joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427b90
Capabilities:
Allocate thread local storage

Disassembly:
xor eax, eax
push esi
mov esi, ecx
mov dword [esi + 0x14], eax
mov dword [esi + 0x18], eax
mov dword [esi + 0x18], 4
mov dword [esi + 4], eax
mov dword [esi + 8], 1
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
mov dword [esi], eax
jne 0x427bc4
call fcn.00414d52
lea eax, [esi + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov eax, esi
pop esi
ret

Function at 0x427c2c
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push edi
mov edi, ecx
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
xor ebx, ebx
cmp esi, ebx
je 0x427c5a
mov eax, dword [esp + 0x10]
cmp eax, dword [esi + 8]
jl 0x427cf5
cmp dword [esp + 0x14], ebx
je 0x427cf5
jmp 0x427c97
push 0x10
call fcn.0042793e
cmp eax, ebx
je 0x427c70
mov ecx, eax
call fcn.00427b87
mov esi, eax
jmp 0x427c72
xor esi, esi
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
lea ebx, [edi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [edi + 0x14]
mov eax, dword [edi + 0x18]
mov dword [esi + eax], ecx
push ebx
mov dword [edi + 0x14], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
mov eax, dword [esi + 0xc]
cmp eax, ebx
jne 0x427cae
mov eax, dword [edi + 0xc]
shl eax, 2
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
jmp 0x427cbe
mov ecx, dword [edi + 0xc]
push 2
shl ecx, 2
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_LocalReAlloc]
cmp eax, ebx
mov dword [esi + 0xc], eax
jne 0x427cca
call fcn.00414d52
mov eax, dword [esi + 8]
mov ecx, dword [edi + 0xc]
sub ecx, eax
shl ecx, 2
push ecx
mov ecx, dword [esi + 0xc]
lea eax, [ecx + eax*4]
push ebx
push eax
call fcn.004084d0
mov eax, dword [edi + 0xc]
add esp, 0xc
push esi
mov dword [esi + 8], eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [esi + 0xc]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
pop edi
pop esi
mov dword [eax + edx*4], ecx
pop ebx
ret 8

Function at 0x427dba
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x427de8
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x427e06
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00427d24
jmp 0x427e06
mov eax, dword [esi + 0x14]
test eax, eax
je 0x427e06
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00427d24
test edi, edi
mov eax, edi
jne 0x427df0
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x448fb0]
test ecx, ecx
je 0x427eb9
jmp 0x427db9
ret 8
Function at 0x4281a5
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
mov eax, 0x434ba8
call fcn.00408464
mov eax, 0x1014
call fcn.00408530
mov eax, dword [0x446440]
xor eax, dword [ebp + 4]
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x1c], edi
cmp dword [ecx + 0x50], edi
mov dword [ebp - 0x10], eax
je 0x42827c
push dword [ebp + 0xc]
call fcn.004280f6
cmp eax, edi
mov dword [ebp - 0x14], eax
jne 0x4281eb
push dword [ebp + 0x14]
jmp 0x4282ad
push esi
call fcn.00419b82
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
lea ebx, [eax + 0x10]
mov dword [ebp + 0xc], ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x20]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp - 0x14]
call esi
cmp eax, edi
mov dword [ebp - 0x18], eax
jne 0x42824d
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 0x20]
lea ecx, [ebp + 0xc]
call fcn.00401880
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 0x14]
call esi
push 0xffffffffffffffff
lea ecx, [ebp + 0xc]
mov dword [ebp - 0x18], eax
call fcn.00404d30
mov ebx, dword [ebp + 0xc]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], edi
mov ecx, dword [ebp + 8]
pop esi
jne 0x42826a
lea eax, [ebp + 0xc]
push eax
call fcn.004048e0
jmp 0x428272
push dword [ebp + 0x14]
call fcn.004019d0
lea ecx, [ebx - 0x10]
call fcn.004019b0
jmp 0x4282b5
cmp dword [ebp + 0x14], edi
jne 0x428288
mov dword [ebp + 0x14], 0x439f48
push dword [ecx + 0x64]
lea eax, [ebp - 0x1020]
push 0x1000
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [ebp - 0x1020]
push eax
mov ecx, dword [ebp + 8]
call fcn.004019d0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
pop edi
pop ebx
call fcn.004084b4
leave
ret 0x10
Function at 0x4283d9
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x446440]
xor eax, dword [ebp + 4]
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00408d16
mov esi, eax
test esi, esi
pop ecx
je 0x428477
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
je 0x42846d
push ebx
push edi
mov edi, SysReAllocStringLen
and byte [eax], 0
push eax
push esi
call fcn.00409ba5
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x42846b
push 0x105
lea eax, [ebp - 0x10c]
push eax
xor ebx, ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x428448
inc ebx
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x42846b
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x5c
push esi
call fcn.00409b3a
test eax, eax
pop ecx
pop ecx
jne 0x42840f
pop edi
pop ebx
push esi
call fcn.00407c0a
xor eax, eax
pop ecx
inc eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop esi
call fcn.004084b4
leave
ret 4
Function at 0x431c85
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push esi
xor esi, esi
inc esi
test al, 1
push edi
je 0x431ccc
push ebx
push 0
mov ebx, 0x439f48
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueA]
mov edi, str.Insertable
push edi
push dword [ebp + 8]
call esi
test eax, eax
jne 0x431cc6
push eax
push ebx
push 1
push edi
push dword [ebp + 0xc]
call esi
test eax, eax
jne 0x431cc6
xor esi, esi
inc esi
jmp 0x431cc8
xor esi, esi
mov eax, dword [ebp + 0x10]
pop ebx
xor edi, edi
test al, 2
je 0x431cd7
mov edi, str.Apartment
test al, 4
je 0x431ce0
mov edi, str.Free
and eax, 6
cmp al, 6
jne 0x431cec
mov edi, str.Both
test edi, edi
je 0x431d37
lea eax, [ebp + 0x10]
push eax
push str.InprocServer32
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
je 0x431d37
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push edi
push 1
push 0
push str.ThreadingModel
push dword [ebp + 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
pop ebp
ret 0xc
Function at 0x431e0a
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x434c4d
call fcn.00408464
sub esp, 0x118
mov eax, dword [0x446440]
xor eax, dword [ebp + 4]
push esi
push edi
mov dword [ebp - 0x10], eax
call fcn.00419b82
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x18], eax
and dword [ebp - 4], 0
call fcn.00419b82
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x20], 0
mov edi, SysReAllocStringLen
cmp dword [ebp + 0x18], edi
mov byte [ebp - 4], 1
jne 0x431e71
lea eax, [ebp - 0x20]
push eax
push str.CLSID
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
mov dword [ebp - 0x24], 1
je 0x431f37
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
add dword [ebp + 8], 4
cmp dword [ebp + 0x18], edi
jne 0x431e9e
cmp byte [esi], 0
je 0x431f1e
push esi
call ebx
push dword [ebp + 0x10]
lea eax, [eax + esi + 1]
push dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
push esi
lea eax, [ebp - 0x18]
push eax
call fcn.00422879
push dword [ebp + 0x10]
lea eax, [ebp - 0x1c]
push dword [ebp + 0xc]
push dword [ebp - 0x14]
push eax
call fcn.00422879
cmp dword [ebp + 0x18], edi
mov eax, dword [ebp - 0x18]
jne 0x431ed8
cmp dword [eax - 0xc], 0
je 0x431f1e
cmp dword [ebp + 0x14], 0
jne 0x431f01
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x124]
push ecx
push eax
push dword [ebp + 0x18]
mov dword [ebp - 0x14], 0x100
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
test eax, eax
je 0x431f1e
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
push esi
mov dword [ebp - 0x14], eax
call ebx
push eax
push esi
push 1
push dword [ebp - 0x14]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegSetValueA]
test eax, eax
jne 0x431f2d
mov eax, dword [ebp + 8]
mov esi, dword [eax]
test esi, esi
jne 0x431e8c
jmp 0x431f36
cmp eax, 5
je 0x431f36
and dword [ebp - 0x24], 0
pop ebx
cmp dword [ebp - 0x20], 0
pop edi
pop esi
je 0x431f48
push dword [ebp - 0x20]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x1c]
add ecx, 0xfffffff0
call fcn.004019b0
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.004019b0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x24]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
xor ecx, dword [ebp + 4]
call fcn.004084b4
leave
ret 0x14
Function at 0x401740
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47dfd8
mov eax, dword fs:[0]
push eax
sub esp, 0x80
mov eax, dword [0x49d4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
push 0xa
push str.regsvr32__
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00406270
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
call fcn.00406360
push 4
push str.___s
lea ecx, [ebp - 0x28]
call fcn.00406270
push 0x40
lea eax, [ebp - 0x84]
push 0
push eax
call fcn.00464360
add esp, 0xc
mov dword [ebp - 0x88], 0x44
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x3c]
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
cmovae eax, dword [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x88]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push eax
push 0
movdqu xmmword [ebp - 0x3c], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40180b
xor bl, bl
jmp 0x40184b
push 0xffffffffffffffff
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x3c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40183a
push eax
call esi
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x401844
push eax
call esi
cmp dword [ebp - 0x2c], 0
sete bl
cmp dword [ebp - 0x14], 0x10
jb 0x40185c
push dword [ebp - 0x28]
call fcn.0045f8c1
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f8b2
mov esp, ebp
pop ebp
ret
Function at 0x401880
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e010
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x49d4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 8
jb 0x4018b7
mov eax, dword [esi]
jmp 0x4018b9
mov eax, esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push eax
call edi
test eax, eax
je 0x4018cd
mov al, 1
jmp 0x401a72
xor eax, eax
mov dword [ebp - 0x14], 7
push 0xffffffffffffffff
push eax
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
call fcn.00406790
mov dword [ebp - 4], 0
push 8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call fcn.00460130
add esp, 4
test eax, eax
jne 0x40192a
call fcn.0047c5e4
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x3c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x3c]
mov dword [eax], ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0
je 0x4019ba
lea esp, [esp]
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x4019ba
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x3c]
call fcn.004035b0
push 1
push ecx
push 0x488554
lea ecx, [ebp - 0x28]
call fcn.00403c40
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x40199c
push 1
push ecx
push 0x4885dc
lea ecx, [ebp - 0x28]
call fcn.00403c40
mov ecx, eax
cmp ecx, 0xffffffff
je 0x4019ba
cmp dword [ebp - 0x18], ecx
jb 0x401a14
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
xor edx, edx
mov word [eax + ecx*2], dx
cmp dword [ebp - 0x18], edx
jne 0x401950
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
mov dword [ebp - 0x40], 0
test eax, eax
je 0x401a43
push 0
lea eax, [ebp - 0x44]
push eax
push 1
push 0x4885b4
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x401a43
mov esi, dword [ebp - 0x2c]
dec esi
js 0x401a3f
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00403e30
mov ecx, eax
call fcn.004041b0
mov edx, eax
mov eax, dword [edx]
test eax, eax
jne 0x401a1e
jmp 0x401a20
push str.invalid_string_position
call fcn.0047c643
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
mov eax, dword [eax + ecx*4]
cmp dword [eax + 0x14], 8
jb 0x401a35
mov eax, dword [eax]
lea ecx, [ebp - 0x48]
push ecx
push eax
call edi
dec esi
jns 0x4019f2
mov bl, 1
jmp 0x401a45
xor bl, bl
lea ecx, [ebp - 0x3c]
call fcn.00403fd0
push dword [ebp - 0x3c]
call fcn.0045f8c1
add esp, 4
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 0x14], 8
jb 0x401a70
push dword [ebp - 0x28]
call fcn.0045f8c1
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f8b2
mov esp, ebp
pop ebp
ret
Function at 0x401e60
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e110
mov eax, dword fs:[0]
push eax
sub esp, 0x54
mov eax, dword [0x49d4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
cmp dword [esi + 0x14], 0x10
jb 0x401e97
mov eax, dword [esi]
jmp 0x401e99
mov eax, esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryA]
push eax
call edi
test eax, eax
je 0x401ead
mov al, 1
jmp 0x402051
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.00406d70
mov dword [ebp - 4], 0
push 8
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
call fcn.00460130
add esp, 4
test eax, eax
jne 0x401f09
call fcn.0047c5e4
mov dword [ebp - 0x3c], eax
lea ecx, [ebp - 0x3c]
mov dword [eax], 0
mov dword [eax + 4], 0
mov eax, dword [ebp - 0x3c]
mov dword [eax], ecx
mov byte [ebp - 4], 1
cmp dword [ebp - 0x18], 0
je 0x401f99
jmp 0x401f30
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call edi
test eax, eax
jne 0x401f99
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00403690
push 1
push ecx
push 0x4885b0
lea ecx, [ebp - 0x28]
call fcn.004038d0
mov ecx, eax
cmp ecx, 0xffffffff
jne 0x401f7c
push 1
push ecx
push 0x4885f4
lea ecx, [ebp - 0x28]
call fcn.004038d0
mov ecx, eax
cmp ecx, 0xffffffff
je 0x401f99
cmp dword [ebp - 0x18], ecx
jb 0x401ff3
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
mov dword [ebp - 0x18], ecx
cmovae eax, dword [ebp - 0x28]
mov byte [eax + ecx], 0
cmp dword [ebp - 0x18], 0
jne 0x401f30
lea eax, [ebp - 0x48]
mov dword [ebp - 0x48], 0xc
mov dword [ebp - 0x40], 0
test eax, eax
je 0x402022
push 0
lea eax, [ebp - 0x44]
push eax
push 1
push 0x4885b4
call dword [sym.imp.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW]
test eax, eax
je 0x402022
mov esi, dword [ebp - 0x2c]
dec esi
js 0x40201e
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push esi
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00403e30
mov ecx, eax
call fcn.004041b0
mov edx, eax
mov eax, dword [edx]
test eax, eax
jne 0x401ffd
jmp 0x401fff
push str.invalid_string_position
call fcn.0047c643
mov eax, dword [eax]
mov ecx, dword [eax + 8]
mov eax, dword [eax + 4]
dec ecx
and ecx, dword [edx + 8]
mov eax, dword [eax + ecx*4]
cmp dword [eax + 0x14], 0x10
jb 0x402014
mov eax, dword [eax]
lea ecx, [ebp - 0x48]
push ecx
push eax
call edi
dec esi
jns 0x401fd1
mov bl, 1
jmp 0x402024
xor bl, bl
lea ecx, [ebp - 0x3c]
call fcn.00404070
push dword [ebp - 0x3c]
call fcn.0045f8c1
add esp, 4
mov dword [ebp - 0x3c], 0
cmp dword [ebp - 0x14], 0x10
jb 0x40204f
push dword [ebp - 0x28]
call fcn.0045f8c1
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f8b2
mov esp, ebp
pop ebp
ret
Function at 0x402070
Capabilities:
Get common file path
Get program files directory
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e14b
mov eax, dword fs:[0]
push eax
sub esp, 0x240
mov eax, dword [0x49d4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push eax
call fcn.00464360
add esp, 0xc
lea eax, [ebp - 0x218]
push 0
push 0x26
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xor eax, eax
mov dword [ebp - 0x21c], 7
mov dword [ebp - 0x220], 0
mov word [ebp - 0x230], ax
cmp word [ebp - 0x218], ax
jne 0x4020fa
xor ecx, ecx
jmp 0x402112
lea ecx, [ebp - 0x218]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x402103
sub ecx, edx
sar ecx, 1
push ecx
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x230]
call fcn.00406b00
push 0x488554
lea edx, [ebp - 0x230]
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x248]
call fcn.00404960
mov edi, eax
add esp, 4
cmp esi, edi
je 0x402176
cmp dword [esi + 0x14], 8
jb 0x40215b
push dword [esi]
call fcn.0045f8c1
add esp, 4
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
mov ecx, esi
push edi
mov word [esi], ax
call fcn.00406610
cmp dword [ebp - 0x234], 8
jb 0x40218d
push dword [ebp - 0x248]
call fcn.0045f8c1
add esp, 4
xor eax, eax
mov dword [ebp - 0x234], 7
cmp dword [ebp - 0x21c], 8
mov dword [ebp - 0x238], 0
mov word [ebp - 0x248], ax
jb 0x4021c1
push dword [ebp - 0x230]
call fcn.0045f8c1
add esp, 4
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f8b2
mov esp, ebp
pop ebp
ret
Function at 0x4021e0
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e190
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x49d4b0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40221e
mov al, 1
jmp 0x4022da
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x402217
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
lea ecx, [ebp - 0x28]
call fcn.00406c00
push 1
push 0x4885f8
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0
call fcn.00403a80
lea ecx, [ebp - 0x40]
call fcn.00402300
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 1
call fcn.004039b0
cmp dword [ebp - 0x2c], 8
jb 0x40227e
push dword [ebp - 0x40]
call fcn.0045f8c1
add esp, 4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x4022c5
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4022c1
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
push 4
cmovae eax, dword [ebp - 0x28]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov bl, 1
jmp 0x4022c7
xor bl, bl
cmp dword [ebp - 0x14], 8
jb 0x4022d8
push dword [ebp - 0x28]
call fcn.0045f8c1
add esp, 4
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0045f8b2
mov esp, ebp
pop ebp
ret
Function at 0x402460
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x47e1cb
mov eax, dword fs:[0]
push eax
sub esp, 0x480
mov eax, dword [0x49d4b0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x488], edi
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x224], 0
mov word [ebp - 0x234], ax
mov dword [ebp - 4], eax
push 0x204
push eax
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x218]
push eax
call fcn.00464360
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4024e0
mov eax, dword [edi]
jmp 0x4024e2
mov eax, edi
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0045fb63
add esp, 0xc
lea eax, [ebp - 0x21c]
push str..
push 0x104
push eax
call fcn.0045fa60
add esp, 0xc
lea eax, [ebp - 0x484]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x402532
xor esi, esi
jmp 0x402620
cmp word [ebp - 0x458], 0x2e
je 0x4025fe
mov ecx, dword [ebp - 0x488]
call fcn.00406c60
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0045fb63
add esp, 0xc
lea eax, [ebp - 0x21c]
push 0x488554
push 0x104
push eax
call fcn.0045fa60
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x21c]
push 0x104
push eax
call fcn.0045fa60
add esp, 0xc
cmp word [ebp - 0x21c], 0
jne 0x4025a2
xor eax, eax
jmp 0x4025bf
lea eax, [ebp - 0x21c]
lea edx, [eax + 2]
jmp 0x4025b0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4025b0
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x234]
call fcn.00406b00
test byte [ebp - 0x484], 0x10
je 0x4025f0
push esi
mov edx, ebx
lea ecx, [ebp - 0x234]
call fcn.00402460
add esp, 4
mov ecx, ebx
jmp 0x4025f2
mov ecx, esi
lea eax, [ebp - 0x234]
push eax
call fcn.00403750
lea eax, [ebp - 0x484]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x402532
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esi, 1
cmp dword [ebp - 0x220], 8
jb 0x402637
push dword [ebp - 0x234]
call fcn.0045f8c1
add esp, 4
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0045f8b2
mov esp, ebp
pop ebp
ret
Function at 0x407390
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x40739b
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.004073b0