joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4254e0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x425503
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
push esi
push dword [ebp + 0x14]
call main
add esp, 4
lea ecx, [ebp - 0x14]
mov esi, eax
call main
push dword [ebp + 0x18]
lea ecx, [ebp - 0x14]
push esi
call main
test al, al
jne 0x42553f
lea ecx, [ebp - 0x14]
mov esi, 1
call main
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push dword [ebp + 0x18]
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42556d
push dword [ebp + 0x1c]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x14]
xor esi, esi
call main
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x425580
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x4255af
mov eax, 0x80004005
jmp 0x4256ac
push dword [ebp + 0x14]
call main
add esp, 4
lea ecx, [ebp - 0x18]
mov ebx, eax
call main
mov edi, dword [ebp + 0x18]
lea ecx, [ebp - 0x18]
push edi
push ebx
call main
test al, al
jne 0x4255df
mov esi, 1
jmp 0x4256a2
test edi, edi
jne 0x4255e7
xor eax, eax
jmp 0x425623
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4255f0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x42560e
xor eax, eax
jmp 0x425623
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push edi
push eax
call main
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4256a0
mov edi, dword [ebp + 0x1c]
test edi, edi
je 0x42566a
mov ecx, edi
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425650
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x42566e
xor eax, eax
jmp 0x425683
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push edi
push eax
call main
push 4
lea ecx, [ebp + 0x20]
push ecx
push 4
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [ebp - 0x18]
call main
mov eax, esi
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x4256d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x4256ff
mov eax, 0x80004005
jmp 0x4257dd
push dword [ebp + 0x14]
call main
add esp, 4
lea ecx, [ebp - 0x18]
mov ebx, eax
call main
mov edi, dword [ebp + 0x18]
lea ecx, [ebp - 0x18]
push edi
push ebx
call main
test al, al
jne 0x42572f
mov esi, 1
jmp 0x4257d3
test edi, edi
jne 0x425737
xor eax, eax
jmp 0x425773
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425740
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x42575e
xor eax, eax
jmp 0x425773
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push edi
push eax
call main
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4257d1
mov edx, dword [ebp + 0x20]
mov ecx, edx
lea esi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4257a0
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push 0
push dword [ebp + 0x1c]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [ebp - 0x18]
call main
mov eax, esi
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x425800
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x42582f
mov eax, 0x80004005
jmp 0x42597a
push dword [ebp + 0x14]
call main
add esp, 4
lea ecx, [ebp - 0x20]
mov esi, eax
mov dword [ebp - 0xc], esi
call main
mov ebx, dword [ebp + 0x18]
lea ecx, [ebp - 0x20]
push ebx
push esi
call main
test al, al
jne 0x425862
mov esi, 1
jmp 0x425970
mov edi, dword [ebp + 0x20]
test edi, edi
jne 0x425871
lea esi, [edi + 0x57]
jmp 0x425970
cmp word [edi], 1
jne 0x42596b
cmp dword [edi + 4], 1
jne 0x42596b
cmp dword [edi + 0x14], 0
jne 0x42596b
lea eax, [ebp - 0x10]
push eax
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov esi, eax
test esi, esi
jne 0x425970
test ebx, ebx
je 0x4258e3
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4258b0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4258ce
xor eax, eax
jmp 0x4258e3
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push ebx
push eax
call main
push 0
lea ecx, [ebp - 8]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425960
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x42592a
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425910
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x42592e
xor eax, eax
jmp 0x425943
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push ebx
push eax
call main
push dword [edi + 0x10]
push dword [ebp - 0x10]
push 3
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
xor esi, esi
jmp 0x425970
mov esi, 0x80004005
lea ecx, [ebp - 0x20]
call main
mov eax, esi
lea esp, [ebp - 0x2c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x425990
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x442f98]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x4259bf
mov eax, 0x80004005
jmp 0x425b64
mov edi, dword [ebp + 0x20]
test edi, edi
je 0x425a05
mov ecx, edi
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4259d0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x4259ee
xor edi, edi
jmp 0x425a05
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push edi
push eax
call main
mov edi, eax
push dword [ebp + 0x14]
call main
add esp, 4
mov dword [ebp - 8], eax
lea ecx, [ebp - 0x1c]
call main
mov ebx, dword [ebp + 0x18]
lea ecx, [ebp - 0x1c]
push ebx
push dword [ebp - 8]
call main
test al, al
jne 0x425a38
mov esi, 1
jmp 0x425b5a
test ebx, ebx
jne 0x425a40
xor eax, eax
jmp 0x425a78
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425a45
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x425a63
xor eax, eax
jmp 0x425a78
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push ebx
push eax
call main
push 0
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push eax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425b58
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
jne 0x425aa8
xor esi, esi
jmp 0x425ae5
mov ecx, ebx
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x425ab0
sub ecx, edx
sar ecx, 1
lea esi, [ecx + 1]
cmp esi, 0x3fffffff
jle 0x425ace
xor esi, esi
jmp 0x425ae5
add esi, esi
mov eax, esi
call fcn.00435230
mov eax, esp
push 3
push esi
push ebx
push eax
call main
mov esi, eax
test edi, edi
je 0x425b24
xor eax, eax
nop dword [eax + eax]
cmp byte [eax + edi], 0
je 0x425afe
inc eax
cmp eax, 0x7fffffff
jb 0x425af0
cmp eax, 0x7fffffff
jne 0x425b3e
push 0
push 0
push 0
push str.ASstrnlen_safe
push str.String_greater_than_maxSize
call fcn.00417600
add esp, 0x14
mov eax, SysReAllocString
jmp 0x425b3e
push 0
push 0
push 0
push str.ASstrnlen_safe
push str.Bad_parameter
call fcn.00417600
add esp, 0x14
xor eax, eax
inc eax
push eax
push edi
push 3
push 0
push esi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea ecx, [ebp - 0x1c]
call main
mov eax, esi
lea esp, [ebp - 0x28]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00434ca0
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x427010
Capabilities:
Get file attributes
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x427033
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp + 0x1c]
lea ecx, [ebp - 0x2c]
push ebx
push esi
xor esi, esi
push edi
mov dword [eax], esi
call main
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0x14]
test bl, 6
je 0x427064
push esi
push 1
push edi
lea ecx, [ebp - 0x2c]
call main
test al, al
je 0x427201
test edi, edi
je 0x427201
cmp word [edi], si
je 0x427201
mov ecx, edi
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427080
sub ecx, edx
sar ecx, 1
cmp word [edi + ecx*2 - 2], 0x2e
je 0x427201
test bl, 4
je 0x4270b1
mov edx, 0xc0000000
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 2
jmp 0x4270fd
test bl, 2
je 0x4270e1
mov eax, 0xc0000000
mov dword [ebp - 0xc], esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 3
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
mov esi, eax
and esi, 1
jne 0x427206
mov edx, 0xc0000000
jmp 0x427100
test bl, 1
je 0x427201
mov edx, SysReAllocString
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 3
mov dword [ebp - 0x10], edx
mov eax, ebx
and eax, 0x28
cmp al, 0x28
je 0x427201
mov ecx, ebx
mov eax, ebx
and ecx, 8
and eax, 0x20
add ecx, ecx
or ecx, eax
mov eax, 0x80
shl ecx, 0x17
test bl, 0x40
push 0
mov ebx, 0x4000100
cmovne eax, ebx
or ecx, eax
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], ecx
push 0
push dword [ebp - 0xc]
push edx
push edi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x4271bf
mov ebx, dword [ebp - 0x14]
test ebx, 0x10000000
je 0x4271dd
lea ecx, [ebp - 0x14]
push ecx
push eax
call dword [sym.imp.kernel32.dll_GetFileSize]
mov dword [ebp - 0x18], eax
cmp eax, 0xffffffff
jne 0x42717a
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
jne 0x4271da
mov eax, dword [ebp - 0x14]
xor ecx, ecx
or ecx, dword [ebp - 0x18]
or eax, 0
mov dword [ebp - 0x18], eax
ja 0x427192
cmp ecx, 0xee6b280
jbe 0x4271da
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
and ebx, 0xefffffff
push 0
push ebx
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.kernel32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4271dd
call dword [sym.imp.kernel32.dll_GetLastError]
lea ecx, [ebp - 0x2c]
mov esi, eax
call main
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov eax, dword [ebp - 4]
test eax, eax
je 0x427206
push dword [ebp + 0x1c]
push eax
mov eax, dword [ebp + 8]
add eax, 8
push eax
call main
add esp, 0xc
test al, al
jne 0x427206
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_CloseHandle]
mov esi, 1
lea ecx, [ebp - 0x2c]
call main
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x4272f0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
je 0x4273ab
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call main
add esp, 0xc
test al, al
je 0x42739e
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x42739e
mov esi, dword [ebp + 0x20]
test esi, esi
je 0x42739e
push dword [ebp + 0x18]
push 0
push 0x11
call dword [sym.imp.OLEAUT32.dll_SafeArrayCopyData]
mov dword [esi], eax
test eax, eax
je 0x4273ab
push edi
lea ecx, [ebp - 4]
xor edi, edi
push ecx
push eax
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x427393
push eax
push ebx
push dword [ebp + 0x18]
mov dword [ebx], edi
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_ReadFile]
test eax, eax
jne 0x427379
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
test edi, edi
je 0x427393
push dword [esi]
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetDim]
mov dword [esi], 0
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x1c
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4273c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
je 0x427467
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call main
add esp, 0xc
test al, al
je 0x42745a
mov ebx, dword [ebp + 0x1c]
test ebx, ebx
je 0x42745a
mov esi, dword [ebp + 0x18]
test esi, esi
je 0x42745a
cmp word [esi], 1
jne 0x427467
cmp dword [esi + 4], 1
jne 0x427467
cmp dword [esi + 0x14], 0
jne 0x427467
push edi
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
mov edi, eax
test edi, edi
jne 0x427451
push eax
push ebx
mov dword [ebx], eax
push dword [esi + 0x10]
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_WriteFile]
test eax, eax
jne 0x427448
call dword [sym.imp.kernel32.dll_GetLastError]
mov edi, eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop esi
mov eax, 0x57
pop ebx
mov esp, ebp
pop ebp
ret 0x18
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x427480
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x4274a1
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x18
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [edi + 8]
call main
add esp, 0xc
test al, al
jne 0x4274c7
mov eax, 0x57
pop edi
mov esp, ebp
pop ebp
ret 0x18
push esi
push dword [ebp + 0x1c]
mov esi, dword [edi]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
mov esi, dword [esi + 0x60]
mov ecx, esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call dword [0x438430]
call esi
pop esi
test eax, eax
jne 0x4274fa
push dword [ebp - 4]
call dword [sym.imp.kernel32.dll_SetEndOfFile]
neg eax
sbb eax, eax
inc eax
pop edi
mov esp, ebp
pop ebp
ret 0x18

Function at 0x427510
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0x10]
mov dword [ebp - 4], 0
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x42753a
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0x14]
push dword [eax + 8]
call main
add esp, 0xc
test al, al
jne 0x42755e
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x1c
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.kernel32.dll_GetFileSize]
mov edx, eax
cmp edx, 0xffffffff
jne 0x42757e
call dword [sym.imp.kernel32.dll_GetLastError]
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp + 0x20], 0
jne 0x427599
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
cmp dword [ebp - 4], 0
jne 0x4275b4
cmp edx, 0x7fffffff
ja 0x4275b4
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
xor eax, eax
mov esp, ebp
pop ebp
ret 0x1c
mov eax, 1
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4275c0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x4275e3
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
test edi, edi
je 0x42763e
lea ecx, [ebp - 0x10]
call main
push esi
push 1
push edi
lea ecx, [ebp - 0x10]
call main
test al, al
jne 0x427619
lea ecx, [ebp - 0x10]
call main
pop edi
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.kernel32.dll_DeleteFileW]
test eax, eax
jne 0x42762c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x10]
call main
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, 1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x427650
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push edi
push ebx
call main
add esp, 8
test eax, eax
jne 0x427679
pop edi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push esi
lea ecx, [ebp - 0x14]
call main
push 0
push 1
push dword [ebp + 0x18]
lea ecx, [ebp - 0x14]
call main
test al, al
je 0x42773f
push 0
push 1
push dword [ebp + 0x1c]
lea ecx, [ebp - 0x14]
call main
test al, al
je 0x42773f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x14]
mov esi, dword [eax]
push dword [ecx]
push edi
mov esi, dword [esi + 0x30]
mov ecx, esi
push ebx
push eax
call dword [0x438430]
call esi
mov esi, eax
test esi, esi
jne 0x427744
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
call dword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__wrename]
mov ecx, dword [ebp + 8]
add esp, 8
mov esi, eax
mov eax, dword [ecx]
push dword [ebp + 0x14]
push 1
mov eax, dword [eax + 0x2c]
mov dword [ebp - 4], eax
test esi, esi
jne 0x42771b
push dword [ebp + 0x1c]
push edi
push ebx
push ecx
mov ecx, eax
call dword [0x438430]
call dword [ebp - 4]
lea ecx, [ebp - 0x14]
mov esi, eax
call main
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
push dword [ebp + 0x18]
push edi
push ebx
push ecx
mov ecx, eax
call dword [0x438430]
call dword [ebp - 4]
lea ecx, [ebp - 0x14]
call main
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
mov esi, 1
lea ecx, [ebp - 0x14]
call main
mov eax, esi
pop esi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x427820
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x427843
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x4278ed
lea ecx, [ebp - 0x10]
call main
push 1
push edi
push esi
lea ecx, [ebp - 0x10]
call main
test al, al
jne 0x42787d
lea ecx, [ebp - 0x10]
call main
lea eax, [edi + 1]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x427882
sub ecx, edx
sar ecx, 1
je 0x4278d6
movzx eax, word [esi + ecx*2 - 2]
cmp eax, 0x2e
je 0x4278d6
cmp ecx, 1
jbe 0x4278af
cmp word [esi + ecx*2 - 4], 0x2e
jne 0x4278af
cmp eax, 0x5c
je 0x4278d6
push 0
push esi
call dword [sym.imp.kernel32.dll_CreateDirectoryW]
test eax, eax
jne 0x4278db
call dword [sym.imp.kernel32.dll_GetLastError]
lea ecx, [ebp - 0x10]
mov edi, eax
call main
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
lea ecx, [ebp - 0x10]
call main
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov edi, 1
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x427900
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call main
add esp, 8
test eax, eax
jne 0x427923
mov eax, 0x80004005
mov esp, ebp
pop ebp
ret 0x10
push esi
push edi
mov edi, dword [ebp + 0x14]
xor esi, esi
test edi, edi
je 0x42797d
lea ecx, [ebp - 0x10]
call main
push esi
push esi
push edi
lea ecx, [ebp - 0x10]
call main
test al, al
jne 0x427958
lea ecx, [ebp - 0x10]
call main
pop edi
lea eax, [esi + 1]
pop esi
mov esp, ebp
pop ebp
ret 0x10
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryW]
test eax, eax
jne 0x42796b
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
lea ecx, [ebp - 0x10]
call main
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
mov esi, 1
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10

Function at 0x427f30
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call main
add esp, 0xc
test al, al
jne 0x427f58
mov eax, 0x57
mov esp, ebp
pop ebp
ret 0x10
push 4
lea eax, [ebp + 0x14]
push eax
push 4
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
sbb eax, eax
neg eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x427f80
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push ebx
push esi
push eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push dword [eax + 8]
call main
add esp, 0xc
test al, al
je 0x42806c
mov ebx, dword [ebp + 0x18]
test ebx, ebx
je 0x42806c
mov esi, dword [ebp + 0x14]
test esi, esi
je 0x42806c
cmp word [esi], 1
jne 0x42805f
cmp dword [esi + 4], 1
jne 0x42805f
cmp dword [esi + 0x14], 0
jne 0x42805f
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayUnaccessData]
test eax, eax
jne 0x428071
cmp ebx, 2
jb 0x42805f
test bl, 1
jne 0x42805f
cmp dword [esi + 0x10], ebx
jne 0x42805f
mov edx, dword [ebp - 4]
cmp byte [edx + ebx - 2], al
jne 0x42805f
cmp byte [edx + ebx - 1], al
jne 0x42805f
mov ecx, edx
push edi
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x428010
sub ecx, edi
sar ecx, 1
pop edi
lea eax, [ecx*2 + 2]
cmp eax, ebx
jne 0x42805f
push ebx
push edx
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42804e
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetElement]
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x14
pop esi
mov eax, 0x80004005
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, 0x57
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14