joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10028035
Capabilities:
Encode data using xor
Set environment variable

Disassembly:
mov eax, 0x10059a2c
call fcn.10058764
sub esp, 0x14
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
je 0x10028136
cmp byte [ebp + 8], 0
je 0x1002811e
mov dword [ebp - 0x18], 0x7bed
cmp dword [ebp - 0x18], 0x7c53
jle 0x100280bc
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp + 0x18], ecx
mov eax, ebx
cdq
idiv ecx
mov ecx, 0x10073a98
and edx, edi
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.1000ab96
mov ecx, dword [ebp + 0x18]
inc ecx
mov dword [ebp + 0x18], ecx
cmp ecx, 0x7a4e
jl 0x1002807a
inc ebx
cmp ebx, 0x3de7
jl 0x10028075
inc edi
cmp edi, 0x42da
jl 0x10028073
inc esi
cmp esi, 0x50fe
jl 0x10028071
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x7a82
jge 0x100280d8
mov edx, str.atn_lje_aqysl_rvufl
mov ecx, 0x10073a98
call fcn.1000d257
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100281ef
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xffff
inc dword [edx]
cmp dword [edx], 2
jl 0x100280ed
jmp 0x100281ef
cmp byte [ecx], 0
je 0x100281ef
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x100281ef
mov dword [ebp - 0x18], 0xe79
cmp dword [ebp - 0x18], 0x10e1
jle 0x1002818c
xor esi, esi
mov dword [ebp + 0x18], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x10073a98
and eax, esi
cdq
push edx
push eax
call fcn.1000ab96
inc esi
cmp esi, 0x536c
jl 0x1002815a
mov esi, dword [ebp + 0x18]
inc edi
cmp edi, 0x3d41
jl 0x1002814d
inc esi
mov dword [ebp + 0x18], esi
cmp esi, 0x7b79
jl 0x1002814b
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0xad9
jge 0x100281ab
mov edx, str.anpqk_eulzbi_zmt_ihftmec_ngfnmihx_exsjo_lkyl_pxxhok_xmxm
mov ecx, 0x10073a98
call fcn.1000d257
cmp byte [ebp - 0x14], 0
je 0x100281d6
mov eax, dword [ebp + 0x14]
push 0xb
pop ecx
mov word [eax], cx
jmp 0x100281ef
push 0x215f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bb4b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10059ba9
call fcn.10058764
sub esp, 0x18
mov byte [ebp - 0x14], 1
mov byte [ebp - 0x18], 1
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002bc2f
mov dword [ebp - 0x20], 0xb27
cmp dword [ebp - 0x20], 0xcda
jle 0x1002bbce
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov esi, dword [ebp - 0x24]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x10073a98
xor eax, esi
cdq
push edx
push eax
call fcn.1000ab96
inc esi
cmp esi, 0x290b
jl 0x1002bb92
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0xd02
jl 0x1002bb85
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x69d
jl 0x1002bb83
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x947
jge 0x1002bbea
mov edx, str.rttzfswvg_tdyg_huc_qlzje
mov ecx, 0x10073a98
call fcn.1000d257
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x1002bc39
push 0x7c56
push 1
push 1
push 0x2f98
xor dl, dl
mov ecx, 0x5ad6
call fcn.1002bb4b
add esp, 0x10
jmp 0x1002bc39
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002c5d9
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002c68e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002c62f
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002c62d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1002c68c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002c65d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x10
jge 0x1002c68c
mov dword [ebp - 0x2c], 0x164c
push 0x4b1e
push dword [ebp - 0x28]
push 0
push dword [ebp - 4]
push 0x4d40
lea eax, [ebp - 0x2c]
push eax
call fcn.1002c6c7
add esp, 0x18
jmp 0x1002c652
jmp 0x1002c6c3
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push 0x327e
push 0x26a6
push 0x1334
push 0x1a44
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0
push 0x610a
call fcn.1002c2cc
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x5d19f9
Capabilities:
Encode data using xor

Disassembly:
in al, 0x61
ror byte [edx - 0x18], cl
mov word [esi + ebp*2 - 0x70451039], gs
insb byte es:[edi], dx
Function at 0x10004420
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_strlen]
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x10004478
cmp byte [esi + ebx - 1], 0xa
je 0x1000444c
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x24]
xchg dword [0x10005118], eax
mov dword [esp], 2
call dword [sym.imp.ucrtbase.dll___acrt_iob_func]
mov dword [esp + 8], ebx
mov dword [esp + 0xc], eax
mov dword [esp + 4], 1
mov dword [esp], esi
call dword [sym.imp.ucrtbase.dll_fwrite]
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa
Function at 0x401096
Capabilities:
Get hostname
Resolve dns

Disassembly:
jmp 0x4077c0
sub esp, 0x100
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 5]
mov byte [esp + 4], 0
push pe_nt_image_headers32
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 8]
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x4077fd
xor eax, eax
pop edi
add esp, 0x100
ret 8
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov edi, eax
test edi, edi
jne 0x407818
pop edi
add esp, 0x100
ret 8
mov ecx, dword [edi + 0xc]
xor eax, eax
cmp dword [ecx], 0
je 0x407852
push ebx
mov ebx, dword [esp + 0x110]
push esi
mov esi, dword [esp + 0x110]
xor edx, edx
cmp eax, ebx
jge 0x407844
mov ecx, dword [edx + ecx]
inc eax
add esi, 4
mov ecx, dword [ecx]
mov dword [esi - 4], ecx
mov ecx, dword [edi + 0xc]
add edx, 4
cmp dword [edx + ecx], 0
jne 0x407834
pop esi
pop ebx
pop edi
add esp, 0x100
ret 8

Function at 0x4010f5
Capabilities:
Get common file path

Disassembly:
jmp 0x413160
sub esp, 0x414
push esi
push edi
xor esi, esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0xe]
mov word [esp + 0xc], si
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x10]
mov dword [esp + 0xc], esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
jne 0x4131af
mov esi, dword [esp + 0x420]
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_2
mov eax, esi
pop edi
pop esi
add esp, 0x414
ret
mov eax, dword [esp + 0x424]
cmp eax, esi
je 0x4131d8
lea ecx, [esp + 0xc]
push eax
push ecx
lea edx, [esp + 0x21c]
push 0x4536ac
push edx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0x10
jmp 0x4131f3
lea eax, [esp + 0xc]
lea ecx, [esp + 0x214]
push eax
push 0x455738
push ecx
call dword [sym.imp.MSVCRT.dll_swprintf]
add esp, 0xc
mov esi, dword [esp + 0x420]
lea edx, [esp + 0x214]
push edx
mov ecx, esi
call sub.MFC42u.DLL_CString::CString_3
mov eax, esi
pop edi
pop esi
add esp, 0x414
ret
Function at 0x40123a
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
jmp 0x40c3b0
sub esp, 0x664
push ebx
push ebp
mov ebp, dword [esp + 0x670]
test ebp, ebp
je 0x40c540
push ebp
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
test eax, eax
je 0x40c540
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40c540
test bl, 1
je 0x40c3fb
and ebx, 0xfffffffe
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test bl, 0x10
je 0x40c530
push esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x16]
mov word [esp + 0x14], 0
rep stosd dword es:[edi], eax
mov ebx, dword [sym.imp.MSVCRT.dll_wcscpy]
push ebp
stosw word es:[edi], ax
lea eax, [esp + 0x18]
push eax
call ebx
mov esi, dword [sym.imp.MSVCRT.dll_wcscat]
lea ecx, [esp + 0x1c]
push 0x453fc8
push ecx
call esi
mov ecx, 0x93
xor eax, eax
lea edi, [esp + 0x230]
add esp, 0x10
mov dword [esp + 0x21c], 0
lea edx, [esp + 0x21c]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
mov dword [esp + 0x10], edi
je 0x40c51e
lea ecx, [esp + 0x248]
push 0x453ff8
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40c500
lea edx, [esp + 0x248]
push 0x453ff4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
je 0x40c500
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x46e]
mov word [esp + 0x46c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x46c]
push ebp
push eax
call ebx
lea ecx, [esp + 0x1c]
push 0x452980
push ecx
call esi
lea edx, [esp + 0x258]
lea eax, [esp + 0x24]
push edx
push eax
call esi
lea ecx, [esp + 0x484]
push ecx
call fcn.0040123a
mov edi, dword [esp + 0x2c]
add esp, 0x1c
lea edx, [esp + 0x21c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40c47c
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebp
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x664
ret
push ebp
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop ebp
pop ebx
add esp, 0x664
ret
pop ebp
xor eax, eax
pop ebx
add esp, 0x664
ret
Function at 0x401442
Capabilities:
Encrypt data using des

Disassembly:
jmp 0x411040
sub esp, 0xf8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x108]
push edi
mov dword [esp + 0x14], ecx
xor edx, edx
xor eax, eax
mov al, byte [edx + str.80_]
mov ecx, eax
and eax, 7
sar ecx, 3
mov bl, byte [eax*2 + 0x454bf0]
mov cl, byte [ecx + esi]
test bl, cl
setne al
mov byte [esp + edx + 0x50], al
inc edx
cmp edx, 0x38
jl 0x411057
mov eax, 0x1e
xor ebx, ebx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x110], 1
je 0x411098
lea eax, [ebx + ebx]
lea edi, [esp + eax*4 + 0x8c]
lea ebp, [esp + eax*4 + 0x88]
xor eax, eax
xor ecx, ecx
mov cl, byte [ebx + 0x454c98]
mov dword [edi], 0
mov esi, ecx
mov dword [ebp], 0
mov edx, esi
cmp edx, 0x1c
jge 0x4110cc
mov cl, byte [esp + edx + 0x50]
jmp 0x4110d0
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x1c
jl 0x4110c1
mov eax, 0x1c
lea edx, [esi + 0x1c]
cmp edx, 0x38
jge 0x4110ee
mov cl, byte [esp + edx + 0x50]
jmp 0x4110f2
mov cl, byte [esp + edx + 0x34]
mov byte [esp + eax + 0x18], cl
inc eax
inc edx
cmp eax, 0x38
jl 0x4110e3
xor edx, edx
mov eax, 0x454c00
xor ecx, ecx
mov cl, byte [edx + 0x454ca8]
cmp byte [esp + ecx + 0x18], 0
je 0x41111d
mov ecx, dword [eax]
mov esi, dword [ebp]
or esi, ecx
mov dword [ebp], esi
xor ecx, ecx
mov cl, byte [edx + 0x454cc0]
cmp byte [esp + ecx + 0x18], 0
je 0x411134
mov ecx, dword [eax]
mov esi, dword [edi]
or esi, ecx
mov dword [edi], esi
add eax, 4
inc edx
cmp eax, str.80_
jl 0x411104
mov eax, dword [esp + 0x10]
inc ebx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x41108b
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x88]
push edx
call fcn.004010cd
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf8
ret 8
Function at 0x408a50
Capabilities:
Get system information on windows

Disassembly:
mov eax, dword [0x4571e8]
test eax, eax
jne 0x408ace
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x456f88
mov dword [0x4571e8], 1
mov dword [0x456f88], 0x114
call esi
mov edx, dword [0x456f98]
xor eax, eax
cmp edx, 2
push 0x4570c8
sete al
mov dword [0x453a20], eax
mov dword [0x4570c8], 0x11c
call esi
push 0x453cc0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push str.GetNativeSystemInfo
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
pop esi
mov dword [0x4571e4], eax
test eax, eax
push 0x4570a0
je 0x408ac8
call eax
ret
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
ret

Function at 0x40b8e0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push edi
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov edi, dword [esp + 0x18]
mov eax, 0x1f3
not ecx
dec ecx
push edi
mov ebx, ecx
push ebp
sub eax, ebx
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x14], eax
jne 0x40b920
pop edi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
push esi
mov esi, 1
test byte [edi], 0x10
je 0x40ba0c
mov al, byte [edi + 0x2c]
lea edx, [edi + 0x2c]
cmp al, 0x2e
jne 0x40b953
mov al, byte [edi + 0x2d]
cmp al, 0x2e
jne 0x40b94b
mov cl, byte [edi + 0x2e]
test cl, cl
je 0x40b9e1
test al, al
je 0x40b9e1
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [esp + 0x10]
not ecx
cmp eax, ecx
jb 0x40b9dd
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
mov byte [ebx + ebp - 1], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x453fc4
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edx, ecx
mov edi, ebp
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x24]
mov ecx, edx
mov edx, dword [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x20]
push eax
push ecx
push edx
push ebp
call fcn.0040b8e0
mov byte [ebx + ebp - 1], 0x2a
add esp, 0x10
mov esi, eax
mov byte [ebx + ebp], 0
mov edi, dword [esp + 0x1c]
test esi, esi
je 0x40b9f9
mov edx, dword [esp + 0x18]
push edi
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b926
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [esp + 0x24]
lea ecx, [edi + 0x2c]
push eax
push ecx
push ebp
mov byte [ebx + ebp - 1], 0
call dword [esp + 0x2c]
mov esi, eax
mov byte [ebx + ebp - 1], 0x2a
jmp 0x40b9e1
Function at 0x40bbb0
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ebx, dword [esp + 0x1c]
add esp, 4
mov edi, eax
mov eax, 0x1f3
sub eax, edi
push ebx
push esi
mov dword [esp + 0x14], eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [esp + 0x18], eax
jne 0x40bbee
pop edi
pop esi
mov eax, 1
pop ebx
pop ecx
ret
push ebp
mov dword [esp + 0x18], 1
test byte [ebx], 0x10
je 0x40bc6f
cmp word [ebx + 0x2c], 0x2e
lea ebp, [ebx + 0x2c]
jne 0x40bc1c
mov ax, word [ebx + 0x2e]
cmp ax, 0x2e
jne 0x40bc17
cmp word [ebx + 0x30], 0
je 0x40bc8f
test ax, ax
je 0x40bc8f
push ebp
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [esp + 0x14]
add esp, 4
inc eax
cmp ecx, eax
jb 0x40bc8f
push ebp
mov ebp, dword [sym.imp.MSVCRT.dll_wcscat]
push esi
mov word [esi + edi*2 - 2], 0
call ebp
push 0x453fc8
push esi
call ebp
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x30]
push eax
push ecx
push ebx
push esi
call fcn.0040bbb0
mov word [esi + edi*2 - 2], 0x2a
add esp, 0x20
mov dword [esp + 0x18], eax
mov word [esi + edi*2], 0
jmp 0x40bc8f
mov edx, dword [esp + 0x24]
lea eax, [ebx + 0x2c]
push edx
push eax
push esi
mov word [esi + edi*2 - 2], 0
call dword [esp + 0x2c]
mov dword [esp + 0x18], eax
mov word [esi + edi*2 - 2], 0x2a
mov eax, dword [esp + 0x18]
test eax, eax
je 0x40bcab
mov ecx, dword [esp + 0x1c]
push ebx
push ecx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40bbf7
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x18]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x4174f0
Capabilities:
Get file size

Disassembly:
jmp 0x4174f0
push esi
mov esi, ecx
cmp dword [esi + 0x24], 0xffffffff
jne 0x417569
mov eax, dword [esi + 0x28]
test eax, eax
je 0x41751c
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x24], eax
mov eax, dword [esi + 0x24]
cmp eax, 0xffffffff
jne 0x417528
xor eax, eax
pop esi
ret
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x500000
jbe 0x417559
mov eax, dword [esi + 0x24]
push 0
push 0
push 0
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov eax, 1
pop esi
ret
mov edx, dword [esi + 0x24]
push 2
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, 1
pop esi
ret
Function at 0x436660
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0xc
mov eax, dword [ecx + 4]
push ebx
push ebp
push esi
push edi
mov edi, dword [ecx]
mov ecx, dword [esp + 0x20]
xor ebp, ebp
cmp ecx, ebp
mov dword [esp + 0x18], edi
je 0x43669e
lea edx, [esp + 0x14]
or eax, 0x20019
push edx
push eax
push ebp
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
mov eax, dword [esp + 0x14]
neg esi
sbb esi, esi
not esi
and esi, eax
jmp 0x4366a0
mov esi, edi
mov ecx, dword [esp + 0x24]
push 0xffffffffffffffff
push ebp
call sub.MFC42u.DLL_CStringArray::SetSize
cmp esi, ebp
je 0x43678b
push ebp
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x34]
push ebp
lea ecx, [esp + 0x28]
push eax
push ecx
push ebp
push ebp
push ebp
push esi
mov dword [esp + 0x40], ebp
mov dword [esp + 0x50], ebp
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x436780
cmp dword [esp + 0x10], ebp
jbe 0x436780
mov eax, dword [esp + 0x20]
cmp eax, 0x104
jae 0x4366fc
mov eax, 0x104
mov dword [esp + 0x20], eax
lea edx, [eax + eax + 2]
push edx
call sub.MFC42u.DLL_operatornew
mov ebx, eax
add esp, 4
cmp ebx, ebp
je 0x436780
cmp dword [esp + 0x10], ebp
jbe 0x43675d
mov eax, dword [esp + 0x20]
mov edi, ebx
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x20]
inc eax
push eax
push ebx
push ebp
push esi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x436750
mov ecx, dword [esp + 0x24]
push ebx
mov edx, dword [ecx + 8]
push edx
call sub.MFC42u.DLL_CStringArray::SetAtGrow_1
mov eax, dword [esp + 0x10]
inc ebp
cmp ebp, eax
jb 0x436715
mov edi, dword [esp + 0x18]
push ebx
call sub.MFC42u.DLL_operatordelete
add esp, 4
cmp esi, edi
je 0x436771
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret 8
cmp esi, edi
je 0x43678b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret 8
Function at 0x436bb0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 8
lea eax, [esp + 0xc]
lea ecx, [esp]
push ebx
push ebp
push esi
push edi
push 0
push 0
mov ebx, dword [esp + 0x24]
push 0
push 0
push 0
push 0
push eax
push ecx
push 0
push 0
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x436d2d
mov eax, dword [esp + 0x10]
test eax, eax
je 0x436d0c
mov eax, dword [esp + 0x1c]
cmp eax, 0x104
jae 0x436c06
mov eax, 0x104
mov dword [esp + 0x1c], eax
lea edx, [eax + eax + 2]
push edx
call sub.MFC42u.DLL_operatornew
mov esi, eax
add esp, 4
test esi, esi
je 0x436d2d
mov eax, dword [esp + 0x1c]
mov edi, esi
lea ecx, [eax + eax + 2]
xor eax, eax
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x436d24
mov ebp, dword [esp + 0x20]
mov eax, ebp
or eax, 0x2001f
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x20]
push ecx
push eax
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x436d24
mov edi, dword [esp + 0x20]
test edi, edi
je 0x436d24
push ebp
push edi
call fcn.00436bb0
add esp, 8
test eax, eax
je 0x436d19
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [0x4588d4]
test eax, eax
je 0x436cb5
test ebp, ebp
je 0x436cb5
push 0
push ebp
push esi
push ebx
call eax
test eax, eax
jne 0x436d24
jmp 0x436cc1
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x436d24
mov eax, dword [esp + 0x10]
dec eax
mov dword [esp + 0x10], eax
je 0x436d03
mov edx, dword [esp + 0x1c]
xor eax, eax
mov edi, esi
lea ecx, [edx + edx + 2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x1c]
inc eax
push eax
push esi
push 0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x436d24
mov eax, dword [esp + 0x14]
jmp 0x436c5e
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
test edi, edi
je 0x436d24
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call sub.MFC42u.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret