joyce8/EMBER2024-capa huggingface dataset:
Function at 0x413c70
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004135dc
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x413ce2
xor eax, eax
push ebp
push 0x413cdb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403a7c
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x413ce6
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov byte [ebp - 0xd], 0
mov al, byte [ebp - 0xd]
mov esp, ebp
pop ebp
ret 8

Function at 0x414118
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov edx, 0x20019
mov eax, dword [ebp - 4]
call fcn.00413558
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x414165
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a7c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
jmp 0x414169
mov byte [ebp - 9], 0
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x414170
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov edx, 0x20006
mov eax, dword [ebp - 4]
call fcn.00413558
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4141b7
mov eax, dword [ebp - 8]
call fcn.00403a7c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret

Function at 0x414338
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov edx, 0x20019
mov eax, dword [ebp - 4]
call fcn.00413558
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x414391
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
jne 0x414388
cmp dword [ebp - 0x10], 0
setg byte [ebp - 5]
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret
Function at 0x414410
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, 0x20019
mov eax, dword [ebp - 4]
call fcn.00413558
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x414489
xor eax, eax
push ebp
push 0x414482
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.00403a7c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x41446b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414489
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x414490
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
mov edx, 0x20019
mov eax, dword [ebp - 4]
call fcn.00413558
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x414509
xor eax, eax
push ebp
push 0x414502
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.00403a7c
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
jne 0x4144eb
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x414509
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret

Function at 0x414620
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0xc], eax
test byte [ebp - 4], 1
je 0x41464b
mov eax, dword [ebp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [ebp - 4], eax
jmp 0x41464e
shr dword [ebp - 4], 1
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 8
jne 0x414636
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov dword [eax*4 + 0x44a620], edx
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x100
jne 0x41462b
mov esp, ebp
pop ebp
ret
Function at 0x4158f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040363c
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x415961
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.00403be8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403a7c
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x415957
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403a7c
call fcn.00407468
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.00403be8
jmp 0x415961
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.00403be8
mov esp, ebp
pop ebp
ret

Function at 0x416020
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [0x449c6c]
cmp dword [eax], 2
jne 0x41608d
test byte [ebp - 4], 0xb
je 0x41608d
lea eax, [ebp - 0xc]
push eax
push 0x20
call sub.KERNEL32.DLL_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x41608d
lea eax, [ebp - 0x18]
push eax
push 0x4160a8
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x41608d
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x4160a1
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x4160e0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406e08
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4161c9
xor eax, eax
push ebp
push 0x4161c2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
lea edx, [ebp - 0x54]
mov ecx, 0x40
mov eax, dword [ebp - 0x10]
call fcn.00406e6c
cmp eax, 0x40
je 0x416141
call fcn.00403178
jmp 0x4161c9
cmp word [ebp - 0x54], 0x5a4d
jne 0x41614f
cmp dword [ebp - 0x18], 0
jne 0x416156
call fcn.00403178
jmp 0x4161c9
mov eax, dword [ebp - 4]
call fcn.00417bb4
cmp eax, dword [ebp - 0x18]
jg 0x41616a
call fcn.00403178
jmp 0x4161c9
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.00406ec4
inc eax
jne 0x416181
call fcn.00403178
jmp 0x4161c9
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.00406e6c
cmp eax, 4
je 0x41619d
call fcn.00403178
jmp 0x4161c9
cmp dword [ebp - 0x14], 0x4550
jne 0x4161ac
mov eax, dword [ebp - 8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4161c9
mov eax, dword [ebp - 0x10]
call fcn.00406ed0
ret
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x4169a0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a6c
xor eax, eax
push ebp
push 0x416aae
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x24]
mov dl, 0x22
mov eax, dword [ebp - 4]
call fcn.0040fee8
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.004036d4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x416a90
mov eax, dword [ebp - 0x14]
inc eax
call fcn.004025b8
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x416a89
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x416ac0
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x416a59
call fcn.00403178
jmp 0x416a90
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416a90
mov eax, dword [ebp - 0x1c]
call fcn.004025d0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416ab5
lea eax, [ebp - 0x24]
call fcn.0040363c
lea eax, [ebp - 4]
call fcn.0040363c
ret
Function at 0x4170b8
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x417328
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e0]
call fcn.0041a36c
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x1e0]
call fcn.00407174
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x1d8]
call fcn.00417c64
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.00407174
push 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x41733c
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.0041762c
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.00403904
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404eea
lea eax, [ebp - 0x1cc]
call fcn.00405172
call fcn.0040267c
push ebp
mov eax, 0x41734c
call fcn.00417048
pop ecx
push ebp
push 0x41735c
push dword [ebp - 0x1e0]
push 0x41736c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00403978
mov eax, dword [ebp - 0x238]
call fcn.00417048
pop ecx
push ebp
push 0x417378
push dword [ebp - 0x1e0]
push 0x41736c
push 0x41738c
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.00403978
mov eax, dword [ebp - 0x238]
call fcn.00417048
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x417227
push ebp
push 0x4173a0
push dword [ebp - 0x1d8]
push 0x41736c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00403978
mov eax, dword [ebp - 0x238]
call fcn.00417048
pop ecx
push ebp
push 0x41735c
push dword [ebp - 0x1d4]
push 0x41736c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00403978
mov eax, dword [ebp - 0x238]
call fcn.00417048
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404f8c
call fcn.0040267c
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x44
call fcn.00402994
mov dword [ebp - 0x208], 1
mov word [ebp - 0x204], 0
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.00403a7c
push eax
push 0
push 0x8000040
push 0
push 0
push 0
push 0x41736c
push dword [ebp - 0x1d4]
push 0x41736c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.00403978
mov eax, dword [ebp - 0x238]
call fcn.00403a7c
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x4172ff
mov eax, dword [ebp - 0x1ec]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x1f0]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41732f
lea eax, [ebp - 0x238]
call fcn.0040363c
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.00403660
ret

Function at 0x417460
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0041743c
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize
cmp ebx, eax
jge 0x417489
mov byte [ebp - 5], 0
jmp 0x41748d
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x41784c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a6c
xor eax, eax
push ebp
push 0x4178a7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x417888
test byte [ebp - 0xc], 0x10
jne 0x41788c
xor eax, eax
jmp 0x41788e
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4178ae
lea eax, [ebp - 4]
call fcn.0040363c
ret

Function at 0x417e18
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00403a6c
xor eax, eax
push ebp
push 0x417f81
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.004178b8
test al, al
je 0x417f5e
mov eax, dword [0x449c6c]
cmp dword [eax], 1
jne 0x417e7f
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.004071a8
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00417b08
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.004036d4
mov eax, dword [0x449c04]
mov al, byte [eax]
sub al, 2
jae 0x417edb
mov eax, dword [0x449c04]
cmp dword [eax + 0xd], 0x457
jge 0x417edb
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x417f5e
mov eax, dword [ebp - 0x30]
imul dword [ebp - 0x2c]
imul dword [ebp - 0x34]
test eax, eax
jns 0x417ed0
add eax, 0x3ff
sar eax, 0xa
mov dword [ebp - 8], eax
jmp 0x417f5e
push 0x417f90
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x417f5e
xor eax, eax
push ebp
push 0x417f57
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x417fa0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x417f40
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x417f40
mov eax, dword [ebp - 0x14]
shl eax, 0x16
mov edx, dword [ebp - 0x18]
shr edx, 0xa
or eax, edx
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417f5e
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417f88
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.00403660
lea eax, [ebp - 4]
call fcn.0040363c
ret
Function at 0x417fb4
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00407024
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x418930
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x418a0a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406e08
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4189f4
xor eax, eax
push ebp
push 0x4189ed
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x418996
call fcn.00403178
jmp 0x4189f4
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x14]
call fcn.00403be8
cmp dword [ebp - 0x14], 0
jle 0x4189c8
lea eax, [ebp - 0x18]
call fcn.00403a88
mov edx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00406e6c
cmp eax, dword [ebp - 0x14]
je 0x4189c8
call fcn.00403178
jmp 0x4189f4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x18]
call fcn.00403690
mov byte [ebp - 9], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4189f4
mov eax, dword [ebp - 0x10]
call fcn.00406ed0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418a11
lea eax, [ebp - 0x18]
call fcn.0040363c
ret

Function at 0x418a3c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
mov byte [ebp - 9], cl
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 0xa], 0
mov eax, dword [ebp - 4]
call fcn.00406f40
test al, al
je 0x418a6d
mov edx, 0x21
mov eax, dword [ebp - 4]
call fcn.00406e08
mov dword [ebp - 0x10], eax
jmp 0x418a78
mov eax, dword [ebp - 4]
call fcn.00406e48
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x418b02
xor eax, eax
push ebp
push 0x418afb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
call fcn.004038b8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jle 0x418abf
mov eax, dword [ebp - 8]
call fcn.00403a7c
mov edx, eax
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.00406e98
cmp eax, dword [ebp - 0x14]
sete byte [ebp - 0xa]
jmp 0x418ac3
mov byte [ebp - 0xa], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418b02
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_SetEndOfFile
test eax, eax
jne 0x418ae1
mov byte [ebp - 0xa], 0
mov al, byte [ebp - 0xa]
and al, byte [ebp - 9]
je 0x418af2
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_FlushFileBuffers
mov eax, dword [ebp - 0x10]
call fcn.00406ed0
ret
mov al, byte [ebp - 0xa]
mov esp, ebp
pop ebp
ret
Function at 0x4197b0
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.0040363c
cmp dword [ebp - 4], 0
je 0x41980e
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jle 0x41980e
mov edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 8]
call fcn.00403be8
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.00403a7c
push eax
mov eax, dword [ebp - 4]
call fcn.00403a7c
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov esp, ebp
pop ebp
ret

Function at 0x419e1c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
xor edx, edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x419edf
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0040d8fc
xor eax, eax
push ebp
push 0x419ebd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x419e96
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.004037f0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0x10]
call fcn.0040f794
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.004038b8
inc eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x419e69
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419ec4
mov eax, dword [ebp - 4]
call fcn.0040d9b8
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
ret
Function at 0x41a0c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41a19f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00403be8
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403a7c
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004038b8
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00403be8
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00417b08
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004036d4
lea eax, [ebp - 0xc]
call fcn.004073f4
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00417b08
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00406a94
test eax, eax
jne 0x41a184
mov eax, dword [0x449c6c]
cmp dword [eax], 1
jne 0x41a177
lea eax, [ebp - 0xc]
call fcn.0041a1d0
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00417b08
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, 0x41a1b4
call fcn.00403904
jmp 0x41a184
mov eax, dword [ebp - 4]
mov edx, 0x41a1c4
call fcn.004036d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a1a6
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.00403660
ret

Function at 0x41a530
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov edx, dword [0x41a458]
call fcn.00403ecc
xor eax, eax
push ebp
push 0x41a595
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.004036d4
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x41a47c
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a59c
lea eax, [ebp - 0x10]
mov edx, dword [0x41a458]
call fcn.00403f94
ret

Function at 0x427954
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x427979
inc ecx
xor esi, esi
mov bl, byte [eax + esi]
xor bl, byte [edx + esi]
mov edi, dword [ebp - 4]
mov byte [edi + esi], bl
inc esi
dec ecx
jne 0x427969
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4