joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401d45
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push dword [ebp + 0xc]
pop esi
push 0x9999ff
push 1
push 6
call sub.gdi32.dll_CreatePen
mov dword [ebp - 4], eax
mov eax, dword [esi]
cmp eax, 5
je 0x401d6a
test dword [esi + 0x10], 1
je 0x401d90
push dword [0x405044]
push dword [esi + 0x18]
call sub.gdi32.dll_SelectObject
push 1
push 1
lea eax, [esi + 0x1c]
push eax
call sub.user32.dll_OffsetRect
jmp 0x401d9e
push dword [0x405040]
push dword [esi + 0x18]
call sub.gdi32.dll_SelectObject
push dword [ebp - 4]
push dword [esi + 0x18]
call sub.gdi32.dll_SelectObject
mov dword [ebp - 8], eax
push dword [0x405040]
lea eax, [esi + 0x1c]
push eax
push dword [esi + 0x18]
call sub.user32.dll_FillRect
push 4
push 4
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push dword [esi + 0x18]
call sub.gdi32.dll_RoundRect
lea eax, [ebp - 0x10]
push eax
push 8
push 0xd
push dword [esi + 0x14]
call sub.user32.dll_SendMessageA
push 1
push dword [esi + 0x18]
call sub.gdi32.dll_SetBkMode
push 0xccccff
push dword [esi + 0x18]
call sub.gdi32.dll_SetTextColor
push 0x25
lea eax, [esi + 0x1c]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x10]
push eax
push dword [esi + 0x18]
call sub.user32.dll_DrawTextA
push dword [ebp - 8]
push dword [esi + 0x18]
call sub.gdi32.dll_SelectObject
push dword [ebp - 4]
call sub.gdi32.dll_DeleteObject
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x100042d0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
xor esi, esi
xor edi, edi
xor ebp, ebp
test eax, eax
jbe 0x1000434f
mov ecx, dword [esp + 0x10]
push ebx
lea eax, [esi + 1]
xor edx, edx
div dword [0x10018128]
mov esi, edx
xor edx, edx
mov bl, byte [esi + ecx]
mov eax, ebx
mov byte [esp + 0x14], bl
and eax, 0xff
add eax, edi
div dword [0x10018128]
mov edi, edx
mov edx, dword [esp + 0x14]
and edx, 0xff
mov al, byte [edi + ecx]
mov byte [esi + ecx], al
xor eax, eax
mov byte [edi + ecx], bl
mov al, byte [esi + ecx]
add eax, edx
xor edx, edx
div dword [0x10018128]
mov eax, dword [0x1001812c]
sub edx, eax
mov eax, dword [esp + 0x18]
mov dl, byte [edx + ecx]
mov bl, byte [eax + ebp]
xor bl, dl
mov byte [eax + ebp], bl
mov eax, dword [esp + 0x1c]
inc ebp
cmp ebp, eax
jb 0x100042e6
pop ebx
pop edi
pop esi
pop ebp
ret
Function at 0x10004bd0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x1000f668
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
push 1
push str.UxTheme.dll
lea ecx, [esp + 0xc]
call sym.GuiLib.dll_public:_void___thiscall_CDllLoader::constructor_char_const___bool_
push str.DrawThemeBackground
lea ecx, [esp + 8]
mov dword [esp + 0x18], 0
call sym.GuiLib.dll_public:_int____stdcall___void____thiscall_CDllLoader::GetProcAddress_char_const__
mov ecx, dword [esp + 0x30]
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x2c]
push edx
mov edx, dword [esp + 0x2c]
push ecx
push edx
call eax
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x14], 0xffffffff
call sym.GuiLib.dll_public:_void___thiscall_CDllLoader::destructor_void_
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret
Function at 0x10005ea0
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
push ebp
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_CWnd::GetParentFrame
push eax
mov eax, dword [sym.imp.MFC42.DLL_CRuntimeClassconstCMDIFrameWnd::classCMDIFrameWnd]
push eax
call sub.MFC42.DLL_AfxDynamicDownCast
add esp, 8
test eax, eax
je 0x10005f2e
lea ecx, [esp + 0xc]
push ecx
mov ecx, eax
call sub.MFC42.DLL_CMDIFrameWnd::MDIGetActive
mov edi, eax
test edi, edi
je 0x10005eeb
mov ecx, edi
call sub.MFC42.DLL_CWnd::GetStyle
test eax, 0x80000
je 0x10005eeb
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10005eeb
mov eax, dword [edi + 0x20]
jmp 0x10005eed
xor eax, eax
cmp eax, dword [esi + 0xb0]
je 0x10005f2e
mov dword [esi + 0xb0], eax
mov edx, dword [esi + 0xd8]
xor edi, edi
dec edx
js 0x10005f27
mov ecx, dword [esi + 0xd4]
mov eax, dword [esi + 0xb0]
push eax
mov ecx, dword [ecx + edi*4]
call fcn.10004940
mov edx, dword [esi + 0xd8]
inc edi
dec edx
cmp edi, edx
jle 0x10005f06
mov ecx, esi
call sym.GuiLib.dll_protected:_void___thiscall_CMenuBar::UpdateMenuBar_void_
call sub.MFC42.DLL_AfxGetModuleState
mov ebp, dword [eax + 4]
mov eax, dword [ebp + 0xc4]
cmp eax, 3
je 0x10005f46
cmp eax, 4
jne 0x10005fb5
mov al, byte [esi + 0xc4]
test al, al
jne 0x10005fb5
push ebx
mov ebx, dword [sym.imp.USER32.dll_GetKeyState]
push 0x12
call ebx
mov di, ax
push 0x79
and edi, 0x8000
call ebx
mov bx, ax
mov ecx, ebp
and ebx, 0x8000
call sym.GuiLib.dll_public:_bool___thiscall_CWinAppEx::GetMenuUnderlines_void_const
test al, al
jne 0x10005f8b
test edi, edi
jne 0x10005f8b
test ebx, ebx
jne 0x10005f8b
mov edi, 0x100000
jmp 0x10005f8d
xor edi, edi
mov eax, dword [esi + 0x20]
push edi
push 0x100000
push 0x446
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
cmp eax, edi
pop ebx
je 0x10005fb5
mov ecx, dword [esi + 0x20]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
push edx
push eax
mov ecx, esi
call sub.MFC42.DLL_CToolBar::OnUpdateCmdUI
pop edi
pop esi
pop ebp
pop ecx
ret 8

Function at 0x10006960
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, ecx
mov al, byte [esi + 0xc5]
test al, al
jne 0x100069c2
mov eax, dword [esp + 8]
push edi
mov ecx, dword [eax + 0xc]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CToolBar::CommandToIndex
push 1
mov edi, eax
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setl al
xor edx, edx
test al, al
sete dl
mov eax, edx
mov edx, dword [esi + 0x20]
and eax, 0xffff
mov ecx, eax
shl ecx, 0x10
or ecx, eax
push ecx
push edi
push 0x464
push edx
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax], 0
ret 8
mov ecx, dword [esp + 0xc]
pop esi
mov dword [ecx], 0
ret 8
Function at 0x1000a9a0
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0xffffffffffffffff
push 0x1000fb78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
push ebx
push esi
push edi
mov esi, ecx
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 4]
cmp dword [eax + 0xc4], 4
sete bl
xor edi, edi
push edi
push 5
push 0x7f00
push edi
call dword [sym.imp.USER32.dll_LoadCursorA]
neg bl
sbb ebx, ebx
push eax
and ebx, 0x20000
or bh, 8
push ebx
call sub.MFC42.DLL_AfxRegisterWndClass
push eax
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
mov al, byte [esi + 0x86]
push edi
mov dl, al
push edi
neg dl
sbb edx, edx
lea ecx, [esp + 0x18]
and edx, 0xfe400000
push edi
add edx, 0x2400000
push ecx
mov ecx, dword [esp + 0x1c]
or edx, 0x84000000
neg al
sbb eax, eax
push edx
and al, 0
push edi
add eax, 0x188
push ecx
push eax
mov ecx, esi
mov dword [esp + 0x48], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
call sub.MFC42.DLL_CWnd::CreateEx
test eax, eax
jne 0x1000aa7d
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.1000e7dc
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
mov edx, dword [esp + 0x3c]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x34]
push edx
mov edx, dword [esp + 0x34]
push eax
push ecx
push edx
mov ecx, esi
call fcn.1000ab30
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call sub.MFC42.DLL_CWnd::FromHandle
mov eax, dword [esi + 0x20]
push 1
push eax
push 0x20
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
mov dword [0x100184b0], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push edi
push 0x1000b130
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 2
mov ecx, esi
mov dword [0x100184ac], eax
call sub.MFC42.DLL_CWnd::RunModalLoop
mov ecx, dword [0x100184ac]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [0x100184ac], edi
mov dword [0x100184b0], edi
mov edx, dword [esi]
mov ecx, esi
call dword [edx + 0x60]
lea ecx, [esp + 0xc]
mov dword [esp + 0x28], 0xffffffff
call fcn.1000e7dc
mov ecx, dword [esp + 0x20]
pop edi
pop esi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x20
ret 0x10
Function at 0x1000c180
Capabilities:
Check os version

Disassembly:
push 0xffffffffffffffff
push 0x1000fc6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x98
mov eax, dword [esp + 0xa8]
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call sub.MFC42.DLL_CWinApp::CWinApp
xor edi, edi
lea ecx, [esi + 0x234]
mov dword [esp + 0xa8], edi
call sub.MFC42.DLL_CImageList::CImageList
mov ecx, 0x11
mov eax, 0xa
mov dword [esi + 0x23c], 0x10012658
mov dword [esi + 0x240], edi
mov dword [esi + 0x244], ecx
mov dword [esi + 0x248], edi
mov dword [esi + 0x24c], edi
mov dword [esi + 0x250], edi
mov dword [esi + 0x254], eax
mov dword [esi + 0x258], 0x10012644
mov dword [esi + 0x25c], edi
mov dword [esi + 0x260], ecx
mov dword [esi + 0x264], edi
mov dword [esi + 0x268], edi
mov dword [esi + 0x26c], edi
mov dword [esi + 0x270], eax
lea ecx, [esp + 0xc]
mov byte [esp + 0xa8], 3
push ecx
mov dword [esi], sym.GuiLib.dll_const_CWinAppEx::vftable
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x1c]
mov ecx, 1
dec eax
je 0x1000c297
dec eax
je 0x1000c266
mov dword [esi + 0xc4], 5
jmp 0x1000c2b6
cmp dword [esp + 0x10], 5
jb 0x1000c28b
cmp dword [esp + 0x14], ecx
jb 0x1000c27f
mov dword [esi + 0xc4], 4
jmp 0x1000c2b6
mov dword [esi + 0xc4], 3
jmp 0x1000c2b6
mov dword [esi + 0xc4], 2
jmp 0x1000c2b6
mov eax, dword [esp + 0x10]
cmp eax, 4
ja 0x1000c2b0
jne 0x1000c2a8
cmp dword [esp + 0x14], edi
ja 0x1000c2b0
mov dword [esi + 0xc4], edi
jmp 0x1000c2b6
mov dword [esi + 0xc4], ecx
mov eax, dword [esi + 0xc4]
cmp eax, ecx
je 0x1000c2ce
cmp eax, 3
je 0x1000c2ce
cmp eax, 4
je 0x1000c2ce
xor eax, eax
jmp 0x1000c2d0
mov eax, ecx
mov ecx, esi
mov byte [esi + 0x230], al
call sym.GuiLib.dll_public:_void___thiscall_CWinAppEx::UpdateSystemParameters_void_
mov ecx, dword [esp + 0xa0]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0xa4
ret 4
Function at 0x1000e510
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [esp + 4]
push ebx
push ebp
push esi
test eax, eax
push edi
je 0x1000e554
xor esi, esi
mov si, word [eax + 6]
test esi, esi
je 0x1000e554
xor ecx, ecx
xor edx, edx
mov cx, word [eax + 0x14]
test esi, esi
lea ebx, [ecx + eax + 0x18]
jbe 0x1000e554
mov edi, dword [esp + 0x1c]
lea eax, [ebx + 0x10]
mov ecx, dword [eax - 4]
cmp edi, ecx
jb 0x1000e54c
mov ebp, dword [eax]
add ebp, ecx
cmp edi, ebp
jb 0x1000e55d
inc edx
add eax, 0x28
cmp edx, esi
jb 0x1000e53d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 0xc
lea edx, [edx + edx*4]
pop edi
pop esi
pop ebp
lea eax, [ebx + edx*8]
pop ebx
ret 0xc
Function at 0x404004
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004098d0
mov eax, dword [0x40a064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40a3cc]
push esi
push edi
xor edi, edi
shl eax, 2
mov esi, edi
test eax, eax
jle 0x404057
push edi
