joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40349e
Capabilities:
Hash data with crc32

Disassembly:
xor edx, edx
add ecx, 8
push esi
push 8
mov eax, edx
pop esi
test al, 1
je 0x4034b6
shr eax, 1
xor eax, 0xedb88320
jmp 0x4034b8
shr eax, 1
dec esi
jne 0x4034a9
mov dword [ecx], eax
inc edx
add ecx, 4
cmp edx, 0xff
jle 0x4034a4
pop esi
ret

Function at 0x40368b
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x45652c]
push ebx
push esi
push edi
push dword [ebp + 0x18]
lea ecx, [ebp - 0x238]
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
call fcn.0040360f
mov eax, dword [ebp - 0x220]
xor eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 0x21c]
xor ecx, dword [ebp + 0x18]
and eax, dword [ebp - 0x210]
and ecx, dword [ebp - 0x20c]
mov dword [ebp - 0x238], eax
mov esi, 0x100
push esi
lea eax, [ebp - 0x204]
mov dword [ebp - 0x234], ecx
xor ebx, ebx
push eax
lea ecx, [ebp - 0x238]
mov byte [ebp - 0x230], bl
mov dword [ebp - 0x208], ebx
xor edi, edi
call fcn.00403652
xor eax, eax
mov byte [ebp + eax - 0x104], al
inc eax
cmp eax, esi
jl 0x403704
mov dword [ebp + 0x18], ebx
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov cl, byte [ebp + edi - 0x204]
lea eax, [ebp + eax - 0x104]
movsx edx, byte [eax]
add ecx, dword [ebp - 0x208]
add ecx, edx
and ecx, 0xff
mov dword [ebp - 0x208], ecx
lea ecx, [ebp + ecx - 0x104]
movsx ebx, byte [ecx]
inc edi
cmp edi, esi
mov byte [ecx], dl
mov byte [eax], bl
jl 0x403752
xor edi, edi
inc dword [ebp + 0x18]
cmp dword [ebp + 0x18], esi
jl 0x403713
mov edi, dword [ebp + 0x10]
test edi, edi
jge 0x403763
neg edi
mov eax, dword [ebp + 0xc]
test eax, eax
jle 0x40378b
mov ecx, dword [ebp + 8]
sub edi, ecx
mov dword [ebp + 0x10], eax
lea eax, [edi + ecx]
cdq
mov ebx, esi
idiv ebx
mov al, byte [ebp + edx - 0x104]
and al, 0x7f
xor byte [ecx], al
inc ecx
dec dword [ebp + 0x10]
jne 0x403772
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.0043196c
leave
ret
Function at 0x404167
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x45652c]
mov dword [ebp - 4], eax
je 0x40434f
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x40434e
push dword [ebp + 0xc]
call fcn.00431980
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x40434e
push ebx
push esi
push 0x104
lea esi, [ebp - 0x108]
call fcn.00404130
pop ecx
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x404214
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x40434c
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x404251
cmp eax, 0x19000
jbe 0x404251
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x404257
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x40434c
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x404290
push dword [ebp + 0x10]
call fcn.00431980
cmp eax, esi
pop ecx
jle 0x404290
push dword [ebp + 0x10]
call fcn.00431980
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.00432882
mov ebx, 0x445720
mov esi, eax
push ebx
push esi
call fcn.00431a20
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x4042b7
push edi
call fcn.0041474f
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.00431c08
lea eax, [ebp + 8]
push eax
call fcn.00433bb8
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.00433b9d
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.00431a20
push edi
call fcn.0041474f
push dword [ebp + 0xc]
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x40432e
push dword [ebp + 0x10]
call fcn.00431980
test eax, eax
pop ecx
jbe 0x40432e
push dword [ebp + 0x10]
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0xc
push ebx
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00431936
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.0043196c
leave
ret
Function at 0x404359
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x459098]
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 0x2001f
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push SysReAllocString
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x404424
push ebx
push edi
push 4
pop edi
push edi
mov dword [ebp - 0x10], edi
call fcn.00432882
pop ecx
lea ecx, [ebp - 0x10]
push ecx
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x14]
push eax
push esi
mov esi, str.WarnOnZoneCrossing
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jne 0x4043e1
cmp dword [ebp - 0x14], edi
jne 0x4043fa
push edi
push dword [ebp - 0xc]
lea eax, [ebp - 0x18]
push eax
call fcn.00432200
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 8], eax
jmp 0x4043fa
xor eax, eax
inc eax
push edi
mov dword [0x459098], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push esi
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp + 8]
je 0x404410
push edi
lea eax, [ebp + 8]
push eax
push edi
push 0
push esi
push dword [ebp - 4]
call ebx
push dword [ebp - 0xc]
call fcn.00431936
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [ebp - 8]
pop esi
leave
ret

Function at 0x404b74
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push dword [ebp + 0x20]
sub eax, edi
push eax
lea eax, [esi + edi]
push eax
call fcn.00404a21
add esp, 0xc
cmp edi, dword [ebp + 0x10]
mov ecx, edi
jae 0x404bb7
xor edx, edx
mov eax, ecx
div dword [ebp + 0x18]
mov eax, dword [ebp + 0x14]
mov al, byte [edx + eax]
xor al, byte [ecx + esi]
xor al, byte [ebp + 0x1c]
mov byte [ecx + esi], al
inc ecx
cmp ecx, dword [ebp + 0x10]
jb 0x404b9b
pop edi
pop esi
pop ebp
ret
Function at 0x40f6c3
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x94]
sub esp, 0x114
mov eax, dword [0x45652c]
push ebx
push esi
push 0x2001f
push dword [ebp + 0x9c]
mov ebx, ecx
push dword [ebx]
xor esi, esi
lea ecx, [ebp - 0x74]
mov dword [ebp + 0x90], eax
mov dword [ebp - 0x74], esi
call fcn.0040f5f4
cmp eax, esi
jne 0x40f74b
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x40f714
lea eax, [ebp - 0x70]
push eax
call fcn.0040f6c3
cmp eax, esi
jne 0x40f74a
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
push esi
push dword [ebp - 0x74]
mov dword [ebp - 0x78], 0x100
call edi
test eax, eax
lea ecx, [ebp - 0x74]
je 0x40f707
call fcn.0040f5dd
push dword [ebp + 0x9c]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
lea ecx, [ebp - 0x74]
mov esi, eax
call fcn.0040f5dd
mov ecx, dword [ebp + 0x90]
mov eax, esi
pop esi
pop ebx
call fcn.0043196c
add ebp, 0x94
leave
ret 4
Function at 0x40fb5b
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov ebx, ecx
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x40fb66
push edi
push dword [esp + 0x18]
push 7
push 0
push dword [esp + 0x20]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebx
ret 8

Function at 0x411026
Capabilities:
Encode data using xor
Set current directory
Terminate process

Disassembly:
push ebp
lea ebp, [esp - 0x68]
sub esp, 0xd38
mov eax, dword [0x45652c]
push ebx
push esi
push edi
mov dword [ebp + 0x64], eax
call fcn.0042b1f3
call fcn.00404bbb
test al, al
jne 0x411065
xor ebx, ebx
push ebx
push str.Fatal_Error
push str.Files_are_altered_
add byte [eax], ch
jns 0x41109a
add byte [ebx - 1], dl
adc eax, sym.imp.USER32.dll_MessageBoxA
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
push 1
jmp 0x411c6d
push 0x445ada
push 0x458b28
call fcn.00431a20
pop ecx
pop ecx
or dword [edx], eax
add byte [ecx + 0x59], bl
mov esi, 0x104
push esi
mov edi, 0x458f28
push edi
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x5c
push edi
call fcn.004332f0
cmp eax, ebx
pop ecx
pop ecx
jne 0x4110a6
push ebx
push str.Fatal_Error
push str.Invalid_access_rights_
jmp 0x411057
push edi
mov byte [eax + 1], bl
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x4110bb
enter 0xffffffffffffc542, 0xffffffffffffff89
dec eax
arpl word [eax + 0x7f], cx
push edx
xor eax, 0xe1a97c91
xchg ebx, esp
or esp, dword [edi + 0x3948d5da]
