joyce8/EMBER2024-capa huggingface dataset:
Function at 0x551698
Capabilities:
Enumerate gui resources

Disassembly:
add esp, 0xfffffff8
mov dword [esp], eax
xor eax, eax
mov dword [esp + 4], eax
mov eax, esp
push eax
push 0x551654
call sub.user32.dll_EnumWindows
mov eax, dword [esp + 4]
pop ecx
pop edx
ret

Function at 0x5516b8
Capabilities:
Create process on windows
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffd9c
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x264], edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 0x25c], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406ec4
xor eax, eax
push ebp
push 0x551859
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
push ebp
push 0x551827
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x57a4b0], 0
jne 0x551725
lea eax, [ebp - 0x25c]
call fcn.00551438
mov edx, dword [ebp - 0x25c]
mov eax, 0x57a4b0
call fcn.00406edc
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040480c
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x10
call fcn.0040480c
mov dword [ebp - 0x48], 0x44
mov word [ebp - 0x18], 3
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x260]
mov ecx, dword [ebp - 4]
mov edx, 0x551878
call fcn.004073a8
mov eax, dword [ebp - 0x260]
call fcn.00406f68
push eax
mov eax, dword [0x57a4b0]
call fcn.00406f68
push eax
call sub.kernel32.dll_CreateProcessW
test eax, eax
je 0x55181d
push 0x1388
mov eax, dword [ebp - 0x58]
push eax
call sub.user32.dll_WaitForInputIdle
xor esi, esi
push 0x3e8
call sub.kernel32.dll_Sleep_2
mov eax, dword [ebp - 0x50]
call fcn.00551698
mov ebx, eax
test ebx, ebx
jg 0x5517c9
inc esi
cmp esi, 5
jl 0x5517ab
push 0x1fe
lea eax, [ebp - 0x256]
push eax
push ebx
call sub.user32.dll_GetWindowTextW
lea eax, [ebp - 0x264]
lea edx, [ebp - 0x256]
mov ecx, 0xff
call fcn.004070d4
mov edx, dword [ebp - 0x264]
mov eax, 0x551888
call fcn.0041b834
test eax, eax
jne 0x55181d
push 0x3e8
call sub.kernel32.dll_Sleep_2
push 0
push 0x5518ac
call sub.user32.dll_FindWindowW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x551833
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x551860
lea eax, [ebp - 0x264]
mov edx, 3
call fcn.00406ed4
lea eax, [ebp - 4]
call fcn.00406ecc
ret
Function at 0x553708
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x55379d
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov dl, 1
mov eax, dword [0x44eca4]
call fcn.0044fea8
mov esi, eax
mov edx, 0x80000002
mov eax, esi
call fcn.0044ff90
mov cl, 1
mov edx, 0x5537b8
mov eax, esi
call fcn.004500d8
lea eax, [ebp - 4]
push eax
xor ecx, ecx
mov edx, 0x553820
mov eax, esi
call fcn.0053bd10
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
test eax, eax
je 0x553771
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x553777
mov bl, 1
mov eax, esi
call fcn.0044ff60
mov dl, 1
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 4]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5537a4
lea eax, [ebp - 4]
call fcn.00406ecc
ret

Function at 0x5568a0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00406ec4
xor eax, eax
push ebp
push 0x5569d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor ecx, ecx
mov dl, 1
mov eax, dword [0x534b38]
call fcn.004e8784
mov ebx, eax
mov dl, 1
mov eax, ebx
call fcn.00537948
movzx eax, byte [0x5569e8]
mov byte [ebx + 0x141], al
mov byte [ebx + 0x134], 1
mov eax, ebx
call fcn.00538154
mov edx, 0x5569f8
call fcn.0051f54c
mov eax, ebx
call fcn.00538154
add eax, 4
mov edx, 0x556a48
call fcn.00406edc
mov eax, ebx
call fcn.00538154
add eax, 0x98
mov edx, 0x556a68
call fcn.00406edc
mov eax, ebx
call fcn.00538154
add eax, 0x98
push eax
lea eax, [ebp - 8]
call fcn.00550b7c
mov edx, dword [ebp - 8]
pop eax
call fcn.00406edc
mov eax, ebx
call fcn.00538154
add eax, 0x78
mov edx, 0x556b40
call fcn.00406edc
mov eax, ebx
call fcn.00538154
add eax, 0x80
mov edx, 0x556bdc
call fcn.00406edc
mov eax, ebx
call fcn.00538154
add eax, 0x7c
mov edx, 0x556c24
call fcn.00406edc
mov eax, ebx
call fcn.00538154
add eax, 0x10
mov edx, 0x556c84
call fcn.00406edc
push edi
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.00535ce4
mov eax, ebx
call fcn.004fd804
mov eax, ebx
call fcn.00404e48
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x5569e0
lea eax, [ebp - 8]
mov edx, 2
call fcn.00406ed4
ret
Function at 0x559398
Capabilities:
Delete internet cache
Enumerate internet cache

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor esi, esi
xor eax, eax
push ebp
push 0x55941d
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 0
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryW
mov eax, dword [ebp - 4]
call fcn.00404258
mov ebx, eax
lea eax, [ebp - 4]
push eax
push ebx
push 0
call sub.wininet.dll_FindFirstUrlCacheEntryW
mov edi, dword [ebx + 4]
test edi, edi
je 0x5593ef
cmp dword [ebx + 0xc], 0x200001
je 0x5593ef
push edi
call sub.wininet.dll_DeleteUrlCacheEntryW
jmp 0x5593f9
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x559427
mov eax, ebx
call fcn.00404274
inc esi
cmp esi, 0x3e8
jle 0x5593af
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x559427
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x569628
Capabilities:
Encrypt data using des

Disassembly:
push ebx
mov ecx, edx
and cl, 0x20
mov ebx, edx
and bl, 0x1e
movzx ebx, bl
shr ebx, 1
or cl, bl
and dl, 1
shl edx, 4
or cl, dl
mov edx, ecx
movzx edx, dl
movzx eax, al
add eax, eax
add eax, eax
add eax, eax
lea eax, [eax*8 + 0x57a658]
movzx eax, byte [eax + edx]
and al, 0xf
pop ebx
ret

Function at 0x569660
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov ebx, edx
test ebx, ebx
js 0x569678
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x569671
mov eax, esp
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 7
call fcn.0040480c
xor edx, edx
mov eax, 0x57a858
movzx ebx, byte [eax]
mov ecx, ebx
and cl, 7
movzx ecx, cl
push ecx
mov ecx, 7
pop esi
sub ecx, esi
mov esi, 1
shl esi, cl
movzx ecx, bl
shr ecx, 3
mov ebx, dword [ebp - 4]
movzx ecx, byte [ebx + ecx]
and esi, ecx
je 0x5696df
mov ecx, edx
and ecx, 7
push ecx
mov ecx, 7
pop ebx
sub ecx, ebx
mov bl, 1
shl bl, cl
mov ecx, edx
shr ecx, 3
mov esi, dword [ebp - 8]
or byte [esi + ecx], bl
inc edx
inc eax
cmp edx, 0x38
jne 0x569696
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x569920
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
mov ebx, dword [ebp + 0x10]
test ebx, ebx
js 0x569939
shr ebx, 2
mov esi, dword [ecx + ebx*4]
dec ebx
push esi
jns 0x569932
mov ecx, esp
mov ebx, edx
test ebx, ebx
js 0x56994b
shr ebx, 2
mov esi, dword [eax + ebx*4]
dec ebx
push esi
jns 0x569944
mov eax, esp
mov dword [ebp - 4], ecx
push 5
lea ecx, [ebp - 0xa]
call fcn.00569518
mov ebx, 6
mov eax, dword [ebp - 4]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
xor byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x569965
movzx eax, byte [ebp - 0xa]
movzx edx, al
shr edx, 2
mov byte [ebp - 0x12], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 9]
movzx ecx, dl
shr ecx, 4
or al, cl
mov byte [ebp - 0x11], al
and dl, 0xf
add edx, edx
add edx, edx
movzx eax, byte [ebp - 8]
movzx ecx, al
shr ecx, 6
or dl, cl
mov byte [ebp - 0x10], dl
and al, 0x3f
mov byte [ebp - 0xf], al
movzx eax, byte [ebp - 7]
movzx edx, al
shr edx, 2
mov byte [ebp - 0xe], dl
and al, 3
shl eax, 4
movzx edx, byte [ebp - 6]
shr edx, 4
or al, dl
mov byte [ebp - 0xd], al
movzx eax, byte [ebp - 6]
and al, 0xf
add eax, eax
add eax, eax
movzx edx, byte [ebp - 5]
shr edx, 6
or al, dl
mov byte [ebp - 0xc], al
movzx eax, byte [ebp - 5]
and al, 0x3f
mov byte [ebp - 0xb], al
xor ebx, ebx
lea esi, [ebp - 0x12]
mov eax, ebx
movzx edx, byte [esi]
call fcn.00569628
mov byte [esi], al
inc ebx
inc esi
cmp ebx, 8
jne 0x5699ed
mov ebx, 4
lea eax, [ebp - 0x12]
lea edx, [ebp - 0xa]
movzx ecx, byte [eax]
shl ecx, 4
or cl, byte [eax + 1]
mov byte [edx], cl
inc edx
add eax, 2
dec ebx
jne 0x569a0b
lea eax, [ebp - 0xa]
mov edx, 5
call fcn.005695a8
mov ebx, 4
lea eax, [ebp - 0xa]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [eax]
mov byte [edx], cl
inc edx
inc eax
dec ebx
jne 0x569a35
mov esi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x569a4c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
mov ebx, ecx
test ebx, ebx
js 0x569a65
shr ebx, 2
mov esi, dword [edx + ebx*4]
dec ebx
push esi
jns 0x569a5e
mov edx, esp
mov dword [ebp - 4], edx
mov ebx, eax
mov dword [ebp - 8], 8
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0xc]
movzx edx, byte [eax]
mov byte [ecx], dl
inc ecx
inc eax
dec dword [ebp - 8]
jne 0x569a79
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00569418
test bl, bl
jne 0x569b53
mov dword [ebp - 8], 0x10
mov dword [ebp - 0x14], 0x581528
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x569ab1
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x569ac6
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov eax, dword [ebp - 0x14]
mov ecx, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00569920
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
movzx ebx, byte [edx]
xor bl, byte [esi]
mov byte [ecx], bl
inc ecx
inc esi
inc edx
dec eax
jne 0x569af9
add dword [ebp - 0x14], 6
dec dword [ebp - 8]
jne 0x569aa6
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ecx, [ebp - 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x569b1d
mov eax, 4
mov edx, dword [ebp + 0xc]
movzx ecx, byte [edx]
mov byte [edx + 4], cl
inc edx
dec eax
jne 0x569b2f
mov eax, 4
lea edx, [ebp - 0xc]
mov ecx, dword [ebp + 0xc]
movzx ebx, byte [edx]
mov byte [ecx], bl
inc ecx
inc edx
dec eax
jne 0x569b44
jmp 0x569c14
cmp bl, 1
jne 0x569c14
mov dword [ebp - 8], 0xfffffff0
mov ebx, 0x581582
mov eax, 4
mov edx, dword [ebp + 0xc]
lea esi, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [esi], cl
inc esi
inc edx
dec eax
jne 0x569b73
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
movzx ecx, byte [edx]
mov byte [edx - 4], cl
inc edx
dec eax
jne 0x569b88
push 5
lea eax, [ebp - 0x10]
push eax
push 3
mov ecx, ebx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00569920
mov eax, 4
lea edx, [ebp - 0xc]
lea esi, [ebp - 0x10]
mov ecx, dword [ebp + 0xc]
add ecx, 4
mov dword [ebp - 0x18], ecx
movzx ecx, byte [edx]
xor cl, byte [esi]
mov edi, dword [ebp - 0x18]
mov byte [edi], cl
inc dword [ebp - 0x18]
inc esi
inc edx
dec eax
jne 0x569bbb
sub ebx, 6
inc dword [ebp - 8]
jne 0x569b68
mov eax, 4
mov edx, dword [ebp + 0xc]
add edx, 4
lea ebx, [ebp - 0xc]
movzx ecx, byte [edx]
mov byte [ebx], cl
inc ebx
inc edx
dec eax
jne 0x569be3
mov eax, 4
mov ebx, dword [ebp + 0xc]
movzx edx, byte [ebx]
mov byte [ebx + 4], dl
inc ebx
dec eax
jne 0x569bf5
mov eax, 4
lea ebx, [ebp - 0xc]
mov edx, dword [ebp + 0xc]
movzx ecx, byte [ebx]
mov byte [edx], cl
inc edx
inc ebx
dec eax
jne 0x569c0a
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
call fcn.00569498
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret 8
Function at 0x43b65e
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0x43b3c1
push ebx
pop ecx
or ebx, ecx
sub ecx, 0x6576ade0
call fcn.0043b6ae
add ebx, 0xdd0d4a1a
push ecx
pop ecx
xor dword [edi], esi
sub ecx, 1
add ecx, ecx
inc edi
sub ecx, 0x46b5ec57
add ebx, ecx
cmp edi, edx
jne fcn.0043b65e
sub ecx, ebx
and ecx, ecx
ret

Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret
Function at 0x492084
Capabilities:
Encode data using xor

Disassembly:
clc
jmp 0x4920aa
arpl word [eax + 0x73], sp
push ds
pushal
jae 0x4920cb
dec ebp
mov dl, 0x3c
pop edi
ficomp word [ebx]
call 0x6a5e199c
pop eax
bound eax, qword [edx]
dec eax
xor eax, 0x2f860a5
fst qword [0x482c9606]
dec ebx
jno 0x4920a9
call fcn.004920e0
add dh, bl
cmpsb byte [esi], byte es:[edi]
lodsb al, byte [esi]
sub al, 0x28
sub ch, bh
xor esp, ebp
ret 0xcdfb
Function at 0x401488
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42e9b0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, ebx
jne 0x40151d
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov edi, 0x105
jmp 0x4014da
cmp dword [ebp + 0x10], ebx
jne 0x401511
push ebx
lea eax, [ebp - 0x10c]
push eax
push dword [ebp - 4]
call fcn.00401488
test eax, eax
jne 0x4014ec
push edi
lea eax, [ebp - 0x10c]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014c1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405603
cmp eax, ebx
je 0x401524
push ebx
push dword [0x42e9b0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40151d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42e9b0], ebx
jne 0x40151a
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
test eax, eax
jne 0x40151a
jmp 0x40151d
Function at 0x4051fa
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x42ad38
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x42ad38], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x405235
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x40536f
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40538c
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x40538f
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
ret 0xc

Function at 0x4053be
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp + 8]
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405402
test edi, edi
jne 0x4053c9
mov byte [esi], 0
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4053fc

Function at 0x405406
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0x14]
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push ebx
push dword [ebp + 0xc]
mov byte [esi], bl
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405477
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push ebx
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x400
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405466
cmp dword [ebp + 0x14], 1
je 0x405468
cmp dword [ebp + 0x14], 2
je 0x405468
mov byte [esi], bl
push dword [ebp + 0x18]
mov byte [esi + 0x3ff], bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x4056c1
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x42ad80
push esi
call fcn.0040551f
push esi
call fcn.00405302
mov edi, eax
test edi, edi
jne 0x4056e2
xor eax, eax
jmp 0x40573a
push edi
call fcn.00405541
test byte [0x42e928], 0x80
je 0x4056fb
mov al, byte [edi]
test al, al
je 0x4056de
cmp al, 0x5c
je 0x4056de
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
sub edi, esi
jmp 0x40571b
push esi
call fcn.004055dc
test eax, eax
je 0x405715
test byte [eax], 0x10
je 0x40573f
push esi
call fcn.0040569a
push esi
call ebx
cmp eax, edi
jg 0x405706
push esi
call fcn.0040566d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x405739
Function at 0x4059ea
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405603
test eax, eax
mov esi, dword [esp + 0x18]
je 0x405a0e
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405b47
test esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x42b180], 0x4c554e
mov edi, 0x400
mov ebp, 0x42b180
je 0x405a52
push 1
push 0
push esi
call fcn.0040538f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x405b4d
cmp eax, edi
jg 0x405b4d
push edi
mov esi, 0x42bac0
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x405b4d
cmp eax, edi
jg 0x405b4d
push esi
push ebp
push str._s_s_r_n
push 0x42b580
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42e8cc]
push dword [eax + 0x128]
push esi
call fcn.00405799
push 4
push 0xc0000000
push esi
call fcn.0040538f
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x14], ebp
je 0x405b47
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x405b40
push 0
lea eax, [esp + 0x1c]
push eax
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x405b40
cmp edi, dword [esp + 0x18]
jne 0x405b40
push str._Rename__r_n
push esi
call fcn.00405743
test eax, eax
jne 0x405b54
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call fcn.0040551f
add edi, 0xa
mov eax, edi
push ebx
push 0x42b580
add eax, esi
push eax
call fcn.0040534f
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [esp + 0x1c]
push eax
add edi, ebx
push edi
push esi
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc dword [0x42e990]
pop edi
pop esi
pop ebp
pop ebx
ret 8
push 0x4076bc
add eax, 0xa
push eax
call fcn.00405743
test eax, eax
je 0x405b0b
inc eax
lea ecx, [esi + edi]
cmp eax, ecx
mov ebp, eax
jae 0x405b7b
mov dl, byte [ebp]
mov byte [ebx + ebp], dl
inc ebp
cmp ebp, ecx
jb 0x405b70
mov ebp, dword [esp + 0x14]
sub eax, esi
jmp 0x405b0d
Function at 0x405b83
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
mov ebx, dword [ebp + 8]
push ebx
call fcn.004056c1
mov ecx, dword [ebp + 0xc]
test cl, 8
mov dword [ebp - 8], eax
je 0x405bb8
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x42e988], eax
jmp 0x405d4a
mov dword [ebp + 8], ecx
and dword [ebp + 8], 1
push esi
je 0x405bd3
test eax, eax
je 0x405cf5
test cl, 2
je 0x405cf5
push edi
push ebx
mov esi, 0x42bec0
push esi
call fcn.0040551f
cmp dword [ebp + 8], 0
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x405bf6
push str..
push esi
call edi
jmp 0x405bfc
push ebx
call fcn.0040569a
cmp byte [ebx], 0
jne 0x405c0a
cmp byte [0x42bec0], 0x5c
jne 0x405c12
push 0x407290
push ebx
call edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
lea eax, [ebp - 0x148]
push eax
push esi
add edi, ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x405cea
lea esi, [ebp - 0x11c]
push 0x3f
mov eax, esi
push eax
call fcn.004052bf
cmp byte [eax], 0
je 0x405c55
cmp byte [ebp - 0x18], 0
je 0x405c55
lea esi, [ebp - 0x18]
cmp byte [esi], 0x2e
jne 0x405c6b
mov al, byte [esi + 1]
test al, al
je 0x405cc9
cmp al, 0x2e
jne 0x405c6b
cmp byte [esi + 2], 0
je 0x405cc9
push esi
push edi
call fcn.0040551f
test byte [ebp - 0x148], 0x10
je 0x405c90
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x405cc9
push dword [ebp + 0xc]
push ebx
call fcn.00405b83
jmp 0x405cc9
push ebx
call fcn.0040536f
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x405cc1
test byte [ebp + 0xc], 4
je 0x405cb9
push ebx
push 0xfffffffffffffff1
call fcn.004045d6
push 0
push ebx
call fcn.004059ea
jmp 0x405cc9
inc dword [0x42e988]
jmp 0x405cc9
push ebx
push 0xfffffffffffffff2
call fcn.004045d6
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x405c37
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x405cf4
mov byte [edi - 1], 0
pop edi
xor esi, esi
cmp dword [ebp + 8], esi
je 0x405d49
cmp dword [ebp - 8], esi
jne 0x405d09
inc dword [0x42e988]
jmp 0x405d49
push ebx
call fcn.004055dc
test eax, eax
je 0x405d49
push ebx
call fcn.0040566d
push ebx
call fcn.0040536f
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x405d41
test byte [ebp + 0xc], 4
je 0x405d01
push ebx
push 0xfffffffffffffff1
call fcn.004045d6
push esi
push ebx
call fcn.004059ea
jmp 0x405d49
push ebx
push 0xffffffffffffffe5
call fcn.004045d6
pop esi
pop ebx
leave
ret 8