lea eax, [ebp - 0x1008]
push eax
push 2
push 0x4019c8
push dword [0x40a06c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x40a3cc]
inc esi
shl eax, 2
cmp esi, eax
jl 0x40402f
lea eax, [ebp + 0xc]
mov edx, 0x800
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x1004]
call fcn.00403f6e
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x404077
sub ecx, edx
lea eax, [ebp - 0x1008]
push edi
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [0x40a06c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004092a0
mov esp, ebp
pop ebp
ret

Function at 0x4040b5
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1008
call fcn.004098d0
mov eax, dword [0x40a064]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x40a3cc]
push esi
push edi
xor edi, edi
shl eax, 2
mov esi, edi
test eax, eax
jle 0x404108
push edi
lea eax, [ebp - 0x1008]
push eax
push 2
push 0x4019c8
push dword [0x40a06c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [0x40a3cc]
inc esi
shl eax, 2
cmp esi, eax
jl 0x4040e0
lea eax, [ebp + 0xc]
mov edx, 0x800
push eax
push dword [ebp + 8]
lea ecx, [ebp - 0x1004]
call fcn.00403f6e
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x404128
sub ecx, edx
lea eax, [ebp - 0x1008]
push edi
sar ecx, 1
push eax
lea eax, [ecx + ecx]
push eax
lea eax, [ebp - 0x1004]
push eax
push dword [0x40a06c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
lea eax, [ebp - 0x1008]
push eax
push 4
push 0x4019cc
push dword [0x40a06c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004092a0
mov esp, ebp
pop ebp
ret
Function at 0x405701
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov edx, ecx
mov ecx, 0x40a7a8
push ebx
push esi
xor ebx, ebx
push edi
mov esi, ebx
call fcn.004032e7
test eax, eax
je 0x4058ce
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x40a06c], eax
cmp eax, 0xffffffff
je 0x4058ce
lea ecx, [ebp - 0x24]
call fcn.0040477d
lea ecx, [ebp - 0x24]
call fcn.004047c6
mov esi, eax
test esi, esi
js 0x4058a4
push 0x401e88
lea ecx, [ebp - 0x24]
call fcn.00404846
mov esi, eax
test esi, esi
js 0x4058a4
lea ecx, [ebp - 0x24]
call fcn.004047c6
mov esi, eax
test esi, esi
js 0x4058a4
push 0x401ea0
lea ecx, [ebp - 0x24]
call fcn.00403282
mov esi, eax
test esi, esi
js 0x4058a4
lea ecx, [ebp - 0x24]
call fcn.004047c6
mov esi, eax
test esi, esi
js 0x4058a4
lea edx, [ebp - 0x24]
xor ecx, ecx
call fcn.0040553b
mov esi, eax
test esi, esi
js 0x4058a4
push 0x401ec0
push 0x401dd8
lea ecx, [ebp - 0x24]
call fcn.00405344
mov esi, eax
test esi, esi
js 0x4058a4
lea ecx, [ebp - 0x24]
call fcn.004047e6
mov esi, eax
test esi, esi
js 0x4058a4
lea ecx, [ebp - 0x24]
call fcn.004047e6
mov esi, eax
test esi, esi
js 0x4058a4
push 0x401f40
lea ecx, [ebp - 0x24]
call fcn.00404846
mov esi, eax
test esi, esi
jne 0x405832
push 1
lea eax, [ebp - 0x1c]
push 0x401d70
push eax
call fcn.00404ef6
mov esi, eax
add esp, 0xc
test esi, esi
js 0x4058a4
lea ecx, [ebp - 0x24]
call fcn.004047e6
mov esi, eax
test esi, esi
js 0x4058a4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 4], ebx
mov edi, ebx
call fcn.00405057
mov esi, eax
test esi, esi
js 0x405899
mov edi, dword [ebp - 0x1c]
lea eax, [ebp - 4]
push eax
mov ecx, edi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x10], ebx
call fcn.004045a4
mov esi, eax
test esi, esi
js 0x405899
push ebx
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
mov eax, dword [ebp - 4]
add eax, eax
push eax
push edi
push dword [0x40a06c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x405899
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test edi, edi
je 0x4058a4
push edi
call dword [sym.imp.ole32.dll_CoTaskMemFree]
push dword [0x40a06c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x4058bf
mov eax, dword [ecx + 4]
push ecx
mov dword [ebp - 0x24], eax
call fcn.00408fc9
pop ecx
mov ecx, dword [ebp - 0x24]
test ecx, ecx
jne 0x4058b2
lea ecx, [ebp - 0x1c]
call fcn.004048f6
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405ff4
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x40a064]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x104
lea eax, [ebp - 0x414]
mov esi, edx
push eax
push dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x40603c
lea eax, [ebp - 0x414]
mov ecx, esi
push eax
lea edx, [ebp - 0x20c]
call fcn.00405f8d
jmp 0x406041
mov eax, 0x80004005
test eax, eax
js 0x406094
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40604a
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jle 0x406094
push ecx
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x406094
push 0x4021e8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrW]
test eax, eax
jne 0x406094
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004092a0
mov esp, ebp
pop ebp
ret 4

Function at 0x406162
Capabilities:
Check if file exists
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x62c
mov eax, dword [0x40a064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push 0x104
lea eax, [ebp - 0x414]
mov edi, ecx
push eax
push 0x5601
mov ebx, edx
mov dword [ebp - 0x628], edi
push edi
mov dword [ebp - 0x620], ebx
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x4061c3
lea eax, [ebp - 0x414]
mov ecx, ebx
push eax
lea edx, [ebp - 0x20c]
call fcn.00405f8d
mov ebx, eax
mov dword [ebp - 0x624], eax
jmp 0x4061ce
mov ebx, 0x80004005
mov dword [ebp - 0x624], ebx
test ebx, ebx
js 0x4062bf
push esi
mov esi, 0x5610
mov edx, dword [ebp - 0x620]
mov ecx, edi
push esi
call fcn.00405ff4
inc esi
cmp esi, 0x5613
jbe 0x4061dc
and dword [ebp - 0x62c], 0
mov edi, 0x5630
mov esi, dword [ebp - 0x62c]
mov ebx, dword [ebp - 0x628]
push 0x104
lea eax, [ebp - 0x414]
push eax
push edi
push ebx
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x40623d
mov ecx, dword [ebp - 0x620]
lea eax, [ebp - 0x414]
push eax
lea edx, [ebp - 0x61c]
call fcn.00405f8d
jmp 0x406242
mov eax, 0x80004005
test eax, eax
js 0x406258
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x406258
inc esi
inc edi
cmp edi, 0x5631
jbe 0x40620b
mov ebx, dword [ebp - 0x624]
cmp esi, 2
mov esi, 0x5630
jl 0x4062be
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x406294
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4062be
mov ebx, dword [ebp - 0x628]
mov edx, dword [ebp - 0x620]
lea eax, [ebp - 0x20c]
push esi
push eax
mov ecx, ebx
call fcn.004060a5
inc esi
cmp esi, 0x5631
jbe 0x40629a
mov ebx, dword [ebp - 0x624]
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
xor ecx, ebp
pop ebx
call fcn.004092a0
mov esp, ebp
pop ebp
ret
Function at 0x4062d1
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x40a064]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
push 0x402458
push edi
call fcn.00406718
pop ecx
pop ecx
mov esi, edi
mov ebx, 0x4024a0
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], edi
push eax
push 0x20006
push edi
push dword [esi + 0x40a030]
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4063d4
test byte [esi + 0x40a038], 1
je 0x40636d
push dword [esi + 0x40a034]
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [esi + 0x40a034]
test eax, eax
jne 0x40635d
push ecx
push ebx
push edi
call fcn.00406718
add esp, 0xc
jmp 0x40636d
push eax
push ecx
push 0x402520
push edi
call fcn.00406718
add esp, 0x10
test byte [esi + 0x40a038], 2
je 0x4063c8
push ecx
mov ecx, dword [esi + 0x40a034]
lea edx, [ebp - 0x20c]
call fcn.00408f2b
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x4063b2
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call fcn.00406718
add esp, 0xc
jmp 0x4063c8
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x402520
push edi
call fcn.00406718
add esp, 0x10
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esi, 0xc
cmp esi, 0x24
jb 0x4062ff
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004092a0
mov esp, ebp
pop ebp
ret
Function at 0x4075f9
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x21c
mov eax, dword [0x40a064]
xor eax, esp
mov dword [esp + 0x218], eax
mov eax, dword [ebp + 8]
mov edx, 0x104
push ebx
push esi
push edi
xor edi, edi
mov dword [esp + 0x14], eax
push ecx
lea ecx, [esp + 0x1c]
mov dword [eax], edi
mov dword [eax + 4], edi
call fcn.0040379d
push 0x402a7c
lea ecx, [esp + 0x1c]
call fcn.0040698a
lea eax, [esp + 0x18]
push eax
push edi
push 0x1f0003
call dword [sym.imp.KERNEL32.dll_OpenSemaphoreW]
mov esi, eax
test esi, esi
jne 0x40767b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x4076b1
mov ecx, dword [ebp + 4]
mov edx, 0xc8
push 0x402a34
call fcn.00407397
mov edi, eax
jmp 0x4076b1
lea edx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov ecx, esi
call fcn.004074de
mov ebx, eax
test ebx, ebx
jns 0x4076a3
push ebx
push ecx
mov ecx, dword [ebp + 4]
mov edx, 0xce
call fcn.00407378
mov edi, ebx
jmp 0x4076b1
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
cdq
mov dword [ecx], eax
mov dword [ecx + 4], edx
test esi, esi
je 0x4076bb
push esi
call fcn.004073f3
mov ecx, dword [esp + 0x224]
mov eax, edi
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.004092a0
mov esp, ebp
pop ebp
ret 8

Function at 0x409290
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x4099a8
call fcn.00409698
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov edi, ebx
mov edx, 0x40aa54
mov ecx, esi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x409118
cmp eax, esi
jne 0x40910b
xor esi, esi
inc esi
mov edi, esi
jmp 0x40911b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4090ef
xor esi, esi
inc esi
cmp dword [0x40aa58], esi
jne 0x40912d
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x409167
cmp dword [0x40aa58], ebx
jne 0x409161
mov dword [0x40aa58], esi
push 0x4010e0
push 0x4010d4
call fcn.00409242
pop ecx
pop ecx
test eax, eax
je 0x409167
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x40923c
mov dword [0x40a084], esi
cmp dword [0x40aa58], esi
jne 0x40918a
push 0x4010d0
push 0x4010b0
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x40aa58], 2
test edi, edi
jne 0x409197
xor eax, eax
mov ecx, 0x40aa54
xchg dword [ecx], eax
cmp dword [0x40aa64], 0
je 0x4091c3
push 0x40aa64
call fcn.004094f0
pop ecx
test eax, eax
je 0x4091c3
push ebx
push 2
push ebx
mov esi, dword [0x40aa64]
mov ecx, esi
call dword [0x40b1b4]
call esi
push dword [0x40a090]
push dword [0x40a08c]
push dword [0x40a088]
call fcn.00405a2f
add esp, 0xc
mov dword [0x40a080], eax
cmp dword [0x40a098], 0
jne 0x409221
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov ecx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
push ecx
push eax
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x40a084], 0
jne 0x409235
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x40a080]
mov dword [ebp - 4], 0xfffffffe
call fcn.004096e0
ret
call fcn.004095e3
jmp 0x4090d3