joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f9f0
Capabilities:
Initialize iwebbrowser2

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44f318
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
lea eax, [ebp - 0x2c]
push esi
push eax
call fcn.0042f590
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x10], esi
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
push ecx
push 0x46b1b0
push 0x17
push esi
push 0x45c7ac
call dword [sym.imp.ole32.dll_CoCreateInstance]
cmp eax, esi
jge 0x40fae0
mov edx, dword [0x4981ec]
mov dword [ebp + 8], edx
push eax
lea eax, [ebp + 8]
push str._hr_0x
push eax
mov byte [ebp - 4], 2
call fcn.0043d910
add esp, 0xc
lea ecx, [ebp - 0x18]
push 0x411
call fcn.004114a0
lea ecx, [ebp + 8]
lea edx, [ebp - 0x14]
push ecx
push eax
push edx
mov byte [ebp - 4], 3
call fcn.00444530
mov eax, dword [eax]
push esi
push esi
push eax
push esi
push 4
mov byte [ebp - 4], 4
call fcn.00411fc0
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.00444260
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 2
call fcn.00444260
lea ecx, [ebp + 8]
mov byte [ebp - 4], 1
call fcn.00444260
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 0
cmp eax, esi
je 0x40fac7
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x10]
cmp eax, esi
jne 0x40fafe
push esi
push esi
push 0x160
push str.C:p_roboform_6_9_9_roboformStringsRFAfx.h
call fcn.0041f390
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov ecx, dword [eax]
push edi
push 0xffffffffffffffff
push eax
call dword [ecx + 0xa4]
push 3
push esi
lea ecx, [ebp - 0x3c]
call fcn.0042f540
mov edi, eax
mov edx, dword [ebp + 8]
push 0xffffffffffffffff
mov byte [ebp - 4], 5
mov eax, dword [edx]
push eax
call fcn.00410220
mov esi, eax
add esp, 8
mov dword [ebp + 8], esi
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 6
test eax, eax
jne 0x40fb52
push eax
push eax
push 0x160
push str.C:p_roboform_6_9_9_roboformStringsRFAfx.h
call fcn.0041f390
mov eax, dword [ebp - 0x10]
add esp, 0x10
lea edx, [ebp - 0x2c]
mov ecx, dword [eax]
push edx
lea edx, [ebp - 0x2c]
push edx
lea edx, [ebp - 0x2c]
push edx
push edi
push esi
push eax
call dword [ecx + 0x2c]
push esi
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov esi, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea eax, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 1
call esi
mov eax, dword [ebp - 0x10]
pop edi
test eax, eax
jne 0x40fb9c
push eax
push eax
push 0x160
push str.C:p_roboform_6_9_9_roboformStringsRFAfx.h
call fcn.0041f390
mov eax, dword [ebp - 0x10]
add esp, 0x10
mov ecx, dword [eax]
lea edx, [ebp - 0x1c]
push edx
push eax
call dword [ecx + 0x94]
test eax, eax
jl 0x40fbb7
mov eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 0
test eax, eax
je 0x40fbc8
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
lea edx, [ebp - 0x2c]
push edx
call esi
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x413790
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0
mov eax, dword [edi]
push 4
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4137bf
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x4137ea
mov eax, dword [edi]
mov dword [ebp + 8], 0
lea edx, [ebp + 8]
push 0
mov ecx, dword [eax - 8]
push edx
push ecx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x4137ea
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x4137fa
pop edi
pop esi
pop ebx
pop ebp
ret
test ebx, ebx
je 0x413810
mov edi, dword [edi]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x413810
pop edi
pop esi
pop ebx
pop ebp
ret
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
Function at 0x413d30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fb48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
mov esi, dword [ebp + 0x18]
push edi
mov ecx, 0xf
xor eax, eax
lea edi, [ebp - 0x4c]
mov edx, dword [ebp + 8]
rep stosd dword es:[edi], eax
mov eax, esi
mov ecx, dword [ebp + 0x14]
neg eax
sbb eax, eax
mov dword [ebp - 0x40], ecx
mov ecx, dword [ebp + 0x10]
and eax, 0x40
mov dword [ebp - 0x48], eax
mov eax, dword [edx]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], ecx
lea ecx, [ebp + 0x18]
mov eax, dword [eax]
mov dword [ebp - 0x4c], 0x3c
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x30], 1
call fcn.00421410
lea edx, [ebp - 0x4c]
push edx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
lea ecx, [ebp + 0x18]
mov edi, eax
mov dword [ebp - 4], 0xffffffff
call fcn.004215d0
test esi, esi
je 0x413e2f
test edi, edi
je 0x413e2f
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x413e3d
mov ecx, dword [ebp + 0x1c]
test ecx, ecx
je 0x413e18
mov ebx, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
push 0xff
push 0xffffffffffffffff
lea eax, [ebp - 0x14]
push 0
push eax
push 1
call ebx
test eax, eax
je 0x413e00
cmp eax, 0x80
je 0x413e00
xor esi, esi
jmp 0x413e05
mov esi, 1
push 0x49063c
call fcn.0040e400
add esp, 4
test esi, esi
je 0x413de0
jmp 0x413e21
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp - 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x413e3d
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test edi, edi
jne 0x413ed5
push eax
lea eax, [ebp + 0x1c]
push eax
call fcn.004231d0
add esp, 8
mov esi, eax
mov ecx, dword [ebp + 8]
lea edx, [ebp + 0x10]
push ecx
push 0x490658
push edx
mov dword [ebp - 4], 4
call fcn.00444650
push 0x49064c
push eax
lea eax, [ebp + 0xc]
mov byte [ebp - 4], 5
push eax
call fcn.004445c0
push esi
lea ecx, [ebp + 0x14]
mov bl, 6
push eax
push ecx
mov byte [ebp - 4], bl
call fcn.00444530
mov ecx, dword [ebp + 0x24]
push eax
mov byte [ebp - 4], 7
call fcn.004443f0
lea ecx, [ebp + 0x14]
mov byte [ebp - 4], bl
call fcn.00444260
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 5
call fcn.00444260
lea ecx, [ebp + 0x10]
mov byte [ebp - 4], 4
call fcn.00444260
lea ecx, [ebp + 0x1c]
mov dword [ebp - 4], 0xffffffff
call fcn.00444260
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x414720
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
test eax, eax
push edi
mov dword [esi], 0
jle 0x414784
mov ebx, dword [ebp + 0x14]
mov edi, dword [ebp + 8]
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41477a
test al, 0x10
jne 0x41477a
push 0
push edi
call fcn.00413790
add esp, 8
test eax, eax
jne 0x41477a
push 1
push 1
push ebx
call fcn.004146d0
mov edx, dword [esi]
mov eax, dword [ebp + 0x10]
add esp, 0xc
inc edx
mov ecx, edx
mov dword [esi], edx
cmp ecx, eax
jge 0x414784
jmp 0x41473c
pop edi
pop esi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x415180
Capabilities:
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4554f8
push 0x43063c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x54
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x24], edi
cmp dword [0x49bbb0], edi
jne 0x4152eb
xor ebx, ebx
cmp dword [0x49bba8], edi
je 0x4151cc
push str.IsolationAware_function_called_after_IsolationAwareCleanup_n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
cmp dword [0x49bbb0], edi
jne 0x4152bf
cmp dword [0x49bba8], edi
jne 0x4151ed
call fcn.00409420
test eax, eax
je 0x4152c4
mov eax, dword [0x468130]
mov dword [ebp - 0x48], eax
mov eax, dword [0x4a1d30]
cmp eax, edi
jne 0x4152b1
xor esi, esi
cmp dword [0x4a1d34], edi
jne 0x41523e
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x415234
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
cmp eax, edi
je 0x415259
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
cmp esi, edi
jne 0x4152a2
mov eax, dword [0x4a1d3c]
cmp eax, edi
jne 0x415294
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x41527e
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x454fb0]
jmp 0x41528b
mov edx, dword [0x454fbc]
push edx
call dword [0x454fb4]
cmp eax, edi
je 0x4152a2
mov dword [0x4a1d3c], eax
push str.ActivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d30], eax
cmp esi, edi
jne 0x4152b1
xor eax, eax
jmp 0x4152bb
lea ecx, [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x48]
push edx
call eax
cmp eax, edi
je 0x4152c4
mov ebx, 1
cmp ebx, edi
jne 0x4152eb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7f
je 0x4152d8
cmp eax, 0x78
jne 0x4152e3
mov ebx, 1
mov dword [0x49bbb0], ebx
cmp ebx, edi
jne 0x4152eb
xor eax, eax
jmp 0x4152f0
mov eax, 1
cmp eax, edi
jne 0x415309
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], edi
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0041533d
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41533d
Capabilities:
Get file attributes

Disassembly:
cmp dword [0x49bbb0], edi
jne 0x415432
xor ebx, ebx
cmp dword [ebp - 0x1c], edi
sete bl
cmp ebx, edi
je 0x415360
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x2c], eax
jmp 0x415363
mov dword [ebp - 0x2c], edi
mov edi, dword [ebp - 0x24]
mov eax, dword [0x4a1d40]
test eax, eax
jne 0x41541f
xor esi, esi
mov eax, dword [0x4a1d34]
test eax, eax
jne 0x4153b0
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x4153a6
push str.___.___
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push str.Unicows.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [0x4a1d38], eax
mov dword [0x4a1d34], 1
mov eax, dword [0x4a1d38]
test eax, eax
je 0x4153cb
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
jne 0x415414
mov eax, dword [0x4a1d3c]
test eax, eax
jne 0x415406
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, 0x80000000
je 0x4153f0
mov ecx, dword [str.Kernel32.dll]
push ecx
call dword [0x454fb0]
jmp 0x4153fd
mov edx, dword [0x454fbc]
push edx
call dword [0x454fb4]
test eax, eax
je 0x415414
mov dword [0x4a1d3c], eax
push str.DeactivateActCtx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
mov eax, esi
mov dword [0x4a1d40], eax
test esi, esi
je 0x415424
push edi
push 0
call eax
test ebx, ebx
je 0x415432
mov eax, dword [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
ret
Function at 0x415570
Capabilities:
Check if file exists
Get file attributes
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44fdff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
mov eax, dword [0x4981ec]
push ebx
push esi
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x10], eax
lea ecx, [ebp - 0x20]
mov ebx, 1
push ecx
push 0x104
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], 0x104
call fcn.004447e0
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
mov esi, eax
call fcn.00444860
test esi, esi
je 0x4155ed
mov edx, dword [ebp - 0x10]
mov eax, dword [edx - 8]
test eax, eax
je 0x4155ed
lea eax, [ebp - 0x10]
push eax
call fcn.004162f0
add esp, 4
test eax, eax
jne 0x4155fa
push 0x4909a8
lea ecx, [ebp - 0x10]
call fcn.00444450
lea ecx, [ebp - 0x28]
push ecx
call fcn.00415be0
add esp, 4
push 0x4909b8
lea edx, [ebp - 0x24]
push eax
push edx
mov byte [ebp - 4], 2
call fcn.004445c0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
push ecx
push eax
push edx
mov byte [ebp - 4], 3
call fcn.00444530
lea ecx, [ebp - 0x24]
mov byte [ebp - 4], 6
call fcn.00444260
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 5
call fcn.00444260
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x41566c
test al, 0x10
je 0x41566c
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, esi
call fcn.004440c0
mov dword [ebp - 0x1c], ebx
jmp 0x4156fc
lea edx, [ebp - 0x18]
push 5
push edx
call fcn.00414d90
add esp, 8
mov eax, dword [ebp - 0x18]
mov byte [ebp - 4], 7
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x415695
mov esi, dword [ebp + 8]
mov ecx, dword [0x4981ec]
mov dword [esi], ecx
jmp 0x4156ed
lea edx, [ebp - 0x18]
push 0x4909e0
lea eax, [ebp - 0x30]
push edx
push eax
call fcn.004445c0
push 0x4909cc
lea ecx, [ebp - 0x2c]
push eax
push ecx
mov byte [ebp - 4], 8
call fcn.004445c0
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 9
call fcn.004443f0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 8
call fcn.00444260
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 7
call fcn.00444260
mov esi, dword [ebp + 8]
lea edx, [ebp - 0x14]
push edx
mov ecx, esi
call fcn.004440c0
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 5
call fcn.00444260
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00444260
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.00444260
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x415b30
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44feaf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4981ec]
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], eax
push 0x104
push 0x104
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], 1
call fcn.004447e0
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.00444860
lea ecx, [ebp - 0x10]
push ecx
call fcn.00414260
mov edx, dword [ebp - 0x10]
add esp, 4
mov eax, dword [edx - 8]
test eax, eax
jne 0x415ba7
push 0x490aa0
lea ecx, [ebp - 0x10]
call fcn.00444450
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.004440c0
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.00444260
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x416e60
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4501e8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [esi], 0
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x416ed7
lea ecx, [ebp + 8]
push ecx
call fcn.004142d0
add esp, 4
lea edx, [ebp - 0x10]
lea eax, [ebp - 0x40]
lea ecx, [ebp - 0x174]
push 0
push 0
push edx
mov edx, dword [ebp + 8]
push eax
push esi
push 0xff
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
je 0x416ed7
cmp dword [esi], 0
jne 0x417011
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov edx, dword [ecx - 8]
test edx, edx
je 0x417053
push eax
lea ecx, [ebp + 0xc]
xor esi, esi
call fcn.004440c0
lea edx, [ebp + 0xc]
mov byte [ebp - 4], 1
push edx
call fcn.004142d0
add esp, 4
lea ecx, [ebp + 0xc]
push 0x490f14
call fcn.00444760
lea ecx, [ebp - 0x3c]
call fcn.0042ea70
mov eax, dword [ebp + 0xc]
push esi
push eax
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.0042eb80
test eax, eax
je 0x41703b
lea ecx, [ebp - 0x3c]
call fcn.0042ee60
test eax, eax
je 0x41703b
lea ecx, [ebp - 0x3c]
call fcn.0042ee20
test eax, eax
jne 0x416f30
mov edx, dword [ebp - 0x3c]
push 0x10
lea ecx, [ebp - 0x3c]
call dword [edx + 0x38]
test eax, eax
jne 0x416f30
lea ecx, [ebp - 0x20]
call fcn.00445a00
lea eax, [ebp - 0x10]
lea ecx, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 3
call fcn.0042ef70
mov eax, dword [eax]
push 0
push 0x8000
push eax
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 4
call fcn.00445b60
test eax, eax
je 0x416f9c
cmp dword [ebp - 0x1c], 0xffffffff
setne al
test al, al
je 0x416f9c
mov bl, 1
jmp 0x416f9e
xor bl, bl
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 3
call fcn.00444260
test bl, bl
je 0x416fcc
mov edx, dword [ebp - 0x1c]
mov ecx, 0xd
xor eax, eax
lea edi, [ebp - 0x74]
rep stosd dword es:[edi], eax
lea ecx, [ebp - 0x74]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x416fe5
mov eax, esi
inc esi
cmp eax, 6
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x20]
jge 0x417036
call fcn.00445a80
jmp 0x416f30
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x58]
mov byte [ebp - 4], 2
mov dword [edx], ecx
lea ecx, [ebp - 0x20]
call fcn.00445a80
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.0042ead0
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.00444260
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00444260
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
call fcn.00445a80
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 1
call fcn.0042ead0
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 0
call fcn.00444260
lea ecx, [ebp + 8]
mov dword [ebp - 4], 0xffffffff
call fcn.00444260
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
xor eax, eax
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x418490
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push edi
mov edi, dword [ebp + 8]
push ebx
push eax
push ecx
push edi
call fcn.00418580
mov esi, eax
add esp, 0x10
test esi, esi
jne 0x4184f0
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4184fb
test al, 0x10
jne 0x4184fb
mov eax, dword [edi]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
je 0x4184fb
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
push ebx
push edx
push eax
push edi
call fcn.00418580
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4184fb
mov ecx, dword [edi]
push ecx
call fcn.00418510
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x418d20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4506e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
mov eax, dword [0x4981ec]
mov dword [ebp - 0x14], eax
push 0x4916bc
push 0x4916c4
lea ecx, [ebp - 0x14]
push SysReAllocStringLen
push ecx
mov dword [ebp - 4], 0
call fcn.0041af10
mov edx, dword [ebp - 0x14]
add esp, 0x10
mov eax, dword [edx - 8]
test eax, eax
je 0x418e04
mov eax, dword [0x4981ec]
mov dword [ebp - 0x10], eax
push 0x4916dc
push 0x4916ec
lea ecx, [ebp - 0x10]
push SysReAllocStringLen
push ecx
mov byte [ebp - 4], 1
call fcn.0041af10
lea edx, [ebp - 0x10]
push edx
call fcn.004142d0
add esp, 0x14
lea ecx, [ebp - 0x10]
push 0x491704
call fcn.00444760
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax - 8]
test ecx, ecx
je 0x418df8
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x418df8
test al, 0x10
jne 0x418df8
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.00444260
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00444260
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 0
call fcn.00444260
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
call fcn.00444260
mov ecx, dword [ebp - 0xc]
xor eax, eax
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x41b260
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
mov dword [ebp - 4], 0
jne 0x41b27d
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
jmp 0x41b297
mov edx, dword [ebp + 8]
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x41b2eb
lea eax, [ebp + 8]
push edi
lea ecx, [ebp + 0xc]
push eax
mov eax, dword [ebp + 0x10]
lea edx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 4]
push edx
push 0
push eax
push ecx
mov dword [ebp - 8], 0
mov dword [ebp + 0xc], 0
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test esi, esi
mov edi, eax
je 0x41b2d9
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
sub eax, 2
je 0x41b2eb
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41bf10
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x450ca8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
mov dword [ebp - 0x20], ecx
mov edi, dword [ecx + 4]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x14]
push eax
push 0x2001f
push ebx
push ecx
push edi
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
cmp esi, ebx
jne 0x41bf78
lea ecx, [ebp - 0x10]
call fcn.0041d3b0
mov esi, eax
mov eax, dword [ebp - 0x14]
cmp esi, ebx
mov dword [ebp - 0x10], eax
je 0x41bf88
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], bl
call fcn.0041d3b0
jmp 0x41c019
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x18]
push edx
push ebx
push ebx
push ebx
lea edx, [ebp - 0x128]
push ecx
push edx
push ebx
push eax
mov dword [ebp - 0x18], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x41bfea
lea eax, [ebp - 0x128]
lea ecx, [ebp - 0x10]
push eax
call fcn.0041d3d0
mov esi, eax
cmp esi, ebx
jne 0x41bf78
lea ecx, [ebp - 0x28]
lea edx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x10]
push ebx
push ebx
push ebx
lea eax, [ebp - 0x128]
push edx
push eax
push ebx
push ecx
mov dword [ebp - 0x18], 0x100
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x41bfad
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp eax, ebx
je 0x41bffd
push eax
call esi
mov dword [ebp - 0x10], ebx
mov edx, dword [ebp + 8]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov edi, eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
mov byte [ebp - 4], bl
je 0x41c017
push eax
call esi
mov esi, edi
cmp esi, ebx
mov dword [ebp - 0x1c], ebx
je 0x41c070
lea eax, [ebp - 0x14]
push esi
push eax
call fcn.004231d0
add esp, 8
mov edx, dword [ebp - 0x20]
mov ecx, dword [eax]
push ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov edx, dword [ebp + 0xc]
push eax
push ecx
push 0x49272c
push edx
mov byte [ebp - 4], 2
call fcn.0043d910
add esp, 0x14
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.00444260
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov eax, 1
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8