joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40fe70
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40ff96
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 4
sub esp, 0x94
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0xa4], ecx
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0xa4]
call fcn.0040fa70
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40ff03
mov ecx, dword [ebp - 0xa4]
call fcn.0040fda0
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x48]
add ecx, 0x48
call dword [eax + 0x44]
mov ecx, dword [ebp - 0xa4]
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x54]
add ecx, 0x54
call dword [eax + 0x44]
jmp 0x40ff08
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x14]
mov dword [ebp - 0xa0], eax
jmp 0x40ff1c
lea eax, [ebp - 0x9c]
push eax
mov eax, dword [ebp - 0xa0]
push eax
call fcn.00409490
add esp, 8
test eax, eax
je 0x40ff69
jmp 0x40ff3f
push pe_nt_image_headers32
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x40ff59
mov eax, dword [ebp - 0xa4]
mov eax, dword [eax + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xa4]
mov dword [ecx + 0x7c], eax
jmp 0x40ff87
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x14]
jmp 0x40ffa0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40ffc0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410212
push eax
mov dword fs:[0], esp
sub esp, 0x1a8
mov dword [ebp - 0x10], 0
push ebx
lea ecx, [ebp - 0x1c]
push esi
push edi
call fcn.0043100b
mov dword [ebp - 4], 1
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x4c]
push ecx
mov ebx, 2
push edx
call fcn.004096e0
add esp, 0xc
lea ecx, [ebp - 0x74]
mov byte [ebp - 4], bl
push 0xa
call fcn.0042f327
mov byte [ebp - 4], 3
lea eax, [ebp - 0x1b4]
mov ecx, dword [ebp - 0x4c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov edi, eax
jne 0x410077
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp + 8]
push eax
call fcn.00431017
or dword [ebp - 0x10], 1
mov byte [ebp - 4], bl
call fcn.00410202
mov byte [ebp - 4], 1
call fcn.0041020a
mov byte [ebp - 4], 0
call fcn.0041021c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpA]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test byte [ebp - 0x1b4], 0x10
je 0x4100c5
cmp dword [ebp + 0x1c], 0
je 0x4100c5
push 0x44f0f8
lea eax, [ebp - 0x188]
push eax
call esi
test eax, eax
je 0x4100c5
push 0x44f104
lea eax, [ebp - 0x188]
push eax
call esi
test eax, eax
je 0x4100c5
lea eax, [ebp - 0x188]
lea ecx, [ebp - 0x74]
push eax
call fcn.0042f4b6
test byte [ebp - 0x1b4], 6
jne 0x4100e8
mov eax, dword [ebp + 0x14]
cmp dword [ebp - 0x194], eax
jb 0x4100e8
mov eax, dword [ebp + 0x18]
cmp dword [ebp - 0x194], eax
jbe 0x41019a
lea eax, [ebp - 0x1b4]
push eax
push edi
call ebx
test eax, eax
jne 0x410083
cmp dword [ebp - 0x18], 0
jne 0x410179
cmp dword [ebp - 0x68], 0
je 0x410179
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x74]
push eax
call fcn.0042f4ec
mov byte [ebp - 4], 5
mov eax, dword [eax]
mov ecx, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x28]
push ecx
push edx
call fcn.004096e0
mov byte [ebp - 4], 7
add esp, 0xc
call fcn.004101e3
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
push eax
mov edx, dword [ebp + 0x14]
push ecx
mov eax, dword [ebp + 0x10]
push edx
mov ecx, dword [ebp - 0x28]
push eax
lea edx, [ebp - 0x40]
push ecx
push edx
call fcn.0040ffc0
add esp, 0x18
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 8
push eax
call fcn.00431174
mov byte [ebp - 4], 7
call fcn.004101db
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 3
jne 0x4101d4
call fcn.004101eb
cmp dword [ebp - 0x68], 0
jne 0x410102
lea ecx, [ebp - 0x74]
call fcn.0042f39a
lea eax, [ebp - 0x1c]
mov ecx, dword [ebp + 8]
push eax
call fcn.00431017
or dword [ebp - 0x10], 1
mov byte [ebp - 4], 2
jmp 0x41004c
lea eax, [ebp - 0x188]
mov ecx, dword [ebp + 0xc]
push eax
lea edx, [ebp - 0x58]
push ecx
push edx
call fcn.004096e0
add esp, 0xc
lea ecx, [ebp - 0x1c]
mov byte [ebp - 4], 4
push eax
call fcn.00431174
mov byte [ebp - 4], 3
call fcn.004101cc
jmp 0x4100f6
call fcn.004101eb
jmp 0x410179
Function at 0x410230
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x410298
push eax
mov dword fs:[0], esp
mov eax, dword [ebp + 8]
sub esp, 0x10
lea ecx, [ebp - 0x1c]
push eax
push ecx
call fcn.004102b0
add esp, 8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
sub eax, 5
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], 0xffffffff
cmp eax, 1
sbb dword [ebp - 0x10], ecx
neg dword [ebp - 0x10]
call fcn.004102a2
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x4105b0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4107ad
push eax
mov dword fs:[0], esp
sub esp, 0xa18
lea eax, [ebp - 0xa24]
push esi
push edi
push 0x44f4f8
push 0x7ff
push eax
push 0x44f4f4
push 0
push str.Drivers32
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 2
jbe 0x41078a
cmp byte [ebp - 0xa24], 0
lea ecx, [ebp - 0xa24]
mov dword [ebp - 0x10], ecx
je 0x41078a
lea ecx, [ebp - 0x1c]
lea edi, [ebp - 0x11f]
call fcn.0043100b
xor eax, eax
mov ecx, 0x40
mov dword [ebp - 4], 0
mov byte [ebp - 0x120], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
push 0x44f4f8
stosb byte es:[edi], al
lea edi, [ebp - 0x223]
push 0x103
mov byte [ebp - 0x224], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x120]
mov ecx, dword [ebp - 0x10]
push eax
push 0x456cb4
push ecx
push str.Drivers32
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jbe 0x41079f
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x14]
push eax
mov edx, dword [ebp - 0x10]
push ecx
push edx
call fcn.00410560
add esp, 0xc
lea ecx, [eax + 1]
cmp ecx, 1
sbb ecx, ecx
inc ecx
je 0x410761
mov ecx, dword [ebp + 0x14]
mov esi, dword [ecx + eax*4]
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x40000000
je 0x4106b8
xor eax, eax
jmp 0x4106c8
and eax, 0x80000000
cmp eax, 1
mov eax, 2
adc eax, 0xffffffff
sub eax, 2
cmp eax, 1
sbb eax, eax
neg eax
test eax, eax
je 0x4106fb
push 0x103
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x120]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionDrivers.desc
push 0x80000002
call fcn.00419b30
add esp, 0x14
push 0x44f5c0
push esi
call fcn.00409540
add esp, 8
test eax, eax
jne 0x410736
cmp dword [0x4578b8], 0
je 0x410736
mov ecx, dword [ebp - 0x10]
push ecx
mov ecx, dword [0x4578b8]
call fcn.0041d160
test eax, eax
je 0x410736
push 0x44f5a8
lea ecx, [ebp - 0x1c]
call fcn.0043118b
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x224]
push eax
lea edx, [ebp - 0x120]
push ecx
mov eax, dword [ebp - 0x10]
push edx
mov ecx, dword [ebp + 0x10]
push esi
mov edx, dword [ebp + 0xc]
push eax
push ecx
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.00410e40
add esp, 0x20
mov dword [ebp - 4], 0xffffffff
call fcn.004107b7
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebp - 0x10]
lea eax, [eax + ecx + 1]
mov dword [ebp - 0x10], eax
cmp byte [eax], 0
jne 0x410612
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0xffffffff
call fcn.004107b7
jmp 0x41078a
Function at 0x4107c0
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa08
lea eax, [esp + 0x208]
push ebx
push esi
push edi
push ebp
push 0x44f4f8
push 0x7ff
push eax
push 0x44f4f4
push 0
push 0x44f504
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 2
jbe 0x4108c6
cmp byte [esp + 0x218], 0
lea ebp, [esp + 0x218]
je 0x4108c6
mov esi, dword [esp + 0xa1c]
mov ebx, dword [esp + 0xa20]
lea edi, [esp + 0x11]
xor eax, eax
mov ecx, 0x40
push 0x44f4f8
mov byte [esp + 0x14], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov ecx, 0x40
push 0x103
stosb byte es:[edi], al
lea edi, [esp + 0x11d]
mov byte [esp + 0x11c], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
push eax
push 0x456cb4
push ebp
push 0x44f504
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 1
jbe 0x4108c6
mov eax, dword [esp + 0xa2c]
mov ecx, dword [esp + 0xa28]
push eax
push ecx
push ebp
call fcn.00410560
add esp, 0xc
cmp eax, 0xffffffff
je 0x4108b1
lea eax, [esp + 0x10]
push 0x456cb4
mov ecx, dword [esp + 0xa28]
push 0x456cb4
push eax
push 0x44f504
push ebp
push ecx
push ebx
push esi
call fcn.00410e40
add esp, 0x20
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ebp, [eax + ebp + 1]
cmp byte [ebp], 0
jne 0x41081a
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0xa08
ret
Function at 0x4119d0
Capabilities:
Check os version

Disassembly:
sub esp, 4
push ebx
push esi
push edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x40000000
je 0x4119e9
xor eax, eax
jmp 0x4119f9
and eax, 0x80000000
cmp eax, 1
mov eax, 2
adc eax, 0xffffffff
test eax, eax
je 0x411a35
call fcn.00411990
test eax, eax
jne 0x411a35
test byte [0x44bca4], 1
jne 0x411a20
or byte [0x44bca4], 1
call fcn.00411930
mov dword [0x44bca0], eax
cmp dword [0x44bca0], 0
mov edi, 0x458188
jne 0x411a3a
mov edi, 0x458a48
jmp 0x411a3a
mov edi, 0x4578c8
xor ebx, ebx
mov edx, edi
mov ecx, dword [esp + 0x14]
mov eax, dword [edx]
cmp eax, 0xffffffff
je 0x411ae4
cmp ecx, eax
je 0x411a66
add edx, 0x118
inc ebx
cmp ebx, 0xa
jl 0x411a42
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 4
ret
lea eax, [ebx*8]
push 0x103
sub eax, ebx
lea ecx, [eax + eax*4]
lea ebx, [edi + ecx*8 + 8]
mov eax, dword [edi + ecx*8 + 4]
lea esi, [edi + ecx*8]
push ebx
push eax
call fcn.0040b4b0
mov dword [esp + 0x18], ebx
add esp, 0xc
mov dword [esi + 0x10c], ebx
cmp byte [ebx], 0
jne 0x411aa1
cmp byte [ebx + 1], 0
je 0x411ab3
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call edi
add eax, ebx
inc eax
mov dword [esp + 0xc], eax
jmp 0x411ab9
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
mov eax, dword [esp + 0xc]
mov dword [esi + 0x110], eax
cmp byte [eax], 0
jne 0x411ace
cmp byte [eax + 1], 0
je 0x411ada
mov eax, dword [esp + 0xc]
push eax
call edi
inc eax
add dword [esp + 0xc], eax
mov eax, dword [esp + 0xc]
mov dword [esi + 0x114], eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 4
ret

Function at 0x412460
Capabilities:
Check os version

Disassembly:
call sub.AVIFIL32.dll_AVIFileInit
push 0
call fcn.00411120
add esp, 4
mov dword [0x4578c0], eax
push 0
call fcn.00411120
add esp, 4
mov dword [0x4578c4], eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x40000000
je 0x412494
xor eax, eax
jmp 0x4124a4
and eax, 0x80000000
cmp eax, 1
mov eax, 2
adc eax, 0xffffffff
cmp eax, 2
jne 0x4124ae
jmp 0x4124b0
ret
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x412556
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x20]
mov ecx, dword [eax*4 + 0x459308]
push ecx
push edx
call fcn.00408040
mov dword [ebp - 4], 0
add esp, 8
cmp dword [ebp - 0x1c], 0
je 0x41251b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x10]
push eax
mov edx, dword [ecx*4 + 0x459308]
push edx
call fcn.00412e20
add esp, 8
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x412541
mov dword [ebp - 4], 0xffffffff
call fcn.00412560
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 5
jb 0x4124d9
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 1
mov dword [ebp - 4], 0xffffffff
call fcn.00412560
jmp 0x412530
Function at 0x4152c0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x528
push ebx
push esi
push edi
push ebp
push 0x4a
push eax
call fcn.00414e60
mov dword [esp + 0x18], 0
add esp, 8
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [esp + 0x24]
push 0x103
mov ecx, dword [esp + 0x14]
push eax
push ecx
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x4154f2
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, eax
push str.NotInsertable
lea eax, [esp + ebx + 0x28]
push eax
call esi
lea eax, [esp + 0x24]
push eax
call fcn.00415290
add esp, 4
test eax, eax
jne 0x4154e0
lea edi, [esp + 0x435]
xor eax, eax
mov byte [esp + 0x434], 0
mov ecx, 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x129]
mov ecx, 0x40
mov byte [esp + 0x128], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x331]
mov ecx, 0x40
mov byte [esp + 0x330], al
push str.CLSID
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + ebx + 0x28]
push eax
call esi
lea eax, [esp + 0x330]
push 0x103
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.00415260
add esp, 0xc
cmp byte [esp + 0x330], 0
je 0x4154e0
lea eax, [esp + ebx + 0x24]
push str.protocolStdFileEditing_server
push eax
call esi
lea eax, [esp + 0x128]
push 0x103
lea ecx, [esp + 0x28]
push eax
push ecx
call fcn.00415260
add esp, 0xc
test eax, eax
jne 0x41548b
lea eax, [esp + ebx + 0x24]
push str.Insertable
push eax
call esi
lea eax, [esp + 0x24]
push eax
call fcn.00415290
add esp, 4
test eax, eax
je 0x4154e0
lea eax, [esp + 0x330]
lea ecx, [esp + 0x22c]
push eax
push str.CLSID_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp + 0x20], str.LocalServer32
mov dword [esp + 0x24], str.InProcServer32
mov dword [esp + 0x28], str.LocalServer
mov dword [esp + 0x2c], str.InProcServer
lea edi, [esp + eax + 0x238]
lea ebp, [esp + 0x20]
add esp, 0xc
mov eax, dword [ebp]
push eax
push edi
call esi
lea eax, [esp + 0x128]
push 0x103
lea ecx, [esp + 0x230]
push eax
push ecx
call fcn.00415260
add esp, 0xc
test eax, eax
jne 0x415481
add ebp, 4
lea eax, [esp + 0x24]
cmp ebp, eax
jb 0x41544e
cmp byte [esp + 0x128], 0
je 0x4154e0
lea eax, [esp + 0x434]
push 0x103
lea ecx, [esp + 0x28]
push eax
mov byte [esp + ebx + 0x2c], 0
push ecx
call fcn.00415260
lea ecx, [esp + 0x33c]
lea edx, [esp + 0x440]
lea eax, [esp + 0x134]
add esp, 0xc
push ecx
push edx
lea ecx, [esp + 0x2c]
push eax
mov edx, dword [esp + 0x548]
push ecx
push edx
call fcn.00415510
add esp, 0x14
call fcn.0040d290
test eax, eax
jne 0x4154f2
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0x3e8
jl 0x4152e7
mov eax, 1
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x528
ret
Function at 0x4159a6
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x415b2d
push eax
mov dword fs:[0], esp
sub esp, 0x184
mov dword [ebp - 0x10], 0
push ebx
lea eax, [ebp - 0x24]
push esi
mov ebx, dword [ebp + 8]
push edi
push 0
push ebx
push eax
call fcn.00409820
add esp, 0xc
lea eax, [ebp - 0x30]
mov dword [ebp - 4], 0
mov edi, dword [ebp - 0x24]
push 1
push ebx
push eax
call fcn.00409820
add esp, 0xc
lea eax, [ebp - 0x3c]
mov byte [ebp - 4], 1
mov esi, dword [ebp - 0x30]
push 2
push ebx
push eax
call fcn.00409820
add esp, 0xc
lea eax, [ebp - 0x190]
mov byte [ebp - 4], 2
mov ebx, dword [ebp - 0x3c]
push esi
push edi
push str.Are_you_sure_you_want_to_kill__s___s_
push eax
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
call edi
add esp, 0x10
lea ecx, [ebp - 0x190]
push 0x24
push ecx
call fcn.00419a20
add esp, 8
cmp eax, 6
jne 0x415ae5
push 0x10
lea eax, [ebp - 0x18]
push eax
push esi
call fcn.004201ad
add esp, 0xc
mov esi, eax
push 0x456cb4
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x415a92
push esi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x415ab5
cmp ebx, 0xffffffff
je 0x415ab5
push 0x29a
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x415ab5
cmp dword [0x457840], 0
jne 0x415aa0
call fcn.0040e5a0
cmp dword [0x457844], 0
je 0x415ab5
push esi
call fcn.0040e7f0
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x415ae5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.Unable_to_kill_process_0x_08X__error__lu_
lea eax, [ebp - 0x190]
push eax
call edi
add esp, 0x10
lea eax, [ebp - 0x190]
push 0x30
push eax
call fcn.00419a20
add esp, 8
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00415b1d
mov byte [ebp - 4], 0
call fcn.00415b25
mov dword [ebp - 4], 0xffffffff
call fcn.00415b37
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x416c50
Capabilities:
Get disk information

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x416cfd
push eax
movsx eax, byte [ebp + 8]
mov dword fs:[0], esp
sub esp, 0x118
mov dword [ebp - 0x10], 0
push ebx
push eax
call fcn.0042045a
add esp, 4
mov bl, al
lea ecx, [ebp - 0x20]
call fcn.0043100b
mov dword [ebp - 4], 0
movsx eax, bl
push eax
lea ecx, [ebp - 0x20]
push 0x4501c0
push ecx
call fcn.0042ddf7
add esp, 0xc
lea eax, [ebp - 0x124]
mov ecx, dword [ebp - 0x20]
push 0x103
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x416cd9
lea eax, [ebp - 0x124]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.0043118b
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call fcn.00416d07
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x416eb0
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x10]
push esi
push edi
mov esi, 1
mov ecx, dword [esp + 0x14]
push str.system.ini
push eax
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push ecx
push 0x459458
push str.display.drv
push str.boot.description
call edi
cmp eax, 2
jae 0x416ee4
xor esi, esi
mov eax, dword [esp + 0x10]
push str.system.ini
mov ecx, dword [esp + 0x10]
push eax
push ecx
push 0x459458
push str.display.drv
push str.boot
call edi
cmp eax, 2
jae 0x416f0b
xor esi, esi
mov eax, esi
pop edi
pop esi
ret

Function at 0x4177d0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x824
mov eax, dword [esp + 0x834]
push ebx
push esi
push edi
mov esi, dword [esp + 0x844]
push ebp
lea ecx, [esp + 0x424]
push esi
push eax
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
push str.SOFTWAREMicrosoftShared_Tools
push 0x450798
push ecx
call ebx
lea ecx, [esp + 0x24]
lea eax, [esp + 0x438]
mov dword [esp + 0x24], 0
add esp, 0x14
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ecx
push 0x20019
push 0
push eax
push 0x80000002
call ebp
test eax, eax
je 0x417844
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x824
ret
xor ebp, ebp
lea edi, [esp + 0x15]
xor eax, eax
mov ecx, 0x40
push 0x103
mov byte [esp + 0x18], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x417968
lea eax, [esp + 0x14]
push str.Normal
lea ecx, [esp + 0x324]
push eax
push 0x4507a8
push ecx
call ebx
lea edi, [esp + 0x129]
lea edx, [esp + 0x330]
add esp, 0x10
xor eax, eax
mov ecx, 0x40
push 0x103
mov byte [esp + 0x11c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x221]
mov ecx, 0x40
mov byte [esp + 0x220], al
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea ecx, [esp + 0x11c]
mov eax, dword [esp + 0x14]
push ecx
push str.Dictionary
push edx
push eax
call fcn.00419b30
lea ecx, [esp + 0x230]
lea edx, [esp + 0x334]
mov eax, dword [esp + 0x24]
add esp, 0x14
push 0x103
push ecx
push str.Engine
push edx
push eax
call fcn.00419b30
lea ecx, [esp + 0x230]
lea edx, [esp + 0x12c]
lea eax, [esp + 0x28]
add esp, 0x14
push ecx
push edx
lea ecx, [esp + 0x530]
push str.Normal
push eax
push esi
push 0x450650
push ecx
call ebx
lea ecx, [esp + 0x544]
mov edx, dword [esp + 0x854]
add esp, 0x1c
push ecx
push edx
call fcn.0040d9f0
add esp, 8
inc ebp
cmp ebp, 0x3e8
jl 0x417846
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x824
ret
Function at 0x4179e0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x928
mov eax, dword [esp + 0x938]
push ebx
push esi
push edi
mov esi, dword [esp + 0x948]
push ebp
lea ecx, [esp + 0x424]
push esi
push eax
push str.SOFTWAREMicrosoftShared_Tools
push 0x450788
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x24]
lea edx, [esp + 0x438]
mov dword [esp + 0x24], 0
add esp, 0x14
push ecx
push 0x20019
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x417a50
mov eax, 2
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x928
ret
xor ebp, ebp
xor ebx, ebx
lea edi, [esp + 0x15]
xor eax, eax
mov ecx, 0x40
push 0x103
mov byte [esp + 0x18], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x18]
mov ecx, dword [esp + 0x14]
push eax
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
test eax, eax
jne 0x417b95
lea edi, [esp + 0x119]
xor eax, eax
mov ecx, 0x40
push 0x103
mov byte [esp + 0x11c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x221]
mov ecx, 0x40
mov byte [esp + 0x220], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea edi, [esp + 0x325]
mov ecx, 0x40
mov byte [esp + 0x324], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x11c]
lea ecx, [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
push str.Extensions
push ecx
push edx
call fcn.00419b30
lea ecx, [esp + 0x230]
lea edx, [esp + 0x28]
mov eax, dword [esp + 0x24]
add esp, 0x14
push 0x103
push ecx
push str.Name
push edx
push eax
call fcn.00419b30
lea ecx, [esp + 0x334]
lea edx, [esp + 0x28]
mov eax, dword [esp + 0x24]
add esp, 0x14
push 0x103
push ecx
push str.Path
push edx
push eax
call fcn.00419b30
lea ecx, [esp + 0x334]
lea edx, [esp + 0x230]
lea eax, [esp + 0x12c]
add esp, 0x14
push ecx
push edx
lea ecx, [esp + 0x1c]
push eax
push esi
push ecx
lea edx, [esp + 0x53c]
push str._s_t_s_t_s_t_s_t_s
push edx
inc ebp
call dword [sym.imp.USER32.dll_wsprintfA]
lea ecx, [esp + 0x544]
mov edx, dword [esp + 0x958]
add esp, 0x1c
push ecx
push edx
call fcn.0040d9f0
add esp, 8
cmp ebp, 0x3e8
jl 0x417a54
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x928
ret