joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409d81
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
push ebx
mov ebx, dword [ebp + 8]
push esi
lea esi, [ebx + 0x28]
mov dword [ebp - 0x1c], esi
call fcn.004085b7
lea eax, [ebp - 0xc]
push eax
push str.SoftwareMicrosoftInternet_ExplorerIntelliFormsStorage2
push dword [ebx + 4]
call fcn.0041334d
add esp, 0xc
test eax, eax
jne 0x409ec7
push edi
add ebx, 0x68
mov esi, 0x2000
xor edi, edi
mov edx, esi
mov eax, ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x18], ebx
call fcn.00408700
push 0x1fe
lea eax, [ebp - 0x21a]
push edi
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 0xff
mov dword [ebp - 4], esi
mov word [ebp - 0x21c], di
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov eax, ebx
call fcn.0040874f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push edi
push dword [ebp - 0xc]
call ebx
test eax, eax
jne 0x409ebd
mov eax, dword [ebp + 8]
add eax, 0x48
mov dword [ebp + 8], eax
lea eax, [ebp - 0x21c]
push eax
call sub.msvcrt.dll__wcsupr
pop ecx
push 0xffffffffffffffff
lea eax, [ebp - 0x21c]
push eax
mov eax, dword [ebp - 0x1c]
call fcn.004085dd
push dword [ebp - 4]
mov eax, dword [ebp - 0x18]
call fcn.0040874f
push eax
mov eax, dword [ebp + 8]
call fcn.004085dd
inc dword [ebp - 8]
push 0x1fe
lea eax, [ebp - 0x21a]
push edi
push eax
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], 0xff
mov dword [ebp - 4], esi
mov word [ebp - 0x21c], di
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
mov eax, dword [ebp - 0x18]
call fcn.0040874f
push eax
lea eax, [ebp - 0x10]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x21c]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call ebx
test eax, eax
je 0x409e32
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x40a670
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 0xc]
call fcn.00407707
cmp eax, 0xffffffff
pop ecx
mov dword [ebp + 0xc], eax
je 0x40a6f4
push ebx
push esi
push edi
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea edi, [esi + 5]
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 4], 0x1388
call fcn.00408d51
mov edi, dword [ebp - 0xc]
push esi
push edi
push dword [ebp + 0xc]
call fcn.00408225
lea eax, [edi + esi]
mov byte [eax], bl
add esp, 0xc
mov byte [eax + 1], bl
mov byte [eax + 2], bl
mov eax, dword [ebp + 8]
push ebx
push 0xffffffffffffffff
mov dword [eax + 0x34], ebx
push edi
lea ebx, [eax + 0x20]
call fcn.0040887c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esi, [ebp - 0xc]
call fcn.00408d6a
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
jmp 0x40a6f6
xor eax, eax
leave
ret 8
Function at 0x40b023
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x452f48
push dword [esp + 0xc]
push esi
push 0x44551c
push dword [esp + 0x14]
push 0x453158
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x40b048
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00444090
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x452f48
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x44551c
push dword [ebp + 8]
push 0x453158
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x40b0b7
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x40b0bb
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00444090
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x452f48
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x44551c
push dword [ebp + 8]
mov esi, 0x453158
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x40b122
cmp dword [ebp + 0x10], 0
jne 0x40b122
xor eax, eax
jmp 0x40b130
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret

Function at 0x40b483
Capabilities:
Read .ini file

Disassembly:
push dword [esp + 4]
call fcn.00407b0b
test eax, eax
pop ecx
je 0x40b50a
push esi
push edi
push dword [esp + 0xc]
mov edi, 0x452f48
push edi
call sub.msvcrt.dll_wcscpy
push str.general
mov esi, 0x453158
push esi
call sub.msvcrt.dll_wcscpy
add esp, 0x10
push edi
push 0
push 0x44a994
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
dec eax
neg eax
sbb eax, eax
inc eax
push 0x3f
push str.charset
mov esi, 0x4531e0
mov dword [0x4531dc], eax
call fcn.0040b023
push 0x3f
push str.TranslatorName
mov esi, 0x453260
call fcn.0040b023
push 0xff
push str.TranslatorURL
mov esi, 0x4532e0
call fcn.0040b023
add esp, 0x18
pop edi
pop esi
ret

Function at 0x40c680
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8004
call fcn.00444090
push ebx
push esi
mov esi, 0x7fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x8003]
push ebx
push eax
mov byte [ebp - 0x8004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x8004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push 0xfde9
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x8004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x8004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x40c6ef
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00444090
push ebx
push esi
mov esi, 0x1fff
xor ebx, ebx
push esi
lea eax, [ebp - 0x2003]
push ebx
push eax
mov byte [ebp - 0x2004], bl
call sub.msvcrt.dll_memset
add esp, 0xc
push ebx
push ebx
push esi
lea eax, [ebp - 0x2004]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call sub.msvcrt.dll_strlen
pop ecx
push eax
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
pop ebx
leave
ret
Function at 0x40d875
Capabilities:
Get common file path
Get file system object information

Disassembly:
sub esp, 0x4cc
push ebx
push ebp
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_Create]
push esi
mov esi, eax
xor ebx, ebx
cmp dword [esi + 0x2a8], ebx
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
je 0x40d93c
cmp dword [esi + 0x2b0], ebx
je 0x40d90c
push 0x2b0
lea eax, [esp + 0x230]
push ebx
push eax
mov dword [esp + 0x234], ebx
call sub.msvcrt.dll_memset
push 0x208
lea eax, [esp + 0x2e]
push ebx
push eax
mov word [esp + 0x34], bx
call sub.msvcrt.dll_memset
add esp, 0x18
push 0x104
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x4001
push 0x2b4
lea eax, [esp + 0x230]
push eax
push ebx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov dword [esi + 0x29c], eax
push eax
jmp 0x40d92d
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
push 8
push eax
mov dword [esi + 0x29c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x29c]
push 1
push 0x1003
push dword [esi + 0x294]
call edi
cmp dword [esi + 0x2ac], ebx
je 0x40d973
push 1
push 1
push 0x19
push 0x20
push 0x20
call ebp
push 8
push eax
mov dword [esi + 0x2a0], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push dword [esi + 0x2a0]
push ebx
push 0x1003
push dword [esi + 0x294]
call edi
push 1
push 1
push 0x19
push 0x10
push 0x10
call ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push ebx
mov dword [esi + 0x298], eax
call ebp
push 0x1000
push 0x10
push 0x10
push ebx
push 0x85
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
mov dword [esp + 0x14], eax
call ebp
push 0x1000
push 0x10
push 0x10
push ebx
push 0x86
push eax
call dword [sym.imp.USER32.dll_LoadImageW]
push ebx
push dword [esi + 0x298]
mov dword [esp + 0x1c], eax
call dword [sym.imp.COMCTL32.dll_ImageList_SetImageCount]
push 0xf
call dword [sym.imp.USER32.dll_GetSysColor]
mov ebp, dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
push eax
push dword [esp + 0x14]
mov dword [esp + 0x20], eax
push dword [esi + 0x298]
call ebp
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [esi + 0x298]
call ebp
push dword [esp + 0x10]
mov ebp, dword [sym.imp.GDI32.dll_DeleteObject]
call ebp
push dword [esp + 0x14]
call ebp
mov eax, dword [esi + 0x298]
mov esi, dword [esi + 0x294]
push eax
push ebx
push 0x1208
push esi
call fcn.00403b60
pop ecx
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4cc
ret
Function at 0x40e78f
Capabilities:
Delete file
Open clipboard

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
push 0x44b1c8
lea edi, [ebp - 0x208]
mov esi, eax
call fcn.00407a89
mov eax, dword [esi + 0x694]
pop ecx
push 1
push 1
mov ecx, edi
push ecx
push eax
push 2
pop edx
call fcn.0040e748
test eax, eax
je 0x40e807
push dword [esi + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40e7e2
mov eax, edi
push eax
call fcn.00407926
pop ecx
jmp 0x40e7e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40e7fa
push dword [esi + 0x208]
mov ecx, eax
call fcn.00407780
pop ecx
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
pop esi
leave
ret

Function at 0x40e87e
Capabilities:
Open clipboard

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [esi + 0x694]
lea eax, [ebp - 4]
push eax
mov eax, edi
call fcn.0040c16d
test eax, eax
je 0x40e8bb
push dword [esi + 0x208]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x40e8bb
mov eax, dword [ebp - 4]
add eax, 0x210
push eax
call fcn.004078be
pop ecx
mov eax, edi
call fcn.0040ba18
pop edi
leave
ret
Function at 0x410c77
Capabilities:
Get common file path
Link many functions at runtime
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
push ebx
push edi
xor edi, edi
push 0x208
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebp - 0x210], di
call sub.msvcrt.dll_memset
add esp, 0xc
cmp dword [ebp + 8], edi
jne 0x410cb7
lea ebx, [ebp - 0x210]
call fcn.004064dd
mov ebx, 0x104
jmp 0x410ccf
push dword [ebp + 8]
mov ebx, 0x104
mov eax, ebx
lea edi, [ebp - 0x210]
call fcn.00407a0a
pop ecx
xor edi, edi
cmp word [ebp - 0x210], di
je 0x410df4
lea eax, [esi + 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x208
lea eax, [ebp - 0x41e]
push edi
push eax
mov word [ebp - 0x420], di
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x449fa4
call sub.msvcrt.dll_wcslen
mov edi, eax
pop ecx
lea eax, [ebp - 0x210]
push eax
call sub.msvcrt.dll_wcslen
lea eax, [edi + eax + 1]
cmp eax, ebx
pop ecx
jae 0x410d4f
lea eax, [ebp - 0x210]
push 0x449fa4
push eax
lea eax, [ebp - 0x420]
call fcn.00407c91
pop ecx
pop ecx
xor edi, edi
jmp 0x410d58
xor edi, edi
mov word [ebp - 0x420], di
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
mov dword [esi], eax
jne 0x410d9a
mov ebx, dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
push 8
push edi
lea eax, [ebp - 0x420]
push eax
call ebx
cmp eax, edi
mov dword [esi], eax
jne 0x410d9a
call fcn.00410c32
push 8
push edi
lea eax, [ebp - 0x420]
push eax
call ebx
cmp eax, edi
mov dword [esi], eax
je 0x410df4
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NSS_Init
push dword [esi]
call ebx
push str.NSS_Shutdown
push dword [esi]
mov dword [esi + 4], eax
call ebx
push str.PK11_GetInternalKeySlot
push dword [esi]
mov dword [esi + 8], eax
call ebx
push str.PK11_FreeSlot
push dword [esi]
mov dword [esi + 0xc], eax
call ebx
push str.PK11_CheckUserPassword
push dword [esi]
mov dword [esi + 0x10], eax
call ebx
push str.PK11_Authenticate
push dword [esi]
mov dword [esi + 0x14], eax
call ebx
push str.PK11SDR_Decrypt
push dword [esi]
mov dword [esi + 0x18], eax
call ebx
mov dword [esi + 0x1c], eax
xor eax, eax
cmp dword [esi], edi
pop edi
setne al
pop ebx
leave
ret 4

Function at 0x4110c9
Capabilities:
Set current directory

Disassembly:
push esi
mov esi, ebx
neg esi
lea eax, [ebx + 0x1b70]
sbb esi, esi
push edi
and esi, eax
call fcn.00443922
mov esi, ebx
neg esi
lea eax, [ebx + 0x1af4]
sbb esi, esi
and esi, eax
lea edi, [esi + 0x2c]
call fcn.00411156
add esi, 4
call fcn.00408d6a
mov esi, ebx
neg esi
sbb esi, esi
lea eax, [ebx + 0xb0]
and esi, eax
add esi, 4
cmp dword [esi], 0
je 0x41111f
lea eax, [esi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
and dword [esi], 0
mov eax, ebx
neg eax
sbb eax, eax
lea ecx, [ebx + 0xac]
and eax, ecx
mov dword [eax], 0x44a4b4
mov eax, ebx
neg eax
lea ecx, [ebx + 0x98]
sbb eax, eax
and eax, ecx
mov dword [eax], 0x44bbac
call fcn.00412fe0
mov edi, ebx
call fcn.00409930
pop edi
pop esi
ret
Function at 0x412922
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x678
push ebx
mov ebx, dword [ebp + 8]
push esi
add ebx, 0x28
push edi
mov esi, ebx
call fcn.00402777
xor edi, edi
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
push 0x228
mov dword [ebp - 4], eax
lea eax, [ebp - 0x468]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 4]
mov dword [ebp - 0x46c], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x412ad6
mov eax, dword [ebp - 0x464]
mov ecx, dword [ebp - 0x454]
push eax
push edi
push 0x410
mov word [ebp - 0x23c], di
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x240], eax
mov dword [ebp - 0x30], ecx
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
cmp esi, edi
mov dword [ebp - 8], esi
je 0x412a86
push 0x208
lea eax, [ebp - 0x676]
push edi
push eax
mov word [ebp - 0x678], di
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x678]
push eax
mov eax, dword [ebp + 8]
push esi
call fcn.00412afd
cmp word [ebp - 0x678], di
jne 0x412a4f
cmp dword [0x453b34], edi
mov dword [ebp - 0xc], 0x104
jne 0x412a37
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, edi
je 0x412a37
push str.QueryFullProcessImageNameW
push eax
mov dword [0x453b34], 1
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x453b38], eax
mov eax, dword [0x453b38]
cmp eax, edi
je 0x412a4f
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 0x678]
push ecx
push edi
push esi
call eax
lea esi, [ebp - 0x678]
lea edi, [ebp - 0x23c]
call fcn.0041252f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call fcn.0041287a
add esp, 0x14
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
mov esi, dword [ebx + 0xc]
cmp esi, edi
jl 0x412ad6
cmp esi, 0xffffffff
mov eax, dword [ebx + 8]
jne 0x412a9e
push dword [ebx]
call sub.msvcrt.dll_free
jmp 0x412ab1
push eax
push 0x234
lea eax, [ebx + 4]
mov edx, esi
mov edi, ebx
call fcn.00407a38
pop ecx
lea eax, [esi + 1]
cmp dword [ebx + 0xc], eax
pop ecx
jge 0x412abd
mov dword [ebx + 0xc], eax
mov edi, esi
imul edi, edi, 0x234
add edi, dword [ebx]
mov ecx, 0x8d
lea esi, [ebp - 0x240]
rep movsd dword es:[edi], dword [esi]
xor edi, edi
lea eax, [ebp - 0x46c]
push eax
push dword [ebp - 4]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x41297b
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x412b25
Capabilities:
Link many functions at runtime

Disassembly:
cmp dword [esi], 0
jne 0x412b7a
push edi
push str.psapi.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.GetModuleBaseNameW
push eax
mov dword [esi], eax
call edi
push str.EnumProcessModules
push dword [esi]
mov dword [esi + 4], eax
call edi
push str.GetModuleFileNameExW
push dword [esi]
mov dword [esi + 8], eax
call edi
push str.EnumProcesses
push dword [esi]
mov dword [esi + 0x10], eax
call edi
push str.GetModuleInformation
push dword [esi]
mov dword [esi + 0x14], eax
call edi
mov dword [esi + 0xc], eax
pop edi
ret
Function at 0x4131f9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20000
call fcn.00444090
cmp dword [ebp + 8], 0
je 0x41325e
test esi, esi
je 0x41324c
push 0x22
push esi
call sub.msvcrt.dll_wcschr
test eax, eax
pop ecx
pop ecx
je 0x41324c
and word [ebp - 0x20000], 0
push esi
push str.__s_
lea eax, [ebp - 0x20000]
push 0xfffe
push eax
call sub.msvcrt.dll__snwprintf
add esp, 0x10
push dword [ebp + 0x1c]
lea eax, [ebp - 0x20000]
push eax
jmp 0x413250
push dword [ebp + 0x1c]
push esi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
leave
ret
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
leave
ret

Function at 0x413276
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4004
call fcn.00444090
push esi
push edi
xor eax, eax
cmp dword [ebp + 8], eax
push 0x4000
push eax
mov word [ebp - 0x4004], ax
lea eax, [ebp - 0x4002]
mov edi, ecx
push eax
je 0x4132d5
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x4004]
push eax
push dword [edi]
push dword [ebp + 0x14]
call fcn.00408289
add esp, 0x18
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, eax
jmp 0x413316
call sub.msvcrt.dll_memset
add esp, 0xc
push dword [ebp + 0x18]
lea eax, [ebp - 0x4004]
push 0x2000
push eax
push 0x44551c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
push dword [ebp + 0x14]
xor ecx, ecx
cmp ecx, eax
sbb esi, esi
push edi
lea edi, [ebp - 0x4004]
neg esi
call fcn.00408312
pop ecx
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x41331c
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push dword [ebp + 0x18]
je 0x41333a
push dword [esi]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.004131ac
add esp, 0x10
pop ebp
ret
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [esi], eax
pop ebp
ret

Function at 0x413367
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
add eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4133a0
mov ecx, dword [ebp - 4]
cmp ecx, 2
jb 0x41339c
shr ecx, 1
and word [esi + ecx*2], ax
leave
ret
and word [esi], 0
leave
ret
Function at 0x413a56
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24c
push esi
push edi
mov esi, eax
call fcn.004139a9
xor edi, edi
cmp dword [0x453574], edi
je 0x413a9b
call fcn.00407c5c
cmp dword [eax + 0x10], 1
jne 0x413a8c
cmp esi, 0x19
je 0x413a9b
cmp esi, 0x17
je 0x413a9b
cmp esi, 0x16
je 0x413a9b
push edi
push esi
push ebx
push edi
call dword [0x453574]
jmp 0x413b33
push 0x206
lea eax, [ebp - 0x24a]
push edi
push eax
mov word [ebp - 0x24c], di
call sub.msvcrt.dll_memset
add esp, 0xc
cmp esi, 0x19
je 0x413ac6
cmp esi, 0x17
je 0x413ac6
cmp esi, 0x16
jne 0x413ad6
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
jmp 0x413ae4
lea eax, [ebp - 4]
push eax
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call fcn.0041334d
add esp, 0xc
cmp eax, edi
jne 0x413b1c
lea ecx, [ebp - 0x44]
mov eax, esi
call fcn.004139d8
lea eax, [ebp - 0x44]
push eax
push dword [ebp - 4]
mov eax, 0x104
lea esi, [ebp - 0x24c]
call fcn.00413367
pop ecx
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24c]
push eax
push ebx
call sub.msvcrt.dll_wcscpy
xor eax, eax
cmp word [ebx], di
pop ecx
pop ecx
setne al
pop edi
pop esi
leave
ret

Function at 0x415efe
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp dword [esp + 4], eax
jle 0x415f27
push esi
movzx edx, byte [ecx]
movzx edx, byte [edx + 0x445cf8]
mov esi, eax
shl esi, 3
xor edx, esi
xor eax, edx
inc ecx
dec dword [esp + 8]
cmp dword [esp + 8], 0
jg 0x415f07
pop esi
ret

Function at 0x4164ea
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x20]
test eax, eax
push esi
push edi
je 0x41652a
cdq
mov esi, eax
add eax, dword [ebp + 0xc]
mov edi, edx
mov ecx, edx
adc ecx, dword [ebp + 0x10]
push edi
sub eax, 1
push esi
sbb ecx, 0
push ecx
push eax
call fcn.00443fe0
push edi
push esi
push edx
push eax
call fcn.00443ec0
mov dword [ebp + 0xc], eax
mov dword [ebp + 0x10], edx
push dword [ebp + 0x10]
mov edi, ebx
push dword [ebp + 0xc]
call fcn.0041638b
test eax, eax
pop ecx
pop ecx
jne 0x416553
push dword [ebx + 8]
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x41655a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebx + 0x10], eax
mov dword [ebp - 4], 0x60a
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x416586
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x4165b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4165b6
mov dword [esi + 0x10], eax
mov eax, 0x70a
jmp 0x4165d6
push 1
push 0
push 0
push dword [ebp + 8]
call fcn.00443ec0
mov ecx, eax
xor eax, eax
add ecx, edi
adc edx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
mov dword [eax + 4], edx
xor eax, eax
pop edi
pop esi
pop ebp
ret