joyce8/EMBER2024-capa huggingface dataset:
Function at 0x425bdc
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x274
mov eax, dword [0x48dc38]
xor eax, esp
mov dword [esp + 0x270], eax
or dword [esp + 8], 0xffffffff
xor ecx, ecx
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x18], ecx
push esi
mov esi, ecx
mov dword [esp + 0xc], esi
push edi
mov edi, ecx
mov dword [esp + 0xc], edi
test ebx, ebx
jne 0x425c3a
mov eax, 0x80070057
push eax
mov ebx, eax
call fcn.004314fa
jmp 0x425da5
test eax, eax
je 0x425c28
push 0x250
push ecx
lea eax, [esp + 0x30]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [esp + 0xc]
push eax
push 0
push 0x407388
push ebx
call fcn.004307e7
mov ebx, eax
test ebx, ebx
js 0x425d9b
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x10]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push eax
lea ecx, [esp + 0x18]
call fcn.0041a4f2
mov edi, dword [esp + 0x14]
test edi, edi
je 0x425d8d
cmp edi, 0xffffffff
je 0x425d8d
mov ecx, 0x407390
lea eax, [esp + 0x54]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x425cca
test dx, dx
je 0x425cc6
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x425cca
add eax, 4
add ecx, 4
test dx, dx
jne 0x425ca4
xor eax, eax
jmp 0x425ccf
sbb eax, eax
or eax, 1
test eax, eax
je 0x425d52
mov ecx, 0x406f00
lea eax, [esp + 0x54]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x425d02
test dx, dx
je 0x425cfe
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x425d02
add eax, 4
add ecx, 4
test dx, dx
jne 0x425cdc
xor eax, eax
jmp 0x425d07
sbb eax, eax
or eax, 1
test eax, eax
je 0x425d52
test byte [esp + 0x28], 0x10
je 0x425d52
test esi, esi
je 0x425d21
push esi
call fcn.00431523
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x58]
push eax
call fcn.0043163c
mov ebx, eax
test ebx, ebx
js 0x425d81
lea eax, [esp + 0x10]
push eax
push dword [esp + 0x20]
lea ecx, [esp + 0x20]
call fcn.00433a31
mov ebx, eax
test ebx, ebx
js 0x425d81
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x28]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x425c9b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x425d8d
mov ecx, dword [esp + 0x24]
lea eax, [esp + 0x18]
push eax
call fcn.004306a4
jmp 0x425da1
push ebx
call fcn.004314fa
mov esi, dword [esp + 0x10]
jmp 0x425da1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov ebx, eax
push ebx
call fcn.004314fa
mov edi, dword [esp + 0xc]
push ebx
call fcn.00431467
lea ecx, [esp + 0x14]
call fcn.00431692
test esi, esi
je 0x425dbe
push esi
call fcn.00431523
test edi, edi
je 0x425dc8
push edi
call fcn.00431523
push 0
lea ecx, [esp + 0x1c]
call fcn.00433af7
lea ecx, [esp + 0x20]
call fcn.0042dbea
mov ecx, dword [esp + 0x27c]
mov eax, ebx
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0047c8b0
mov esp, ebp
pop ebp
ret 8
Function at 0x427d03
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x18], ecx
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], ebx
mov eax, edx
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x427d36
mov eax, 0x80070057
mov esi, eax
push eax
call fcn.004314fa
jmp 0x427ee2
test eax, eax
je 0x427d24
lea edx, [ebp - 0xc]
mov ecx, eax
call fcn.00430b00
mov esi, eax
test esi, esi
jns 0x427d4d
push esi
jmp 0x427d2c
cmp dword [ebp - 0xc], ebx
jne 0x427d87
mov eax, dword [0x48dcb8]
test eax, eax
je 0x427d60
cmp eax, 0xffffffff
jne 0x427d62
xor eax, eax
mov esi, dword [ebp - 0x10]
push esi
push 0x409560
push dword [0x490330]
push eax
call fcn.0041ad72
add esp, 0x10
mov ecx, esi
call fcn.004308af
mov esi, eax
test esi, esi
js 0x427d4a
xor eax, eax
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 8]
push 0x40a1c8
push eax
call fcn.0041a612
mov esi, eax
add esp, 0xc
test esi, esi
js 0x427ed9
mov ebx, dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push 0
push ebx
push dword [ebp - 0x10]
call fcn.004307e7
mov esi, eax
test esi, esi
js 0x427ece
mov edi, dword [ebp - 4]
lea edx, [ebp - 0xc]
mov ecx, edi
call fcn.00430b00
mov esi, eax
test esi, esi
js 0x427d4a
cmp dword [ebp - 0xc], 0
mov eax, dword [0x48dcb8]
je 0x427e38
test eax, eax
je 0x427def
cmp eax, 0xffffffff
jne 0x427df1
xor eax, eax
push edi
push 0x4095c8
push dword [0x490330]
push eax
call fcn.0041ad72
add esp, 0x10
test edi, edi
je 0x427e15
push edi
call fcn.00431523
xor edi, edi
mov dword [ebp - 4], edi
test ebx, ebx
je 0x427e24
push ebx
call fcn.00431523
xor ebx, ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x2710
jb 0x427d8c
jmp 0x427e58
test eax, eax
je 0x427e41
cmp eax, 0xffffffff
jne 0x427e43
xor eax, eax
push edi
push 0x409618
push dword [0x490330]
push eax
call fcn.0041ad72
add esp, 0x10
mov eax, dword [0x48dcb8]
test edi, edi
jne 0x427e8a
test eax, eax
je 0x427e6a
cmp eax, 0xffffffff
jne 0x427e6c
xor eax, eax
push 0x409668
push dword [0x490330]
push eax
call fcn.0041ad72
add esp, 0xc
mov esi, 0x80070003
jmp 0x427d4a
test eax, eax
je 0x427e93
cmp eax, 0xffffffff
jne 0x427e95
xor eax, eax
push edi
push dword [ebp - 0x18]
push 0x4096b0
push dword [0x490330]
push eax
call fcn.0041ad72
add esp, 0x14
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x427ee2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov esi, eax
jmp 0x427d4a
push esi
call fcn.004314fa
mov edi, dword [ebp - 4]
jmp 0x427ee2
push esi
call fcn.004314fa
mov ebx, dword [ebp - 8]
push esi
call fcn.00431467
test ebx, ebx
je 0x427ef2
push ebx
call fcn.00431523
test edi, edi
je 0x427efc
push edi
call fcn.00431523
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 8
Function at 0x42d9e5
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x60
push esi
push edi
xor edi, edi
push edi
push 0x40cb9c
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], edi
mov dword [esp + 0x50], edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x5c], edi
mov dword [esp + 0x60], edi
mov dword [esp + 0x64], edi
mov dword [esp + 0x68], edi
mov dword [esp + 0x6c], edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, 0x490314
call fcn.0041a646
mov eax, dword [0x48dcb8]
test eax, eax
je 0x42da78
cmp eax, 0xffffffff
jne 0x42da7a
mov eax, edi
push 0x40cbbc
push dword [0x490330]
push eax
call fcn.0041ad72
add esp, 0xc
mov edx, 0x490330
mov ecx, 0x48dcb8
call fcn.0041b60d
call fcn.0042c6af
mov esi, eax
test esi, esi
js 0x42dad6
mov ecx, dword [ebp + 0x10]
lea edx, [esp + 8]
call fcn.0042c756
mov esi, eax
test esi, esi
js 0x42dad6
cmp dword [esp + 0x40], edi
je 0x42dac7
mov esi, 0xc190010a
jmp 0x42dad6
lea ecx, [esp + 8]
call fcn.0042a5c2
mov esi, eax
test esi, esi
jns 0x42db06
push esi
call fcn.004314fa
mov eax, dword [0x48dcb8]
test eax, eax
je 0x42daea
cmp eax, 0xffffffff
jne 0x42daec
mov eax, edi
push esi
push 0x40cbd8
push 0x406200
push dword [0x490330]
push eax
call fcn.0041ad72
add esp, 0x14
push esi
call fcn.00431467
lea ecx, [esp + 8]
call fcn.0042db25
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x42f4a5
Capabilities:
Enumerate files on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x48dc38]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x260], 0xffffffff
xor eax, eax
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x268], edx
mov dword [ebp - 0x278], edi
mov esi, eax
mov dword [ebp - 0x274], eax
mov dword [ebp - 0x270], eax
mov dword [ebp - 0x26c], eax
mov dword [ebp - 0x25c], esi
mov dword [ebp - 0x264], eax
test edi, edi
jne 0x42f505
mov eax, 0x80070057
mov ebx, eax
push eax
jmp 0x42f6c5
call fcn.0043383f
mov ebx, eax
test ebx, ebx
js 0x42f6c4
cmp dword [ebp - 0x268], esi
je 0x42f4f8
lea eax, [ebp - 0x264]
push eax
push 0
push 0x409778
push edi
call fcn.004307e7
mov ebx, eax
test ebx, ebx
js 0x42f6c4
push 0x250
lea eax, [ebp - 0x258]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 0x264]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push eax
lea ecx, [ebp - 0x260]
call fcn.0041a4f2
mov edi, dword [ebp - 0x260]
test edi, edi
je 0x42f6b6
cmp edi, 0xffffffff
je 0x42f6b6
mov ecx, 0x407390
lea eax, [ebp - 0x22c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42f5b7
test dx, dx
je 0x42f5b3
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42f5b7
add eax, 4
add ecx, 4
test dx, dx
jne 0x42f591
xor eax, eax
jmp 0x42f5bc
sbb eax, eax
or eax, 1
test eax, eax
je 0x42f65d
mov ecx, 0x406f00
lea eax, [ebp - 0x22c]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x42f5f5
test dx, dx
je 0x42f5f1
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x42f5f5
add eax, 4
add ecx, 4
test dx, dx
jne 0x42f5cf
xor eax, eax
jmp 0x42f5fa
sbb eax, eax
or eax, 1
test eax, eax
je 0x42f65d
test byte [ebp - 0x258], 0x10
je 0x42f65d
test esi, esi
je 0x42f618
push esi
call fcn.00431523
and dword [ebp - 0x25c], 0
lea eax, [ebp - 0x25c]
push eax
push 0
lea eax, [ebp - 0x22c]
push eax
push dword [ebp - 0x278]
call fcn.004307e7
mov ebx, eax
test ebx, ebx
js 0x42f6a8
lea eax, [ebp - 0x25c]
push eax
push dword [ebp - 0x270]
lea ecx, [ebp - 0x274]
call fcn.00433a31
mov ebx, eax
test ebx, ebx
js 0x42f6a8
mov esi, dword [ebp - 0x25c]
push 0x250
lea eax, [ebp - 0x258]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x42f586
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x42f6b6
mov ecx, dword [ebp - 0x268]
lea eax, [ebp - 0x274]
push eax
call fcn.004306a4
jmp 0x42f6ca
push ebx
call fcn.004314fa
mov esi, dword [ebp - 0x25c]
jmp 0x42f6ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov ebx, eax
push ebx
call fcn.004314fa
push ebx
call fcn.00431467
lea ecx, [ebp - 0x260]
call fcn.00431692
mov eax, dword [ebp - 0x264]
test eax, eax
je 0x42f6eb
push eax
call fcn.00431523
test esi, esi
je 0x42f6f5
push esi
call fcn.00431523
push 0
lea ecx, [ebp - 0x274]
call fcn.00433af7
lea ecx, [ebp - 0x26c]
call fcn.0042dbea
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c8b0
leave
ret
Function at 0x42f7f2
Capabilities:
Get disk information

Disassembly:
push 0x240
mov eax, 0x4891ed
call fcn.0047ceef
mov ecx, edx
mov dword [ebp - 0x248], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov edi, ebx
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 2
mov esi, ebx
test ecx, ecx
jne 0x42f865
mov eax, 0x80070057
mov esi, eax
push eax
call fcn.004314fa
jmp 0x42f9ea
test eax, eax
je 0x42f853
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x42f8a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov esi, eax
push esi
jmp 0x42f85b
cmp word [ebp - 0x21c], si
lea ebx, [ebp - 0x21c]
jmp 0x42f9b8
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x42f8cc
cmp eax, 2
jne 0x42f995
test edi, edi
je 0x42f8de
push edi
call fcn.00431523
xor eax, eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
push eax
xor eax, eax
push eax
push 0x409ec0
push ebx
call fcn.004307e7
mov esi, eax
test esi, esi
js 0x42fa32
mov edi, dword [ebp - 0x220]
lea edx, [ebp - 0x240]
mov ecx, edi
call fcn.00430b00
mov esi, eax
test esi, esi
js 0x42fa40
cmp dword [ebp - 0x240], 0
je 0x42f995
xor eax, eax
xor edx, edx
push eax
push eax
mov ecx, edi
mov ebx, eax
call fcn.0043941c
test eax, eax
jne 0x42f94b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x42f94b
movzx ebx, bx
or ebx, 0x80070000
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x238]
lea ecx, [ebp - 0x23c]
call fcn.00433a31
mov esi, eax
test esi, esi
js 0x42fa32
push ebx
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x230]
call fcn.00434225
mov esi, eax
test esi, esi
js 0x42fa32
mov edi, dword [ebp - 0x220]
mov ebx, dword [ebp - 0x224]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x244]
jne 0x42f99a
sub ecx, edx
xor eax, eax
sar ecx, 1
lea ebx, [ebx + ecx*2]
add ebx, 2
cmp word [ebx], ax
mov dword [ebp - 0x224], ebx
jne 0x42f8b7
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x23c]
push eax
call fcn.004306a4
mov ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x230]
push eax
call fcn.004306a4
xor ebx, ebx
push esi
call fcn.00431467
test edi, edi
je 0x42f9fa
push edi
call fcn.00431523
push ebx
lea ecx, [ebp - 0x230]
call fcn.004342c4
lea ecx, [ebp - 0x228]
call fcn.0042dbea
push ebx
lea ecx, [ebp - 0x23c]
call fcn.00433af7
lea ecx, [ebp - 0x234]
call fcn.0042dbea
mov eax, esi
call fcn.0047cea1
ret 4
push esi
call fcn.004314fa
mov edi, dword [ebp - 0x220]
jmp 0x42f9e8
push esi
call fcn.004314fa
jmp 0x42f9e8
Function at 0x4301b2
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov eax, ecx
xor esi, esi
mov dword [ebp - 0xc], eax
mov ebx, edx
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
push edi
test eax, eax
jne 0x4301e2
mov eax, 0x80070057
mov edi, eax
push eax
call fcn.004314fa
jmp 0x430273
test ebx, ebx
je 0x4301d0
push esi
call fcn.00431467
push esi
call fcn.00431467
push 0x820
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
lea ecx, [ebp - 4]
mov edi, eax
call fcn.0042dbea
test edi, edi
jne 0x43021e
mov dword [ebp - 4], esi
mov edi, 0x8007000e
push edi
jmp 0x4301d8
push 0x820
push esi
push edi
mov dword [ebp - 4], edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x410
push edi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x430253
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov edi, eax
jmp 0x43021b
lea eax, [ebp - 8]
push eax
push edi
call fcn.0043163c
mov edi, eax
test edi, edi
jns 0x43026e
push edi
call fcn.004314fa
mov esi, dword [ebp - 8]
jmp 0x430273
mov eax, dword [ebp - 8]
mov dword [ebx], eax
push edi
call fcn.00431467
lea ecx, [ebp - 4]
call fcn.0042dbea
test esi, esi
je 0x43028b
push esi
call fcn.00431523
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x430738
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x48dc38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov word [ebp - 8], 0x500
mov esi, edx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
push edi
mov edi, ecx
test esi, esi
jne 0x430770
mov ebx, 0x80070057
push ebx
call fcn.004314fa
jmp 0x4307bb
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4307a4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov ebx, eax
jmp 0x430768
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x430794
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
push ebx
call fcn.00431467
cmp dword [ebp - 0x10], 0
je 0x4307d0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c8b0
leave
ret
Function at 0x4308af
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x48dc38]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x63c]
mov edi, ecx
push eax
push 0x104
push edi
call fcn.0041a309
mov esi, eax
test esi, esi
js 0x430a96
push edi
push 0x105
lea eax, [ebp - 0x218]
push eax
call fcn.0041a121
mov esi, eax
test esi, esi
js 0x430a96
mov edi, dword [ebp - 0x63c]
mov ecx, 0x80070216
lea eax, [edi - 1]
cmp eax, edi
ja 0x430919
mov edi, eax
xor esi, esi
jmp 0x430921
push ecx
mov esi, ecx
call fcn.004314fa
push esi
call fcn.00431467
test esi, esi
js 0x430a96
add edi, edi
push 0x5c
pop ecx
cmp word [ebp + edi - 0x218], cx
jne 0x430954
cmp edi, 0x20a
jae 0x430abd
xor eax, eax
mov word [ebp + edi - 0x218], ax
xor eax, eax
lea edi, [ebp - 0x218]
and dword [ebp - 0x63c], eax
mov word [ebp - 0x428], ax
cmp word [ebp - 0x218], cx
jne 0x430978
lea edi, [ebp - 0x216]
push ecx
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
lea eax, [ebp - 0x638]
mov dword [ebp - 0x640], ebx
pop ecx
pop ecx
test ebx, ebx
jne 0x4309b6
push edi
push 0x105
push eax
call fcn.0041a121
mov esi, eax
test esi, esi
js 0x430a96
mov dword [ebp - 0x63c], 1
jmp 0x4309fb
sub ebx, edi
sar ebx, 1
push ebx
push edi
push 0x105
push eax
call fcn.0041a168
mov esi, eax
test esi, esi
js 0x430a96
cmp dword [ebp - 0x640], edi
jb 0x430ab3
add ebx, ebx
cmp ebx, 0x20a
jae 0x430abd
xor eax, eax
mov word [ebp + ebx - 0x638], ax
mov ebx, dword [ebp - 0x640]
lea eax, [ebp - 0x638]
push eax
push 0x105
lea eax, [ebp - 0x428]
push eax
call fcn.0041a1bd
mov esi, eax
test esi, esi
js 0x430a96
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430a2f
test al, 0x10
jne 0x430a54
push 0
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x430a88
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430a88
test ebx, ebx
je 0x430a77
push 0x405ff4
push 0x105
lea eax, [ebp - 0x428]
push eax
lea edi, [ebx + 2]
call fcn.0041a1bd
mov esi, eax
test esi, esi
js 0x430a96
cmp dword [ebp - 0x63c], 0
jne 0x430a9c
push 0x5c
pop ecx
jmp 0x430978
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004317f4
mov esi, eax
push esi
call fcn.004314fa
push esi
call fcn.00431467
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0047c8b0
leave
ret
mov eax, 0x80070216
mov esi, eax
push eax
jmp 0x430a97
call fcn.0047cbae
int3

Function at 0x430ac9
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430ae4
shr eax, 4
not eax
and eax, 1
jmp 0x430ae6
xor eax, eax
mov dword [esi], eax
push 0
call fcn.00431467
push 0
call fcn.00431467
xor eax, eax
pop esi
ret
Function at 0x430b00
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x430b19
shr eax, 4
and eax, 1
jmp 0x430b1b
xor eax, eax
mov dword [esi], eax
push 0
call fcn.00431467
push 0
call fcn.00431467
xor eax, eax
pop esi
ret

Function at 0x4320a7
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push esi
push edi
push eax
push ecx
xor edi, edi
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], edi
call fcn.00435a07
mov esi, eax
mov dword [ebp - 0x10], esi
test esi, esi
js 0x43216c
xor esi, esi
mov dword [ebp - 4], esi
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x14]
push eax
push esi
push 0x40a788
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push eax
call fcn.004317c7
test eax, eax
je 0x432169
test edi, edi
jne 0x432139
cmp dword [ebp - 4], esi
jbe 0x432132
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
lea ecx, [ebp - 8]
call fcn.00432f2b
mov edi, dword [ebp - 8]
test edi, edi
jne 0x4320db
mov esi, 0x8007000e
jmp 0x43216c
mov esi, 0x8000ffff
jmp 0x43216c
cmp dword [ebp - 0x14], 2
je 0x432146
mov esi, 0x8007000d
jmp 0x43216c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov ecx, edi
call fcn.0041a8a1
mov esi, eax
test esi, esi
js 0x43216c
cmp dword [ebp - 0x10], 0
je 0x432172
and dword [ebp - 8], 0
jmp 0x432172
mov esi, dword [ebp - 0x10]
push esi
call fcn.004314fa
push esi
call fcn.00431467
lea ecx, [ebp - 8]
call fcn.0042dbea
cmp dword [ebp - 0xc], 0
je 0x43218f
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
leave
ret 0xc

Function at 0x432501
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x48dc38]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x12c], esi
test edi, edi
jne 0x432533
mov esi, 0x80070057
push esi
call fcn.004314fa
jmp 0x432597
push 0x118
lea eax, [ebp - 0x124]
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x12c]
push eax
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
push eax
call fcn.00431702
test eax, eax
jne 0x432578
mov esi, dword [ebp - 0x12c]
jmp 0x43252b
cmp dword [ebp - 0x124], 6
ja 0x43258c
jne 0x43258f
cmp dword [ebp - 0x120], 2
jb 0x43258f
xor esi, esi
inc esi
mov dword [edi], esi
mov esi, dword [ebp - 0x12c]
push esi
call fcn.00431467
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0047c8b0
leave
ret
Function at 0x432d45
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 2
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.004357f8
mov esi, eax
test esi, esi
js 0x432d9c
push ebx
call fcn.00431467
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push eax
call fcn.004317c7
mov esi, dword [ebp - 8]
test eax, eax
jne 0x432da2
push esi
call fcn.004314fa
push esi
call fcn.00431467
lea ecx, [ebp - 0xc]
call fcn.0042dbea
cmp dword [ebp - 4], ebx
je 0x432dbe
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x432ec1
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 2
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.004357f8
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
js 0x432f03
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
call fcn.004317c7
mov esi, dword [ebp - 8]
test eax, eax
jne 0x432f09
push esi
call fcn.004314fa
push esi
call fcn.00431467
cmp dword [ebp - 4], 0
je 0x432f1e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret 4