joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b770
Capabilities:
Get common file path

Disassembly:
push 0xffffffffffffffff
push 0x411328
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push edi
mov edi, ecx
mov eax, dword [edi + 0x68]
test eax, eax
jne 0x40b81a
push esi
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString
push 0x104
push 0x104
lea ecx, [esp + 0x10]
mov dword [esp + 0x1c], 0
call sub.MFC42.DLL_CString::GetBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReleaseBuffer
push str.winhlp32.exe
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
je 0x40b801
push 0x6a
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
test eax, eax
je 0x40b801
push eax
call dword [sym.imp.USER32.dll_CopyIcon]
mov dword [edi + 0x68], eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [esp + 8]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040f790
pop esi
mov ecx, dword [esp + 8]
pop edi
mov dword fs:[0], ecx
add esp, 0x10
ret

Function at 0x40b830
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40b892
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x40baa0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x208
mov eax, dword [esp + 0x20c]
push ebx
push ebp
mov ebp, dword [esp + 0x218]
push esi
push edi
push ebp
push 0
push 0
push eax
push str.open
push 0
mov edi, ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x40bb94
lea ecx, [esp + 0x10]
push ecx
push str..htm
push SysReAllocString
mov ecx, edi
call fcn.0040b830
test eax, eax
jne 0x40bb94
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x10]
push str._shellopencommand
push edx
call ebx
lea eax, [esp + 0x10]
lea ecx, [esp + 0x10]
push eax
push ecx
push SysReAllocString
mov ecx, edi
call fcn.0040b830
test eax, eax
jne 0x40bb94
lea edx, [esp + 0x10]
push str.__1_
push edx
call dword [sym.imp.MSVCRT.dll__mbsstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40bb65
lea eax, [esp + 0x10]
push 0x4173fc
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
mov esi, eax
add esp, 8
test esi, esi
jne 0x40bb65
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0xf]
jmp 0x40bb68
mov byte [esi], 0
push 0x4173f8
push esi
call ebx
mov edx, dword [esp + 0x21c]
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret 8

