joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40364e
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
mov ecx, reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ecx*8 + 0x41a054]
mov edx, dword [ecx*8 + 0x41a058]
bswap eax
bswap edx
mov dword [ecx*8 + 0x41a054], eax
mov dword [ecx*8 + 0x41a058], edx
inc ecx
jne reloc.gdi32.dll_SetWorldTransform
mov ecx, reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ecx*4 + 0x41a148]
mov edx, dword [ecx*4 + 0x41a134]
xor eax, dword [ecx*4 + 0x41a11c]
xor edx, dword [ecx*4 + 0x41a114]
xor eax, edx
rol eax, 1
mov dword [ecx*4 + 0x41a154], eax
inc ecx
jne reloc.gdi32.dll_SetWorldTransform
mov ebx, dword [0x41a000]
mov esi, dword [0x41a004]
mov edi, dword [0x41a008]
push dword [0x41a00c]
pop dword [ebp - 4]
push dword [0x41a010]
pop dword [ebp - 8]
mov ecx, reloc.gdi32.dll_SetWorldTransform
mov edx, esi
mov eax, edi
not edx
and eax, esi
and edx, dword [ebp - 4]
or eax, edx
add eax, dword [ecx*4 + 0x41a064]
add eax, dword [ebp - 8]
add eax, reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne reloc.gdi32.dll_SetWorldTransform
mov ecx, reloc.gdi32.dll_SetWorldTransform
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x41a0b4]
add eax, dword [ebp - 8]
add eax, reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne reloc.gdi32.dll_SetWorldTransform
mov ecx, reloc.gdi32.dll_SetWorldTransform
mov eax, edi
mov edx, dword [ebp - 4]
or eax, dword [ebp - 4]
and edx, edi
and eax, esi
or eax, edx
add eax, dword [ecx*4 + 0x41a104]
add eax, dword [ebp - 8]
add eax, reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne reloc.gdi32.dll_SetWorldTransform
mov ecx, reloc.gdi32.dll_SetWorldTransform
mov eax, esi
mov edx, edi
xor eax, dword [ebp - 4]
xor eax, edx
add eax, dword [ecx*4 + 0x41a154]
add eax, dword [ebp - 8]
add eax, reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
pop dword [ebp - 8]
mov dword [ebp - 4], edi
rol esi, 0x1e
mov edi, esi
mov esi, ebx
rol ebx, 5
add ebx, eax
inc ecx
jne reloc.gdi32.dll_SetWorldTransform
add dword [0x41a000], ebx
add dword [0x41a004], esi
add dword [0x41a008], edi
mov eax, dword [ebp - 4]
add dword [0x41a00c], eax
mov eax, dword [ebp - 8]
add dword [0x41a010], eax
leave
ret
Function at 0x4037d2
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 8]
call sub.wsock32.dll_inet_addr
cmp eax, reloc.gdi32.dll_SetWorldTransform
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call sub.wsock32.dll_gethostbyname
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov eax, reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, dword [eax + 0xc]
nop
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov eax, reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, dword [eax]
mov eax, dword [eax]
leave
ret 4

Function at 0x40380c
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
xor ebx, ebx
push 6
push 1
push 2
call sub.wsock32.dll_socket
cmp eax, reloc.gdi32.dll_SetWorldTransform
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
mov ebx, eax
push reloc.wsock32.dll_WSAIsBlocking
lea eax, [ebp - 0x10]
push eax
call fcn.0040189f
mov word [ebp - 0x10], 2
mov ecx, dword [ebp + 0x10]
xchg ch, cl
mov word [ebp - 0xe], cx
cmp dword [ebp + 0xc], 0
je reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0xc]
jmp reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp + 0xc], 0
jne reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp + 8], 0
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call fcn.004037d2
cmp eax, reloc.gdi32.dll_SetWorldTransform
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0xc], eax
push reloc.wsock32.dll_WSAIsBlocking
lea eax, [ebp - 0x10]
push eax
push ebx
call sub.wsock32.dll_connect
cmp eax, reloc.gdi32.dll_SetWorldTransform
jne reloc.gdi32.dll_SetWorldTransform
push ebx
call sub.wsock32.dll_closesocket
xor ebx, ebx
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x403890
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
cmp dword [ebp + 0x10], 0
jne reloc.gdi32.dll_SetWorldTransform
mov eax, 1
pop edi
pop ebx
leave
ret 0xc
mov edi, dword [ebp + 0xc]
mov ebx, 0
push 0
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call sub.wsock32.dll_send
test eax, eax
jle reloc.gdi32.dll_SetWorldTransform
add edi, eax
sub dword [ebp + 0x10], eax
cmp dword [ebp + 0x10], 0
jne reloc.gdi32.dll_SetWorldTransform
mov ebx, 1
jmp reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, ebx
pop edi
pop ebx
leave
ret 0xc
Function at 0x4038dc
Capabilities:
Get socket status

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
pop dword [ebp - reloc.gdi32.dll_SetMagicColors]
mov dword [ebp - reloc.gdi32.dll_GetFontResourceInfoW], 0
mov dword [ebp - reloc.gdi32.dll_AbortPath], 1
lea eax, reloc.gdi32.dll_CancelDC
push dword [ebp + 8]
pop dword [eax]
lea eax, reloc.gdi32.dll_SetMagicColors
push eax
push 0
push 0
lea eax, reloc.gdi32.dll_AbortPath
push eax
push 0
call sub.wsock32.dll_select
cmp eax, reloc.gdi32.dll_SetWorldTransform
je reloc.gdi32.dll_SetWorldTransform
or eax, eax
jne reloc.gdi32.dll_SetWorldTransform
xor eax, eax
jmp reloc.gdi32.dll_SetWorldTransform
mov eax, 1
leave
ret 8

Function at 0x40393c
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
sub ebx, ebx
push reloc.shlwapi.dll_StrFromTimeIntervalW
push dword [ebp + 8]
call fcn.004038dc
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_StrFromTimeIntervalW
push dword [ebp + 8]
call fcn.004038dc
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 8]
call sub.wsock32.dll_recv
test eax, eax
jle reloc.gdi32.dll_SetWorldTransform
mov eax, dword [ebp + 0x14]
cmp byte [ebp - 1], al
jne reloc.gdi32.dll_SetWorldTransform
mov bl, 1
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
push 0
push 1
lea eax, [ebp - 1]
push eax
push dword [ebp + 0xc]
call dword [edx + reloc.wsock32.dll_WSAIsBlocking]
push dword [ebp + 0xc]
call fcn.00401091
cmp eax, dword [ebp + 0x10]
jb reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
test ebx, ebx
je reloc.gdi32.dll_SetWorldTransform
mov eax, ebx
pop ebx
leave
ret 0x10

Function at 0x4039ae
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push ebx
sub ebx, ebx
push reloc.shlwapi.dll_StrFromTimeIntervalW
push dword [ebp + 8]
call fcn.004038dc
and eax, eax
je reloc.gdi32.dll_SetWorldTransform

Function at 0x403c09
Capabilities:
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
mov word [ebp - 4], 1
mov word [ebp - 2], reloc.shlwapi.dll_StrChrA
push 4
lea eax, [ebp - 4]
push eax
push reloc.shlwapi.dll_StrCSpnW
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call sub.wsock32.dll_setsockopt
leave
ret 4
Function at 0x403e9e
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x190]
push eax
push reloc.gdi32.dll_GetTextExtentPointI
call sub.wsock32.dll_WSAStartup
leave
ret
Function at 0x404049
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0xc]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp byte [eax], 0
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_SHRegGetUSValueW
push dword [ebp + 0xc]
call fcn.00401db1
mov dword [ebp - 0x148], eax
push reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x140]
push eax
call fcn.0040189f
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
test dword [edx], 0x10
je reloc.gdi32.dll_SetWorldTransform
lea eax, [edx + 0x2c]
push eax
push reloc.shlwapi.dll_StrRStrIA
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
lea edx, [ebp - 0x140]
lea eax, [edx + 0x2c]
push eax
push reloc.shlwapi.dll_StrRStrIA
call sub.kernel32.dll_lstrcmpiA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0xc]
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
jmp reloc.gdi32.dll_SetWorldTransform
push 0
push dword [ebp + 0xc]
call fcn.00401db1
lea edx, [ebp - 0x140]
lea edx, [edx + 0x2c]
push edx
push eax
call fcn.00401e05
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.00404049
call fcn.00401871
jmp reloc.gdi32.dll_SetWorldTransform
lea eax, [edx + 0x2c]
mov dword [ebp - 0x14c], eax
cmp dword [ebp + 0x10], 0
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.shlwapi.dll_StrStrIA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push eax
call fcn.00401e05
push eax
cmp dword [ebp + 0x18], 0
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call dword [ebp + reloc.wsock32.dll_WSASetBlockingHook]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x14]
push eax
push dword [ebp + 8]
call fcn.00403f0f
call fcn.00401871
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindClose
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
leave
ret 0x14
Function at 0x4046b0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [reloc.wsock32.dll_WSACleanup]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
lea eax, [ebp - 0x814]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumValueA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 1
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 7
je reloc.gdi32.dll_SetWorldTransform
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_SHRegSetUSValueW
lea eax, [ebp - 0x80c]
push eax
call sub.shlwapi.dll_StrStrIA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x818]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp + 0xc]
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x810], eax
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call fcn.00401522
cmp dword [ebp - 0x814], 1
jne reloc.gdi32.dll_SetWorldTransform
push 0
push dword [ebp + 8]
call fcn.00401522
jmp reloc.gdi32.dll_SetWorldTransform
push 1
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401558
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x4047be
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [reloc.wsock32.dll_WSACleanup]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
mov dword [ebp - 0x81c], eax
push 0
push reloc.shlwapi.dll_PathIsRelativeA
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push 0
push reloc.shlwapi.dll_SHRegDeleteUSValueW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [reloc.wsock32.dll_WSACleanup]
call fcn.00401d2a
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x81c], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
cmp dword [ebp - 0x818], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call fcn.00401522
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00401584
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004047be
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 8
Function at 0x408c1b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push reloc.shlwapi.dll_StrTrimW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.00403ee6
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408c1b
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408d0a
Capabilities:
Gather wise-ftp information
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call sub.advapi32.dll_RegOpenKeyA
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0x7ff
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x80c]
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call sub.advapi32.dll_RegEnumKeyExA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0x10]
call fcn.00401db1
push eax
mov edx, eax
lea eax, [ebp - 0x80c]
push eax
push edx
call fcn.00401db1
mov dword [ebp - 0x810], eax
call fcn.00401871
push 0
push 0
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
call fcn.00401d2a
mov dword [ebp - 0x814], eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.004023e6
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push eax
mov dword [ebp - 0x818], eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401f38
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_StrPBrkW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_StrPBrkW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
push reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_StrPBrkW
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 8]
call fcn.004041f4
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00408d0a
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call fcn.00401871
inc dword [ebp - 8]
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
leave
ret 0xc
Function at 0x408f88
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push ebx
mov dword [0x416812], 0
sub ebx, ebx
push dword [ebp + 8]
call sub.kernel32.dll_lstrlenA
mov edx, dword [ebp + 8]
cmp eax, 2
jbe reloc.gdi32.dll_SetWorldTransform
add edx, eax
sub edx, 2
cmp word [edx], 0x5c5c
jne reloc.gdi32.dll_SetWorldTransform
mov word [edx], reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call sub.kernel32.dll_SetCurrentDirectoryA
push 0x4167ee
push reloc.shlwapi.dll_StrIsIntlEqualA
call fcn.00402491
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 8]
call dword [0x4167ee]
add esp, 4
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
call dword [0x4167fe]
mov dword [0x416812], eax
cmp dword [0x416812], 0
jne reloc.gdi32.dll_SetWorldTransform
call dword [0x4167f2]
jmp reloc.gdi32.dll_SetWorldTransform
push 0
push 1
push dword [0x416812]
call dword [0x416802]
add esp, 0xc
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [0x416812]
call dword [0x41680a]
add esp, 4
call dword [0x4167f2]
mov dword [0x416812], 0
jmp reloc.gdi32.dll_SetWorldTransform
inc ebx
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x409547
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
mov dword [ebp - 0x148], 0
mov eax, dword [ebp + 0x14]
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
cmp byte [eax], 0
jne reloc.gdi32.dll_SetWorldTransform
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x14]
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0x14]
call fcn.00401db1
jmp reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_SHRegGetUSValueW
push dword [ebp + 0x14]
call fcn.00401db1
mov dword [ebp - 0x148], eax
push reloc.gdi32.dll_SetWorldTransform
lea eax, [ebp - 0x140]
push eax
call fcn.0040189f
lea eax, [ebp - 0x140]
push eax
push dword [ebp - reloc.gdi32.dll_SetWorldTransform]
call sub.kernel32.dll_FindFirstFileA
mov dword [ebp - 0x144], eax
inc eax
je reloc.gdi32.dll_SetWorldTransform
Function at 0x4097d6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
add esp, reloc.gdi32.dll_SetWorldTransform
push edi
push dword [ebp + 0xc]
call fcn.00401f38
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
pop edi
leave
ret 0xc
push dword [ebp + 0x10]
call fcn.00401f38
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
pop edi
leave
ret 0xc
push dword [ebp + 0xc]
call fcn.00402573
and eax, eax
jne reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_PathIsUNCServerShareW
push dword [ebp + 0xc]
call fcn.00401db1
jmp reloc.gdi32.dll_SetWorldTransform
push 0
push dword [ebp + 0xc]
call fcn.00401db1
mov dword [ebp - 0xc], eax
push reloc.shlwapi.dll_ColorHLSToRGB
push dword [ebp - 0xc]
call fcn.00401db1
mov dword [ebp - 8], eax
push reloc.gdi32.dll_SetWorldTransform
call fcn.00401888
mov dword [ebp - 4], eax
push reloc.gdi32.dll_SetWorldTransform
call fcn.00401888
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
call fcn.00401eef
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 4]
call sub.kernel32.dll_GetPrivateProfileSectionNamesA
cmp eax, 2
jbe reloc.gdi32.dll_SetWorldTransform
mov edi, dword [ebp - 4]
cmp byte [edi], 0
je reloc.gdi32.dll_SetWorldTransform
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push edi
call sub.shlwapi.dll_StrStrIA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
push reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0x10]
push 0x4150c6
push reloc.shlwapi.dll_SHRegGetBoolUSValueA
push edi
call sub.kernel32.dll_GetPrivateProfileStringA
and eax, eax
je reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 8]
push 1
push reloc.shlwapi.dll_StrNCatA
push edi
call sub.kernel32.dll_GetPrivateProfileIntA
cmp eax, 1
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00401db1
push eax
mov edx, eax
jmp reloc.gdi32.dll_SetWorldTransform
cmp byte [edx], 0x2f
jne reloc.gdi32.dll_SetWorldTransform
mov byte [edx], reloc.shlwapi.dll_PathIsUNCServerShareW
inc edx
and edx, edx
je reloc.gdi32.dll_SetWorldTransform
cmp byte [edx], 0
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call fcn.004097be
call fcn.00401871
jmp reloc.gdi32.dll_SetWorldTransform
push dword [ebp + 0x10]
push dword [ebp - 0x10]
push dword [ebp + 8]
call fcn.004097be
cld
xor eax, eax
mov ecx, reloc.gdi32.dll_SetWorldTransform
repne scasb al, byte es:[edi]
cmp byte [edi], al
jne reloc.gdi32.dll_SetWorldTransform
push dword [ebp - 0xc]
call fcn.00401871
push dword [ebp - 0x10]
call fcn.00401871
push dword [ebp - 8]
call fcn.00401871
push dword [ebp - 4]
call fcn.00401871
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.004097be
pop edi
leave
ret 0xc