joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4068c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 4
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREAdobeAdobe_ARM1.0ARM
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x406927
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
push edx
lea eax, [ebp - 0x20]
push eax
push 4
push 0
push str.iLastSvcSuccess
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x28]
add eax, 0x230
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x40cf90
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x454], 0
je 0x406977
lea edx, [ebp - 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherW]
test eax, eax
jne 0x406977
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
mov dword [eax + 0x454], 0
mov ecx, dword [ebp - 0x28]
cmp dword [ecx + 0x454], 0
jne 0x40698b
mov ecx, dword [ebp - 0x28]
call fcn.0040b470
mov esp, ebp
pop ebp
ret

Function at 0x407810
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jne 0x407823
xor al, al
jmp 0x407855
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
call fcn.00407650
push eax
mov ecx, dword [ebp - 8]
mov edx, dword [ecx + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x407853
xor eax, eax
cmp dword [ebp - 4], 0
setne al
mov ecx, dword [ebp + 0xc]
mov byte [ecx], al
mov al, 1
jmp 0x407855
xor al, al
mov esp, ebp
pop ebp
ret 8

Function at 0x407f30
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x413018]
jne 0x407f3a
repz ret
jmp fcn.004084c2
Function at 0x408a80
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x413018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x430], ax
push 0x208
push 0
lea ecx, [ebp - 0x42e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
xor edx, edx
mov word [ebp - 0x218], dx
push 0x208
push 0
lea eax, [ebp - 0x216]
push eax
call sub.MSVCR90.dll_memset
add esp, 0xc
mov dword [ebp - 0x434], 0
mov dword [ebp - 0x21c], 0
mov dword [ebp - 0x438], 0
push 0x105
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
push 0x105
lea edx, [ebp - 0x430]
push edx
push 0x40e9b0
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x408b46
push 0xa
push 0x104
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x434]
push ecx
call dword [sym.imp.MSVCR90.dll__itow_s]
add esp, 0x10
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x10
jge 0x408b68
push str.thsnYaViMRAeBoda
push 0x104
mov eax, dword [ebp + 8]
push eax
call fcn.004063c0
cmp dword [ebp + 0xc], 0
je 0x408b80
mov ecx, dword [ebp + 0xc]
push ecx
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.004063c0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407f30
mov esp, ebp
pop ebp
ret
Function at 0x408f00
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x413018]
xor eax, ebp
mov dword [ebp - 8], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call fcn.00408e50
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x408fa3
push 0x40ef98
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406370
push str.Could_not_open_file_mapping_object.
push 0x104
mov edx, dword [ebp + 0xc]
add edx, 0x208
push edx
call fcn.00406370
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x410], eax
xor eax, eax
jmp 0x40909e
push 0x1e78
push 0
push 0
push 4
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 0
jne 0x409019
push 0x40f010
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call fcn.00406370
push str.Could_not_map_view_of_file.
push 0x104
mov ecx, dword [ebp + 0xc]
add ecx, 0x208
push ecx
call fcn.00406370
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [ebp + 0xc]
mov dword [edx + 0x410], eax
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x40909e
mov dword [ebp - 4], 0xe3c
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCR90.dll_memcpy_s]
add esp, 0x10
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov eax, dword [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.ReadSharedMemory__:
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.00406370
lea edx, [ebp - 0x210]
push edx
push str.succeeded._mapping_obj_name:__s
push 0x104
mov eax, dword [ebp + 0xc]
add eax, 0x208
push eax
call dword [sym.imp.MSVCR90.dll_swprintf_s]
add esp, 0x10
mov ecx, dword [ebp + 0xc]
mov dword [ecx + 0x410], 0
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407f30
mov esp, ebp
pop ebp
ret
Function at 0x4090b0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x413018]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
call fcn.00408e50
add esp, 4
lea eax, [ebp - 0x210]
push eax
push 0
push 0xf001f
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x409148
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x218], eax
cmp dword [ebp - 0x218], 2
je 0x409144
push 0
mov ecx, dword [ebp - 0x218]
push ecx
push str.Could_not_open_file_mapping_object
push str.ReleaseSharedMemory__
call fcn.00408b90
add esp, 0x10
xor eax, eax
jmp 0x40915a
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00407f30
mov esp, ebp
pop ebp
ret

Function at 0x409370
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov byte [0x41380c], 1
mov dword [0x413804], 1
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x40f218
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4093ea
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
push str.iLogLevel
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x409400
cmp dword [ebp - 0xc], 1
jne 0x409400
mov dword [0x413804], 2
mov esp, ebp
pop ebp
ret
Function at 0x409ad0
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x409af4
mov eax, 3
jmp 0x409c0c
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x409b10
mov eax, 2
jmp 0x409c0c
mov dword [ebp - 4], 0x82
mov edx, dword [ebp - 4]
shl edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 4], eax
ja 0x409beb
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x821
jb 0x409b49
mov eax, 0xd
jmp 0x409c0c
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call sub.MSVCR90.dll_void____cdecl_operator_new___unsigned_int_
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x40f630
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x409bbc
mov ecx, dword [ebp - 4]
sub ecx, 1
cmp dword [ebp - 8], ecx
jne 0x409be6
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.MSVCR90.dll_void___cdecl_operator_delete___void__
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [ebp - 8], 0
jne 0x409be6
mov eax, 0xe8
jmp 0x409c0c
jmp 0x409b1f
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x409c03
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x409c0a
mov eax, 0xd
jmp 0x409c0c
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x409ca0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], vtable.CArmReport.0
push 0x104
push 0
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
mov edx, dword [ebp - 8]
add edx, 4
push edx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x409ceb
jmp 0x409d17
push str.AdobeARM_
push 0x104
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.004063c0
push str.ArmReport.ini
push 0x104
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call fcn.004063c0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40a3c0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x413018]
xor eax, ebp
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x210], eax
mov ecx, dword [ebp - 0x210]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0x100
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCR90.dll_vswprintf_s]
add esp, 0x10
mov dword [ebp - 0x210], 0
lea ecx, [ebp - 0x208]
mov dword [ebp - 0x20c], ecx
mov edx, dword [ebp + 8]
cmp dword [edx + 0x454], 0
je 0x40a463
mov eax, dword [ebp + 8]
add eax, 0x230
push eax
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40a461
push 0
lea ecx, [ebp - 0x20c]
push ecx
push 0
push 1
push 0
push 0
push 0
push 4
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_ReportEventW]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
jmp 0x40a473
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.MSVCR90.dll__putws]
add esp, 4
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407f30
mov esp, ebp
pop ebp
ret

Function at 0x40a580
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
push 0
push 0x80
push 1
push 0
mov eax, dword [ebp + 0x10]
push eax
push 0x40000000
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40a676
mov dword [ebp - 0x18], 0x100000
mov dword [ebp - 0x10], 0
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.MSVCR90.dll_malloc]
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 8], 0
jne 0x40a65d
push 0
lea ecx, [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a65d
cmp dword [ebp - 0x10], 0
jbe 0x40a65d
mov dword [ebp - 0xc], 0
push 0
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40a63c
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x18]
push ecx
push 0
mov edx, dword [ebp - 0x14]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
jmp 0x40a5e3
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.MSVCR90.dll_free]
add esp, 4
jmp 0x40a67f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x40ba10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
mov eax, dword [0x413018]
xor eax, ebp
mov dword [ebp - 8], eax
cmp dword [ebp + 8], 0
jne 0x40ba33
mov eax, 0xd
jmp 0x40bada
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40bad5
call fcn.0040a690
test eax, eax
je 0x40ba56
xor eax, eax
jmp 0x40bada
mov dword [ebp - 0x258], 0
push 0x24c
push 0
lea ecx, [ebp - 0x254]
push ecx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea edx, [ebp - 0x258]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40bad5
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0xc], 0xffffffff
je 0x40bab2
mov edx, dword [ebp - 0x238]
cmp edx, dword [ebp + 0xc]
je 0x40bab2
mov eax, 0x5b6
jmp 0x40bada
mov eax, dword [ebp + 0x10]
push eax
push 0
mov ecx, dword [ebp + 8]
push ecx
call fcn.0040af60
add esp, 0xc
test eax, eax
je 0x40bace
xor eax, eax
jmp 0x40bada
mov eax, 0x3ee
jmp 0x40bada
mov eax, 2
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00407f30
mov esp, ebp
pop ebp
ret
Function at 0x40c040
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40d279
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x413018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040b510
add esp, 0x10
lea ecx, [ebp - 0x42c]
call fcn.00409ca0
mov dword [ebp - 4], 0
mov byte [ebp - 0x42d], 0
lea ecx, [ebp - 0x42d]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x42c]
call fcn.0040a250
xor ecx, ecx
mov word [ebp - 0x21c], cx
push 0x206
push 0
lea edx, [ebp - 0x21a]
push edx
call sub.MSVCR90.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0
push 0
push 0x2b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jge 0x40c102
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.00409c20
jmp 0x40c151
push str.AdobeARM1.0Temp
push 0x104
lea ecx, [ebp - 0x21c]
push ecx
call fcn.004063c0
test eax, eax
jge 0x40c130
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.00409c20
jmp 0x40c151
lea edx, [ebp - 0x21c]
push edx
call fcn.0040b700
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x42c]
call fcn.00409c20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00407f30
mov esp, ebp
pop ebp
ret
Function at 0x407b6e
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x407b92
jmp 0x407b9c
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x407b82
mov esp, ebp
pop ebp
ret

Function at 0x409a10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x409a30
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040b498
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x409a51
test byte [esp + 8], 2
je 0x409a51
mov dword [0x418f90], 0xd
mov dword [0x418f94], 5
jmp 0x409a2c
xor eax, eax
ret

Function at 0x40b2d1
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4118d0
cmp edx, dword [eax]
je 0x40b2f3
add eax, 8
inc ecx
cmp eax, 0x411960
jl 0x40b2e4
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4118d0]
jne 0x40b421
mov eax, dword [0x418fe4]
cmp eax, 1
je 0x40b3fb
test eax, eax
jne 0x40b324
cmp dword [0x411358], 1
je 0x40b3fb
cmp edx, 0xfc
je 0x40b421
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x40b35b
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00408210
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004083e0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40b39e
lea eax, [ebp - 0x1a4]
push eax
call fcn.004083e0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4104fc
push edi
call fcn.00408a70
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00408210
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00408220
lea eax, [ebp - 0xa0]
push 0x4104dc
push eax
call fcn.00408220
push dword [esi + 0x4118d4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00408220
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.0040dd96
add esp, 0x2c
pop edi
jmp 0x40b421
lea eax, [ebp + 8]
lea esi, [esi + 0x4118d4]
push 0
push eax
push dword [esi]
call fcn.004083e0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x5ce700
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x6a4bcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00694f78
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x5ce782
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00691df6
mov eax, dword [eax]
push 0x896f20
push eax
call fcn.00682ed4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00695203
test bl, bl
je 0x5ce782
push 0x896f20
lea ecx, [esp + 0xc]
call fcn.00695593
push 0x896f2c
lea ecx, [esp + 0xc]
call fcn.00695593
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x5ce7be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00695203
jmp 0x5ce889
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x5ce842
lea edx, [esp + 0x7c]
push 0x896f28
push edx
call fcn.00682ed4
add esp, 8
test eax, eax
je 0x5ce842
lea eax, [esp + 0x7c]
push 0x896f24
push eax
call fcn.00682ed4
add esp, 8
test eax, eax
je 0x5ce842
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x5ce7d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00695203
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x5cf0b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x5cf112
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x5cf120
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x6a4c4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x8ac7b8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x5cf258
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x5cf186
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00695203
xor eax, eax
jmp 0x5cf2cf
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.00695340
push esi
lea ecx, [esp + 0xc]
call fcn.006955cf
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push 0x896f60
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x5cf2ad
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push connect
call fcn.005cf0b0
test eax, eax
jne 0x5cf2ad
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push connect
mov ecx, edi
call fcn.005cf0b0
test eax, eax
jne 0x5cf2ad
lea eax, [esp + 0x14]
push 0x896f3c
push eax
call fcn.006841b0
mov esi, eax
add esp, 8
test esi, esi
jne 0x5cf28c
lea ecx, [esp + 0x14]
push 0x896f38
push ecx
call fcn.00684130
mov esi, eax
add esp, 8
test esi, esi
jne 0x5cf28c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x5cf28f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.006952f0
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x5cf19e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.00695203
xor eax, eax
jmp 0x5cf2cf
mov byte [esi], 0
push 0x896f34
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.00695203
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4