Function at 0x40bd50
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x41140c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
push edi
mov dword [esp + 8], esi
mov dword [esi], 0x413114
mov dword [esp + 0x18], 3
call fcn.0040bfb0
lea ecx, [esi + 0x30]
mov byte [esp + 0x18], 2
call fcn.0040f988
lea ecx, [esi + 0x20]
mov byte [esp + 0x18], 1
call fcn.0040f988
lea edi, [esi + 0xc]
mov dword [esp + 0xc], edi
mov dword [edi], 0x4127fc
mov ecx, edi
mov byte [esp + 0x18], 4
call sub.MFC42.DLL_CGdiObject::DeleteObject
add esi, 4
mov dword [edi], 0x4127e8
mov dword [esp + 0xc], esi
mov dword [esi], 0x4127fc
mov ecx, esi
mov dword [esp + 0x18], 5
call sub.MFC42.DLL_CGdiObject::DeleteObject
mov ecx, dword [esp + 0x10]
mov dword [esi], 0x4127e8
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x40c100
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x411492
push eax
mov eax, 0x2024
mov dword fs:[0], esp
call fcn.0040fc80
push ebx
push esi
lea ecx, [esp + 0x1c]
or esi, 0xffffffff
call sub.MFC42.DLL_CFile::CFile
lea ecx, [esp + 8]
mov dword [esp + 0x2034], 0
call sub.MFC42.DLL_CException::CException
lea ecx, [esp + 0x18]
mov byte [esp + 0x2034], 1
call sub.MFC42.DLL_CString::CString
mov ebx, 0x412e60
push 0
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2038], 2
mov dword [esp + 0xc], ebx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0xffffffff
call fcn.0040f84a
mov eax, dword [esp + 0x2044]
mov byte [esp + 0x2034], 3
cmp eax, 9
jl 0x40c26e
mov ecx, dword [esp + 0x203c]
lea eax, [esp + 8]
push eax
push 0x40
push ecx
lea ecx, [esp + 0x28]
call sub.MFC42.DLL_CFile::Open
test eax, eax
je 0x40c26e
mov eax, dword [esp + 0x1c]
lea edx, [esp + 0x2c]
push 0x2000
push edx
lea ecx, [esp + 0x24]
call dword [eax + 0x3c]
test eax, eax
je 0x40c214
xor ecx, ecx
test eax, eax
je 0x40c1f6
xor edx, edx
mov ebx, esi
mov dl, byte [esp + ecx + 0x2c]
and ebx, 0xff
xor edx, ebx
shr esi, 8
mov edx, dword [edx*4 + 0x417450]
xor esi, edx
inc ecx
cmp ecx, eax
jne 0x40c1d5
mov edx, dword [esp + 0x1c]
lea eax, [esp + 0x2c]
push 0x2000
push eax
lea ecx, [esp + 0x24]
call dword [edx + 0x3c]
test eax, eax
jne 0x40c1cf
mov ebx, 0x412e60
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CFile::Close
mov eax, dword [esp + 0x2040]
not esi
push esi
push 0x417850
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
mov dword [esp + 8], ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x2034], 5
call fcn.0040f790
lea ecx, [esp + 0x1c]
mov dword [esp + 8], 0x4127e8
mov dword [esp + 0x2034], 0xffffffff
call fcn.0040f9d6
mov eax, 1
jmp 0x40c2d2
mov esi, dword [esp + 0x2048]
test esi, esi
je 0x40c29f
push 0x400
mov ecx, esi
call sub.MFC42.DLL_CString::GetBuffer
push 0
push 0x400
push eax
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CFileException::GetErrorMessage
push 0xffffffffffffffff
mov ecx, esi
call sub.MFC42.DLL_CString::ReleaseBuffer
mov dword [esp + 8], ebx
lea ecx, [esp + 0x18]
mov byte [esp + 0x2034], 4
call fcn.0040f790
lea ecx, [esp + 0x1c]
mov dword [esp + 8], 0x4127e8
mov dword [esp + 0x2034], 0xffffffff
call fcn.0040f9d6
xor eax, eax
mov ecx, dword [esp + 0x202c]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x2030
ret 0x10

Function at 0x40c350
Capabilities:
Create tcp socket

Disassembly:
push esi
push 6
push 1
push 2
mov esi, ecx
call dword [sym.imp.WS2_32.dll_socket]
cmp eax, 0xffffffff
mov dword [esi + 0x22c], eax
jne 0x40c384
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.socket___failed
mov ecx, esi
call fcn.0040c600
mov eax, reloc.OLEAUT32.dll_SysReAllocString
pop esi
ret
xor eax, eax
pop esi
ret
Function at 0x40c410
Capabilities:
Connect socket

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov word [esi], 2
mov ax, word [edi + 2]
push eax
call dword [sym.imp.WS2_32.dll_htons]
mov edx, dword [esi + 0x22c]
mov word [esi + 2], ax
mov ecx, dword [edi + 4]
push 0x10
push esi
push edx
mov dword [esi + 4], ecx
call dword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x40c464
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.connect___failed
mov ecx, esi
call fcn.0040c600
pop edi
mov eax, reloc.OLEAUT32.dll_SysReAllocString
pop esi
ret 4
mov dword [esi + 0x228], 1
pop edi
xor eax, eax
pop esi
ret 4

Function at 0x40c480
Capabilities:
Resolve dns

Disassembly:
sub esp, 0x10
xor eax, eax
push ebx
push esi
mov esi, dword [esp + 0x1c]
push edi
mov ebx, ecx
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x40c4df
mov edi, dword [esp + 0x24]
test edi, edi
je 0x40c4df
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x40c4ba
mov eax, dword [eax + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx]
mov dword [esp + 0x10], edx
jmp 0x40c4c5
push esi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov dword [esp + 0x10], eax
lea eax, [esp + 0xc]
mov ecx, ebx
push eax
mov word [esp + 0x12], di
call fcn.0040c410
pop edi
pop esi
pop ebx
add esp, 0x10
ret 8
pop edi
pop esi
mov eax, SysReAllocString
pop ebx
add esp, 0x10
ret 8

Function at 0x40c4f0
Capabilities:
Send data
Send data on socket

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esp + 8]
test ecx, ecx
je 0x40c53f
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40c53f
push 0
push eax
mov eax, dword [esi + 0x22c]
push ecx
push eax
call dword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x40c544
mov dword [esi + 0x228], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.send___failed
mov ecx, esi
call fcn.0040c600
mov eax, reloc.OLEAUT32.dll_SysReAllocString
pop esi
ret 8
mov eax, SysReAllocString
pop esi
ret 8

Function at 0x40c550
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov eax, dword [esp + 4]
push esi
test eax, eax
mov esi, ecx
je 0x40c592
mov ecx, dword [esp + 0xc]
mov edx, dword [esi + 0x22c]
push 0
push ecx
push eax
push edx
call dword [sym.imp.WS2_32.dll_recv]
cmp eax, 0xffffffff
jne 0x40c594
mov dword [esi + 0x228], 0
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
push str.recv___failed
mov ecx, esi
call fcn.0040c600
xor eax, eax
pop esi
ret 8
Function at 0x40e2c0
Capabilities:
Write file on windows

Disassembly:
push 0xffffffffffffffff
push 0x4117a8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
push ebx
push esi
mov ebx, ecx
push edi
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::CString
mov ecx, 8
xor eax, eax
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 0
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x48]
mov dword [esp + 0x3c], 0
test eax, eax
jle 0x40e3ba
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x40e3ba
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.MSVCRT.dll__stat]
add esp, 8
test eax, eax
jne 0x40e345
mov edx, dword [ebx + 4]
mov eax, dword [esp + 0x24]
shl edx, 0x14
cmp eax, edx
jg 0x40e345
push 0x417910
jmp 0x40e34a
push 0x41790c
mov eax, dword [ebx + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x40e3ba
mov eax, dword [esp + 0x4c]
mov edi, dword [sym.imp.MSVCRT.dll_fwrite]
test eax, eax
je 0x40e3a1
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x40e382
lea ecx, [esp + 0xc]
push ecx
mov ecx, ebx
call fcn.0040e4f0
push 0x416aec
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::operator
mov eax, dword [esp + 0xc]
push esi
mov ecx, dword [eax - 8]
push ecx
push 1
push eax
call edi
add esp, 0x10
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
push esi
push edx
push 1
push eax
call edi
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
lea ecx, [esp + 0xc]
mov dword [esp + 0x3c], 0xffffffff
call fcn.0040f790
mov ecx, dword [esp + 0x34]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x34
ret 0xc

Function at 0x40e3e0
Capabilities:
Read .ini file

Disassembly:
push 0xffffffffffffffff
push 0x4117e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebp
push esi
mov esi, ecx
push eax
lea ebp, [esi + 8]
mov ecx, ebp
call fcn.0040f84a
mov edx, dword [esp + 0x20]
test edx, edx
je 0x40e437
push edi
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
je 0x40e437
push edx
lea ecx, [esp + 0x24]
push ebp
push ecx
call sub.MFC42.DLL_operator
mov dword [esp + 0x14], 1
jmp 0x40e44f
push str.log.log
lea edx, [esp + 0x24]
push ebp
push edx
call sub.MFC42.DLL_operator
mov dword [esp + 0x14], 0
lea ecx, [esi + 0xc]
push eax
call fcn.0040f8b0
lea ecx, [esp + 0x20]
mov dword [esp + 0x14], 0xffffffff
call fcn.0040f790
lea ecx, [esp + 0x1c]
call sub.MFC42.DLL_CString::CString
push str._setting.ini
lea eax, [esp + 0xc]
push ebp
push eax
mov dword [esp + 0x20], 2
call sub.MFC42.DLL_operator
push eax
lea ecx, [esp + 0x20]
mov byte [esp + 0x18], 3
call fcn.0040f8b0
lea ecx, [esp + 8]
mov byte [esp + 0x14], 2
call fcn.0040f790
mov ecx, dword [esp + 0x1c]
push ecx
push 1
push str.logSize
push str.setting
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
lea ecx, [esp + 0x1c]
mov dword [esi + 4], eax
mov dword [esp + 0x14], 0xffffffff
call fcn.0040f790
mov ecx, dword [esp + 0xc]
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x40e690
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4117fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x114
push esi
lea eax, [esp + 8]
push edi
push eax
call sub.MFC42.DLL_CTime::GetTickCount
lea ecx, [esp + 0x14]
push str._Y__m__d__H:_M:_S
push ecx
lea ecx, [esp + 0x14]
call sub.MFC42.DLL_CTime::Format
mov edx, dword [eax]
mov dword [esp + 0x124], 0
push edx
push str.___Error_Time__s___n
call fcn.0040ec10
add esp, 8
lea ecx, [esp + 0x14]
mov dword [esp + 0x124], 0xffffffff
call fcn.0040f790
mov edi, dword [esp + 0x12c]
mov esi, dword [edi]
mov eax, dword [esi]
push eax
call fcn.0040e830
mov ecx, dword [esi]
push eax
push ecx
push str.Exception_code:__08X__s_n
call fcn.0040ec10
lea edx, [esp + 0x18]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esi + 0xc]
push eax
lea ecx, [esp + 0x30]
push 0x104
push ecx
push edx
call fcn.0040eab0
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x34]
lea eax, [esp + 0x3c]
push eax
mov eax, dword [esi + 0xc]
push ecx
push edx
push eax
push str.Fault_address:___08X__02X:_08X__s_n
call fcn.0040ec10
mov esi, dword [edi + 4]
push str._nRegisters:_n
call fcn.0040ec10
mov ecx, dword [esi + 0x9c]
mov edx, dword [esi + 0xa0]
mov eax, dword [esi + 0xa8]
push ecx
mov ecx, dword [esi + 0xac]
push edx
mov edx, dword [esi + 0xa4]
push eax
mov eax, dword [esi + 0xb0]
push ecx
push edx
push eax
push str.EAX:_08X_nEBX:_08X_nECX:_08X_nEDX:_08X_nESI:_08X_nEDI:_08X_n
call fcn.0040ec10
mov ecx, dword [esi + 0xb8]
mov edx, dword [esi + 0xbc]
add esp, 0x58
push ecx
push edx
push str.CS:EIP:_04X:_08X_n
call fcn.0040ec10
mov eax, dword [esi + 0xb4]
mov ecx, dword [esi + 0xc4]
mov edx, dword [esi + 0xc8]
push eax
push ecx
push edx
push str.SS:ESP:_04X:_08X__EBP:_08X_n
call fcn.0040ec10
mov eax, dword [esi + 0x8c]
mov ecx, dword [esi + 0x90]
mov edx, dword [esi + 0x94]
push eax
mov eax, dword [esi + 0x98]
push ecx
push edx
push eax
push str.DS:_04X__ES:_04X__FS:_04X__GS:_04X_n
call fcn.0040ec10
mov ecx, dword [esi + 0xc0]
push ecx
push str.Flags:_08X_n
call fcn.0040ec10
push esi
call fcn.0040eb50
push 0x41795c
call fcn.0040ec10
mov ecx, dword [esp + 0x15c]
add esp, 0x40
mov dword fs:[0], ecx
pop edi
pop esi
add esp, 0x120
ret
Function at 0x40eab0
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x30]
push 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40eb26
mov ecx, dword [esp + 0x38]
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x14]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x40eb26
mov eax, dword [esi + 0x3c]
xor ecx, ecx
add eax, esi
sub edi, esi
xor ebp, ebp
mov cx, word [eax + 0x14]
lea edx, [ecx + eax + 0x18]
xor ecx, ecx
mov cx, word [eax + 6]
test ecx, ecx
jbe 0x40eb26
lea eax, [edx + 0x10]
mov edx, dword [eax]
mov esi, dword [eax - 8]
mov ebx, dword [eax - 4]
cmp edx, esi
ja 0x40eb14
mov edx, esi
cmp edi, ebx
jb 0x40eb1e
add edx, ebx
cmp edi, edx
jbe 0x40eb30
inc ebp
add eax, 0x28
cmp ebp, ecx
jb 0x40eb06
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x1c
ret
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x40]
inc ebp
sub edi, ebx
mov dword [edx], ebp
mov dword [eax], edi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x1c
ret

Function at 0x40ec10
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x404
lea eax, [esp + 0x40c]
lea edx, [esp + 4]
push esi
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_wvsprintfA]
mov edx, dword [0x417dec]
mov esi, eax
lea eax, [esp + 4]
push 0
push eax
lea ecx, [esp + 0x10]
push esi
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, esi
pop esi
add esp, 0x404
ret
Function at 0x40fccb
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413360
push 0x40fe30
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
push 2
call sym.imp.MSVCRT.dll___set_app_type
nop
pop ecx
or dword [0x418130], 0xffffffff
or dword [0x418134], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x418114]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov ecx, dword [0x418110]
mov dword [eax], ecx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x41812c], eax
call fcn.0040fe63
cmp dword [0x417cc8], ebx
jne 0x40fd4e
push 0x40fe60
call dword [sym.imp.MSVCRT.dll___setusermatherr]
pop ecx
call fcn.0040fe4e
push 0x416020
push 0x41601c
call sub.MSVCRT.dll__initterm
mov eax, dword [0x41810c]
mov dword [ebp - 0x6c], eax
lea eax, [ebp - 0x6c]
push eax
push dword [0x418108]
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.MSVCRT.dll___getmainargs]
push 0x416018
push section..data
call sub.MSVCRT.dll__initterm
add esp, 0x24
mov eax, dword [sym.imp.MSVCRT.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x40fde1
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x40fdb5
cmp al, 0x22
jne 0x40fda7
cmp byte [esi], 0x22
jne 0x40fdbe
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
cmp al, bl
je 0x40fdc8
cmp al, 0x20
jbe 0x40fdba
mov dword [ebp - 0x30], ebx
lea eax, [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x40fdec
movzx eax, word [ebp - 0x2c]
jmp 0x40fdef
cmp byte [esi], 0x20
jbe 0x40fdbe
inc esi
mov dword [ebp - 0x74], esi
jmp 0x40fde1
push 0xa
pop eax
push eax
push esi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x78], ecx
push eax
push ecx
call sub.MSVCRT.dll__XcptFilter
pop ecx
pop ecx
ret
Function at 0x401d54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
xor ebx, ebx
cmp edi, ebx
jne 0x401d6d
push 0x80004005
call fcn.00401c46
mov esi, dword [ebp + 8]
push edi
push esi
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp + 0x10], ebx
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp esi, ebx
je 0x401dbc
mov ecx, dword [edi]
cmp ecx, ebx
jbe 0x401dba
cmp dword [ebp + 0x10], ebx
jbe 0x401db7
cmp dword [ebp + 0x10], 2
jbe 0x401dc3
cmp dword [ebp + 0x10], 7
jne 0x401db7
cmp ecx, 1
jb 0x401db7
lea edx, [ecx + esi]
cmp byte [edx - 1], bl
jne 0x401db7
cmp ecx, 1
jbe 0x401dbc
cmp byte [edx - 2], bl
je 0x401dbc
push 0xd
pop eax
mov byte [esi], bl
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp byte [ecx + esi - 1], bl
jmp 0x401db5
Function at 0x45e0f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4ba9eb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004af396
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x45e172
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004ad20d
mov eax, dword [eax]
push 0x4e51c0
push eax
call fcn.004a0074
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004af621
test bl, bl
je 0x45e172
push 0x4e51c0
lea ecx, [esp + 0xc]
call fcn.004af9b1
push 0x4e8d3c
lea ecx, [esp + 0xc]
call fcn.004af9b1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x45e1ae
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004af621
jmp 0x45e279
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x45e232
lea edx, [esp + 0x7c]
push 0x4e8d38
push edx
call fcn.004a0074
add esp, 8
test eax, eax
je 0x45e232
lea eax, [esp + 0x7c]
push 0x4e8d34
push eax
call fcn.004a0074
add esp, 8
test eax, eax
je 0x45e232
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x45e1c2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004af621
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x45ea70
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x45ead2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc