joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401622
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x674
push ebx
push esi
push edi
push dword [ebp + 0xc]
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x417950
lea eax, [ebp - 0x670]
push eax
call ebx
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x670]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x401675
xor al, al
jmp 0x4017e1
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push 0
call esi
push 0xa
call esi
push 0
call esi
push dword [ebp + 0xc]
lea eax, [ebp - 0x468]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x4173d8
lea eax, [ebp - 0x468]
push eax
call ebx
lea eax, [ebp - 0x234]
push eax
lea eax, [ebp - 0x468]
push eax
call ebx
test byte [ebp - 0x260], 0x10
jne 0x401759
push dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
lea edi, [ebp - 0x10]
lea eax, [ebp - 0x260]
call fcn.00401547
test al, al
je 0x4017b6
mov eax, dword [ebp + 8]
mov edi, dword [eax + 4]
call fcn.0040d04d
push eax
mov dword [ebp - 8], eax
call fcn.0040c915
push eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x468]
push eax
push 0x70941102
push dword [ebp - 8]
lea ecx, [ebp - 0x260]
call fcn.0040bb6f
push edi
push 0x408dd3
push dword [ebp - 0xc]
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x468]
push eax
push 0x70941101
push dword [ebp - 8]
call fcn.0040ba83
test al, al
je 0x4017b6
push 0
call fcn.0040d04d
push eax
lea edi, [ebp - 0x468]
call fcn.0040b696
push 0xa
call esi
push 0
call esi
jmp 0x4017b6
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x417958
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x4017be
push 0x41795c
lea eax, [ebp - 0x234]
push eax
call edi
test eax, eax
je 0x4017be
lea eax, [ebp - 0x468]
push 0x4201b4
push eax
call fcn.00401372
pop ecx
pop ecx
test al, al
jne 0x4017b6
call fcn.0040d04d
lea edi, [ebp - 0x468]
call fcn.0040c2d5
mov ecx, dword [ebp + 8]
push eax
add ecx, 0x18
call fcn.0040a9cd
push 0xa
call esi
push 0
call esi
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x401683
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x4018bc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x41490a
push eax
mov dword fs:[0], esp
sub esp, 0x268
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
lea eax, [esp + 0x1c]
push eax
mov ebx, ecx
mov eax, dword [ebx + 4]
push edi
push edi
add eax, 0x90
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
jne 0x401915
mov eax, dword [ebx + 4]
movzx eax, word [eax + 0x90]
sub eax, 0x41
mov dword [esp + 0xc], eax
jmp 0x401919
mov eax, dword [esp + 0xc]
push eax
call fcn.0040d04d
push eax
mov eax, 0x70941101
lea ecx, [esp + 0x18]
call fcn.00409d89
mov dword [esp + 0x27c], edi
mov eax, dword [ebx + 4]
cmp dword [eax], edi
jne 0x4019d8
call fcn.004017e8
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + 4]
shr eax, 2
xor esi, esi
test eax, eax
jle 0x401989
mov eax, dword [ebx + 0x28]
mov eax, dword [eax]
push dword [eax + esi*4]
push ebx
call fcn.00401622
mov eax, dword [ebx + 4]
cmp dword [eax], edi
jne 0x401979
mov eax, dword [ebx + 0x28]
mov eax, dword [eax + 4]
inc esi
shr eax, 2
cmp esi, eax
jl 0x401954
jmp 0x401989
mov eax, dword [ebx + 0x2c]
call fcn.0040a633
mov eax, dword [ebx + 0x28]
call fcn.0040a633
cmp dword [ebx + 0x1c], edi
je 0x4019b0
mov eax, dword [ebx + 0x2c]
mov ecx, dword [ebx + 0x28]
mov dword [ebx + 0x28], eax
mov eax, ecx
mov dword [ebx + 0x2c], ecx
call fcn.0040a633
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push edi
call esi
jmp 0x401945
xor esi, esi
mov eax, dword [ebx + 4]
cmp dword [eax], edi
jne 0x401935
call fcn.0040d04d
push eax
push 5
pop eax
call fcn.0040c8be
add esi, 5
cmp esi, 0x78
jl 0x4019b2
jmp 0x401935
or dword [esp + 0x27c], 0xffffffff
lea eax, [esp + 0x10]
call fcn.00409b45
mov ecx, dword [esp + 0x274]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x40514c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41ba98]
jne 0x405156
repz ret
jmp fcn.0040632a
Function at 0x405bdf
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41ba98]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004034fc
and dword [ebp - 0x14], 0
cmp dword [0x41e06c], 0
mov dword [ebp - 0x18], eax
jne 0x405c92
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405d3a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405d3a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41e06c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41e070], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41e074], eax
call edi
push eax
call esi
mov dword [0x41e07c], eax
test eax, eax
je 0x405c92
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41e078], eax
mov eax, dword [0x41e078]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405ceb
cmp dword [0x41e07c], ecx
je 0x405ceb
push eax
call esi
push dword [0x41e07c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405ceb
test ebx, ebx
je 0x405ceb
call edi
test eax, eax
je 0x405ce2
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405ce2
test byte [ebp - 8], 1
jne 0x405ceb
or dword [ebp + 0x10], 0x200000
jmp 0x405d1e
mov eax, dword [0x41e070]
cmp eax, dword [ebp - 0x18]
je 0x405d1e
push eax
call esi
test eax, eax
je 0x405d1e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405d1e
mov eax, dword [0x41e074]
cmp eax, dword [ebp - 0x18]
je 0x405d1e
push eax
call esi
test eax, eax
je 0x405d1e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41e06c]
call esi
test eax, eax
je 0x405d3a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405d3c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040514c
leave
ret

Function at 0x407395
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
mov esi, 0x41bb40
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
movzx eax, word [esi]
push 2
pop edi
push eax
push 0x41812c
push ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x18], 7
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
add esp, 0xc
push 4
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
test eax, eax
je 0x40740d
add esi, edi
cmp esi, 0x41bb6e
jl 0x4073a2
xor al, al
pop edi
pop esi
leave
ret
mov al, 1
jmp 0x407409
Function at 0x407d07
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push esi
push edi
xor esi, esi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
movzx eax, word [esi + str.ZXVNMSDFGHJKLQWERTYUIOP]
push 2
pop edi
push eax
push 0x41812c
push ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x1c], 9
mov dword [ebp - 0x18], 7
call dword [sym.imp.USER32.dll_wsprintfW]
mov eax, dword [ebp + 8]
and dword [ebp - 8], 0
add esp, 0xc
push 4
push dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0x14], ebx
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
test eax, eax
je 0x407d86
push 1
push ebx
call dword [sym.imp.MPR.dll_WNetCancelConnectionW]
add esi, edi
cmp esi, 0x30
jb 0x407d11
xor al, al
pop edi
pop esi
leave
ret
mov al, 1
jmp 0x407d82

Function at 0x4081ee
Capabilities:
Modify service
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
cmp edi, esi
jne 0x40820c
xor eax, eax
jmp 0x40822d
push ebx
push 0x14
push str.Schedule
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
call edi
cmp ebx, esi
jne 0x408231
xor eax, eax
pop ebx
pop edi
pop esi
leave
ret
lea eax, [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x408247
push ebx
call edi
mov eax, esi
jmp 0x40822c
cmp dword [ebp - 0x18], 4
jne 0x408252
xor esi, esi
inc esi
jmp 0x408240
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push esi
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x40824d
jmp 0x408240
Function at 0x408da0
Capabilities:
Check if file exists
Check mutex on windows

Disassembly:
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [esp + 8]
push 0
push 0x1f0001
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x408dcf
test esi, esi
je 0x408dcf
mov al, 1
pop esi
ret
xor al, al
pop esi
ret

Function at 0x40913e
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push dword [ebp + 8]
mov eax, esi
call fcn.00408e28
pop ecx
call fcn.0040d04d
xor ebx, ebx
cmp dword [0x41ffa4], ebx
jne 0x409195
call fcn.00401270
cmp al, bl
jne 0x409195
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push ebx
push eax
push 0x408fe6
push 0x10000
push ebx
mov dword [eax], esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, ebx
je 0x409192
cmp eax, 0xffffffff
je 0x409192
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
leave
ret
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push 8
push 8
push dword [0x41ffa4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
jne 0x409169
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4091b8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x417e88]
push esi
push edi
mov dword [ebp - 0x10], eax
mov eax, dword [0x417e8c]
mov dword [ebp - 0xc], eax
xor eax, eax
lea edi, [ebp - 8]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0xd
pop ecx
mov esi, str.PZYDXKIHGFEWVUTSRQONMLJCAB
lea edi, [ebp - 0x48]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor edi, edi
movzx esi, word [ebp + edi*2 - 0x48]
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
jne 0x409235
lea eax, [ebp - 0x10]
push eax
call fcn.00408d26
pop ecx
test al, al
je 0x409235
lea eax, [ebp - 0x10]
push eax
add esi, 0xffffffbf
mov eax, esi
imul eax, eax, 0xa0
add eax, 0x41ea78
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push dword [0x41e9e4]
call fcn.0040913e
pop ecx
inc edi
cmp edi, 0x18
jb 0x4091e8
pop edi
pop esi
leave
ret
Function at 0x40953e
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x414652
call fcn.004104dc
sub esp, 0x270
push ebx
push esi
push edi
lea esi, [ebp - 0x2c]
call fcn.0040a5df
mov dword [ebp - 4], 1
mov esi, str.C:URGENT
push esi
mov byte [0x41e9d0], 1
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x4095e9
call fcn.0040d04d
lea eax, [ebp - 0x2c]
push eax
push esi
call fcn.00401490
mov esi, dword [ebp - 0x28]
shr esi, 2
xor ebx, ebx
test esi, esi
jle 0x4095e9
mov eax, dword [ebp - 0x2c]
push 0x104
lea ecx, [ebp - 0x27c]
lea eax, [eax + ebx*4]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x4095e4
lea eax, [ebp - 0x27c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x4095e4
call fcn.0040d04d
lea edi, [ebp - 0x27c]
call fcn.0040c2d5
mov ecx, dword [0x41e9c8]
push eax
call fcn.0040a9cd
mov byte [0x41e9d0], 0
inc ebx
cmp ebx, esi
jl 0x409592
cmp byte [0x41e9d0], 0
je 0x4096bc
lea esi, [ebp - 0x3c]
call fcn.0040a5df
mov byte [ebp - 4], 3
call fcn.0040d04d
mov eax, esi
push eax
push 0x4179f4
call fcn.00401490
mov esi, dword [ebp - 0x38]
shr esi, 2
xor ebx, ebx
test esi, esi
jle 0x40965f
mov eax, dword [ebp - 0x3c]
push 0x104
lea ecx, [ebp - 0x27c]
lea eax, [eax + ebx*4]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x40965a
call fcn.0040d04d
lea edi, [ebp - 0x27c]
call fcn.0040c2d5
mov ecx, dword [0x41e9c8]
push eax
call fcn.0040a9cd
inc ebx
cmp ebx, esi
jl 0x409620
mov eax, dword [0x417c00]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x417c04]
mov dword [ebp - 0x18], eax
xor eax, eax
lea edi, [ebp - 0x14]
stosw word es:[edi], ax
push 0xc
pop ecx
mov esi, str.PZYDXKIHGFEWVUTSRQONMLJC
lea edi, [ebp - 0x70]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
mov ax, word [ebp + esi*2 - 0x70]
mov word [ebp - 0x1c], ax
call fcn.0040d04d
lea edi, [ebp - 0x1c]
call fcn.0040c2d5
mov ecx, dword [0x41e9c8]
push eax
call fcn.0040a9cd
inc esi
cmp esi, 0x18
jb 0x409687
mov byte [ebp - 4], 1
lea eax, [ebp - 0x3c]
push eax
call fcn.004012b0
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.004012b0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4096d8
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
push dword [ebp + 8]
mov ebx, eax
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x4173d8
lea eax, [ebp - 0x214]
push eax
call esi
lea edi, [ebx + 0x2c]
push edi
lea eax, [ebp - 0x214]
push eax
call esi
test byte [ebx], 0x10
jne 0x40977f
cmp byte [0x41e9d0], 0
jne 0x40987a
call fcn.0040d04d
push dword [ebp + 8]
lea edi, [ebp - 8]
mov eax, ebx
call fcn.004013cd
pop ecx
test al, al
je 0x40987a
push 0
push 0
push ebx
lea eax, [ebp - 0x214]
push eax
push 0x70243102
push 0x70243101
call fcn.0040d04d
push eax
call fcn.0040bcf6
test al, al
je 0x40987a
lea eax, [ebp - 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40987a
mov esi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
push 0x417958
push edi
call esi
test eax, eax
je 0x40987a
push 0x41795c
push edi
call esi
test eax, eax
je 0x40987a
cmp byte [0x41e9d0], 0
je 0x409834
lea eax, [ebp - 0x214]
push 0x420044
push eax
call fcn.00401372
pop ecx
pop ecx
test al, al
jne 0x409834
push dword [ebp + 8]
mov eax, ebx
call fcn.004012e0
pop ecx
mov esi, eax
call fcn.0040d04d
push esi
mov eax, 0x420180
call fcn.0040d9d0
mov ecx, dword [0x420180]
cmp dword [ecx + eax*4], esi
je 0x409834
call fcn.0040d04d
push eax
call fcn.0040c915
push eax
lea eax, [ebp - 0x214]
push eax
push 0x70243102
call fcn.0040d04d
push eax
mov ecx, ebx
call fcn.0040bb6f
test al, al
je 0x409834
call fcn.0040d04d
mov ebx, esi
call fcn.0040da09
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
call esi
push 0
call esi
call fcn.0040d04d
lea edi, [ebp - 0x214]
call fcn.0040c2d5
mov ecx, dword [0x41e9d4]
push eax
call fcn.0040a9cd
call fcn.0040d04d
call fcn.0040c55b
mov esi, eax
sub eax, dword [0x41e9d8]
cmp eax, 0x12c
jbe 0x40987a
mov ecx, dword [0x41e9dc]
call fcn.00409ec6
mov dword [0x41e9d8], esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40987f
Capabilities:
Enumerate files on windows
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x45c
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
je 0x4098aa
cmp eax, 4
je 0x4098aa
cmp eax, 3
je 0x4098aa
test eax, eax
je 0x4098aa
xor al, al
jmp 0x409927
push dword [ebp + 8]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x417950
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0xa
mov edi, eax
call esi
push 0
call esi
cmp edi, 0xffffffff
je 0x4098a6
push dword [ebp + 8]
lea eax, [ebp - 0x45c]
call fcn.004096d8
pop ecx
push 0xa
call esi
push 0
call esi
lea eax, [ebp - 0x45c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4098f5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov al, 1
pop edi
pop esi
leave
ret
Function at 0x409b78
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [esi + 0x48]
sub esp, 0x20
push ebx
xor ecx, ecx
sub eax, ecx
push edi
mov edi, dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
je 0x409b9e
dec eax
je 0x409bb0
dec eax
je 0x409bc2
dec eax
je 0x409bd2
xor al, al
pop edi
pop ebx
leave
ret
lea ebx, [esi + 0x4c]
push ebx
push 1
push ecx
push 0x2e
push ecx
call edi
test eax, eax
je 0x409be5
xor ecx, ecx
lea ebx, [esi + 0x4c]
push ebx
push 1
push ecx
push 0x23
push ecx
call edi
test eax, eax
je 0x409be5
xor ecx, ecx
lea ebx, [esi + 0x4c]
push ebx
push 1
push ecx
push 0x2d
push ecx
call edi
test eax, eax
je 0x409be5
lea ebx, [esi + 0x4c]
push ebx
push 0x208
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x409b98
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatW]
inc dword [esi + 0x48]
push 0x4173d8
push ebx
call edi
push str.ntuser4CB46D7F_7EEE_4906_8698_
push ebx
call edi
push dword [esi + 0x44]
lea eax, [ebp - 0x20]
push dword [esi + 0x40]
push 0x4177f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
call edi
mov eax, dword [esi + 0x40]
mov edx, dword [esi + 0x44]
mov cl, 0x20
call fcn.0040fff0
push edx
push eax
lea eax, [ebp - 0x20]
push 0x4177f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x20]
push eax
push ebx
call edi
push str..pol
push ebx
call edi
mov al, 1
jmp 0x409b9a

Function at 0x409f83
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0xc]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 0x20006
push esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x409fb2
xor al, al
jmp 0x409fec
cmp dword [ebp + 0x18], esi
je 0x409fe1
cmp dword [ebp + 0x1c], esi
je 0x409fe1
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
je 0x409fe4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x409fae
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
pop esi
leave
ret 0x18
Function at 0x409ff1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 4]
push eax
push 1
xor edi, edi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
push 0x80000001
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], 3
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a024
xor al, al
jmp 0x40a09e
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push str.SerialIID
push dword [ebp - 4]
call ebx
test eax, eax
je 0x40a048
push dword [ebp - 4]
jmp 0x40a071
mov eax, dword [ebp - 8]
cmp dword [esi], eax
jb 0x40a08c
cmp dword [ebp + 0xc], edi
je 0x40a08c
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push eax
push edi
push str.SerialIID
push dword [ebp - 4]
call ebx
push dword [ebp - 4]
test eax, eax
je 0x40a07d
mov dword [esi], edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
jmp 0x40a09d
mov eax, dword [ebp - 8]
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x40a09d
push dword [ebp - 4]
mov dword [esi], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0xc], edi
sete al
pop ebx
pop edi
leave
ret 8

Function at 0x40a263
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push edi
cmp eax, ebx
jg 0x40a279
xor al, al
jmp 0x40a39f
add eax, dword [esi + 4]
cmp dword [esi + 8], eax
jg 0x40a391
add eax, 0x2000
cdq
and edx, 0xf
add eax, edx
mov edi, eax
sar edi, 4
inc edi
shl edi, 4
mov dword [ebp - 4], edi
cmp dword [esi], ebx
jne 0x40a30b
call fcn.0040d04d
cmp edi, ebx
jl 0x40a2f4
cmp edi, 0x6400000
jg 0x40a2f4
cmp edi, ebx
jne 0x40a2bc
mov dword [ebp - 4], 1
add dword [ebp - 4], 4
cmp dword [0x41ffa4], ebx
jne 0x40a2d1
call fcn.00401270
test al, al
je 0x40a2f4
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 4]
push 8
push dword [0x41ffa4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
jne 0x40a2f6
push ebx
call dword [sym.imp.KERNEL32.dll_ExitProcess]
xor eax, eax
mov dword [esi], eax
mov dword [esi + 4], ebx
cmp eax, ebx
jne 0x40a38e
mov dword [esi + 8], ebx
jmp 0x40a272
call fcn.0040d04d
cmp edi, ebx
jl 0x40a35e
cmp edi, 0x6400000
jg 0x40a35e
cmp edi, ebx
jne 0x40a327
mov dword [ebp - 4], 1
add dword [ebp - 4], 4
cmp dword [0x41ffa4], ebx
jne 0x40a340
call fcn.00401270
test al, al
je 0x40a272
push ebx
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp - 4]
push 8
push dword [0x41ffa4]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
cmp eax, ebx
je 0x40a2ed
mov ebx, eax
test ebx, ebx
je 0x40a272
push dword [esi + 4]
push dword [esi]
push ebx
call fcn.00401ab0
mov eax, dword [esi]
add esp, 0xc
mov dword [ebp - 4], eax
call fcn.0040d04d
cmp dword [ebp - 4], 0
je 0x40a38c
push dword [ebp - 4]
call fcn.0040e8d8
mov dword [esi], ebx
mov dword [esi + 8], edi
cmp byte [ebp + 0xc], 0
je 0x40a39d
mov eax, dword [ebp + 8]
add dword [esi + 4], eax
mov al, 1
pop edi
pop ebx
leave
ret 8