joyce8/EMBER2024-capa huggingface dataset:
Function at 0x84df64
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bl, byte [esp]
sete bl
rcl ax, 5
btc ebx, esi
rcl eax, cl
jmp 0x84df6a
mov dword [esp], esi
pop edi
jmp 0x84df4e
mov ebx, edi
setge dl
lea esi, [edi*4]
cpuid
pushfd
add esp, 1
jmp 0x84dfb2
xchg byte [esp], al
mov byte [esp], dh
neg bp
and bp, cx
jmp 0x84dfd8
add esp, 0
pop di
mov al, 0x31
mov bl, ch
setne ah
mov dl, bl
jmp 0x84df9c
lea esp, [esp]
mov ebx, 0xa9455ee
xchg bl, ah
mov dx, bp
rcl bh, 4
jmp 0x84e322
lea esi, [esi*4]
rdtsc
btr dx, bp
rdtsc
xchg bx, ax
inc ch
jmp 0x84dfc2
mov word [esp + 1], bx
mov byte [esp], bh
pop word [esp]
lea esp, [esp + 2]
jmp 0x84e03f
pop dword [esp]
lea esp, [esp + 3]
lea esp, [esp + 4]
popal
pushfd
cmc
jmp 0x84dfed
mov esi, dword [esp + 5]
xchg ebp, ebx
bt esi, esp
mov bx, 0x5f89
lea esi, reloc.IPHLPAPI.DLL_GetInterfaceInfo
xchg dword [esp + 1], ebp
jmp 0x84e003
popfd
lea esp, [esp + 4]
call int.0084e090
mov dword [reloc.IPHLPAPI.DLL_GetInterfaceInfo], eax
aad 0xcb
inc eax
salc
mov cl, 0x40
out 0x77, eax
std
insd dword es:[edi], dx
hlt
setl dl
lea edx, reloc.IPHLPAPI.DLL_GetInterfaceInfo
lea edi, [esi + 0x95]
xchg edi, ecx
lea eax, [esp + ecx]
lea ebp, reloc.IPHLPAPI.DLL_GetInterfaceInfo
jmp 0x84e026
cpuid
neg ebp
mov si, word [esp]
sub esp, 0xa
mov si, word [esp + 0xa]
bsr edi, ecx
jmp 0x84e05e
dec ebp
adc al, 0xe7
pop es
movsd dword es:[edi], dword [esi]
mov esp, 0xb59136db
inc ebx
sal dword [esi + reloc.IPHLPAPI.DLL_GetInterfaceInfo], cl
lcall 0x3330, 0x31e30cfd
pop word [esp]
xchg bp, ax
add esp, 2
mov cx, bx
jmp 0x84e0ad
lea esp, [esp]
std
call 0x84e2e8
or eax, 0x9465028c
jbe 0x84e2cf
sbb dword [ecx - 0x20fe418], ecx
jp 0x84e322
invalid
Function at 0x401070
Capabilities:
Set current directory

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x11c]
mov ebx, ecx
push edi
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x10]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x10]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str._binn_sqlsui.dll
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [ebx + 0x18], eax
jne 0x4010fe
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x108
ret 4
Function at 0x4012e0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
sub esp, 0x234
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x248]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40130c
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret 8
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x144]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x144]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
mov ebp, dword [esp + 0x24c]
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40a06c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov al, byte [ebp]
mov ecx, ebx
and ecx, 3
xor ebx, ebx
test al, al
rep movsb byte es:[edi], byte [esi]
je 0x401442
mov ecx, 0xc
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [ebx + ebp]
lea ecx, [esp + 0x14]
push eax
push 0x40a068
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add ebx, eax
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x50]
rep stosd dword es:[edi], eax
add esp, 0xc
lea edx, [ebx + ebp + 1]
lea edi, [esp + 0x144]
or ecx, 0xffffffff
inc ebx
mov dword [esp + 0x10], edx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x44]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x44]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401433
mov ecx, dword [esp + 0x10]
cmp byte [ecx], 0
jne 0x401375
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret 8
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x234
ret 8
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x234
ret 8

