joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d950
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa2c
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xa2c]
push eax
push 0x104
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_GetFullPathNameW]
test eax, eax
je 0x44daa9
push ebx
lea eax, [ebp - 0xa2c]
push eax
lea eax, [ebp - 0x20c]
push str.___s
push eax
call fcn.0042234b
lea eax, [ebp - 0x20c]
push eax
call fcn.004218fb
mov ebx, eax
add esp, 0x10
cmp word [ebp + ebx*2 - 0x20e], 0x5c
jne 0x44d9c4
cmp word [ebp + ebx*2 - 0x210], 0x3a
je 0x44d9c4
xor eax, eax
mov word [ebp + ebx*2 - 0x20e], ax
push edi
xor edi, edi
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x44d9de
cmp byte [ebp + 0x10], al
je 0x44da9a
push edi
push 0x2200000
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x44da91
push 0x618
lea eax, [ebp - 0x824]
push 0
push eax
call fcn.00421970
lea eax, [ebx + ebx]
mov word [ebp - 0x81a], ax
mov eax, dword [ebp - 0x81a]
add eax, 2
mov word [ebp - 0x818], ax
push 0x104
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x814]
push eax
mov dword [ebp - 0x824], 0xa0000003
call fcn.00422c1d
mov eax, dword [ebp - 0x81a]
add esp, 0x18
add eax, 0xc
xor edx, edx
push edx
mov word [ebp - 0x820], ax
lea ecx, [ebp + 8]
push ecx
push edx
movzx eax, ax
push edx
add eax, 8
push eax
lea eax, [ebp - 0x824]
push eax
push 0x900a4
push edi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
push edi
test eax, eax
jne 0x44da9e
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
xor eax, eax
jmp 0x44daa7
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop edi
pop ebx
leave
ret 0xc
Function at 0x452044
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4520df
lea eax, [ebp - 0x22c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4520cd
lea eax, [ebp - 0x22c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4520cd
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
mov ecx, eax
or ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
not eax
and ecx, eax
push ecx
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
je 0x452190
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45206e
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x14], 0
je 0x452187
lea eax, [ebp - 0x258]
push eax
push 0x4b3a60
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x45217e
mov edi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x45216c
lea eax, [ebp - 0x22c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x45216c
lea eax, [ebp - 0x22c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x45216c
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00452044
test al, al
je 0x45219b
push 0x4b3a68
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45210e
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
jmp 0x452189
xor ebx, ebx
jmp 0x452180
Function at 0x45219f
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov dword [ebp - 4], ecx
xor bl, bl
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x452225
lea eax, [ebp - 0x22c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x452213
lea eax, [ebp - 0x22c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x452213
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x22c]
call fcn.00447606
pop ecx
test al, al
je 0x4522d6
mov bl, 1
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x4521c9
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
cmp byte [ebp + 0x14], 0
je 0x4522cd
lea eax, [ebp - 0x258]
push eax
push 0x4b3a60
call edi
mov esi, eax
cmp esi, 0xffffffff
je 0x4522c4
mov edi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
mov ebx, dword [ebp - 4]
test byte [ebp - 0x258], 0x10
je 0x4522b2
lea eax, [ebp - 0x22c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4522b2
lea eax, [ebp - 0x22c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4522b2
lea eax, [ebp - 0x22c]
push eax
call edi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0045219f
test al, al
je 0x4522e1
push 0x4b3a68
call edi
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x452254
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x10
push esi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
jmp 0x4522cf
xor ebx, ebx
jmp 0x4522c6
Function at 0x4524a9
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x10]
call fcn.0040caee
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
push 0x4b3a60
inc dword [eax]
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x18], eax
call fcn.004039e8
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x10]
mov bl, 1
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x452608
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x14]
call fcn.0041e76d
cmp eax, 1
je 0x452603
cmp eax, 0xb
jne 0x45252e
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x45250e
lea eax, [ebp - 0x24c]
push 0x49daa0
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4525e9
lea eax, [ebp - 0x24c]
push 0x4b3a68
push eax
call fcn.00422203
pop ecx
pop ecx
test eax, eax
je 0x4525e9
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x10]
call fcn.0040c935
lea eax, [ebp - 0x24c]
push eax
lea ecx, [ebp - 0x10]
call fcn.004039e8
test byte [ebp - 0x278], 0x10
je 0x4525c6
cmp byte [ebp + 0x18], 0
je 0x452595
add dword [esi], 1
adc dword [esi + 4], 0
cmp byte [ebp + 0x1c], 0
je 0x4525e9
push 0x49dc88
lea ecx, [ebp - 0x10]
call fcn.004039e8
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x14]
push dword [ebp + 0x18]
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.004524a9
mov bl, al
test bl, bl
je 0x452605
jmp 0x4525e9
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp - 0x25c]
xor eax, eax
or eax, dword [ebp - 0x258]
add dword [edx], eax
adc dword [edx + 4], ecx
cmp byte [ebp + 0x18], 0
je 0x4525e9
add dword [edi], 1
adc dword [edi + 4], 0
lea eax, [ebp - 0x278]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x45250e
jmp 0x452605
xor bl, bl
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [ebp - 0x24]
call fcn.00405cd3
lea ecx, [ebp - 0x10]
call fcn.00405cd3
pop edi
pop esi
mov al, bl
pop ebx
leave
ret 0x18
Function at 0x463c63
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
push ebx
push esi
mov esi, ecx
xor ecx, ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
push ecx
mov ebx, edx
push esi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 4], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
je 0x463d62
mov eax, ebx
or eax, 0x20019
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 8]
push ecx
push eax
push 0
lea eax, [ebp - 0x228]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x463d77
mov ecx, dword [ebp - 8]
mov edx, ebx
call fcn.00463c63
push dword [ebp - 8]
mov bl, al
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x463d77
xor ebx, ebx
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call fcn.00463aba
test al, al
lea eax, [ebp - 0x228]
je 0x463d14
push ebx
mov ebx, dword [ebp - 0xc]
push ebx
push eax
push esi
lea ecx, [ebp - 0x18]
call fcn.004629ed
call eax
jmp 0x463d1f
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ebx, dword [ebp - 0xc]
test eax, eax
jne 0x463d68
cmp dword [ebp - 0x18], eax
je 0x463d31
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor ecx, ecx
lea eax, [ebp - 0x24]
push eax
push ecx
push ecx
push ecx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x228]
push eax
push ecx
push esi
mov dword [ebp - 4], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
cmp eax, 0x103
mov eax, dword [ebp - 0x1c]
jne 0x463cad
mov al, 1
pop esi
pop ebx
leave
ret
cmp dword [ebp - 0x18], 0
je 0x463d77
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.DLL_FreeLibrary]
xor al, al
jmp 0x463d64
Function at 0x46e13e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push 0x44
push 0
mov ebx, 0x4c3ee0
push ebx
call fcn.00421970
push 0x10
push 0
mov esi, 0x4c3f24
push esi
call fcn.00421970
add esp, 0x18
xor eax, eax
push esi
push ebx
inc eax
mov dword [0x4c3f0c], eax
mov word [0x4c3f10], ax
xor eax, eax
push eax
push eax
push 0x20
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x4c3ee0], 0x44
push eax
call dword [sym.imp.KERNEL32.DLL_CreateProcessW]
pop esi
pop ebx
test eax, eax
je 0x46e1a3
push dword [0x4c3f24]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop ebp
ret 4

Function at 0x46e1a7
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push esi
mov edx, dword [ebx + 4]
push edi
push 3
mov edi, ecx
mov dword [ebp + 8], edx
pop esi
cmp dword [ebx + 0x190], eax
je 0x46e25d
cmp dword [edi + 0x84], esi
jl 0x46e257
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x46e248
cmp dword [ecx + 4], edx
jne 0x46e248
mov dl, byte [ecx + 0x90]
cmp dl, 0xb
je 0x46e245
mov dh, byte [ecx + 0x93]
movzx eax, dh
cmp eax, dword [ebx + 0x190]
je 0x46e217
cmp byte [ebx + 0x198], 0
je 0x46e245
cmp dh, 0xff
je 0x46e245
cmp dl, 0xa
je 0x46e245
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x46e245
cmp byte [eax + 0x90], 0x1a
jne 0x46e245
push 0
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x46e1d7
mov eax, dword [ebp + 0xc]
push 3
pop esi
mov dword [ebx + 0x190], eax
cmp dword [edi + 0x84], esi
jl 0x46e2ea
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov ecx, dword [eax]
test ecx, ecx
je 0x46e2db
cmp dword [ecx + 4], edx
jne 0x46e2db
cmp byte [ecx + 0x90], 0xb
je 0x46e2db
movzx eax, byte [ecx + 0x93]
cmp eax, dword [ebx + 0x190]
jne 0x46e2db
test byte [ecx + 0x92], 0x20
jne 0x46e2db
push 0
push dword [ecx]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
push 4
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [edi + 0x74]
mov eax, dword [eax + esi*4]
mov eax, dword [eax]
test byte [eax + 0x92], 0x40
je 0x46e2db
cmp byte [eax + 0x90], 0x1a
jne 0x46e2db
push 1
push dword [eax]
call dword [sym.imp.USER32.dll_EnableWindow]
mov edx, dword [ebp + 8]
inc esi
cmp esi, dword [edi + 0x84]
jle 0x46e269
mov eax, dword [ebp + 0xc]
push 0
push eax
push 0x130c
push dword [ebx + 0x188]
call dword [sym.imp.USER32.dll_SendMessageW]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x46e541
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
cmp word [eax], di
je 0x46e65b
push edi
push edi
push 3
push edi
push edi
push SysAllocStringLen
push eax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x46e578
xor eax, eax
jmp 0x46e68a
push 0
push edi
call dword [sym.imp.KERNEL32.DLL_GetFileSize]
mov esi, eax
push esi
push 2
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov ebx, eax
test ebx, ebx
jne 0x46e59b
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
jmp 0x46e571
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalLock]
push 0
lea ecx, [ebp - 0xc]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_ReadFile]
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_GlobalUnlock]
push edi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
test esi, esi
je 0x46e571
lea eax, [ebp - 8]
push eax
push 1
push ebx
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
lea eax, [ebp - 4]
push eax
push 0x48d9bc
xor edi, edi
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], edi
call dword [sym.imp.OLEAUT32.dll_OleCreatePictureIndirect]
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_GlobalFree]
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x46e571
mov eax, dword [ecx]
lea edx, [ebp + 0xc]
push edx
push ecx
call dword [eax + 0xc]
lea eax, [ebp - 0x24]
push eax
push 0x18
push dword [ebp + 0xc]
call dword [sym.imp.GDI32.dll_GetObjectW]
mov edx, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [edx], edi
jne 0x46e637
cmp dword [ecx], edi
jne 0x46e637
mov eax, dword [ebp - 0x20]
mov dword [edx], eax
mov eax, dword [ebp - 0x1c]
mov dword [ecx], eax
push 0x2000
push dword [ecx]
push dword [edx]
push edi
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_CopyImage]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [ebp + 0xc]
jmp 0x46e660
mov eax, edi
mov dword [ebp + 0xc], eax
mov esi, dword [ebp + 8]
cmp dword [esi + 0x64], 0
je 0x46e675
push dword [esi + 0x64]
call dword [sym.imp.GDI32.dll_DeleteObject]
mov eax, dword [ebp + 0xc]
push eax
push edi
mov dword [esi + 0x64], eax
mov esi, dword [esi]
push 0x172
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x4047c5
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.00436375
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.00436375
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
mov dword [ebp - 0x14], 0
cmp dword [ebp + 0xc], 0
jne 0x40485b
mov dword [ebp - 0x18], esp
mov eax, 2
call fcn.00436381
cmp dword [ebp - 0x18], esp
je 0x404858
push 6
call fcn.0043637b
add esp, 4
mov dword [ebp + 8], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 8]
push 0
push 0x1f0fff
mov eax, 3
call fcn.00436381
cmp dword [ebp - 0x18], esp
je 0x404887
push 6
call fcn.0043637b
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0xf01ff
push dword [ebp - 4]
mov eax, 4
call fcn.00436381
cmp dword [ebp - 0x18], esp
je 0x4048b5
push 6
call fcn.0043637b
add esp, 4
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
push 0x4d5ca9
push 0
mov eax, 5
call fcn.00436381
cmp dword [ebp - 0x18], esp
je 0x4048e1
push 6
call fcn.0043637b
add esp, 4
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
push 0
push 0
push 0
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
mov eax, 6
call fcn.00436381
cmp dword [ebp - 0x18], esp
je 0x404970
push 6
call fcn.0043637b
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 4]
mov eax, 7
call fcn.00436381
cmp dword [ebp - 0x18], esp
je 0x404995
push 6
call fcn.0043637b
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x40499d
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.00436369
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.00436369
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 8
Function at 0x4360ad
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x11
push 0xfffffffffffffffe
mov eax, 0xc7
mov edx, esp
int 0x2e
mov eax, 0xe5
mov edx, esp
int 0x2e
mov eax, 0xee
mov edx, esp
int 0x2e
mov eax, 0x136
mov edx, esp
int 0x2e
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x436100
Capabilities:
Check for trap flag exception

Disassembly:
push dword fs:[0]
mov dword fs:[0], esp
pushfd
or dword [esp], 0x100
popfd
clc
call fcn.00436125
Function at 0x4469b0
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4cbbcd
push eax
mov dword fs:[0], esp
sub esp, 0x13c
push ebx
push ebp
mov ebx, ecx
push esi
push edi
xor edi, edi
cmp dword [ebx + 0x78], edi
jne 0x446a1e
push 8
call fcn.004bdbc1
add esp, 4
mov dword [esp + 0x10], eax
cmp eax, edi
mov dword [esp + 0x154], edi
je 0x4469fa
mov ecx, eax
call fcn.004bc5c3
jmp 0x4469fc
xor eax, eax
push 0xff00ff
push edi
push 0x10
push 0x407
mov ecx, eax
mov dword [esp + 0x164], 0xffffffff
mov dword [ebx + 0x78], eax
call fcn.004bc6b0
mov eax, dword [ebx + 0x1c]
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0xffff0000
push edi
push 0x1101
push eax
mov dword [esp + 0x20], edi
call ebp
mov eax, dword [ebx + 0x40]
lea esi, [ebx + 0x40]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x446a6c
lea ecx, [esp + 0x48]
push ecx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x446b7e
lea edx, [esp + 0x48]
mov ecx, esi
push edx
call fcn.004be009
jmp 0x446a93
mov edi, eax
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x48]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov eax, dword [ebx + 0x78]
test eax, eax
je 0x446a9d
mov eax, dword [eax + 4]
mov ecx, dword [ebx + 0x1c]
push eax
push 0
push 0x1109
push ecx
call ebp
push eax
call fcn.004bc655
lea edx, [esp + 0x48]
push 0x876254
push edx
mov esi, 0xffff0000
call fcn.004ad5c7
add esp, 8
test eax, eax
je 0x446b20
mov ecx, dword [ebx + 0x1c]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], esi
push eax
push 0
push 0x1100
push ecx
mov dword [esp + 0x28], 0xffff0002
mov dword [esp + 0x44], 2
mov dword [esp + 0x48], 3
mov dword [esp + 0x2c], 0x23
call ebp
push 0x876254
push 0
mov esi, eax
inc edi
call fcn.004ad5c7
add esp, 8
test eax, eax
jne 0x446acc
mov dword [esp + 0x10], edi
mov edx, dword [ebx + 0x1c]
xor edi, edi
push edi
push edi
push 0x110a
push edx
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
jle 0x446b68
mov dword [esp + 0x10], eax
mov eax, dword [ebx + 0x1c]
push esi
push 2
push 0x1102
push eax
mov edi, esi
call ebp
mov ecx, dword [ebx + 0x1c]
push esi
push 4
push 0x110a
push ecx
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
jne 0x446b3d
mov edx, dword [ebx + 0x1c]
push edi
push 9
push 0x110b
push edx
call ebp
push edi
mov ecx, ebx
call fcn.00446ba0
mov ecx, dword [esp + 0x14c]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x148
ret
Function at 0x446ba0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4cbbeb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004bdbf5
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x446c22
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004bb18d
mov eax, dword [eax]
push 0x876254
push eax
call fcn.004ac434
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004bde80
test bl, bl
je 0x446c22
push 0x876254
lea ecx, [esp + 0xc]
call fcn.004be25c
push 0x879e34
lea ecx, [esp + 0xc]
call fcn.004be25c
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x446c5e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004bde80
jmp 0x446d29
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x446ce2
lea edx, [esp + 0x7c]
push 0x879e30
push edx
call fcn.004ac434
add esp, 8
test eax, eax
je 0x446ce2
lea eax, [esp + 0x7c]
push 0x879e2c
push eax
call fcn.004ac434
add esp, 8
test eax, eax
je 0x446ce2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x446c72
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004bde80
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x447520
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x447582
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc