joyce8/EMBER2024-capa huggingface dataset:
Function at 0x412ef4
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68c
push ebx
push esi
mov esi, eax
push edi
lea eax, [ebp - 0x478]
call fcn.00411a5f
push 0
push dword [esi + 4]
xor edi, edi
push dword [esi]
inc edi
mov dword [ebp - 0xc], edi
call fcn.00451663
add esp, 0xc
lea eax, [ebp - 0x688]
push eax
push str.___AUTOIT_SCRIPT___
call fcn.00413064
test eax, eax
je 0x412f3f
push 6
pop eax
jmp 0x41305d
push dword [esi]
lea eax, [ebp - 1]
push edi
push edi
push eax
call fcn.00451cbe
push dword [esi]
lea eax, [ebp - 8]
push edi
push 4
push eax
call fcn.00451cbe
push dword [esi]
mov edi, dword [ebp - 8]
push 1
lea eax, [ebp - 8]
push 4
mov ebx, 0x87bc
push eax
xor edi, ebx
call fcn.00451cbe
push dword [esi]
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
xor eax, ebx
push 1
mov dword [ecx], eax
lea eax, [ebp - 8]
push 4
push eax
call fcn.00451cbe
mov ebx, dword [ebp - 8]
add esp, 0x40
push 1
push 0x10
push dword [esi]
xor ebx, 0xa685
call fcn.00451663
mov eax, dword [ebp + 0xc]
add esp, 0xc
push dword [eax]
call fcn.0045034f
pop ecx
push edi
mov dword [ebp + 0xc], eax
call fcn.0045034f
pop ecx
push dword [esi]
mov dword [ebp - 0x10], eax
push 1
push edi
push eax
call fcn.00451cbe
mov eax, dword [esi + 8]
mov esi, dword [ebp - 0x10]
add esp, 0x10
add eax, 0x2477
push eax
push edi
push esi
call fcn.00412bbc
push edi
push esi
lea edi, [ebp - 0xc]
call fcn.00411a0b
cmp ebx, dword [ebp - 0xc]
je 0x413005
push dword [ebp + 0xc]
call fcn.004505a8
pop ecx
push esi
call fcn.004505a8
pop ecx
push 0xa
jmp 0x412f39
cmp byte [ebp - 1], 1
jne 0x413047
lea eax, [ebp - 0x478]
call fcn.00411a5f
xor eax, eax
inc eax
mov dword [ebp - 0x464], eax
mov dword [ebp - 0x460], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x478], eax
lea eax, [ebp - 0x478]
mov dword [ebp - 0x474], esi
call fcn.00411a8d
push esi
call fcn.004505a8
jmp 0x413052
push dword [ebp + 0xc]
call fcn.004505a8
mov dword [ebp + 0xc], esi
mov eax, dword [ebp + 8]
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x413064
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push edi
mov byte [ebp - 1], 1
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push 1
push eax
call fcn.00451cbe
add esp, 0x10
push 0x18ee
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.00412bbc
lea eax, [ebp - 0x14]
push str.FILE
push eax
mov byte [ebp - 0x10], 0
call fcn.00450f60
test eax, eax
pop ecx
pop ecx
jne 0x4131b9
push dword [esi]
lea eax, [ebp - 0xc]
push 1
push 4
push eax
call fcn.00451cbe
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xadbc
lea ebx, [edi + edi]
push ebx
lea eax, [ebp - 0x228]
push 1
push eax
call fcn.00451cbe
add esp, 0x20
add edi, 0xb33f
push edi
push ebx
lea eax, [ebp - 0x228]
push eax
call fcn.00412bbc
and word [ebp + ebx - 0x228], 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.0044e262
push dword [esi]
lea eax, [ebp - 0xc]
push 1
push 4
push eax
call fcn.00451cbe
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xf820
lea ebx, [edi + edi]
push ebx
lea eax, [ebp - 0x228]
push 1
push eax
call fcn.00451cbe
add esp, 0x28
add edi, 0xf479
push edi
push ebx
lea eax, [ebp - 0x228]
push eax
call fcn.00412bbc
and word [ebp + ebx - 0x228], 0
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0xc]
call fcn.0044e262
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
call fcn.0044e81b
add esp, 0x10
test eax, eax
je 0x4131d0
xor edi, edi
inc edi
push edi
push edi
push dword [esi]
call fcn.00451663
add esp, 0xc
push dword [esi]
lea eax, [ebp - 8]
push edi
push 4
push eax
call fcn.00451cbe
xor dword [ebp - 8], 0x87bc
mov eax, dword [ebp - 8]
push edi
add eax, 0x18
push eax
push dword [esi]
call fcn.00451663
add esp, 0x1c
jmp 0x4131bd
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 1
je 0x413073
push 6
pop eax
pop edi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x4131ca
Function at 0x41a6a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x7c
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov esi, ecx
mov eax, dword [esi + 0x290]
push edi
lea edi, [esi + 0x66c]
mov ebx, dword [edi]
mov dword [esp + 0xc], esi
mov dword [esp + 0x4c], eax
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], ebx
je 0x41a6df
call fcn.0040e0ed
cmp byte [ebp + 0x10], 0
je 0x41a858
lea eax, [esi + 0x6b0]
push eax
lea ebx, [esp + 0x7c]
mov dword [esp + 0x14], eax
call fcn.0040f915
lea edi, [esi + 0x6c0]
lea esi, [esp + 0x5c]
mov dword [esp + 0x14], edi
call fcn.0040e356
mov ebx, dword [esp + 0xc]
mov eax, dword [ebx + 0xc]
mov dword [esp + 0x18], eax
mov eax, dword [ebx + 0x770]
mov dword [esp + 0x1c], eax
lea eax, [ebx + 0x6cc]
mov dword [esp + 0x24], eax
mov eax, dword [eax]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
mov eax, dword [ebx + 0x778]
lea edi, [ebx + 0x7c4]
lea esi, [esp + 0x50]
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], edi
call fcn.0040e356
mov eax, dword [ebx + 0x7d0]
mov dword [esp + 0x30], eax
mov eax, dword [ebx + 0x7d4]
mov dword [esp + 0x34], eax
mov eax, dword [ebx + 0x354]
mov dword [esp + 0x38], eax
mov eax, dword [ebx + 0x358]
add ebx, 0x340
push ebx
mov dword [esp + 0x44], ebx
lea ebx, [esp + 0x6c]
mov dword [esp + 0x40], eax
call fcn.0040f915
mov edi, dword [esp + 0xc]
push dword [ebp + 8]
mov eax, edi
call fcn.0041942d
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x78]
push eax
call fcn.00410021
mov eax, dword [esp + 0x14]
lea ebx, [esp + 0x5c]
call fcn.0040e41a
mov eax, dword [esp + 0x18]
push dword [esp + 0x20]
mov esi, dword [esp + 0x28]
mov dword [edi + 0xc], eax
mov eax, dword [esp + 0x20]
mov dword [edi + 0x770], eax
call fcn.0040305e
mov eax, dword [esp + 0x28]
mov dword [edi + 0x778], eax
mov eax, dword [esp + 0x2c]
lea ebx, [esp + 0x50]
call fcn.0040e41a
mov eax, dword [esp + 0x30]
mov ebx, dword [esp + 0x40]
mov dword [edi + 0x7d0], eax
mov eax, dword [esp + 0x34]
mov dword [edi + 0x7d4], eax
mov eax, dword [esp + 0x38]
mov dword [edi + 0x354], eax
mov eax, dword [esp + 0x3c]
mov dword [edi + 0x358], eax
lea eax, [esp + 0x68]
push eax
call fcn.00410021
lea ecx, [esp + 0x68]
call fcn.0040fb67
push dword [esp + 0x50]
call fcn.0044e346
push dword [esp + 0x60]
call fcn.0044e346
pop ecx
pop ecx
lea ecx, [esp + 0x78]
call fcn.0040fb67
mov edi, dword [esp + 0x44]
mov ebx, dword [esp + 0x48]
mov esi, dword [esp + 0xc]
jmp 0x41a862
push dword [ebp + 8]
mov eax, esi
call fcn.0041942d
cmp byte [ebp + 0xc], 0
je 0x41a874
call fcn.0040e147
jmp 0x41a874
call fcn.0041a8e6
cmp ebx, dword [edi]
jl 0x41a86f
mov eax, dword [esp + 0x4c]
pop edi
mov dword [esi + 0x290], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41bae0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, eax
xor eax, eax
mov ecx, ebx
call fcn.004059bd
cmp dword [eax + 8], 4
jne 0x41bb5b
push 0x60
call fcn.0044e2dc
test eax, eax
pop ecx
je 0x41bb0f
call fcn.0040b341
mov edi, eax
jmp 0x41bb11
xor edi, edi
xor eax, eax
mov ecx, ebx
call fcn.004059bd
mov esi, eax
call fcn.0040fc1a
xor ebx, ebx
push eax
inc ebx
mov eax, ebx
mov ecx, edi
call fcn.0040b351
test al, al
jne 0x41bbe9
test edi, edi
je 0x41bb48
mov esi, edi
call fcn.0040b51c
push edi
call fcn.0044e346
pop ecx
push 0
mov esi, dword [ebp + 0xc]
call fcn.004101d5
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret 0xc
xor eax, eax
mov ecx, ebx
call fcn.004059bd
call fcn.0040fcf2
mov esi, eax
dec esi
js 0x41bb48
xor eax, eax
mov ecx, ebx
call fcn.004059bd
call fcn.00410f2f
test al, al
je 0x41bb48
cmp esi, dword [edi + 0x680]
jge 0x41bb48
jb 0x41bb91
call fcn.0041a92b
jmp 0x41bb9a
mov eax, dword [edi + 0x67c]
mov eax, dword [eax + esi*4]
xor ebx, ebx
cmp dword [eax], ebx
je 0x41bb48
cmp esi, dword [edi + 0x680]
jb 0x41bbaf
call fcn.0041a92b
jmp 0x41bbb8
mov eax, dword [edi + 0x67c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
cmp dword [eax], ebx
jne 0x41bb48
cmp esi, dword [edi + 0x680]
jb 0x41bbcd
call fcn.0041a92b
jmp 0x41bbd6
mov eax, dword [edi + 0x67c]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
mov edi, dword [eax + 4]
test byte [edi], 3
jne 0x41bbe6
push ebx
jmp 0x41bb4a
xor ebx, ebx
inc ebx
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004059bd
cmp dword [eax + 8], 0xb
je 0x41bc8a
test byte [edi], 0x10
jne 0x41bc8a
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004059bd
mov esi, eax
call fcn.0040fc1a
mov ecx, eax
mov esi, edi
call fcn.0040b5de
cmp byte [ebp + 0x10], 0
je 0x41bcd0
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004059bd
mov esi, eax
call fcn.0040fc1a
push eax
call fcn.0044e874
test eax, eax
pop ecx
je 0x41bc7c
mov ecx, dword [ebp + 8]
lea ebx, [eax + eax - 2]
xor eax, eax
inc eax
call fcn.004059bd
mov esi, eax
call fcn.0040fc1a
cmp word [eax + ebx], 0xd
je 0x41bcd0
mov ecx, dword [ebp + 8]
xor eax, eax
inc eax
call fcn.004059bd
mov esi, eax
call fcn.0040fc1a
cmp word [eax + ebx], 0xa
je 0x41bcd0
mov ecx, 0x46becc
mov esi, edi
call fcn.0040b5de
jmp 0x41bcd0
mov ecx, dword [ebp + 8]
mov eax, ebx
call fcn.004059bd
call fcn.0040fc5c
mov ecx, dword [ebp + 8]
mov esi, eax
mov eax, ebx
call fcn.004059bd
mov ecx, eax
call fcn.0040fbdf
push dword [edi + 4]
push eax
push ebx
push esi
call fcn.004518b2
push dword [edi + 4]
call fcn.004514d4
add esp, 0x14
test eax, eax
je 0x41bcd0
mov esi, dword [ebp + 0xc]
push 0
call fcn.004101d5
mov ecx, dword [ebp + 8]
xor eax, eax
call fcn.004059bd
cmp dword [eax + 8], 4
jne 0x41bb52
mov esi, edi
call fcn.0040b51c
call fcn.0040b51c
push edi
call fcn.0044e346
pop ecx
jmp 0x41bb52
Function at 0x41c194
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push edi
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov ebx, ecx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x41c214
lea eax, [ebp - 0x22c]
push 0x46bd14
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41c202
lea eax, [ebp - 0x22c]
push 0x46ea20
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41c202
push dword [ebp + 0x10]
lea eax, [ebp - 0x22c]
push dword [ebp + 0xc]
push eax
call fcn.0040c241
add esp, 0xc
test al, al
je 0x41c22c
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41c1bb
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
call edi
cmp byte [ebp + 0x14], 0
jne 0x41c237
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x10
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor al, al
jmp 0x41c225
lea eax, [ebp - 0x258]
push eax
push 0x46ea18
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x41c2c5
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test byte [ebp - 0x258], 0x10
je 0x41c2b1
lea eax, [ebp - 0x22c]
push 0x46bd14
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41c2b1
lea eax, [ebp - 0x22c]
push 0x46ea20
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41c2b1
lea eax, [ebp - 0x22c]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041c194
test al, al
je 0x41c2c9
push 0x46ea20
call esi
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41c253
mov bl, 1
jmp 0x41c2cb
xor bl, bl
push dword [ebp - 4]
call edi
mov al, bl
jmp 0x41c225
Function at 0x41d852
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push str.___s
push eax
call fcn.0044e88a
lea eax, [ebp - 0x208]
push eax
call fcn.0044e874
add esp, 0x10
xor ebx, ebx
cmp word [ebp + eax*2 - 0x20a], 0x5c
jne 0x41d8b9
lea eax, [ebp - 0x208]
push eax
call fcn.0044e874
cmp word [ebp + eax*2 - 0x20c], 0x3a
pop ecx
je 0x41d8b9
lea eax, [ebp - 0x208]
push eax
call fcn.0044e874
pop ecx
mov word [ebp + eax*2 - 0x20a], bx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x41d8ce
cmp byte [ebp + 8], bl
je 0x41d99a
push esi
push ebx
push 0x2200000
push 3
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41d985
push 0x14
lea eax, [ebp - 0x820]
push ebx
push eax
call fcn.00450e40
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 0x820], 0xa0000003
call fcn.0044e874
add eax, eax
mov word [ebp - 0x816], ax
mov eax, dword [ebp - 0x816]
add eax, 2
mov word [ebp - 0x814], ax
push 0x104
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.00450d4d
mov eax, dword [ebp - 0x816]
add esp, 0x1c
push ebx
add eax, 0xc
mov word [ebp - 0x81c], ax
lea ecx, [ebp + 0xc]
push ecx
push ebx
movzx eax, ax
push ebx
add eax, 8
push eax
lea eax, [ebp - 0x820]
push eax
push 0x900a4
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
push esi
jne 0x41d990
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor eax, eax
jmp 0x41d999
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 8
Function at 0x41e5c6
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push edi
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
mov dword [esp + 0x1c], ecx
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x41e5fb
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
lea eax, [esp + 0x44]
push 0x46bd14
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41e650
lea eax, [esp + 0x44]
push 0x46ea20
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41e650
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
not ecx
and eax, ecx
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41e66f
lea eax, [esp + 0x18]
push eax
push edi
call ebx
test eax, eax
jne 0x41e601
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
call edi
cmp byte [ebp + 0x14], 0
jne 0x41e67b
mov al, 1
jmp 0x41e5f2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x41e5f0
lea eax, [esp + 0x18]
push eax
push 0x46ea18
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x41e6fd
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
test byte [esp + 0x18], 0x10
je 0x41e6ee
lea eax, [esp + 0x44]
push 0x46bd14
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41e6ee
lea eax, [esp + 0x44]
push 0x46ea20
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41e6ee
lea eax, [esp + 0x44]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041e5c6
test al, al
je 0x41e701
push 0x46ea20
call esi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call ebx
test eax, eax
jne 0x41e696
mov bl, 1
jmp 0x41e703
xor bl, bl
push dword [esp + 0x10]
call edi
mov al, bl
jmp 0x41e5f2
Function at 0x41f1e8
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
call fcn.0040e2e3
mov edi, esi
lea esi, [ebp - 0x20]
call fcn.0040e356
push 0x46ea18
mov eax, edi
call fcn.0040e4de
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0xc]
mov byte [ebp + 0xb], 1
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x41f33b
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp - 0x10]
call fcn.00419372
cmp eax, 1
je 0x41f337
cmp eax, 0xb
jne 0x41f25b
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41f23b
lea eax, [ebp - 0x244]
push 0x46bd14
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41f31d
lea eax, [ebp - 0x244]
push 0x46ea20
push eax
call fcn.0044e81b
test eax, eax
pop ecx
pop ecx
je 0x41f31d
lea ebx, [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.0040e41a
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0xc]
call fcn.0040e4de
test byte [ebp - 0x270], 0x10
je 0x41f2f5
mov esi, dword [ebp + 0x14]
xor ebx, ebx
cmp byte [ebp + 0x18], bl
je 0x41f2c4
add dword [esi], 1
adc dword [esi + 4], ebx
cmp byte [ebp + 0x1c], bl
je 0x41f31d
push 0x46b370
lea eax, [ebp - 0xc]
call fcn.0040e4de
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call fcn.0041f1e8
cmp al, bl
mov byte [ebp + 0xb], al
je 0x41f33b
jmp 0x41f31d
mov eax, dword [ebp - 0x250]
mov edx, dword [ebp - 0x254]
xor ecx, ecx
xor esi, esi
or ecx, eax
mov eax, dword [ebp + 0xc]
or edx, esi
add dword [eax], ecx
adc dword [eax + 4], edx
cmp byte [ebp + 0x18], 0
je 0x41f31d
add dword [edi], 1
adc dword [edi + 4], esi
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41f23b
jmp 0x41f33b
mov byte [ebp + 0xb], 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp - 0x20]
call fcn.0044e346
pop ecx
push dword [ebp - 0xc]
call fcn.0044e346
mov al, byte [ebp + 0xb]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x427994
Capabilities:
Set socket configuration

Disassembly:
push ebx
push edi
push dword [esp + 0x10]
or eax, 0xffffffff
mov word [esi], 2
call fcn.0040df1c
pop ecx
mov ebx, eax
push ebx
call sub.WSOCK32.dll_inet_addr
push ebx
mov edi, eax
call fcn.0044e346
cmp edi, 0xffffffff
pop ecx
jne 0x4279c5
xor ecx, ecx
push 0
inc ecx
jmp 0x4279ea
mov eax, dword [esp + 0x14]
lea ecx, [eax - 1]
cmp ecx, 0xfffe
mov dword [esi + 4], edi
ja 0x4279e5
push eax
call sub.WSOCK32.dll_htons
mov word [esi + 2], ax
mov al, 1
jmp 0x4279f5
push 0
push 2
pop ecx
mov eax, dword [esp + 0x10]
call fcn.0041a88b
xor al, al
pop edi
pop ebx
ret 0xc

Function at 0x428614
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
and dword [ebp - 8], 0
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 0x80004002
mov dword [ebp - 4], 0x28
call fcn.0040e2b7
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
mov ebx, 0x20019
push ebx
push 0
push str.interface
mov edi, bind
push edi
call esi
test eax, eax
je 0x428672
mov esi, 0x80004002
push dword [ebp - 0x20]
call fcn.0044e346
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x428740
mov eax, dword [ebp - 4]
and word [ebp + eax*2 - 0x78], 0
push str.interface_
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0x1fe
call fcn.0040e446
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x20]
call fcn.0040e4de
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
push dword [ebp - 0x20]
push edi
call esi
test eax, eax
jne 0x42872b
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x280]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x428722
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
and word [ebp + eax*2 - 0x280], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x280]
push eax
call fcn.0044e1a7
test eax, eax
pop ecx
pop ecx
jne 0x428722
push dword [ebp + 8]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 0
je 0x428740
inc dword [ebp - 8]
mov dword [ebp - 4], 0x28
jmp 0x428672
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0xc]
jmp 0x428662
Function at 0x428751
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.0040e2b7
fld1
lea eax, [ebp - 0xc]
fstp qword [ebp - 0x28]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x4288e8
push dword [ebp - 0xc]
call fcn.0040d6b8
mov esi, eax
lea eax, [ebp - 0x20]
mov dword [esp], str.interface_
call fcn.0040e446
push esi
lea eax, [ebp - 0x20]
call fcn.0040e4de
push str.TypeLib
lea eax, [ebp - 0x20]
call fcn.0040e4de
push esi
call fcn.0044e346
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push dword [ebp - 0x20]
push bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x4288e8
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
call ebx
mov esi, eax
cmp esi, edi
jne 0x4288df
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x240], di
lea eax, [ebp - 0x240]
push eax
call fcn.0040d6b8
pop ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push dword [ebp - 0x14]
mov esi, eax
call fcn.0044e346
cmp esi, edi
pop ecx
jl 0x4288df
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push str.Version
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
call ebx
test eax, eax
jne 0x42888a
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x240], di
lea eax, [ebp - 0x240]
push eax
call fcn.00450f44
fstp qword [ebp - 0x28]
pop ecx
fld1
lea eax, [ebp - 0x10]
push eax
push edi
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ebp - 0x28]
fstp qword [esp]
call fcn.00452eb0
add esp, 0x10
call fcn.00465706
fld qword [ebp - 0x28]
push eax
call fcn.00465706
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
mov esi, eax
cmp esi, edi
jl 0x4288df
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x20]
call fcn.0044e346
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret