joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409b10
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf0
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x20c], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x208], ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409c9e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40d4c4]
cmp dword [eax], 2
jne 0x409be0
mov byte [ebp - 0x203], bl
mov byte [ebp - 0x202], 0x3a
mov byte [ebp - 0x201], 0
mov byte [ebp - 0x102], 0
push pe_nt_image_headers32
lea eax, [ebp - 0x102]
push eax
lea eax, [ebp - 0x203]
push eax
call sub.kernel32.dll_QueryDosDeviceA
mov edx, esi
lea eax, [ebp - 0x102]
call fcn.00406d88
lea eax, [ebp - 0x208]
push eax
mov eax, dword [esi]
mov ecx, 4
mov edx, 1
call fcn.004044a8
mov eax, dword [ebp - 0x208]
mov edx, 0x409cb4
call fcn.00404394
jne 0x409bd4
push esi
mov eax, dword [esi]
call fcn.00404250
mov ecx, eax
mov eax, dword [esi]
mov edx, 5
call fcn.004044a8
jmp 0x409c80
mov eax, esi
call fcn.00403fe0
jmp 0x409c80
lea eax, [ebp - 0x210]
mov edx, ebx
call fcn.004041a8
mov eax, dword [ebp - 0x210]
lea edx, [ebp - 0x20c]
call fcn.00406708
mov eax, dword [ebp - 0x20c]
mov al, byte [eax]
sub al, 0x40
mov byte [ebp - 1], al
mov byte [ebp - 0x102], 0
pushal
push es
xor ebx, ebx
mov bh, 2
mov bl, byte [ebp - 1]
lea edx, [ebp - 0x102]
push 0
push 0x71aa
push 0x2a0010
call sub.kernel32.dll_BaseThreadInitThunk
pop es
popal
mov edx, esi
lea eax, [ebp - 0x102]
call fcn.00406d88
cmp dword [esi], 0
je 0x409c80
pushal
push ds
push es
xor ebx, ebx
lea esi, [ebp - 0x102]
lea edi, [ebp - 0x203]
mov ecx, 0
mov cl, 2
mov ch, 0
push ecx
push 0x7160
push 0x2a0010
call sub.kernel32.dll_BaseThreadInitThunk
pop es
pop ds
popal
mov edx, esi
lea eax, [ebp - 0x203]
call fcn.00406d88
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409ca5
lea eax, [ebp - 0x210]
mov edx, 3
call fcn.00404004
ret

Function at 0x409d44
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff78
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x88], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409dff
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebx], 0xffffffff
xor eax, eax
mov dword [ebx + 4], eax
lea eax, [ebp - 0x81]
push eax
push 0x81
call sub.kernel32.dll_GetLogicalDriveStringsA
test ax, ax
je 0x409de6
movzx eax, ax
cmp eax, 0x81
ja 0x409de6
lea esi, [ebp - 0x81]
jmp 0x409de1
inc dword [ebx]
inc dword [ebx + 4]
mov eax, dword [ebx + 4]
push eax
lea eax, [ebx + 8]
mov ecx, 1
mov edx, dword [0x409d04]
call fcn.00404e4c
add esp, 4
lea eax, [ebp - 0x88]
mov dl, byte [esi]
call fcn.004041a8
mov edx, dword [ebp - 0x88]
mov eax, dword [ebx]
mov ecx, dword [ebx + 8]
lea eax, [ecx + eax*4]
mov ecx, 0x409e14
call fcn.0040429c
add esi, 4
cmp byte [esi], 0
jne 0x409d9a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409e06
lea eax, [ebp - 0x88]
call fcn.00403fe0
ret
Function at 0x40b890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.00404438
xor eax, eax
push ebp
push 0x40b9c3
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [ebp - 4]
call fcn.00404250
mov esi, eax
inc esi
test esi, esi
jle 0x40b9a5
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.004044a8
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404448
push eax
push edi
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40b9a5
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.00404250
mov ecx, eax
sub ecx, esi
lea edx, [esi + 1]
mov eax, dword [ebp - 4]
call fcn.004044a8
cmp dword [ebp - 0xc], 0
jne 0x40b92c
xor esi, esi
jmp 0x40b936
mov eax, dword [ebp - 0xc]
call fcn.00404448
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40b99c
mov eax, dword [ebp - 0x18]
call fcn.00402554
mov edi, eax
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push 0
push esi
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40b995
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x10]
jne 0x40b98c
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [eax], edx
mov bl, 1
jmp 0x40b99c
mov eax, edi
call fcn.00402574
jmp 0x40b99c
mov eax, edi
call fcn.00402574
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b9ca
lea eax, [ebp - 0xc]
call fcn.00403fe0
lea eax, [ebp - 4]
call fcn.00403fe0
ret
Function at 0x40ba7c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor eax, eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x40bbd7
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.00407c18
add esp, 0xfffffff8
fstp qword [esp]
wait
lea ecx, [ebp - 0x12]
lea edx, [ebp - 0x10]
lea eax, [ebp - 0xe]
call fcn.00407bf8
lea eax, [ebp - 4]
push eax
push 0x40bbe8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyA
test eax, eax
jne 0x40bb2a
lea ecx, [ebp - 8]
mov edx, 0x40bc1c
mov eax, dword [ebp - 4]
call fcn.0040b9d8
lea ecx, [ebp - 0xc]
mov edx, 0x40bc28
mov eax, dword [ebp - 4]
call fcn.0040b9d8
mov eax, dword [ebp - 8]
call fcn.004067a8
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 0xc]
call fcn.004067a8
cmp ax, 0xc
jne 0x40bb0e
cmp ax, word [ebp - 0x10]
jbe 0x40bb0e
add word [ebp - 0x10], ax
mov edx, eax
shl eax, 5
sub eax, edx
add word [ebp - 0xe], ax
mov ax, word [ebp - 0x10]
mov edx, eax
shl eax, 5
sub eax, edx
add word [ebp - 0x12], ax
jmp 0x40bba3
lea edx, [ebp - 8]
movzx eax, word [ebp - 0x12]
call fcn.00406778
lea edx, [ebp - 0xc]
movzx eax, word [ebp - 0x10]
call fcn.00406778
lea eax, [ebp - 4]
push eax
push 0x40bbe8
push 0x80000002
call sub.advapi32.dll_RegCreateKeyA
mov eax, dword [ebp - 8]
call fcn.00404250
inc eax
push eax
mov eax, dword [ebp - 8]
call fcn.00404448
push eax
push 1
push 0x40bc30
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov eax, dword [ebp - 0xc]
call fcn.00404250
inc eax
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404448
push eax
push 1
push 0x40bc34
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegSetValueA
mov ax, word [ebp - 0x12]
mov word [ebp - 0xe], ax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey_1
movzx eax, word [ebp - 0x12]
movzx edx, word [ebp - 0xe]
sub eax, edx
cmp eax, 0xf
setg bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bbde
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00404004
ret
Function at 0x40bc3c
Capabilities:
Get common file path
Get hostname
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe04
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1fc], ecx
mov dword [ebp - 4], ecx
mov edi, edx
xor edx, edx
push ebp
push 0x40bd02
push dword fs:[edx]
mov dword fs:[edx], esp
dec eax
je 0x40bc6e
dec eax
je 0x40bc7b
dec eax
je 0x40bc88
jmp 0x40bca4
push 0x64
lea eax, [ebp - 0x68]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
jmp 0x40bca4
lea eax, [ebp - 0x68]
push eax
push 0x64
call sub.kernel32.dll_GetTempPathA
jmp 0x40bca4
lea eax, [ebp - 0x1f8]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
push 0x64
lea eax, [ebp - 0x68]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 4]
call fcn.00403fe0
mov esi, 1
jmp 0x40bccf
lea eax, [ebp - 0x1fc]
mov edx, ebx
call fcn.004041a8
mov edx, dword [ebp - 0x1fc]
lea eax, [ebp - 4]
call fcn.00404258
inc esi
mov bl, byte [ebp + esi - 0x69]
test bl, bl
jne 0x40bcb3
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.00406708
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40bd09
lea eax, [ebp - 0x1fc]
call fcn.00403fe0
lea eax, [ebp - 4]
call fcn.00403fe0
ret

Function at 0x40bd10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeac
push ebx
xor eax, eax
mov dword [ebp - 0x154], eax
mov dword [ebp - 0x150], eax
xor eax, eax
push ebp
push 0x40be12
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x40e870]
call fcn.00406c50
mov byte [0x40e851], 1
lea eax, [ebp - 0x150]
mov ecx, 0x40be28
mov edx, dword [0x40e870]
call fcn.0040429c
mov eax, dword [ebp - 0x150]
xor edx, edx
call fcn.00406980
mov edx, 0x40be28
lea eax, [ebp - 0x14c]
call fcn.00402b64
lea eax, [ebp - 0x14c]
call fcn.00402d60
mov edx, 0x40be28
lea eax, [ebp - 0x14c]
call fcn.00402b64
mov edx, 1
lea eax, [ebp - 0x14c]
call fcn.00402f84
push 0
mov edx, dword [0x40e85c]
mov ecx, dword [0x40e860]
lea eax, [ebp - 0x14c]
call fcn.00402ce8
lea eax, [ebp - 0x14c]
call fcn.00402d08
push 5
lea eax, [ebp - 0x154]
mov ecx, 0x40be28
mov edx, dword [0x40e870]
call fcn.0040429c
mov eax, dword [ebp - 0x154]
call fcn.00404448
push eax
call sub.kernel32.dll_WinExec
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40be19
lea eax, [ebp - 0x154]
mov edx, 2
call fcn.00404004
ret
Function at 0x40c364
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
mov byte [ebp - 1], 0
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [esi], eax
lea eax, [ebp - 8]
push eax
push edi
push 0
push ebx
push 2
call sub.mpr.dll_WNetOpenEnumA
test eax, eax
jne 0x40c471
xor eax, eax
push ebp
push 0x40c46a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 0x4000
mov eax, dword [ebp - 0xc]
call fcn.00402554
mov edx, dword [ebp + 8]
mov dword [edx], eax
xor eax, eax
push ebp
push 0x40c43a
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [esi], 0xffffffff
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.00402de4
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
push esi
mov eax, dword [ebp - 8]
push eax
call sub.mpr.dll_WNetEnumResourceA
mov ebx, eax
cmp ebx, 0xea
jne 0x40c407
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0xc]
call fcn.00402594
cmp ebx, 0xea
je 0x40c3c9
test ebx, ebx
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x40c430
mov eax, dword [ebp + 8]
mov eax, dword [eax]
call fcn.00402574
mov eax, dword [ebp + 8]
xor edx, edx
mov dword [eax], edx
xor eax, eax
mov dword [esi], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x40c453
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c471
mov eax, dword [ebp - 8]
push eax
call sub.mpr.dll_WNetCloseEnum
ret
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x40c780
Capabilities:
Create process on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov ecx, 6
push 0
push 0
dec ecx
jne 0x40c788
push ecx
mov eax, 0x40c730
call fcn.00405684
xor eax, eax
push ebp
push 0x40c97f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0x40e8d0
call fcn.00409d44
mov byte [0x40e850], 0
xor eax, eax
mov dword [0x40e860], eax
mov dword [0x40e8e8], 0xffffffff
xor eax, eax
mov dword [0x40e8ec], eax
mov byte [0x40e853], 0
lea edx, [ebp - 0x14]
mov eax, 1
call fcn.00402848
mov eax, dword [ebp - 0x14]
mov edx, 0x40c994
call fcn.00404394
jne 0x40c833
push 5
push 0x40c9a0
lea eax, [ebp - 0x20]
call fcn.00406c44
mov eax, dword [ebp - 0x20]
mov dl, byte [eax]
lea eax, [ebp - 0x1c]
call fcn.004041a8
push dword [ebp - 0x1c]
push 0x40c9bc
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.00404310
mov eax, dword [ebp - 0x18]
call fcn.00404448
push eax
call sub.kernel32.dll_WinExec
lea edx, [ebp - 0x24]
mov eax, 1
call fcn.0040bc3c
mov edx, dword [ebp - 0x24]
mov eax, 0x40e86c
call fcn.00404034
lea edx, [ebp - 0x28]
mov eax, 2
call fcn.0040bc3c
mov edx, dword [ebp - 0x28]
mov eax, 0x40e870
call fcn.00404034
call fcn.0040b7ec
mov byte [0x40e853], al
call fcn.0040be34
lea eax, [ebp - 0x30]
call fcn.00406c44
mov eax, dword [ebp - 0x30]
mov dl, byte [eax]
lea eax, [ebp - 0x2c]
call fcn.004041a8
lea eax, [ebp - 0x2c]
mov edx, 0x40c9bc
call fcn.00404258
mov eax, dword [ebp - 0x2c]
call fcn.00404448
push eax
call sub.kernel32.dll_GetDriveTypeA
cmp eax, 3
setne byte [0x40e851]
push 0x3f
call sub.user32.dll_GetSystemMetrics
and eax, 1
dec eax
sete byte [0x40e854]
cmp byte [0x40e854], 0
je 0x40c8ef
lea edx, [ebp - 0x34]
mov eax, 3
call fcn.0040bc3c
mov edx, dword [ebp - 0x34]
mov eax, 0x40e8cc
call fcn.00404034
mov eax, 0x40e8e8
call fcn.0040c614
cmp byte [0x40e853], 0
jne 0x40c959
cmp byte [0x40e851], 0
jne 0x40c944
call fcn.0040ba7c
test al, al
je 0x40c91a
cmp byte [0x40e850], 0
jne 0x40c91a
call fcn.0040b7a8
jmp 0x40c959
call fcn.0040c62c
mov eax, 0x40e8d0
xor edx, edx
call fcn.0040b62c
mov eax, 0x40e8e8
xor edx, edx
call fcn.0040b62c
mov eax, dword [0x40e868]
push eax
call sub.kernel32.dll_CloseHandle_1
jmp 0x40c959
mov eax, dword [0x40e868]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.0040bd10
call fcn.0040c62c
mov eax, dword [0x40e868]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40c986
lea eax, [ebp - 0x34]
mov edx, 9
call fcn.00404004
ret
Function at 0x401541
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x128]
push ebx
sub esp, 0x14c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 9
mov dword [esp + 8], eax
call fcn.004085e5
sub esp, 0x10
test eax, eax
jne 0x4016a1
mov eax, dword [ebp - 0x128]
test byte [ebp + 0x10], 2
je 0x4015d7
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x124], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x124]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x11d]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
sub esp, 0x20
cmp eax, 0x103
jne 0x401642
mov eax, dword [ebp + 0x10]
and eax, 1
mov dword [ebp - 0x12c], eax
jmp 0x4015ff
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00401541
sub esp, 0xc
test eax, eax
jne 0x401659
lea edx, [ebp - 0x11d]
xor eax, eax
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edx, [ebp - 0x11d]
sub esp, 0x10
test eax, eax
jne 0x401659
cmp dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x128]
je 0x4015e5
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x4016a1
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov dword [esp], 3
call fcn.00408e7c
push edx
test eax, eax
jne 0x40168b
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ecx
push ecx
jmp 0x4016a1
xor edx, edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x404429
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
test eax, eax
js 0x404465
add eax, dword [0x423158]
xor edx, edx
mov dword [0x437218], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [0x40b010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp], 4
call fcn.00404257
push esi
mov esi, eax
test eax, eax
js 0x40457b
lea eax, [ebp - 0xc]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov eax, dword [0x40b010]
mov dword [esp], eax
call fcn.00408414
sub esp, 0xc
test eax, eax
jne 0x4044a9
mov esi, 0xfffffffd
jmp 0x40457b
mov eax, dword [ebp - 0xc]
add dword [0x437218], 4
mov dword [esp], eax
call fcn.00404257
mov esi, eax
push ecx
test eax, eax
js 0x40457b
mov eax, dword [ebp - 0xc]
test ebx, ebx
jne 0x404536
mov eax, dword [ebp - 0xc]
test eax, eax
jle 0x40457b
mov edx, 0x4000
cmp eax, edx
cmovg eax, edx
mov dword [ebp - 0x10], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x433180
mov eax, dword [0x40b010]
mov dword [esp], eax
call fcn.00408414
sub esp, 0xc
test eax, eax
je 0x40449f
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], 0x433180
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.00408458
sub esp, 0xc
test eax, eax
je 0x404576
mov eax, dword [ebp - 0x10]
sub dword [ebp - 0xc], eax
add dword [0x437218], eax
add esi, eax
jmp 0x4044cd
xor edx, edx
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x10]
mov dword [esp + 0xc], edx
cmp dword [ebp + 0x14], eax
cmovle eax, dword [ebp + 0x14]
mov dword [esp + 4], ebx
mov dword [esp + 8], eax
mov eax, dword [0x40b010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x40449f
mov esi, dword [ebp - 0x10]
add dword [0x437218], esi
jmp 0x40457b
mov esi, 0xfffffffe
lea esp, [ebp - 8]
mov eax, esi
pop ebx
pop esi
pop ebp
ret 0x10
Function at 0x407ffc
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
mov dword [0x454ca0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x18], edx
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp + 0x20], 0x454ca0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x408068
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x40806c
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], edx
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExA]

Function at 0x4082c7
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
inc eax
push edx
je 0x4082f5
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x408300
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.004082c7
push ecx
cmp eax, 0xffffffff
je 0x408355
test byte [ebp + 0xc], 1
mov esi, eax
mov dword [esp], ebx
je 0x40834d
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edx
test eax, eax
jne 0x408346
test byte [ebp + 0xc], 4
jne 0x408355
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
push eax
jmp 0x408355
mov eax, 1
jmp 0x408357
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40832a
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x408360
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edx
cmp eax, 0xffffffff
jne 0x40837b
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
xor edx, edx
xor ecx, ecx
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], edx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x4083b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x64
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [ebp - 0xc], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
div ecx
xor eax, eax
add byte [ebp - 0xa], dl
mov dword [esp + 8], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
jne 0x408409
dec esi
jne 0x4083c4
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x408414
Capabilities:
Read file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x408451
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x408458
Capabilities:
Write file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x408495
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x408699
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x14]
sub esp, 0x30
mov dword [ebp - 0x10], 0x2000
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
xor eax, eax
cmp dword [ebp + 0x18], 0
setne al
shl eax, 8
or eax, 0x20019
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004085e5
sub esp, 0x10
test eax, eax
je 0x4086e5
mov byte [ebx], 0
jmp 0x408736
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov byte [ebx + 0x1fff], 0
test esi, esi
jne 0x4086e0
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x4086e0
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14