword [ebp - 0x210]
push 1
push 0x400023a5
call fcn.4a216d44
add esp, 0xc
jmp 0x4a22dd93
mov edi, dword [ebp - 0x218]
cmp edi, ebx
je 0x4a22dd5f
cmp word [edi], bx
je 0x4a22dd5f
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4a22dd00
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push 2
push ebx
push 0x4a213afc
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
jne 0x4a22dd41
push edi
push dword [ebp - 0x210]
push str._s_s_r_n
call fcn.4a2158f3
jmp 0x4a22dd84
push ebx
push esi
call fcn.4a216d44
push dword [ebp - 0x210]
push 1
push 0x235d
call fcn.4a216d44
add esp, 0x14
jmp 0x4a22dd87
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, ebx
je 0x4a22dd87
push dword [ebp - 0x210]
push 1
push 0x400023a5
call fcn.4a216d44
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4a2113a9
leave
ret 0xc
Function at 0x4a22ea5f
Capabilities:
Delete directory

Disassembly:
push 0
push 0x2351
call fcn.4a216d44
pop ecx
pop ecx
jmp fcn.4a22fca6
Function at 0x405a03
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x405a12
pop dword [ebp - 0x4c]
mov eax, 0x405a12
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x42ea7f6e
sub dword [ebp - 0x5c], 0xf4983a23
mov dword [ebp - 0x58], 0xf3646824
add dword [ebp - 0x58], 0x3ecee421
mov dword [ebp - 0x54], 0xea8adf92
sub dword [ebp - 0x54], 0x9e3e9b64
mov dword [ebp - 0x50], 0x19b75202
sub dword [ebp - 0x50], 0x19b75202
lea eax, [ebp - 0x5c]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0xf6275454
sub dword [ebp - 0x5c], 0x81b4eafe
mov dword [ebp - 0x58], 0x8908c3d5
add dword [ebp - 0x58], 0xb8639da0
mov dword [ebp - 0x54], 0x8448a68c
sub dword [ebp - 0x54], 0x20d93a20
mov dword [ebp - 0x50], 0xe182c869
add dword [ebp - 0x50], 0x1e7d3797
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0xca451d12
sub eax, 0xca049c12
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x32c1c
push 0
call eax
mov ecx, 0x371b
mov edx, eax
mov edi, 0x46e400
add edi, dword [ebp - 0x4c]
mov esi, 0x693181bd
sub dword [ebp - 0xc], 0x7ec0558e
mov ebx, dword [edi]
sub dword [ebp - 0x14], 0xdaf84501
xor ebx, esi
mov dword [edx], ebx
xor dword [ebp - 0x44], esi
add edx, 4
add edi, 0x3c8cf43c
sub edi, 0x3c8cf438
loop 0x405b18
add eax, 0xd0f305ae
sub eax, 0xd0f2366f
xor ebx, ebx
add ebx, eax
add eax, 0x34a29f20
add eax, 0xcb5d60e5
mov ecx, 0x400000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x405cce
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425f30
push esi
call fcn.00406212
push esi
call fcn.00405c71
mov edi, eax
test edi, edi
jne 0x405cef
xor eax, eax
jmp 0x405d47
push edi
call fcn.004064a6
test byte [0x42a258], 0x80
je 0x405d0c
mov ax, word [edi]
test ax, ax
je 0x405ceb
cmp ax, 0x5c
je 0x405ceb
sub edi, esi
sar edi, 1
jmp 0x405d26
call fcn.00406555
test eax, eax
je 0x405d20
test byte [eax], 0x10
je 0x405ceb
push esi
call fcn.00405c12
push esi
call sub.kernel32.dll_lstrlenW
cmp eax, edi
push esi
jg 0x405d12
call fcn.00405bc6
push esi
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop edi
pop esi
ret 4

Function at 0x405dc2
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x405de1
and al, 0xfe
push eax
push dword [esp + 0xc]
call dword [sym.imp.kernel32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x405de7
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov ecx, eax
push 0
inc ecx
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.kernel32.dll_CreateFileW]
ret 0xc
Function at 0x10019c80
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100b700c]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x208
push 0
push 0x100b8088
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push str.DCIM_
push 0x104
push 0x100b8088
call fcn.10019b40
push 0x100b8088
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffff
jne 0x10019cd9
push 0
push 0x100b8088
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 8]
push ecx
movzx edx, word [ebp - 0xa]
push edx
movzx eax, word [ebp - 0xc]
push eax
movzx ecx, word [ebp - 0xe]
push ecx
movzx edx, word [ebp - 0x12]
push edx
movzx eax, word [ebp - 0x14]
push eax
call fcn.1001b660
mov ecx, eax
call fcn.1001b500
push eax
push str.DCIM_S__d__02d__02d__02d_02d_02d.jpg
push 0x104
push 0x100b8088
call fcn.10019ae0
add esp, 0x28
mov eax, 0x100b8088
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100584af
mov esp, ebp
pop ebp
ret

Function at 0x1001aa60
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005aa6d
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x100b700c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 1
lea eax, [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call fcn.10003f70
mov byte [ebp - 4], 2
lea ecx, [ebp + 0x20]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.10003f70
mov edx, dword [ebp - 0x10]
add edx, 0x30
mov eax, dword [ebp + 0x38]
mov dword [edx], eax
mov ecx, dword [ebp + 0x3c]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x40]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x44]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x40
mov eax, dword [ebp + 0x48]
mov dword [edx], eax
mov ecx, dword [ebp + 0x4c]
mov dword [edx + 4], ecx
mov eax, dword [ebp + 0x50]
mov dword [edx + 8], eax
mov ecx, dword [ebp + 0x54]
mov dword [edx + 0xc], ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x50], 0
mov eax, dword [ebp - 0x10]
or ecx, 0xffffffff
mov dword [eax + 0x58], 0xffffffff
mov dword [eax + 0x5c], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.10003df0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x20]
call fcn.10003df0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 0x50