joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4632e1
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x4ab608]
je 0x4632fc
inc edi
cmp edi, 0x17
jb 0x4632ed
cmp edi, 0x17
jae 0x46347c
push ebp
push 3
call fcn.0046d778
cmp eax, 1
pop ecx
je 0x463448
push 3
call fcn.0046d778
test eax, eax
pop ecx
jne 0x463330
cmp dword [0x4ab1c0], 1
je 0x463448
cmp ebx, 0xfc
je 0x46347b
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x4aff00
push ebp
call fcn.004612e3
add esp, 0xc
test eax, eax
je 0x463366
push esi
push esi
push esi
push esi
push esi
call fcn.0045c062
add esp, 0x14
push 0x104
mov esi, 0x4aff19
push esi
push 0
mov byte [0x4b001d], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4633aa
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.004612e3
add esp, 0xc
test eax, eax
je 0x4633aa
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0045c062
add esp, 0x14
push esi
call fcn.0045f500
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x4633ef
push esi
call fcn.0045f500
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x4b0214
push 0x4963c4
sub ecx, eax
push ecx
push eax
call fcn.0045c854
add esp, 0x14
test eax, eax
je 0x4633ef
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0045c062
add esp, 0x14
jmp 0x4633f1
xor esi, esi
push 0x4963c0
push ebx
push ebp
call fcn.00461348
add esp, 0xc
test eax, eax
je 0x463411
push esi
push esi
push esi
push esi
push esi
call fcn.0045c062
add esp, 0x14
push dword [edi*8 + 0x4ab60c]
push ebx
push ebp
call fcn.00461348
add esp, 0xc
test eax, eax
je 0x463433
push esi
push esi
push esi
push esi
push esi
call fcn.0045c062
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0046d5bb
add esp, 0xc
jmp 0x46347b
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x46347b
cmp ebp, 0xffffffff
je 0x46347b
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x4ab60c]
push dword [esi]
call fcn.0045f500
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x46d5bb
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00462a6d
xor ebx, ebx
cmp dword [0x4b06c8], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x46d691
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x46d771
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x49673c
push edi
call esi
cmp eax, ebx
je 0x46d771
push eax
call fcn.004629ff
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4b06c8], eax
call esi
push eax
call fcn.004629ff
mov dword [esp], 0x496718
push edi
mov dword [0x4b06cc], eax
call esi
push eax
call fcn.004629ff
mov dword [0x4b06d0], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00461070
test eax, eax
pop ecx
pop ecx
je 0x46d65f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0045c062
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x46d691
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004629ff
cmp eax, ebx
pop ecx
mov dword [0x4b06d8], eax
je 0x46d691
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004629ff
pop ecx
mov dword [0x4b06d4], eax
mov eax, dword [0x4b06d4]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x46d716
cmp dword [0x4b06d8], ecx
je 0x46d716
push eax
call fcn.00462a76
push dword [0x4b06d8]
mov esi, eax
call fcn.00462a76
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x46d716
cmp edi, ebx
je 0x46d716
call esi
cmp eax, ebx
je 0x46d6e3
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x46d6e3
test byte [ebp - 0x18], 1
jne 0x46d716
lea eax, [ebp - 0x10]
push eax
call fcn.004610a7
test eax, eax
pop ecx
je 0x46d6fe
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0045c062
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x46d70d
or dword [ebp + 0x10], 0x200000
jmp 0x46d751
or dword [ebp + 0x10], 0x40000
jmp 0x46d751
mov eax, dword [0x4b06cc]
cmp eax, dword [ebp - 8]
je 0x46d751
push eax
call fcn.00462a76
cmp eax, ebx
pop ecx
je 0x46d751
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x46d751
mov eax, dword [0x4b06d0]
cmp eax, dword [ebp - 8]
je 0x46d751
push eax
call fcn.00462a76
cmp eax, ebx
pop ecx
je 0x46d751
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4b06c8]
call fcn.00462a76
cmp eax, ebx
pop ecx
je 0x46d771
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x46d773
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4841d0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x48de48
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4b0b04]
test eax, eax
jne 0x484202
xor esi, esi
jmp 0x48420b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
test esi, esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x20], 0
je 0x48424d
cmp dword [esi + 0x14], 0
jne 0x48428f
cmp dword [esi + 0x10], 0
jne 0x484295
push 0x483cf0
push 0x4b0afc
call fcn.00483ef0
mov eax, dword [0x4b0b04]
add esp, 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
test esi, esi
mov dword [esp + 0x20], 0xffffffff
je 0x48427b
lea ecx, [esi + 4]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x48427b
mov eax, dword [esi]
mov edx, dword [eax]
push 0
mov ecx, esi
call edx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
cmp dword [esi + 0x10], 0
je 0x4842d5
mov ebx, dword [esi + 0x10]
mov eax, dword [ebx + 4]
mov dword [esi + 0x10], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x4842c3
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x10], 0
jne 0x484295
cmp dword [esi + 0x14], 0
je 0x484227
mov edi, dword [esi + 0x14]
mov ecx, dword [edi + 0x10]
mov dword [esi + 0x14], ecx
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x4842fa
mov edx, dword [ecx]
mov eax, dword [edi + 0xc]
mov edx, dword [edx + 4]
push eax
call edx
mov ebx, dword [edi + 8]
test ebx, ebx
je 0x48432b
lea eax, [ebx + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x48432b
mov edx, dword [ebx]
mov eax, dword [edx + 4]
mov ecx, ebx
call eax
lea ecx, [ebx + 8]
or edx, 0xffffffff
lock xadd dword [ecx], edx
jne 0x48432b
mov eax, dword [ebx]
mov edx, dword [eax + 8]
mov ecx, ebx
call edx
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0x14], 0
jne 0x4842df
jmp 0x484221
Function at 0x4844a0
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x48dec8
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x1c]
push ecx
push 4
push eax
push 0x484350
push 0
push 0
call fcn.0045d1d4
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x48450b
lea ecx, [esp + 0x10]
call fcn.0045b65b
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x2c], ebx
call fcn.0040b860
mov eax, dword [edi]
add eax, 4
mov ecx, 1
lock xadd dword [eax], ecx
mov esi, dword [edi]
mov eax, dword [esi + 8]
add esi, 8
test eax, eax
je 0x484531
cmp eax, 0xffffffff
je 0x484531
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi], ebx
mov edx, dword [edi]
mov eax, dword [edx + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x485af0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 0x10
jb 0x485aff
mov eax, dword [eax + 4]
jmp 0x485b02
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x485b9a
push esi
call fcn.00484f60
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x485b7f
cmp eax, 3
je 0x485b7f
cmp eax, 0x7b
je 0x485b7f
cmp eax, 0xf
je 0x485b7f
cmp eax, 0x15
je 0x485b7f
cmp eax, 0x57
je 0x485b7f
cmp eax, 0xa1
je 0x485b7f
cmp eax, 0x35
je 0x485b7f
cmp eax, 0x20
jne 0x485b74
mov eax, dword [0x4b0b60]
mov dword [ecx], eax
mov edx, dword [0x4b0b64]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4b0b60]
mov dword [ecx], eax
mov edx, dword [0x4b0b64]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4b0b60]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4b0b64]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x485bc7
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x485bd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 8]
cmp dword [eax + 0x18], 8
jb 0x485bdf
mov eax, dword [eax + 4]
jmp 0x485be2
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x485c7a
push esi
call fcn.00484f60
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
mov ecx, dword [esp + 0x10]
mov dword [ecx + 4], esi
mov dword [ecx], eax
pop esi
je 0x485c5f
cmp eax, 3
je 0x485c5f
cmp eax, 0x7b
je 0x485c5f
cmp eax, 0xf
je 0x485c5f
cmp eax, 0x15
je 0x485c5f
cmp eax, 0x57
je 0x485c5f
cmp eax, 0xa1
je 0x485c5f
cmp eax, 0x35
je 0x485c5f
cmp eax, 0x20
jne 0x485c54
mov eax, dword [0x4b0b60]
mov dword [ecx], eax
mov edx, dword [0x4b0b64]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 9
ret
mov eax, dword [esp + 4]
mov dword [eax], 0
ret
mov eax, dword [0x4b0b60]
mov dword [ecx], eax
mov edx, dword [0x4b0b64]
mov eax, dword [esp + 4]
mov dword [ecx + 4], edx
mov dword [eax], 1
ret
mov edx, dword [0x4b0b60]
mov ecx, dword [esp + 0xc]
mov dword [ecx], edx
mov edx, dword [0x4b0b64]
test al, 0x10
mov dword [ecx + 4], edx
lea eax, [esp + 8]
mov dword [esp + 8], 3
jne 0x485ca7
mov dword [esp + 8], 2
mov ecx, dword [eax]
mov eax, dword [esp + 4]
mov dword [eax], ecx
ret

Function at 0x485cb0
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x485ccb
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
neg eax
ret
Function at 0x485ce0
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 8
jb 0x485cfb
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x485d10
Capabilities:
Delete directory

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x485d2b
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
neg eax
ret

Function at 0x485d40
Capabilities:
Delete file

Disassembly:
mov eax, dword [esp + 4]
cmp dword [eax + 0x18], 0x10
jb 0x485d5b
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
neg eax
ret
Function at 0x485f50
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x48e07b
mov eax, dword fs:[0]
push eax
sub esp, 0x27c
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x278], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x290]
mov dword fs:[0], eax
mov ecx, dword [esp + 0x2ac]
mov eax, dword [esp + 0x2a8]
mov edx, dword [esp + 0x2b0]
mov ebp, dword [esp + 0x2a0]
mov ebx, dword [esp + 0x2a4]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x2b4]
xor esi, esi
push 0xffffffffffffffff
push esi
mov dword [esp + 0x20], ecx
push eax
lea ecx, [esp + 0x2c]
mov dword [esp + 0x20], edx
mov dword [esp + 0x44], 7
mov dword [esp + 0x40], esi
mov word [esp + 0x30], si
call fcn.00402157
mov eax, dword [esp + 0x34]
cmp eax, esi
mov dword [esp + 0x298], esi
je 0x486017
lea edi, [eax - 1]
cmp edi, eax
jbe 0x485ffc
call fcn.0045c182
cmp dword [esp + 0x38], 8
mov eax, dword [esp + 0x24]
jae 0x48600b
lea eax, [esp + 0x24]
cmp word [eax + edi*2], 0x5c
mov edx, 0x498bd8
je 0x48601c
mov edx, 0x498bd0
mov eax, edx
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x486021
sub eax, edi
sar eax, 1
push eax
push edx
lea ecx, [esp + 0x28]
call fcn.00411d20
mov eax, dword [esp + 0x24]
mov edi, 8
cmp dword [esp + 0x38], edi
jae 0x48604e
lea eax, [esp + 0x24]
lea edx, [esp + 0x3c]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebx], eax
jne 0x486091
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx], esi
call edi
cmp eax, 2
je 0x486074
call edi
mov esi, eax
call fcn.00484f60
cmp dword [esp + 0x38], 8
mov dword [ebp], esi
mov dword [ebp + 4], eax
jb 0x486113
mov eax, dword [esp + 0x24]
push eax
jmp 0x48610b
lea eax, [esp + 0x68]
lea edx, [eax + 2]
jmp 0x4860a0
mov cx, word [eax]
add eax, 2
cmp cx, si
jne 0x4860a0
sub eax, edx
sar eax, 1
push eax
lea ecx, [esp + 0x6c]
push ecx
mov ecx, dword [esp + 0x24]
call fcn.00402438
test byte [esp + 0x3c], 0x10
je 0x4860db
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov dword [edx], 3
mov dword [eax], 3
jmp 0x4860ef
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx], 2
mov dword [edx], 2
cmp dword [esp + 0x38], edi
mov eax, dword [0x4b0b60]
mov dword [ebp], eax
mov ecx, dword [0x4b0b64]
mov dword [ebp + 4], ecx
jb 0x486113
mov edx, dword [esp + 0x24]
push edx
call fcn.00451909
add esp, 4
mov eax, ebp
mov ecx, dword [esp + 0x290]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x278]
xor ecx, esp
call fcn.0045b0da
add esp, 0x288
ret
Function at 0x486240
Capabilities:
Check if file exists

Disassembly:
push 0xffffffffffffffff
push 0x48e0bb
mov eax, dword fs:[0]
push eax
sub esp, 0x16c
mov eax, dword [0x4ab13c]
xor eax, esp
mov dword [esp + 0x168], eax
push ebp
push esi
push edi
mov eax, dword [0x4ab13c]
xor eax, esp
push eax
lea eax, [esp + 0x17c]
mov dword fs:[0], eax
mov eax, dword [esp + 0x18c]
mov ecx, dword [esp + 0x19c]
mov edx, dword [esp + 0x1a0]
mov edi, dword [esp + 0x190]
mov ebp, dword [esp + 0x198]
push 0xffffffffffffffff
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x198]
push 0
mov dword [esp + 0x1c], ecx
push eax
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
mov dword [esp + 0x40], 0xf
mov dword [esp + 0x3c], 0
mov byte [esp + 0x2c], 0
call fcn.0040204d
mov eax, dword [esp + 0x30]
test eax, eax
mov dword [esp + 0x184], 0
je 0x486333
lea esi, [eax - 1]
cmp esi, eax
jbe 0x4862f6
call fcn.0045c182
mov eax, dword [esp + 0x30]
cmp dword [esp + 0x34], 0x10
mov ecx, dword [esp + 0x20]
jae 0x486305
lea ecx, [esp + 0x20]
cmp byte [ecx + esi], 0x5c
je 0x48632c
lea esi, [eax - 1]
cmp esi, eax
jbe 0x486317
call fcn.0045c182
cmp dword [esp + 0x34], 0x10
mov eax, dword [esp + 0x20]
jae 0x486326
lea eax, [esp + 0x20]
cmp byte [eax + esi], 0x3a
jne 0x486333
mov edx, 0x494a7c
jmp 0x486338
mov edx, 0x498bdc
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x486340
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x24]
call fcn.0040abf0
mov eax, dword [esp + 0x20]
mov esi, 0x10
cmp dword [esp + 0x34], esi
jae 0x486369
lea eax, [esp + 0x20]
lea ecx, [esp + 0x38]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [edi], eax
jne 0x4863ba
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [edi], 0
call esi
cmp eax, 2
je 0x48639c
call esi
cmp eax, 0x12
je 0x48639c
call esi
mov esi, eax
jmp 0x48639e
xor esi, esi
call fcn.00484f60
cmp dword [esp + 0x34], 0x10
mov edi, dword [esp + 0x10]
mov dword [edi], esi
mov dword [edi + 4], eax
jb 0x486431
mov edx, dword [esp + 0x20]
push edx
jmp 0x486429
lea eax, [esp + 0x64]
lea edx, [eax + 1]
mov cl, byte [eax]
add eax, 1
test cl, cl
jne 0x4863c1
sub eax, edx
push eax
lea eax, [esp + 0x68]
push eax
mov ecx, ebp
call fcn.00402288
test byte [esp + 0x38], 0x10
je 0x4863f6
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [ecx], 3
mov dword [edx], 3
jmp 0x48640a
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov dword [eax], 2
mov dword [ecx], 2
cmp dword [esp + 0x34], esi
mov edx, dword [0x4b0b60]
mov edi, dword [esp + 0x10]
mov dword [edi], edx
mov eax, dword [0x4b0b64]
mov dword [edi + 4], eax
jb 0x486431
mov ecx, dword [esp + 0x20]
push ecx
call fcn.00451909
add esp, 4
mov eax, edi
mov ecx, dword [esp + 0x17c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
mov ecx, dword [esp + 0x168]
xor ecx, esp
call fcn.0045b0da
add esp, 0x178
ret
Function at 0x401000
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
push esi
push edi
xor eax, eax
push 0x18e
mov word [ebp - 0x198], ax
xor edi, edi
lea eax, [ebp - 0x196]
push edi
push eax
call fcn.004237a0
add esp, 0xc
push edi
call dword [sym.imp.ole32.dll_CoInitialize]
push dword [0x44141c]
push dword [0x441414]
push edi
call dword [sym.imp.KERNEL32.DLL_GetModuleFileNameW]
mov esi, 0x441410
call fcn.00406409
push 0x5c
call fcn.004063df
cmp eax, edi
jle 0x401077
mov ecx, dword [0x441414]
cmp ecx, edi
je 0x401077
cmp eax, dword [0x441418]
jae 0x401077
xor edx, edx
mov dword [0x441418], eax
mov word [ecx + eax*2], dx
call fcn.0040aeb0
lea eax, [ebp - 0x198]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x4010a9
push 0x10
push str.Network_error
push str.WSA_sockets_startup_failed_
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
xor al, al
jmp 0x4010dc
call fcn.0040e490
push edi
push edi
push edi
push edi
call dword [sym.imp.USER32.dll_DefWindowProcW]
lea eax, [ebp - 8]
push eax
mov dword [ebp - 8], 8
mov dword [ebp - 4], 4
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
call fcn.00406365
call fcn.004061c0
mov al, 1
pop edi
pop esi
leave
ret

Function at 0x406f2b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x406f39
push 0xd
pop eax
jmp 0x406f6c
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x406f40
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x407391
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
mov eax, dword [esi + 4]
push dword [esi]
xor edi, edi
or eax, 0x2001f
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.00407353
mov ebx, eax
cmp ebx, edi
je 0x4073d4
cmp dword [ebp - 0xc], edi
je 0x4073d0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
jmp 0x407441
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x4073f2
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0xc]
call fcn.00407391
mov dword [ebp - 0x14], eax
cmp eax, edi
jne 0x407448
lea eax, [ebp - 0x1c]
push eax
push edi
push edi
push edi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0xc]
mov dword [ebp - 0x10], 0x100
call ebx
test eax, eax
je 0x4073dc
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], edi
je 0x407428
push dword [ebp - 0xc]
call ebx
mov dword [ebp - 0xc], edi
push dword [ebp + 8]
mov dword [ebp - 8], edi
call fcn.004074a7
mov esi, eax
cmp dword [ebp - 0xc], edi
je 0x40743f
push dword [ebp - 0xc]
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4
cmp dword [ebp - 0xc], edi
je 0x407456
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
jmp 0x407441

Function at 0x4074a7
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x44138c], 0
jne 0x4074d7
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleW]
test eax, eax
je 0x4074d0
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
mov dword [0x441390], eax
mov byte [0x44138c], 1
mov eax, dword [0x441390]
test eax, eax
je 0x4074ef
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x4074fb
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x407cc2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40c
push ebx
push esi
push edi
xor esi, esi
push 2
push esi
push dword [ebp + 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0x40c], esi
call dword [sym.imp.KERNEL32.DLL_LoadLibraryExW]
mov ebx, eax
cmp ebx, esi
jne 0x407cfa
call fcn.00406aa6
mov esi, eax
jmp 0x407de5
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindResourceW]
mov edi, eax
cmp edi, esi
jne 0x407d17
call fcn.00406aa6
jmp 0x407ddc
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_LoadResource]
mov dword [ebp + 8], eax
cmp eax, esi
je 0x407d0d
push edi
push ebx
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x407d5a
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x407d50
lea eax, [ebp - 0x40c]
call fcn.00406a7c
mov eax, 0x8007000e
jmp 0x407e00
push 2
pop ecx
mul ecx
cmp edx, esi
ja 0x407d68
cmp eax, 0xffffffff
jbe 0x407d72
push 0x80070057
call fcn.00407285
cmp eax, 0x400
jbe 0x407d88
push eax
lea eax, [ebp - 0x40c]
push eax
call fcn.00406a85
jmp 0x407d94
lea eax, [ebp - 0x408]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], esi
jne 0x407da3
mov esi, 0x8007000e
jmp 0x407dde
push edi
push dword [ebp - 0x40c]
push edi
push dword [ebp + 8]
push esi
push 3
call dword [sym.imp.KERNEL32.DLL_MultiByteToWideChar]
cmp eax, esi
je 0x407d0d
mov edx, dword [ebp - 0x40c]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x40c]
lea ecx, [ebp - 8]
call fcn.00407b92
mov esi, eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
lea eax, [ebp - 0x408]
cmp dword [ebp - 0x40c], eax
je 0x407dfe
lea eax, [ebp - 0x40c]
call fcn.00406a7c
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x408414
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [esi]
and dword [esi], 0
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x408478
cmp dword [ebp + 0xc], 1
je 0x408450
cmp dword [ebp + 0xc], 2
je 0x408450
push 0xd
pop eax
jmp 0x408478
mov eax, dword [ebp - 4]
test edi, edi
je 0x408472
test eax, eax
je 0x40846d
test al, 1
jne 0x40844b
mov ecx, eax
shr ecx, 1
cmp word [edi + ecx*2 - 2], 0
je 0x408472
jmp 0x40844b
xor ecx, ecx
mov word [edi], cx
shr eax, 1
mov dword [esi], eax
xor eax, eax
leave
ret 8