Function at 0x401e10
Capabilities:
Set current directory

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x401e52
mov ecx, dword [esi + 0x20]
test ecx, ecx
mov ecx, str.sqlinab
jne 0x401e31
mov ecx, str.setupex
push ecx
push eax
lea eax, [esp + 0xc]
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi + 0x18]
add esp, 0x10
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x401e77
mov eax, dword [esi + 0x20]
test eax, eax
mov eax, str.sqlinab
jne 0x401e63
mov eax, str.setupex
push eax
lea edx, [esp + 8]
push str._s.dll
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
add esp, 0x104
ret
Function at 0x401e90
Capabilities:
Set current directory

Disassembly:
sub esp, 0x104
push esi
mov esi, ecx
mov eax, dword [esi + 0x18]
test eax, eax
je 0x401ec0
push eax
lea eax, [esp + 8]
push str._ssqlboot.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [esi + 0x18]
add esp, 0xc
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
jmp 0x401ed3
lea edx, [esp + 4]
push str.sqlboot.dll
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 8
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
pop esi
add esp, 0x104
ret

Function at 0x4027d0
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40281e
test al, 1
je 0x4027f0
xor eax, 1
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0
push 0x80
push 3
push 0
push 3
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x402817
mov eax, 1
pop esi
ret 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
ret 4
Function at 0x402830
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x78
push edi
mov ecx, 0x11
xor eax, eax
lea edi, [esp + 0x38]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x38]
mov dword [esp + 8], 0
push eax
mov dword [esp + 0x3c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x88]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x38]
push ecx
mov ecx, dword [esp + 0x88]
push edx
mov edx, dword [esp + 0x88]
push eax
push 0
push 8
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x40289f
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
add esp, 0x78
ret 0x10
mov eax, dword [esp + 0x8c]
push esi
push ebp
push ebx
test eax, eax
je 0x40296a
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x40293c
mov ebp, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov edi, dword [sym.imp.USER32.dll_PeekMessageA]
mov ebx, dword [sym.imp.USER32.dll_DispatchMessageA]
mov dword [esp + 0x10], 1
push 0xff
push 0xffffffffffffffff
lea eax, [esp + 0x20]
push 0
push eax
push 1
call ebp
mov esi, eax
sub eax, 0
je 0x40292a
dec eax
jne 0x402932
push 1
push 0
push 0
lea ecx, [esp + 0x34]
push 0
push ecx
call edi
test eax, eax
je 0x402932
cmp dword [esp + 0x2c], 0x12
je 0x40292a
lea edx, [esp + 0x28]
push edx
call ebx
push 1
push 0
push 0
lea eax, [esp + 0x34]
push 0
push eax
call edi
test eax, eax
jne 0x402907
jmp 0x402932
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4028d8
jmp 0x40294b
mov ecx, dword [esp + 0x18]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esi, eax
cmp esi, 0xffffffff
je 0x402962
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x14]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x40296a
mov dword [esp + 0x14], 0xffffffff
mov ecx, dword [esp + 0x1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x18]
push edx
call esi
mov eax, dword [esp + 0x14]
pop ebx
pop ebp
pop esi
pop edi
add esp, 0x78
ret 0x10
Function at 0x4029b0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x114
push ebx
push ebp
mov ebp, dword [esp + 0x124]
push esi
test ebp, ebp
push edi
mov byte [esp + 0x13], 0
je 0x4029ec
mov edi, 0x40ca90
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x128]
test edi, edi
jne 0x402a1b
lea ecx, [esp + 0x20]
push 0x104
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x402a3c
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 0x10
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x20]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x130]
test eax, eax
je 0x402a4d
mov dword [eax], 0
mov eax, dword [esp + 0x134]
test eax, eax
je 0x402a5e
mov dword [eax], 0
lea ecx, [esp + 0x18]
lea edx, [esp + 0x20]
push ecx
push edx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
je 0x402b1d
push edi
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
test ebx, ebx
je 0x402b1d
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov esi, eax
test esi, esi
je 0x402b1d
mov eax, dword [esp + 0x128]
push esi
push edi
push 0
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x402b0f
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x14]
push ecx
push edx
push 0x40a06c
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x402b0f
mov eax, dword [esp + 0x14]
test ebp, ebp
mov esi, eax
je 0x402aea
mov eax, dword [eax + 0x10]
push 0xa
shr eax, 0x10
and eax, 0xffff
push ebp
push eax
call fcn.004047a0
add esp, 0xc
mov ecx, dword [esp + 0x130]
test ecx, ecx
je 0x402b0a
mov eax, dword [esp + 0x134]
test eax, eax
je 0x402b0a
mov edx, dword [esi + 8]
mov dword [ecx], edx
mov ecx, dword [esi + 0xc]
mov dword [eax], ecx
mov byte [esp + 0x13], 1
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov al, byte [esp + 0x13]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret 0x10
Function at 0x402c10
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x10c
test eax, eax
push ebx
push ebp
push esi
push edi
mov edi, ecx
jne 0x402c2e
mov eax, dword [edi + 4]
mov dword [esp + 0x120], eax
mov ebp, dword [esp + 0x124]
test ebp, ebp
je 0x402c67
mov edx, dword [esp + 0x120]
lea ecx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x402c71
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 8
mov eax, dword [edi + 8]
mov ebp, dword [edi + 0xc]
mov dword [esp + 0x10], eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, 0x104
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x28]
push ecx
push edx
push 0
push eax
mov dword [esp + 0x34], ebx
call esi
test eax, eax
jne 0x402cb4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
push edx
mov ecx, edi
call fcn.00402c10
test al, al
jne 0x402c7c
mov eax, dword [esp + 0x10]
mov ecx, dword [edi + 8]
cmp eax, ecx
jne 0x402cc8
mov ecx, edi
call fcn.00402bf0
jmp 0x402ccf
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x120]
push ebp
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
pop edi
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
add esp, 0x10c
ret 8

Function at 0x402d90
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov eax, 4
mov dword [esp + 4], eax
mov dword [esp], eax
mov eax, dword [ecx + 8]
test eax, eax
jne 0x402daa
mov eax, dword [ecx + 4]
lea ecx, [esp]
lea edx, [esp + 0xc]
push ecx
lea ecx, [esp + 8]
push edx
mov edx, dword [esp + 0x14]
push ecx
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402dd5
mov eax, dword [esp + 0xc]
add esp, 8
ret 8
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [esp + 0x10]
add esp, 8
ret 8
Function at 0x4056a0
Capabilities:
Terminate process

Disassembly:
mov eax, dword [0x40d054]
push ebx
push ebp
mov ebp, dword [esp + 0xc]
cmp eax, 1
push esi
jne 0x4056bf
push ebp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
test eax, eax
mov dword [0x40d050], 1
mov byte [0x40d04c], bl
jne 0x405719
mov ecx, dword [0x40d408]
test ecx, ecx
je 0x405707
mov esi, dword [0x40d404]
sub esi, 4
cmp esi, ecx
jb 0x405707
mov eax, dword [esi]
test eax, eax
je 0x405700
call eax
mov ecx, dword [0x40d408]
sub esi, 4
cmp esi, ecx
jae 0x4056f2
push 0x40a018
push 0x40a014
call fcn.00405750
add esp, 8
push 0x40a024
push 0x40a01c
call fcn.00405750
add esp, 8
test ebx, ebx
jne 0x405740
push ebp
mov dword [0x40d054], 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop esi
pop ebp
pop ebx
ret

Function at 0x406090
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x40d180]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentStrings]
push esi
xor esi, esi
xor ebx, ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
test eax, eax
jne 0x4060d2
call edi
mov esi, eax
test esi, esi
je 0x4060bc
mov eax, 1
jmp 0x4060cd
call ebp
mov ebx, eax
test ebx, ebx
je 0x4061df
mov eax, 2
mov dword [0x40d180], eax
cmp eax, 1
jne 0x406172
test esi, esi
jne 0x4060eb
call edi
mov esi, eax
test esi, esi
je 0x4061df
cmp word [esi], 0
mov eax, esi
je 0x406105
add eax, 2
cmp word [eax], 0
jne 0x4060f3
add eax, 2
cmp word [eax], 0
jne 0x4060f3
sub eax, esi
push 0
sar eax, 1
inc eax
push 0
mov ebp, eax
push 0
push 0
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov edi, eax
test edi, edi
je 0x406164
push edi
call fcn.00404a10
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x406164
push 0
push 0
push edi
push ebx
push ebp
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
jne 0x406156
push ebx
call fcn.004049c0
add esp, 4
xor ebx, ebx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x4061df
test ebx, ebx
jne 0x406183
call ebp
mov ebx, eax
test ebx, ebx
je 0x4061df
mov cl, byte [ebx]
mov eax, ebx
test cl, cl
je 0x40619b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40618b
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x40618b
sub eax, ebx
inc eax
mov esi, eax
push esi
call fcn.00404a10
mov ebp, eax
add esp, 4
test ebp, ebp
jne 0x4061bd
push ebx
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x406830
Capabilities:
Write file on windows

Disassembly:
mov ecx, dword [esp + 4]
sub esp, 0x1a8
mov eax, 0x40a9d0
push ebx
push ebp
push esi
push edi
xor ebp, ebp
cmp ecx, dword [eax]
je 0x406854
add eax, 8
inc ebp
cmp eax, 0x40aa60
jb 0x406845
cmp ecx, dword [ebp*8 + 0x40a9d0]
jne 0x4069fb
mov eax, dword [0x40cff8]
cmp eax, 1
je 0x4069bd
test eax, eax
jne 0x406880
cmp dword [0x40a614], 1
je 0x4069bd
cmp ecx, 0xfc
je 0x4069fb
lea eax, [esp + 0xb4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4068bb
mov ecx, 5
mov esi, str._program_name_unknown_
lea edi, [esp + 0xb4]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
xor eax, eax
lea ebx, [esp + 0xb4]
repne scasb al, byte es:[edi]
not ecx
cmp ecx, 0x3c
jbe 0x406904
lea edi, [esp + 0xb4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
push 3
mov ebx, ecx
lea ecx, [esp + 0xb8]
sub ecx, 0x3b
push 0x40852c
add ebx, ecx
push ebx
call fcn.00403db0
add esp, 0xc
mov ecx, 6
mov esi, str.Runtime_Error__n_nProgram:
lea edi, [esp + 0x14]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
or ecx, 0xffffffff
mov edi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x14]
mov ebx, ecx
mov esi, edi
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x14]
and ecx, 3
push 0x12010
rep movsb byte es:[edi], byte [esi]
mov edi, 0x40850c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push str.Microsoft_Visual_C_Runtime_Library
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea edx, [esp + 0x1c]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, dword [ebp*8 + 0x40a9d4]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x1c]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00407920
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
mov eax, dword [0x40d300]
test eax, eax
je 0x4069ce
mov esi, dword [eax + 0x10]
cmp esi, 0xffffffff
jne 0x4069d8
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, eax
mov edx, dword [ebp*8 + 0x40a9d4]
lea ecx, [esp + 0x10]
push 0
push ecx
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1a8
ret
Function at 0x409930
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x464acb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004596d6
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x4099b2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004575ed
mov eax, dword [eax]
push 0x8581c0
push eax
call fcn.0044a454
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00459961
test bl, bl
je 0x4099b2
push 0x8581c0
lea ecx, [esp + 0xc]
call fcn.00459cf1
push 0x85bd2c
lea ecx, [esp + 0xc]
call fcn.00459cf1
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x4099ee
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00459961
jmp 0x409ab9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x409a72
lea edx, [esp + 0x7c]
push 0x85bd28
push edx
call fcn.0044a454
add esp, 8
test eax, eax
je 0x409a72
lea eax, [esp + 0x7c]
push 0x85bd24
push eax
call fcn.0044a454
add esp, 8
test eax, eax
je 0x409a72
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x409a02
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00459961
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40a2b0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40a312
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc