joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad05e01
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4ad05e78
push 0x80000001
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4ad05e57
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4ad05e5c
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
pop esi
leave
ret 4

Function at 0x4ad06744
Capabilities:
Read file on windows

Disassembly:
cmp byte [esi + 1], 0xa
jne 0x4ad067cc
mov eax, dword [ebp - 0xc]
mov byte [esi + 2], bl
sub esi, edi
inc esi
inc esi
push ebx
push ebx
mov dword [ebp - 8], esi
add esi, eax
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4ad067e4
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push 1
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
mov edi, 0x4ad26600
mov esi, edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [ebp - 0xc], eax
mov eax, 0x1fff
cmp dword [ebp + 0x10], eax
jae 0x4ad06814
push ebx
push dword [ebp + 0x14]
mov dword [0x4ad240f0], 1
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x4ad240f0], ebx
cmp eax, ebx
je 0x4ad07236
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp eax, ebx
je 0x4ad07236
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
jle 0x4ad067e4
cmp dword [ebp - 4], 3
jl 0x4ad067cc
mov al, byte [esi]
cmp al, 0xa
je 0x4ad0723d
cmp al, 0xd
je 0x4ad06569
movzx eax, byte [esi]
cmp byte [eax + 0x4ad24e00], bl
jne 0x4ad14150
dec dword [ebp - 4]
inc esi
cmp dword [ebp - 4], ebx
jg 0x4ad067b4
push dword [ebp + 0x10]
mov esi, dword [0x4ad241b0]
push dword [ebp + 0xc]
push dword [ebp - 8]
push edi
push esi
call fcn.4ad0651c
neg eax
sbb eax, eax
neg eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
leave
ret 0x10
mov dword [ebp + 0x10], eax
jmp 0x4ad06776
xor eax, eax
jmp 0x4ad0680d
cmp byte [esi + 1], 0xd
jne 0x4ad067c4
jmp 0x4ad06573
xor eax, eax
inc eax
cmp dword [ebp - 4], eax
je 0x4ad14163
sub dword [ebp - 4], 2
inc esi
inc esi
jmp 0x4ad067df
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
inc esi
push esi
push dword [ebp + 8]
mov dword [0x4ad240f0], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [0x4ad240f0], 1
cmp eax, ebx
je 0x4ad14194
cmp dword [ebp - 4], ebx
je 0x4ad14194
inc dword [ebp - 8]
jmp 0x4ad067e4
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
jmp 0x4ad07236
Function at 0x4ad080a8
Capabilities:
Manipulate console buffer
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
and eax, 0xffff7fff
cmp eax, 2
je 0x4ad144c0
pop ebp
jmp fcn.4ad06744
pop ebp
jmp fcn.4ad1335e

Function at 0x4ad084ee
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x66c
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4ad19dd8
push esi
lea eax, [ebp - 0x668]
push eax
lea eax, [ebp - 0x414]
push eax
push 0x208
push edi
call fcn.4ad01b0c
push eax
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov esi, eax
test esi, esi
je 0x4ad0859b
push 4
lea eax, [ebp - 0x414]
push 0x4ad085b0
push eax
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x4ad19ddf
mov eax, dword [ebp - 0x668]
test eax, eax
je 0x4ad19e3e
cmp word [eax], 0
je 0x4ad19e3e
lea eax, [ebp - 0x66c]
push eax
lea eax, [ebp - 0x664]
push eax
push 0x37
lea eax, [ebp - 0x414]
push eax
call fcn.4ad02e35
push dword [ebp - 0x66c]
movzx esi, al
call fcn.4ad02e7b
test esi, esi
je 0x4ad085c5
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.4ad0139d
leave
ret 4
cmp word [ebp - 0x412], 0x5c
je 0x4ad085ec
cmp word [ebp - 0x412], 0x3a
jne 0x4ad0859b
cmp word [ebp - 0x410], 0x5c
jne 0x4ad0859b
cmp word [ebp - 0x40e], si
jne 0x4ad0859b
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad0859b
jmp 0x4ad19e36
xor eax, eax
jmp 0x4ad0859e
lea eax, [ebp - 0x40c]
push eax
push edi
mov dword [ebp - 0x668], eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
mov dword [ebp - 0x668], eax
test eax, eax
je 0x4ad19e21
cmp eax, edi
jbe 0x4ad19e21
movzx esi, word [eax]
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
mov eax, dword [ebp - 0x668]
mov word [eax], si
mov eax, ecx
jmp 0x4ad19e2a
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc eax
neg eax
sbb eax, eax
and eax, ecx
jmp 0x4ad0859d
xor esi, esi
inc esi
jmp 0x4ad0859b
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
jmp 0x4ad0859b
Function at 0x4ad09aa9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x24
call fcn.4ad0190d
mov esi, eax
push esi
mov dword [esi], edi
call fcn.4ad098bc
mov eax, dword [esi + 0x18]
mov ebx, dword [esi + 0xc]
mov dword [ebp - 0x214], eax
mov eax, dword [esi]
push 0x208
mov dword [ebp - 0x210], eax
call fcn.4ad0190d
push 0
mov edi, 0x104
push edi
push eax
mov dword [0x4ad2411c], eax
call fcn.4ad03a9f
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push edi
push eax
call fcn.4ad02ece
test eax, eax
jne 0x4ad09bdb
movzx eax, word [0x4ad40620]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01b5c
xor ecx, ecx
mov word [eax + 2], cx
lea eax, [ebp - 0x20c]
push eax
push edi
push 0x4ad25220
call fcn.4ad017fb
test ebx, ebx
je 0x4ad09bb9
movzx eax, word [ebx]
cmp ax, 0x3a
je 0x4ad09bb9
cmp ax, word [0x4ad40620]
jne 0x4ad09b89
cmp ebx, dword [ebp - 0x210]
je 0x4ad09be0
push ebx
push dword [ebp - 0x210]
call fcn.4ad09be9
movzx eax, word [eax]
cmp ax, 0x3a
je 0x4ad09be0
cmp ax, word [0x4ad40620]
je 0x4ad09be0
movzx edi, word [ebx]
push dword [ebp - 0x210]
xor eax, eax
mov word [ebx], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad19736
and dword [0x4ad24120], 0
mov word [ebx], di
cmp dword [0x4ad24120], 0
jne 0x4ad09bdb
push esi
call fcn.4ad098bc
mov eax, dword [ebp - 0x214]
mov dword [esi + 0x18], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad0139d
leave
ret 4
xor eax, eax
inc eax
jmp 0x4ad09bca
inc ebx
inc ebx
jmp 0x4ad09b89
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad24120], eax
jmp 0x4ad09bad
Function at 0x4ad0b2fd
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
push ebx
push esi
push edi
push 2
pop esi
jne 0x4ad0b313
push 3
pop esi
mov ebx, dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
and dword [ebx], 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4ad15af0
xor eax, eax
inc eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ad15b37
push 0x400023d4
push 0x400023d3
push dword [ebp + 0xc]
call fcn.4ad1fc1f
sub eax, 0
je 0x4ad15b2f
dec eax
dec eax
jne 0x4ad15b1e
mov eax, dword [ebp + 0x10]
and dword [eax], 0
or esi, 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
jmp 0x4ad0b333
xor eax, eax
inc eax
jmp 0x4ad0b335
xor eax, eax
jmp 0x4ad0b335
Function at 0x4ad0b422
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x224]
xor esi, esi
push eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
call fcn.4ad0b579
test eax, eax
jne 0x4ad136ce
cmp dword [ebp - 0x224], esi
je 0x4ad136ce
xor ebx, ebx
inc ebx
push 0x40002748
mov dword [ebp - 0x218], ebx
call fcn.4ad0b696
pop ecx
mov dword [ebp - 0x214], eax
cmp eax, esi
je 0x4ad15dc0
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4ad0b490
sub eax, edx
sar eax, 1
mov esi, 0x104
mov dword [ebp - 0x21c], eax
cmp eax, esi
jae 0x4ad0b53b
push 0x208
call fcn.4ad018b8
mov dword [ebp - 0x210], eax
test eax, eax
je 0x4ad0b53b
push dword [ebp - 0x214]
mov dword [ebp - 0x220], ebx
push esi
push eax
call fcn.4ad017fb
test edi, edi
je 0x4ad13255
mov edi, dword [edi + 0x3c]
test edi, edi
je 0x4ad15dab
push edi
push esi
push dword [ebp - 0x210]
call fcn.4ad01a89
test eax, eax
jne 0x4ad0b527
xor esi, esi
cmp dword [ebp - 0x210], esi
je 0x4ad0b519
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov byte [0x4ad24083], 0
mov dword [ebp - 0x218], esi
cmp dword [ebp - 0x220], esi
je 0x4ad0b53b
cmp dword [ebp - 0x210], 0
je 0x4ad0b53b
push dword [ebp - 0x210]
call fcn.4ad013cf
xor esi, esi
cmp dword [ebp - 0x214], esi
je 0x4ad0b551
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x218], esi
jne 0x4ad15dc0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad0139d
leave
ret 4
lea ebx, [ebp - 0x20c]
push esi
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
test eax, eax
je 0x4ad0b527
push dword [ebp - 0x214]
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
mov eax, ebx
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4ad15d82
push ebx
push esi
push dword [ebp - 0x210]
call fcn.4ad01a89
test eax, eax
je 0x4ad0b4fc
jmp 0x4ad0b527
mov dword [ebp - 0x210], esi
jmp 0x4ad0b4fc
cmp edi, esi
je 0x4ad132a2
push esi
push dword [edi + 0x3c]
call fcn.4ad02b03
mov dword [ebp - 0x210], eax
cmp eax, esi
je 0x4ad0b519
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4ad136f0
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x4ad0b4fc
jmp 0x4ad15db6
mov eax, dword [ebp - 0x21c]
add eax, eax
mov dword [ebp - 0x21c], eax
add ebx, dword [ebp - 0x21c]
push dword [ebp - 0x214]
push ebx
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad13288
jmp 0x4ad15d90
and dword [ebp - 0x218], edi
jmp 0x4ad0b527
mov dword [ebp - 0x218], 1
push esi
push 8
call fcn.4ad0ab8b
pop ecx
pop ecx
jmp 0x4ad0b55d
Function at 0x4ad104f8
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3d
pop eax
mov word [ebp - 0xc], ax
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0xa], ax
push 0x3a
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call fcn.4ad01931
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
test edi, edi
je 0x4ad19bd3
push edi
call esi
test al, al
je 0x4ad19bc9
push 0
push 0x104
push 0x4ad25220
call fcn.4ad03a9f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad0139d
leave
ret 4
push 1
call ebx
mov dword [ebp - 0x218], eax
mov ax, word [ebp - 0xa]
mov word [ebp - 0x214], ax
mov ax, word [ebp - 8]
mov word [ebp - 0x212], ax
mov ax, word [0x4ad40620]
mov word [ebp - 0x210], ax
xor eax, eax
mov word [ebp - 0x20e], ax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.4ad01730
lea eax, [ebp - 0x214]
push eax
call esi
test eax, eax
jne 0x4ad19c2b
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad0ab8b
pop ecx
pop ecx
test edi, edi
je 0x4ad10558
push dword [ebp - 0x218]
call ebx
jmp 0x4ad10558

Function at 0x4ad10de4
Capabilities:
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
push edi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
mov dword [0x4ad24118], edi
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4ad18851
mov edx, dword [esi]
cmp edx, edi
je 0x4ad18804
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx + 0x1c]
test eax, 0xc000
jne 0x4ad10e57
cmp edx, 2
jb 0x4ad10e4f
mov edi, dword [ebp + 0xc]
mov edx, 0xfeff
cmp word [edi], dx
je 0x4ad18824
or eax, 0x8000
mov dword [ecx + 0x1c], eax
mov ecx, dword [ecx + 0x1c]
mov eax, 0x8002
xor ebx, ebx
and ecx, eax
inc ebx
cmp ecx, eax
je 0x4ad1882e
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x1c
call ebx
cmp eax, 0x3e3
je 0x4ad18851
mov edx, dword [esi]
cmp edx, edi
jne 0x4ad10e2c
mov dword [0x4ad24120], edi
xor eax, eax
jmp 0x4ad10e6e
or eax, 0x4000
jmp 0x4ad10e54
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push ebx
call fcn.4ad1e0c4
cmp edi, dword [esi]
je 0x4ad10e6c
mov dword [0x4ad24118], ebx
jmp 0x4ad10e6c
call ebx
push dword [ebp + 8]
mov dword [0x4ad24120], eax
call fcn.4ad03b88
push dword [ebp + 0x1c]
call fcn.4ad03bd3
push dword [ebp + 0x1c]
test eax, eax
jne 0x4ad1887f
call fcn.4ad03b88
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4ad18884
call fcn.4ad03b88
push 1
push dword [0x4ad24120]
call fcn.4ad1efd3
int3
Function at 0x4ad1136a
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x20]
mov dword [ebp - 4], 0x1a
test eax, eax
je 0x4ad187d4
push esi
push edi
push eax
call fcn.4ad113f3
mov edi, dword [ebp + 0x10]
mov esi, dword [sym.imp.msvcrt.dll__get_osfhandle]
test eax, eax
jne 0x4ad187db
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ad113dc
test byte [eax + 0x1c], 0x80
jne 0x4ad113dc
push edi
call fcn.4ad03bd3
test eax, eax
jne 0x4ad113dc
mov eax, dword [0x4ad24160]
cmp eax, 3
je 0x4ad113dc
cmp dword [ebp + 0x14], 0
je 0x4ad113dc
cmp eax, 2
je 0x4ad113dc
push dword [ebp + 0x14]
push 0
push 0
push edi
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call fcn.4ad03b88
inc dword [0x4ad2415c]
pop edi
pop esi
leave
ret 0x10
mov eax, ecx
jmp 0x4ad11385
push edi
call fcn.4ad03bd3
test eax, eax
jne 0x4ad1139e
push eax
lea eax, [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
push edi
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad1139e
Function at 0x4ad12062
Capabilities:
Get disk information

Disassembly:
xor eax, eax
mov word [ebp - 0x20e], ax
jmp 0x4ad1212e
cmp dword [ebp - 0x82c], ebx
jne 0x4ad12170
jmp 0x4ad121aa
lea eax, [ebp - 0x210]
push eax
push 1
push 0x235e
push dword [ebp - 0x828]
call fcn.4ad12236
add esp, 0x10
jmp 0x4ad1215e
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x828], eax
mov eax, dword [ebp + 0xc]
push eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x418]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x418]
lea edx, [eax + 2]
xor ebx, ebx
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4ad120a4
sub eax, edx
sar eax, 1
mov esi, 0x106
push esi
lea ecx, [ebp - 0x210]
push ecx
inc eax
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.4ad0a4f4
test al, al
je 0x4ad1a9fe
push 0x4ad02db4
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4ad01a89
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x830]
push eax
push edi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad1aa05
cmp word [ebp - 0x210], 0x5c
jne 0x4ad11f51
lea eax, [ebp - 0x210]
push eax
call fcn.4ad02d9a
xor ecx, ecx
mov word [eax], cx
cmp word [ebp - 0x624], bx
je 0x4ad11f70
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
push 2
push 0x235f
push dword [ebp - 0x828]
call fcn.4ad12236
add esp, 0x14
cmp eax, ebx
jne 0x4ad121aa
mov ecx, dword [ebp - 0x830]
cmp ecx, ebx
je 0x4ad11f5f
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._04X__04X
lea eax, [ebp - 0x824]
push 0x100
push eax
call fcn.4ad01799
lea eax, [ebp - 0x824]
push eax
push 1
push 0x235b
push dword [ebp - 0x828]
call fcn.4ad12236
add esp, 0x24
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad0139d
leave
ret 8
xor eax, eax
jmp 0x4ad121aa
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x90
je 0x4ad1a9fe
push ebx
call esi
push eax
call fcn.4ad0ab8b
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4ad121aa
Function at 0x4ad12ce7
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.4ad0d06f
push esi
mov esi, 0x106
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4ad017fb
lea eax, [ebp - 0x210]
push eax
call fcn.4ad12dc7
test eax, eax
jne 0x4ad1ab0e
and dword [ebp - 0x214], 0
and dword [ebp - 0x218], 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 6
push edi
call fcn.4ad122bd
push esi
lea eax, [ebp - 0x210]
push eax
push 0xe
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0x10]
call fcn.4ad1236d
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x14]
push 0x4ad12db8
call fcn.4ad0a0e1
push eax
push 2
push 0x2379
push edi
call fcn.4ad12236
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
xor ecx, ebp
pop esi
call fcn.4ad0139d
leave
ret 0x10
push 0x4ad02db4
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4ad01a89
jmp 0x4ad12d31
Function at 0x4ad1cbe8
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
push 0x4ad1ccc0
call fcn.4ad02210
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x4ad1cc27
cmp word [eax], si
je 0x4ad1cc27
lea edx, [ebp - 0x1c]
push edx
push 1
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x4ad1cc27
push eax
jmp 0x4ad1cc8a
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
call edi
cmp eax, 2
jne 0x4ad1cc51
push 0x4ad03c0c
call fcn.4ad01b82
mov dword [ebp - 0x20], eax
jmp 0x4ad1cc90
cmp eax, esi
jne 0x4ad1cc24
push dword [ebp - 0x24]
call fcn.4ad018b8
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, esi
je 0x4ad1cc88
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push dword [ebp - 0x1c]
call edi
mov edi, eax
cmp edi, esi
je 0x4ad1cc90
push ebx
call fcn.4ad013cf
mov dword [ebp - 0x20], esi
push edi
jmp 0x4ad1cc8a
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
call fcn.4ad1ccac
mov eax, dword [ebp - 0x20]
call fcn.4ad013aa
ret 8
Function at 0x4ad1cce1
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x214], esi
cmp eax, ebx
jne 0x4ad1cdcd
mov dword [ebp - 0x210], ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
cmp esi, ebx
jne 0x4ad1cda6
cmp word [ebp - 0x20c], 0x2e
jne 0x4ad1cd8b
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.4ad1cbe8
mov edi, eax
cmp edi, ebx
je 0x4ad1cdb9
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4ad1cd5e
sub eax, edx
sar eax, 1
je 0x4ad1cd85
push edi
lea eax, [ebp - 0x20c]
push eax
push str._s_s_r_n
call fcn.4ad0735f
add esp, 0xc
mov esi, eax
push edi
call fcn.4ad013cf
cmp dword [0x4ad241ac], ebx
jne 0x4ad1cdc8
inc dword [ebp - 0x210]
cmp esi, ebx
jne 0x4ad1ce3f
jmp 0x4ad1cd15
cmp esi, 0x103
jne 0x4ad1ce3f
xor esi, esi
jmp 0x4ad1ce3f
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad0ab8b
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x4ad1ce41
push ebx
push eax
call fcn.4ad02b03
push eax
call fcn.4ad01b82
mov edi, eax
cmp edi, ebx
je 0x4ad1cdc8
push 0x20
push edi
call fcn.4ad01b5c
cmp eax, ebx
je 0x4ad1cdf1
xor ecx, ecx
mov word [eax], cx
push edi
push esi
call fcn.4ad1cbe8
mov ebx, eax
test ebx, ebx
je 0x4ad1ce21
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1ce01
sub eax, edx
sar eax, 1
je 0x4ad1ce21
push ebx
push edi
push str._s_s_r_n
call fcn.4ad0735f
mov esi, eax
jmp 0x4ad1ce30
xor esi, esi
push edi
inc esi
push esi
push 0x400023a3
call fcn.4ad0ab8b
add esp, 0xc
push ebx
call fcn.4ad013cf
push edi
call fcn.4ad013cf
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad0139d
leave
ret 8
Function at 0x4ad1ce57
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push 0xc
push 0x4ad1cf80
call fcn.4ad02210
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp edi, esi
je 0x4ad1cece
cmp word [edi], si
je 0x4ad1cece
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4ad1ce76
sub eax, edx
sar eax, 1
push eax
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
jne 0x4ad1ceb3
push edi
push dword [ebp + 0xc]
push str._s_s_r_n
call fcn.4ad0735f
add esp, 0xc
jmp 0x4ad1cf3d
push esi
push ebx
call fcn.4ad0ab8b
push dword [ebp + 0xc]
push 1
push 0x235d
call fcn.4ad0ab8b
add esp, 0x14
jmp 0x4ad1cf3d
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegDeleteKeyExW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
je 0x4ad1cf41
lea eax, [ebp + 0xc]
push eax
push 0x2000000
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
je 0x4ad1cf14
cmp ebx, 2
je 0x4ad1cf3d
push esi
push ebx
call fcn.4ad0ab8b
pop ecx
pop ecx
jmp 0x4ad1cf3d
push 0x4ad03c0c
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegDeleteValueW]
mov ebx, eax
mov dword [ebp + 0x10], eax
cmp ebx, esi
je 0x4ad1cf34
push esi
push ebx
call fcn.4ad0ab8b
pop ecx
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
cmp ebx, esi
jne 0x4ad1cf71
mov dword [ebp - 4], esi
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x4ad1cf6a
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 0x10]
call fcn.4ad013aa
ret 0xc