joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401080
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.724fae7f839736399bed
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x401127
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x401127
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x401140
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x401127
test al, 1
jne 0x401105
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4010d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x401127
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.60e9665f85fb9203bcb922134beb219
call fcn.004392d0
add esp, 4
jmp 0x401127

Function at 0x4011c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.46a3833b87853e517
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.b0af33fdfa25e2d375375f23aafd63
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x401238
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.701396414449bad3ae33c47b504d
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x401205
test eax, eax
jne 0x40124f
push edi
push str.8b7f15831e31c1530c53ca857d2fbc_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.8409d0475709d8b388c1f4cd69f3__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x401270
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0xaa
idiv ecx
inc esi
sub dl, 8
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x4012a6
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401327
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401327
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x401340
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.a6fd9bf9093b69312d0
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.eb439ad11ad73695b8
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4013b8
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.e9333a7183496c7179c33bdb
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x401385
test eax, eax
jne 0x4013cf
push edi
push str.991372272c858c871f8bac419_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.7f8f839ba24bc21f79d5ec83__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x401460
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x270
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x268], eax
push esi
push 0x103
lea eax, [esp + 0x165]
push 0
push eax
mov byte [esp + 0x16c], 0
call fcn.0043fbd0
add esp, 0xc
xor esi, esi
call fcn.004393a7
cdq
mov ecx, 0x2b
idiv ecx
inc esi
add dl, 4
cmp esi, 0x19
mov byte [esp + esi + 0x15f], dl
jl 0x401496
xor eax, eax
lea edx, [esp + 0x160]
push edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401517
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x401517
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
lea ecx, [esp + 0x10]
mov dword [esp + 8], edx
push ecx
lea edx, [esp + 0xc]
push edx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
mov ecx, dword [esp + 0x26c]
pop esi
xor ecx, esp
call fcn.00438dc1
add esp, 0x270
ret

Function at 0x401530
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.c6df2f1fb1cd1a5f26316c0b3
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x4015d7
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4015d7
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x4015f0
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x4015d7
test al, 1
jne 0x4015b5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401582
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x4015d7
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.5afdaa51fd8153c5a7515803b8c75
call fcn.004392d0
add esp, 4
jmp 0x4015d7
Function at 0x401600
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.e7bd5b8bf2d72a318c4bcdefd00df7
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.72834f41c9e343c74393fb
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x401678
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.96594379070d93d73dc34a8
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x401645
test eax, eax
jne 0x40168f
push edi
push str.851343af7a4353ab52e9_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.becf2083bea58adfe13920__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x401850
Capabilities:
Delete file

Disassembly:
push ecx
push esi
push edi
mov esi, eax
mov dword [esp + 8], 0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0
shr edi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp edi, eax
jbe 0x401886
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
call fcn.00401150
xor edi, edi
cmp dword [esi + 0x54], edi
jbe 0x4018fb
push ebx
push ebp
nop
xor edx, edx
mov eax, edi
div dword [esi + 0x30]
mov dword [esp + 0x10], edx
cmp edx, dword [esi + 0x30]
jbe 0x4018a5
call fcn.004392c0
mov ebx, 0x10
cmp dword [esi + 0x34], ebx
jb 0x4018b4
mov ebp, dword [esi + 0x20]
jmp 0x4018b7
lea ebp, [esi + 0x20]
cmp edi, dword [esi + 0x4c]
jbe 0x4018c1
call fcn.004392c0
cmp dword [esi + 0x50], ebx
jb 0x4018cb
mov eax, dword [esi + 0x3c]
jmp 0x4018ce
lea eax, [esi + 0x3c]
mov bl, byte [eax + edi]
mov eax, dword [esp + 0x10]
xor bl, byte [eax + ebp]
cmp edi, dword [esi + 0x4c]
jbe 0x4018e2
call fcn.004392c0
cmp dword [esi + 0x50], 0x10
jb 0x4018ed
mov eax, dword [esi + 0x3c]
jmp 0x4018f0
lea eax, [esi + 0x3c]
mov byte [eax + edi], bl
inc edi
cmp edi, dword [esi + 0x54]
jb 0x401890
pop ebp
pop ebx
mov edi, dword [esp + 0x10]
push 0xffffffffffffffff
add esi, 0x38
push 0
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
push esi
mov ecx, edi
mov byte [edi + 4], 0
call fcn.00402d80
mov eax, edi
pop edi
pop esi
pop ecx
ret 4
Function at 0x401930
Capabilities:
Set uefi variable

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
xor ebx, ebx
push edi
mov esi, eax
mov dword [esp + 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x401954
sub eax, 2
je 0x401954
sub eax, 4
jne 0x401963
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.004011c0
cmp dword [esi + 0x54], ebx
jbe 0x401a94
lea esp, [esp]
xor edx, edx
mov eax, ebx
test bl, 1
jne 0x4019ca
div dword [esi + 0x14]
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0
shr edi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp edi, eax
jbe 0x4019ad
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
call fcn.00401270
cmp ebp, dword [esi + 0x14]
jbe 0x4019b7
call fcn.004392c0
cmp dword [esi + 0x18], 0x10
jb 0x4019c5
mov edi, dword [esi + 4]
jmp 0x401a49
lea edi, [esi + 4]
jmp 0x401a49
div dword [esi + 0x30]
mov ebp, edx
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0
shr edi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp edi, eax
jbe 0x401a02
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, 1
jmp 0x401a04
xor ecx, ecx
mov eax, 0x701c773b
imul ecx
sar edx, 0xd
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x4912
jle 0x401a31
push 0x4912
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401340
call fcn.004308a0
cmp ebp, dword [esi + 0x30]
jbe 0x401a3b
call fcn.004392c0
cmp dword [esi + 0x34], 0x10
jb 0x401a46
mov edi, dword [esi + 0x20]
jmp 0x401a49
lea edi, [esi + 0x20]
cmp ebx, dword [esi + 0x4c]
jbe 0x401a53
call fcn.004392c0
cmp dword [esi + 0x50], 0x10
jb 0x401a5e
mov eax, dword [esi + 0x3c]
jmp 0x401a61
lea eax, [esi + 0x3c]
mov al, byte [eax + ebx]
xor al, byte [edi + ebp]
mov byte [esp + 0x13], al
cmp ebx, dword [esi + 0x4c]
jbe 0x401a79
call fcn.004392c0
mov al, byte [esp + 0x13]
cmp dword [esi + 0x50], 0x10
jb 0x401a84
mov ecx, dword [esi + 0x3c]
jmp 0x401a87
lea ecx, [esi + 0x3c]
mov byte [ecx + ebx], al
inc ebx
cmp ebx, dword [esi + 0x54]
jb 0x401970
mov edi, dword [esp + 0x1c]
push 0xffffffffffffffff
add esi, 0x38
push 0
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
push esi
mov ecx, edi
mov byte [edi + 4], 0
call fcn.00402d80
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x401ad0
Capabilities:
Delete file

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov esi, eax
mov dword [esp + 0x14], 0
call fcn.004300d0
mov ecx, eax
mov eax, 0x4f576647
imul ecx
sar edx, 0xb
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0x19d0
jle 0x401b15
push 0x19d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.004013f0
call fcn.00436210
mov eax, dword [esi + 0x54]
mov ebp, eax
shr ebp, 1
cmp ebp, eax
jae 0x401bf4
mov ecx, dword [esi + 0x14]
xor edx, edx
mov eax, ebp
div ecx
mov edi, edx
cmp edi, ecx
jbe 0x401b38
call fcn.004392c0
mov ebx, 0x10
cmp dword [esi + 0x18], ebx
jb 0x401b4b
mov ecx, dword [esi + 4]
mov dword [esp + 0x14], ecx
jmp 0x401b52
lea eax, [esi + 4]
mov dword [esp + 0x14], eax
cmp ebp, dword [esi + 0x4c]
jbe 0x401b5c
call fcn.004392c0
cmp dword [esi + 0x50], ebx
jb 0x401b66
mov eax, dword [esi + 0x3c]
jmp 0x401b69
lea eax, [esi + 0x3c]
mov bl, byte [eax + ebp]
mov edx, dword [esp + 0x14]
xor bl, byte [edx + edi]
cmp ebp, dword [esi + 0x4c]
jbe 0x401b7d
call fcn.004392c0
cmp dword [esi + 0x50], 0x10
jb 0x401b88
mov eax, dword [esi + 0x3c]
jmp 0x401b8b
lea eax, [esi + 0x3c]
mov byte [eax + ebp], bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
push 0
shr edi, 0x18
call fcn.0043a6c4
imul eax, eax, 0x63
add esp, 4
cmp edi, eax
jbe 0x401bb9
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, 1
jmp 0x401bbb
xor ecx, ecx
mov eax, 0x86d90545
imul ecx
add edx, ecx
sar edx, 7
mov eax, edx
shr eax, 0x1f
add eax, edx
cmp eax, 0xf3
jle 0x401bea
push 0xf3
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00401460
call fcn.004308a0
inc ebp
cmp ebp, dword [esi + 0x54]
jb 0x401b24
mov ebp, dword [esi + 0x54]
xor edi, edi
sub ebp, 1
je 0x401c66
mov edi, edi
cmp ebp, dword [esi + 0x4c]
jbe 0x401c0a
call fcn.004392c0
mov ebx, 0x10
cmp dword [esi + 0x50], ebx
jb 0x401c1d
mov ecx, dword [esi + 0x3c]
mov dword [esp + 0x14], ecx
jmp 0x401c24
lea edx, [esi + 0x3c]
mov dword [esp + 0x14], edx
cmp edi, dword [esi + 0x4c]
jbe 0x401c2e
call fcn.004392c0
cmp dword [esi + 0x50], ebx
jb 0x401c38
mov eax, dword [esi + 0x3c]
jmp 0x401c3b
lea eax, [esi + 0x3c]
mov bl, byte [eax + edi]
mov eax, dword [esp + 0x14]
xor bl, byte [eax + ebp]
cmp edi, dword [esi + 0x4c]
jbe 0x401c4f
call fcn.004392c0
cmp dword [esi + 0x50], 0x10
jb 0x401c5a
mov eax, dword [esi + 0x3c]
jmp 0x401c5d
lea eax, [esi + 0x3c]
mov byte [eax + edi], bl
inc edi
dec ebp
cmp edi, ebp
jb 0x401c00
mov edi, dword [esp + 0x1c]
push 0xffffffffffffffff
add esi, 0x38
push 0
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
push esi
mov ecx, edi
mov byte [edi + 4], 0
call fcn.00402d80
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 4
Function at 0x401ca0
Capabilities:
Set uefi variable

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov esi, eax
mov edi, dword [esi + 0x54]
mov dword [esp + 0x10], 0
shr edi, 1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x401cc9
sub eax, 2
je 0x401cc9
sub eax, 4
jne 0x401cd7
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
cmp edi, dword [esi + 0x54]
jae 0x401d49
lea esp, [esp]
xor edx, edx
mov eax, edi
div dword [esi + 0x30]
mov dword [esp + 0x10], edx
cmp edx, dword [esi + 0x30]
jbe 0x401cf5
call fcn.004392c0
mov ebx, 0x10
cmp dword [esi + 0x34], ebx
jb 0x401d04
mov ebp, dword [esi + 0x20]
jmp 0x401d07
lea ebp, [esi + 0x20]
cmp edi, dword [esi + 0x4c]
jbe 0x401d11
call fcn.004392c0
cmp dword [esi + 0x50], ebx
jb 0x401d1b
mov eax, dword [esi + 0x3c]
jmp 0x401d1e
lea eax, [esi + 0x3c]
mov bl, byte [eax + edi]
mov eax, dword [esp + 0x10]
xor bl, byte [eax + ebp]
cmp edi, dword [esi + 0x4c]
jbe 0x401d32
call fcn.004392c0
cmp dword [esi + 0x50], 0x10
jb 0x401d3d
mov eax, dword [esi + 0x3c]
jmp 0x401d40
lea eax, [esi + 0x3c]
mov byte [eax + edi], bl
inc edi
cmp edi, dword [esi + 0x54]
jb 0x401ce0
mov ebp, dword [esi + 0x54]
xor edi, edi
sub ebp, 1
je 0x401db9
cmp ebp, dword [esi + 0x4c]
jbe 0x401d5d
call fcn.004392c0
mov ebx, 0x10
cmp dword [esi + 0x50], ebx
jb 0x401d70
mov ecx, dword [esi + 0x3c]
mov dword [esp + 0x10], ecx
jmp 0x401d77
lea edx, [esi + 0x3c]
mov dword [esp + 0x10], edx
cmp edi, dword [esi + 0x4c]
jbe 0x401d81
call fcn.004392c0
cmp dword [esi + 0x50], ebx
jb 0x401d8b
mov eax, dword [esi + 0x3c]
jmp 0x401d8e
lea eax, [esi + 0x3c]
mov bl, byte [eax + edi]
mov eax, dword [esp + 0x10]
xor bl, byte [eax + ebp]
cmp edi, dword [esi + 0x4c]
jbe 0x401da2
call fcn.004392c0
cmp dword [esi + 0x50], 0x10
jb 0x401dad
mov eax, dword [esi + 0x3c]
jmp 0x401db0
lea eax, [esi + 0x3c]
mov byte [eax + edi], bl
inc edi
dec ebp
cmp edi, ebp
jb 0x401d53
mov edi, dword [esp + 0x18]
push 0xffffffffffffffff
add esi, 0x38
push 0
mov dword [edi + 0x18], 0xf
mov dword [edi + 0x14], 0
push esi
mov ecx, edi
mov byte [edi + 4], 0
call fcn.00402d80
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
Function at 0x403860
Capabilities:
Check if file exists
Copy file
Create directory
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x254
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x24c], eax
push ebx
push ebp
push esi
push edi
push 0
push str.c977f4c706fffcc75b7daf1b
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x403907
lea eax, [esp + 0x10]
push eax
push str..txt
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x403907
mov ebp, dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
lea ecx, [esp + 0x154]
push ecx
lea edx, [esp + 0x44]
push edx
call ebp
test eax, eax
je 0x403920
lea eax, [esp + 0x3c]
push eax
call esi
cmp eax, 0xffffffff
je 0x403907
test al, 1
jne 0x4038e5
or eax, 1
push eax
lea ecx, [esp + 0x154]
push ecx
call edi
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4038b2
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x403907
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x25c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00438dc1
add esp, 0x254
ret
push str.145b2973a2d98df5c299cf2984e
call fcn.004392d0
add esp, 4
jmp 0x403907

Function at 0x4044e0
Capabilities:
Initialize winsock library

Disassembly:
push 0xffffffffffffffff
push 0x44cc39
mov eax, dword fs:[0]
push eax
sub esp, 0x19c
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x198], eax
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0x1a0]
mov dword fs:[0], eax
xor eax, eax
mov ecx, 0xf
mov dword [esi + 0x18], ecx
mov dword [esi + 0x14], eax
mov byte [esi + 4], al
mov dword [esi + 0x38], ecx
mov dword [esi + 0x34], eax
mov byte [esi + 0x24], al
lea ecx, [esp + 0xc]
push ecx
push 0x202
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], eax
mov word [esi + 0x1c], ax
call sub.WS2_32.dll_WSAStartup
mov eax, esi
mov ecx, dword [esp + 0x1a0]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [esp + 0x198]
xor ecx, esp
call fcn.00438dc1
add esp, 0x1a8
ret
Function at 0x4062e0
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x44d2d8
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x4612b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
sub esp, 0x1c
xor eax, eax
mov ecx, esp
mov dword [esp + 0x30], eax
mov dword [esp + 0x24], esp
push 0xffffffffffffffff
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x18], 0xf
push eax
mov byte [ecx + 4], al
lea eax, [esp + 0x40]
push eax
call fcn.00402d80
call fcn.004016b0
cmp dword [esp + 0x34], 0x10
jb 0x406346
mov ecx, dword [esp + 0x20]
push ecx
call fcn.004393c9
add esp, 4
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 0x1c

Function at 0x406540
Capabilities:
Set uefi variable

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, 2
je 0x406558
sub eax, 2
je 0x406558
sub eax, 4
je 0x406558
xor eax, eax
ret
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetFirmwareEnvironmentVariableA]
mov eax, 1
ret

Function at 0x406630
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
push ebx
push esi
push edi
mov edi, 0x2000
push edi
call fcn.00439099
push str.f7bb260b1bc12e9338a577c3b3c75
mov esi, eax
mov dword [esp + 0x14], edi
call fcn.004392d0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
lea eax, [esp + 0xc]
push eax
push esi
push 0
push 0
push str.34e5c3d59bd796436d032e95d
push 0x80000004
call ebx
cmp eax, 0xea
jne 0x4066a8
add edi, 0x1000
push edi
push esi
call fcn.004394a6
add esp, 8
lea ecx, [esp + 0xc]
push ecx
mov esi, eax
push esi
push 0
push 0
push str.16e706fd78ad6725350553ebe08f75
push 0x80000004
mov dword [esp + 0x24], edi
call ebx
cmp eax, 0xea
je 0x406675
test eax, eax
jne 0x4066bf
push edi
push str.0c232bcfe2ebeb9576_d
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret
push eax
push str.c985c02d5d657e113f67__d_
call fcn.004392d0
add esp, 8
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x406750
Capabilities:
Get common file path
Set current directory

Disassembly:
sub esp, 0x68
mov eax, dword [0x4612b0]
xor eax, esp
mov dword [esp + 0x64], eax
lea eax, [esp]
push eax
push 0xc6
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x4067d1
cmp eax, 0x6f
jbe 0x406793
push eax
push str.4f1f2a71491be82573530c
call fcn.004392d0
add esp, 8
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
push str.4a1723a9241d74232543ee3
call esi
test eax, eax
jne 0x4067c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.SetCurrentDirectory_failed___d_
call fcn.004392d0
add esp, 8
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret
lea ecx, [esp + 4]
push ecx
call esi
pop esi
mov ecx, dword [esp + 0x64]
xor ecx, esp
call fcn.00438dc1
add esp, 0x68
ret