joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10090455
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x100ba014]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.1008492a
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.1008492a
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x100904cc
cmp word [ecx], dx
je 0x100904cc
mov eax, dword [0x100a1dfc]
push edi
dec eax
push eax
push 0x100a1ce8
call fcn.100903f4
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x1009053f
cmp word [eax], dx
je 0x1009053f
mov eax, dword [edi]
test eax, eax
je 0x100904f0
cmp word [eax], dx
je 0x100904f0
lea eax, [ebp - 0x10]
push eax
call fcn.1008fdd7
jmp 0x100904f9
lea eax, [ebp - 0x10]
push eax
call fcn.1008fe72
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x10090569
mov eax, dword [0x100a1ce4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x100a19d8
call fcn.100903f4
add esp, 0xc
test al, al
je 0x10090569
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x10090534
cmp word [eax], di
je 0x10090534
lea eax, [ebp - 0x10]
push eax
call fcn.1008fdd7
pop ecx
jmp 0x1009056b
lea eax, [ebp - 0x10]
push eax
call fcn.1008fe72
jmp 0x10090531
mov eax, dword [edi]
test eax, eax
je 0x10090556
cmp word [eax], dx
je 0x10090556
lea eax, [ebp - 0x10]
push eax
call fcn.1008fd8c
pop ecx
jmp 0x10090569
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x10090634
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10090279
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x10090634
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x10090634
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x10090634
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x100905c1
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.1008967e
test ebx, ebx
je 0x1009062f
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.1008967e
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10090634
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x10090634
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.10093fdf
add esp, 0x10
xor eax, eax
inc eax
jmp 0x10090636
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10072220
leave
ret
Function at 0x10094731
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.100946ad
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x100948a0
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x100948a0
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x10094855
jg 0x1009478d
test eax, eax
je 0x1009484b
push 1
push 0x1000
call fcn.1008432b
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x100947b0
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x10094842
push 0x8000
push ebx
call fcn.100945de
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x100947d9
jg 0x100947d4
cmp ecx, 0x1000
jb 0x100947d9
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1008a2cb
add esp, 0x10
cmp eax, 0xffffffff
je 0x1009481e
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x100947d4
jl 0x10094805
test ecx, ecx
jne 0x100947c6
push dword [ebp - 0xc]
push ebx
call fcn.100945de
push esi
call fcn.10086396
add esp, 0xc
xor ebx, ebx
jmp 0x100948ae
cmp byte [edi + 0x24], 0
je 0x10094835
cmp dword [edi + 0x20], 5
jne 0x10094835
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x10094840
mov ebx, dword [edi + 0x18]
jmp 0x10094842
xor ebx, ebx
push esi
call fcn.10086396
pop ecx
jmp 0x100948ae
test ecx, ecx
jg 0x10094817
jl 0x10094855
test eax, eax
jae 0x10094817
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10088194
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10094875
cmp byte [edi + 0x1c], 0
je 0x10094817
jmp 0x100948a6
push ebx
call fcn.1009241f
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x10094817
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100948ae
cmp byte [edi + 0x1c], 0
je 0x100948ab
mov ebx, dword [edi + 0x18]
jmp 0x100948ae
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10088194
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401a4d
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x214
lea eax, [esp]
push ebp
push esi
mov esi, dword [esp + 0x228]
push edi
mov edi, dword [esp + 0x22c]
and esi, 1
push eax
and edi, 0x300
mov eax, edi
or eax, 9
push eax
push dword [esp + 0x230]
push dword [esp + 0x230]
call fcn.00406783
test eax, eax
jne 0x401b5f
xor ebp, ebp
test byte [esp + 0x22c], 2
je 0x401ac2
push ebp
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
mov dword [esp + 0x20], ebp
push eax
lea eax, [esp + 0x28]
push eax
push ebp
push dword [esp + 0x28]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x401b3b
push 0x105
lea eax, [esp + 0x18]
push eax
push ebp
push dword [esp + 0x18]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
call ebp
test eax, eax
jne 0x401b10
test esi, esi
jne 0x401b3b
push dword [esp + 0x22c]
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call fcn.00401a4d
test eax, eax
jne 0x401b10
push 0x105
lea eax, [esp + 0x18]
push eax
push 0
push dword [esp + 0x18]
call ebp
test eax, eax
je 0x401ae1
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.00406d93
test eax, eax
jne 0x401b4c
push dword [esp + 0x228]
push dword [esp + 0x228]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x401b5f
push dword [esp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x401b5f
push 0
push edi
push dword [esp + 0x230]
push dword [esp + 0x230]
call eax
pop edi
pop esi
pop ebp
add esp, 0x214
ret 0xc
Function at 0x403774
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub esp, 0x9c
mov ecx, dword [esp + 0xa0]
mov eax, 0x7b0d80
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0xb8]
mov ebx, 0x8000
test edi, edi
cmovne ebx, dword [esp + 0xbc]
xor esi, esi
test edi, edi
cmovne eax, edi
mov dword [esp + 0x1c], eax
test ecx, ecx
js 0x4037bc
mov eax, dword [0x7c21d8]
add eax, ecx
push eax
call fcn.0040375d
push 4
lea eax, [esp + 0x14]
push eax
push dword [0x423010]
call fcn.00406df5
test eax, eax
je 0x403983
mov eax, dword [esp + 0x10]
test eax, eax
jns 0x403925
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [0x4264e0], esi
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
and eax, 0x7fffffff
mov byte [0x4264c8], 0xb
mov ecx, eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x10], ecx
jbe 0x40391d
mov ebp, 0x4000
cmp ecx, ebp
cmovl ebp, ecx
push ebp
push 0x7acd80
call fcn.00403747
test eax, eax
je 0x403983
sub dword [esp + 0x10], ebp
mov dword [0x4264bc], ebp
mov ebp, dword [esp + 0x1c]
mov dword [0x4264b8], 0x7acd80
push 0x4264b8
mov dword [0x4264c0], ebp
mov dword [0x4264c4], ebx
call fcn.004086f7
mov dword [esp + 0x28], eax
test eax, eax
js 0x403921
mov eax, dword [0x4264c0]
sub eax, ebp
mov dword [esp + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
test byte [0x7c2274], 1
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x24], eax
je 0x4038d6
sub eax, dword [esp + 0x14]
cmp eax, 0xc8
ja 0x40389a
test ecx, ecx
jne 0x4038d6
mov eax, dword [esp + 0x20]
push eax
push 0x64
sub eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_MulDiv]
push eax
lea eax, [esp + 0x30]
push 0x41a5f0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [esp + 0x2c]
push eax
push 0
call fcn.004061fa
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x10]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x18]
test eax, eax
je 0x403915
test edi, edi
jne 0x4038fa
push eax
push ebp
push dword [esp + 0xbc]
call fcn.00406eb8
test eax, eax
je 0x403968
mov eax, dword [esp + 0x18]
jmp 0x403906
mov ebp, dword [0x4264c0]
sub ebx, eax
mov dword [esp + 0x1c], ebp
add esi, eax
cmp dword [esp + 0x28], 4
jne 0x403847
jmp 0x40391d
test ecx, ecx
jg 0x403812
mov eax, esi
jmp 0x403986
push 0xfffffffffffffffc
jmp 0x403985
test edi, edi
jne 0x40396c
test eax, eax
jle 0x40391d
mov ebp, 0x7acd80
cmp eax, ebx
mov edi, ebx
cmovl edi, eax
push edi
push ebp
call fcn.00403747
test eax, eax
je 0x403983
push edi
push ebp
push dword [esp + 0xbc]
call fcn.00406eb8
test eax, eax
je 0x403968
mov eax, dword [esp + 0x10]
add esi, edi
sub eax, edi
mov dword [esp + 0x10], eax
test eax, eax
jg 0x403932
jmp 0x40391d
push 0xfffffffffffffffe
jmp 0x403985
mov esi, dword [esp + 0xbc]
cmp eax, esi
cmovl esi, eax
push esi
push edi
call fcn.00403747
test eax, eax
jne 0x40391d
push 0xfffffffffffffffd
pop eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x9c
ret 0x10
Function at 0x403993
Capabilities:
Hide graphical window

Disassembly:
cmp dword [esp + 4], 0
je 0x4039b2
mov eax, dword [0x4264b0]
test eax, eax
je 0x4039aa
push eax
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [0x4264b0], 0
ret
cmp dword [0x4264b0], 0
je 0x4039c3
push 0
call fcn.004066ba
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x7c2180]
jbe 0x4039f6
push 0
push 0x4040c1
push 0
push 0x6f
push dword [0x7c1174]
call dword [sym.imp.USER32.dll_CreateDialogParamW]
push 5
push eax
mov dword [0x4264b0], eax
call dword [sym.imp.USER32.dll_ShowWindow]
ret
Function at 0x4062de
Capabilities:
Create directory

Disassembly:
push esi
xor esi, esi
push esi
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x4062f8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret 4
Function at 0x40664f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
lea eax, [ebp - 0x23c]
push esi
mov esi, 0x104
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
cmp eax, esi
pop esi
cmovbe ecx, eax
lea eax, [ebp - 0x23c]
lea eax, [eax + ecx*2]
test ecx, ecx
je 0x40668d
cmp word [eax - 2], 0x5c
mov ecx, 0x41a3d0
jne 0x406692
mov ecx, 0x41a3d2
push dword [ebp + 8]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x4066e8
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x40670b
push dword [esp + 8]
push dword [esp + 8]
call fcn.004067b1
pop ecx
pop ecx
inc dword [0x7c2250]
ret 8

Function at 0x4067b1
Capabilities:
Get file size

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14]
mov ebx, 0x400
mov dword [0x7bea08], 0x55004e
mov ebp, 0x7bea08
mov dword [0x7bea0c], 0x4c
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
je 0x406807
push 1
push 0
push esi
call fcn.00406dc8
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebp
push esi
call edi
test eax, eax
je 0x4068e7
cmp eax, ebx
jg 0x4068e7
push ebx
mov esi, 0x7be208
push esi
push dword [esp + 0x1c]
call edi
test eax, eax
je 0x4068e7
cmp eax, ebx
jg 0x4068e7
push esi
push ebp
push str._ls_ls_r_n
push 0x7bde08
call dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, dword [0x7c2190]
add esp, 0x10
mov ebp, eax
push dword [ecx + 0x128]
push esi
call fcn.00406359
push 4
push 0xc0000000
push esi
call fcn.00406dc8
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4068e7
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
lea ecx, [esi + 0xa]
add ecx, ebp
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x4068e0
push esi
push edi
push ebx
call fcn.00406df5
test eax, eax
je 0x4068e0
push str._Rename__r_n
push edi
call fcn.00406fe3
test eax, eax
jne 0x4068ec
push str._Rename__r_n
lea eax, [edi + esi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add esi, 0xa
mov ecx, esi
push ebp
push 0x7bde08
lea eax, [ecx + edi]
push eax
call fcn.00406b61
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
lea eax, [esi + ebp]
push eax
push edi
push ebx
call fcn.00406eb8
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret
push 0x41aab4
add eax, 0xa
push eax
call fcn.00406fe3
mov ecx, eax
test ecx, ecx
je 0x4068b1
lea edx, [edi + esi]
jmp 0x40690b
mov al, byte [edx]
mov byte [edx + ebp], al
dec edx
cmp edx, ecx
ja 0x406905
sub ecx, edi
inc ecx
jmp 0x4068b3
Function at 0x406a30
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 8]
call fcn.00407049
mov edi, eax
cmp edi, 0xffffffff
je 0x406a66
test byte [ebp + 0xc], 1
push dword [ebp + 8]
je 0x406a6d
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x406a75
test byte [ebp + 0xc], 4
jne 0x406a66
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop ebp
ret 8
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x406a52
xor eax, eax
inc eax
jmp 0x406a68

Function at 0x406ae3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push esi
push dword [esp + 0xc]
mov ebx, 0x7bd608
push ebx
call fcn.00406fc7
push ebx
call fcn.00407071
mov esi, eax
test esi, esi
je 0x406b5a
push esi
call fcn.004071e9
test byte [0x7c218c], 0x80
je 0x406b1c
movzx eax, word [esi]
test ax, ax
je 0x406b5a
cmp eax, 0x5c
je 0x406b5a
sub esi, ebx
sar esi, 1
jmp 0x406b36
call fcn.00406a7a
test eax, eax
je 0x406b30
test byte [eax], 0x10
je 0x406b5a
push ebx
call fcn.004071bc
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ebx
cmp eax, esi
jg 0x406b22
call fcn.00406a01
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
jmp 0x406b5c
xor eax, eax
pop esi
pop ebx
ret 4

Function at 0x406b83
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x7bcdc0], 0x44
lea eax, [ebp - 0x10]
push eax
push 0x7bcdc0
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406bc2
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x406bc6
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x25c
push ebx
mov ebx, dword [esp + 0x268]
push esi
mov esi, dword [esp + 0x268]
push edi
mov edi, ebx
push esi
and edi, 4
call fcn.00406ae3
mov dword [esp + 0x14], eax
test bl, 8
je 0x406c08
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x7c2248], eax
jmp 0x406d87
push ebp
mov ebp, ebx
and ebp, 1
mov dword [esp + 0x14], ebp
je 0x406c25
test eax, eax
je 0x406d76
test bl, 2
je 0x406d3f
push esi
push 0x7bce08
call fcn.00406fc7
test ebp, ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406c48
push str..
push 0x7bce08
call ebp
jmp 0x406c4e
push esi
call fcn.004071bc
xor eax, eax
cmp word [esi], ax
jne 0x406c5f
cmp word [0x7bce08], 0x5c
jne 0x406c67
push 0x41a3d0
push esi
call ebp
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [esi + eax*2]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 0x7bce08
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x406d28
push 0x2e
pop eax
cmp word [esp + 0x48], ax
jne 0x406cb1
cmp word [esp + 0x4a], 0
je 0x406d0a
cmp word [esp + 0x4a], ax
jne 0x406cb1
cmp word [esp + 0x4c], 0
je 0x406d0a
lea eax, [esp + 0x48]
push eax
push dword [esp + 0x14]
call fcn.00406fc7
test byte [esp + 0x1c], 0x10
je 0x406cd8
mov eax, ebx
and eax, 3
cmp al, 3
jne 0x406d0a
push ebx
push esi
call fcn.00406bc6
jmp 0x406d0a
push edi
push esi
call fcn.00406a30
test eax, eax
jne 0x406d02
test edi, edi
je 0x406cfa
push esi
push 0xfffffffffffffff1
call fcn.004061fa
xor eax, eax
push eax
push esi
call fcn.004066e8
jmp 0x406d0a
inc dword [0x7c2248]
jmp 0x406d0a
push esi
push 0xfffffffffffffff2
call fcn.004061fa
lea eax, [esp + 0x1c]
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
push 0x2e
test eax, eax
pop eax
jne 0x406c93
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x14], 0
je 0x406d86
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov word [eax - 2], cx
cmp dword [esp + 0x18], ecx
je 0x406d76
push esi
call fcn.00406a7a
test eax, eax
je 0x406d86
push esi
call fcn.00406a01
mov eax, edi
or eax, 1
push eax
push esi
call fcn.00406a30
test eax, eax
jne 0x406d7e
test edi, edi
je 0x406d76
push esi
push 0xfffffffffffffff1
call fcn.004061fa
xor eax, eax
push eax
push esi
call fcn.004066e8
jmp 0x406d86
inc dword [0x7c2248]
jmp 0x406d86
push esi
push 0xffffffffffffffe5
call fcn.004061fa
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x25c
ret 8

Function at 0x406dc8
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
push 0
cmove eax, ecx
push eax
push dword [esp + 0x14]
push ecx
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc
Function at 0x406e24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 4]
mov dword [ebp - 8], 0x800
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00406783
mov edi, dword [ebp + 0x14]
test eax, eax
jne 0x406e96
push esi
lea eax, [ebp - 8]
push eax
push edi
lea eax, [ebp + 0x18]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
mov word [edi + 0x7fe], ax
pop esi
jne 0x406e96
cmp dword [ebp + 0x18], 1
je 0x406e9b
cmp dword [ebp + 0x18], 2
je 0x406e9b
xor eax, eax
mov word [edi], ax
pop edi
leave
ret 0x14

Function at 0x406ea0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
and dword [eax + 0x24], 0
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x406f03
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
dec edi
mov dword [ebp - 8], 0x73006e
mov dword [ebp - 4], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
add word [ebp - 4], dx
lea eax, [ebp - 8]
push 0
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406f4d
test edi, edi
jne 0x406f10
mov word [esi], ax
jmp 0x406f4f
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x407049
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40706b
mov ecx, esi
and ecx, 0xfffffffe
push ecx
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4
Function at 0x4075c7
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x28
push ebx
push ebp
mov ebp, dword [esp + 0x34]
push esi
push edi
mov edx, dword [ebp]
movzx eax, word [edx + 0x14]
lea ebx, [edx + 0x18]
add ebx, eax
mov eax, dword [ebp + 0x38]
neg eax
push ebx
push ebp
mov ecx, dword [ebx + 8]
and eax, ecx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x30], eax
call fcn.004076f8
mov edi, dword [ebx + 0x24]
mov esi, eax
and dword [esp + 0x3c], 0
xor eax, eax
inc eax
mov dword [esp + 0x34], esi
pop ecx
add ebx, 0x28
mov dword [esp + 0x34], edi
pop ecx
mov dword [esp + 0x20], eax
cmp ax, word [edx + 6]
jae 0x4076d5
mov ebp, dword [ebp + 0x38]
mov eax, dword [ebx + 8]
neg ebp
mov edx, dword [esp + 0x3c]
and ebp, eax
push ebx
push edx
mov dword [esp + 0x24], eax
call fcn.004076f8
pop ecx
pop ecx
mov dword [esp + 0x18], eax
cmp dword [esp + 0x14], ebp
je 0x40768a
mov ecx, dword [esp + 0x10]
add ecx, esi
cmp ecx, ebp
ja 0x40768a
lea eax, [esp + 0x24]
push eax
push edx
call fcn.00407528
pop ecx
pop ecx
test eax, eax
je 0x4076f4
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x18]
mov edi, dword [ebx + 0x24]
mov dword [esp + 0x10], eax
mov dword [esp + 0x24], eax
mov eax, ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x28], eax
jmp 0x4076ab
mov ecx, dword [ebx + 0x24]
mov eax, ecx
and eax, edi
or edi, ecx
bt eax, 0x19
jb 0x40769f
and edi, 0xfdffffff
mov esi, dword [esp + 0x18]
sub esi, dword [esp + 0x10]
add esi, dword [esp + 0x1c]
mov ebp, dword [esp + 0x3c]
add ebx, 0x28
mov ecx, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x30], edi
mov dword [esp + 0x2c], esi
mov eax, dword [ebp]
mov dword [esp + 0x20], ecx
movzx eax, word [eax + 6]
cmp ecx, eax
jl 0x407627
xor eax, eax
inc eax
mov dword [esp + 0x34], eax
lea eax, [esp + 0x24]
push eax
push ebp
call fcn.00407528
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
xor eax, eax
jmp 0x4076ec