loopne 0x4110c0
xchg ecx, eax
jl 0x411071
loope 0x411051
jecxz 0x4110d7
cmpsd dword [esi], dword es:[edi]
fcmovbe st(0), st(5)
dec eax
cmp eax, esp
in eax, dx
fistp dword [esi]
xchg edx, edx
or ah, dh
mov cl, byte [esp + esi*8]
mov dword [0x5e12cf66], eax
inc esi
xor dword [ebx + 0x70], 0xffffffaf
arpl word [ebp - 0x9461471], dx
mov ebx, 0x8c4c4a1c
dec ebx
jnp 0x411120
or byte [edi + ecx*4 - 0x63], dl
cmpsb byte [esi], byte es:[edi]
push ebx
xor eax, 0xcb4225c7
insd dword es:[edi], dx
leave
dec eax
push ebx
ror dword [ecx - 0x1d], 0x24
adc eax, 0x6f7583bc
mov ebp, 0x88c7be7a
jecxz 0x41110d
jp 0x4110cd
invalid
bound ecx, qword [ecx]
push edx
js 0x411169
movsb byte es:[edi], byte [esi]
inc edi
std
fild dword [edx + 0x4a]
jmp 0x36481305
add dword [edi], eax
insb byte es:[edi], dx
pop esp
cmp al, 0xfc
cmpsd dword [esi], dword es:[edi]
inc esp
test al, 0x27
cmp byte [esp + ecx*4], al
jle 0x4110c5
popfd
xchg edi, eax
test al, 0x56
sbb eax, 0x26586a44
mov dh, 0xe3
int1
rcr eax, 0x99
sbb dl, byte [esi]
cdq
push esi
sub dword [edi], esp
xor ch, bh
invalid
retf 0x5276
call fcn.00433ff9
int3

Function at 0x41474f
Capabilities:
Encode data using xor
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
test esi, esi
je 0x414782
push esi
call fcn.00431980
pop ecx
xor ecx, ecx
test eax, eax
jbe 0x414771
xor byte [ecx + esi], 0x2f
inc ecx
cmp ecx, eax
jb 0x414768
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp - 4]
leave
ret
Function at 0x4149ad
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push esi
jmp 0x4149b9
mov eax, dword [0x8d2a6e90]
jo 0x4149e7
test al, 0x6d
sal byte [eax - 0x24bb5f13], 0xa6
inc ecx
fsubr dword [esi + 0x45]
or dword [eax + ebp*2 - 0x39], 0xffffffa1
mov ebp, 0x2a8afac4
add ah, dl
inc ebx
dec esp
add cl, byte [eax + ecx*2]
dec eax
dec ebp
inc edx
adc ch, bl
push es
jmp 0x414a2a
xor ebp, ebx
and bl, byte [esi - 0x3d]
add byte [ebp - 0x547af040], al
add byte [eax], al
add byte [ebp - 0x72af7fbb], cl
inc ebp
mov word [eax - 0x73], ss
inc ebp
lodsb al, byte [esi]

Function at 0x414af8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x7b8]
sub esp, 0x838
mov eax, dword [0x45652c]
push esi
mov dword [ebp + 0x7b4], eax
lea eax, [ebp - 0x50]
push eax
push 0x20019
push 0
mov esi, ecx
push dword [esi + 0x100]
mov dword [ebp - 0x60], 0x800
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x414bea
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
push 0
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x414be1
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
inc eax
push edi
push eax
call fcn.00432882
pop ecx
mov edi, eax
lea eax, [ebp - 0x5c]
push eax
push edi
lea eax, [ebp - 0x58]
push eax
push 0
push str.cdgfilename
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x414bd9
cmp dword [ebp - 0x58], 1
jne 0x414bd9
push dword [esi + 0xfc]
call fcn.00431936
and dword [esi + 0xfc], 0
push edi
call fcn.00431980
inc eax
push eax
call fcn.00432882
push edi
push eax
mov dword [esi + 0xfc], eax
call fcn.00431a20
add esp, 0x14
push edi
call fcn.0043287d
pop ecx
pop edi
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esi + 0xfc]
mov ecx, dword [ebp + 0x7b4]
pop esi
call fcn.0043196c
add ebp, 0x7b8
leave
ret
Function at 0x417e11
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x45652c]
mov dword [ebp - 4], eax
je 0x41802d
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x41802c
push dword [ebp + 0xc]
call fcn.00431980
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x41802c
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.004332f0
cmp eax, edi
pop ecx
pop ecx
je 0x417e94
mov byte [eax + 1], 0
lea eax, [ebp - 0x108]
push str.wrapperdl.tdat
push eax
call fcn.00431a30
pop ecx
pop ecx
push ebx
push esi
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x417ef2
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x41802a
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x417f2f
cmp eax, 0x19000
jbe 0x417f2f
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x417f35
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x41802a
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x417f6e
push dword [ebp + 0x10]
call fcn.00431980
cmp eax, esi
pop ecx
jle 0x417f6e
push dword [ebp + 0x10]
call fcn.00431980
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.00432882
mov ebx, 0x445720
mov esi, eax
push ebx
push esi
call fcn.00431a20
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x417f95
push edi
call fcn.0041474f
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.00431c08
lea eax, [ebp + 8]
push eax
call fcn.00433bb8
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.00433b9d
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.00431a20
push edi
call fcn.0041474f
push dword [ebp + 0xc]
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x41800c
push dword [ebp + 0x10]
call fcn.00431980
test eax, eax
pop ecx
jbe 0x41800c
push dword [ebp + 0x10]
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0xc
push ebx
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00431936
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.0043196c
leave
ret
Function at 0x41a45d
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0xcc]
sub esp, 0x14c
mov eax, dword [0x45652c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [ebp + 0xc8], eax
lea eax, [ebp - 0x40]
push eax
xor esi, esi
mov ebx, 0x20019
push ebx
push esi
push dword [ebp + 0xd8]
mov dword [ebp - 0x5c], 0x104
push dword [ebp + 0xd4]
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x48], esi
call edi
test eax, eax
jne 0x41a5dc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
jne 0x41a5d3
mov eax, dword [ebp - 0x44]
inc eax
push eax
mov dword [ebp - 0x4c], eax
call fcn.00431a0b
push dword [ebp + 0xd8]
mov dword [ebp - 0x50], eax
call fcn.00431980
add eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x58]
lea eax, [eax + ecx + 0xa]
push eax
call fcn.00431a0b
add esp, 0xc
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x60], esi
mov eax, dword [ebp - 0x44]
inc eax
mov dword [ebp - 0x4c], eax
lea eax, [ebp - 0x80]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x4c]
push eax
push dword [ebp - 0x50]
push dword [ebp - 0x60]
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, esi
mov dword [ebp - 0x78], eax
jne 0x41a5ad
push dword [ebp - 0x50]
push dword [ebp + 0xd8]
push str._s_s
push dword [ebp - 0x54]
call fcn.00432a7c
add esp, 0x10
lea eax, [ebp - 0x48]
push eax
push ebx
push esi
push dword [ebp - 0x54]
push dword [ebp + 0xd4]
call edi
test eax, eax
jne 0x41a5b5
push dword [ebp + 0xe0]
push dword [ebp - 0x48]
call fcn.00419eff
cmp eax, esi
pop ecx
pop ecx
je 0x41a5a2
mov edx, dword [ebp + 0xdc]
mov ecx, dword [edx]
cmp ecx, esi
jne 0x41a59a
mov dword [edx], eax
jmp 0x41a5a2
mov ecx, dword [ecx + 0x34]
cmp dword [ecx + 0x34], esi
jne 0x41a597
mov dword [ecx + 0x34], eax
push dword [ebp - 0x48]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x41a5b5
cmp eax, 0x103
je 0x41a5b5
nop
inc dword [ebp - 0x60]
cmp dword [ebp - 0x78], esi
je 0x41a51d
push dword [ebp - 0x54]
call fcn.00431936
push dword [ebp - 0x50]
call fcn.00431936
pop ecx
pop ecx
push dword [ebp - 0x40]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 0xc8]
pop edi
pop esi
pop ebx
call fcn.0043196c
add ebp, 0xcc
leave
ret
Function at 0x41b090
Capabilities:
Get file size
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x510
cmp byte [ebp + 8], 0
mov eax, dword [0x45652c]
mov dword [ebp - 4], eax
je 0x41b2ac
push edi
xor edi, edi
cmp dword [ebp + 0xc], edi
je 0x41b2ab
push dword [ebp + 0xc]
call fcn.00431980
cmp eax, edi
pop ecx
mov dword [ebp - 0x510], eax
jle 0x41b2ab
push 0x104
lea eax, [ebp - 0x108]
push eax
push edi
mov byte [ebp - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.004332f0
cmp eax, edi
pop ecx
pop ecx
je 0x41b113
mov byte [eax + 1], 0
lea eax, [ebp - 0x108]
push str.wrapperdl.tdat
push eax
call fcn.00431a30
pop ecx
pop ecx
push ebx
push esi
push edi
mov esi, 0x80
push esi
push 4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileA]
push 2
mov ebx, 0x40000000
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
jne 0x41b171
push esi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push esi
push 4
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
cmp eax, 0xffffffff
mov dword [ebp - 0x50c], eax
je 0x41b2a9
push 0
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x41b1ae
cmp eax, 0x19000
jbe 0x41b1ae
push dword [ebp - 0x50c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push 5
push 0
push 2
push ebx
lea eax, [ebp - 0x108]
push eax
call edi
mov edi, eax
jmp 0x41b1b4
mov edi, dword [ebp - 0x50c]
cmp edi, 0xffffffff
je 0x41b2a9
push 2
xor ebx, ebx
push ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [ebp + 0x10], ebx
mov esi, dword [ebp - 0x510]
je 0x41b1ed
push dword [ebp + 0x10]
call fcn.00431980
cmp eax, esi
pop ecx
jle 0x41b1ed
push dword [ebp + 0x10]
call fcn.00431980
pop ecx
mov esi, eax
add esi, 0x64
push esi
call fcn.00432882
mov ebx, 0x445720
mov esi, eax
push ebx
push esi
call fcn.00431a20
add esp, 0xc
cmp byte [ebp + 0x14], 0
je 0x41b214
push edi
call fcn.0041474f
pop ecx
and dword [ebp + 8], 0
lea eax, [ebp + 8]
push eax
call fcn.00431c08
lea eax, [ebp + 8]
push eax
call fcn.00433bb8
push eax
push str._d__m__Y__H:_M:_S
lea eax, [ebp - 0x508]
push 0x400
push eax
call fcn.00433b9d
lea eax, [ebp - 0x508]
push eax
push esi
call fcn.00431a20
push edi
call fcn.0041474f
push dword [ebp + 0xc]
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0x30
cmp dword [ebp + 0x10], 0
je 0x41b28b
push dword [ebp + 0x10]
call fcn.00431980
test eax, eax
pop ecx
jbe 0x41b28b
push dword [ebp + 0x10]
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0xc
push ebx
push esi
call fcn.00431a20
push edi
call fcn.0041474f
add esp, 0xc
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.00431936
pop ecx
pop esi
pop ebx
pop edi
mov ecx, dword [ebp - 4]
call fcn.0043196c
leave
ret
Function at 0x41d2a3
Capabilities:
Delete file

Disassembly:
mov eax, 0x443a91
call fcn.004321d4
push ecx
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x1c], ebx
push edi
mov dword [ebp - 0x10], esp
mov dword [esi], 0x448b50
mov dword [ebp - 4], ebx
je 0x41d304
call fcn.0041bf2d
mov edi, eax
cmp edi, ebx
je 0x41d2e8
mov eax, dword [esi + 0x1c]
push dword [eax + 4]
push 0x44de88
push edi
call fcn.0040c2ed
mov eax, dword [edi]
push edi
call dword [eax + 8]
mov edi, dword [esi + 0x1c]
mov eax, dword [edi + 0xc]
cmp eax, ebx
je 0x41d2f8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov dword [edi + 0xc], ebx
mov eax, dword [esi + 0x1c]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esi + 0x20], ebx
je 0x41d328
push dword [esi + 0x2c]
push 0x44df28
push dword [esi + 0x28]
call fcn.0040c2ed
mov eax, dword [esi + 0x20]
mov dword [eax + 8], ebx
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x24]
cmp eax, ebx
je 0x41d335
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esi + 0x28]
cmp eax, ebx
je 0x41d342
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea ecx, [esi + 0x30]
cmp dword [ecx], ebx
je 0x41d34e
call fcn.0041b007
mov eax, dword [esi + 0x34]
cmp eax, ebx
je 0x41d35c
push eax
call fcn.0043287d
pop ecx
mov eax, dword [esi + 0x38]
cmp eax, ebx
je 0x41d36a
push eax
call fcn.0043287d
pop ecx
mov eax, dword [esi + 0x3c]
cmp eax, ebx
je 0x41d378
push eax
call fcn.0043287d
pop ecx
mov eax, dword [esi + 0x40]
cmp eax, ebx
je 0x41d386
push eax
call fcn.0043287d
pop ecx
lea eax, [esi + 0x48]
cmp byte [eax], bl
je 0x41d394
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret