joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402420
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, edx
lea edi, [ebp - 0x1c]
push ebx
mov ebx, eax
sub esp, 0x5c
mov eax, dword [sym.imp.kernel32.dll_GetStdHandle]
mov dword [esp], 0xfffffff5
mov dword [ebp - 0x2c], eax
call eax
sub esp, 4
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], edi
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteConsoleW]
sub esp, 0x14
test eax, eax
je 0x402470
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov edx, dword [sym.imp.kernel32.dll_GetOEMCP]
mov dword [ebp - 0x40], edx
call edx
mov dword [esp + 0x1c], 0
mov dword [esp], eax
mov eax, dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 0
mov dword [ebp - 0x38], eax
call eax
sub esp, 0x20
mov dword [ebp - 0x30], eax
mov dword [esp + 8], eax
mov dword [esp + 4], 0
mov ecx, dword fs:[0x18]
mov eax, dword [ecx + 0x30]
mov dword [ebp - 0x3c], ecx
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
mov dword [ebp - 0x34], eax
sub esp, 0xc
test eax, eax
je 0x402468
mov edx, dword [ebp - 0x40]
call edx
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0x30]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov ebx, dword [ebp - 0x38]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], edx
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call ebx
mov esi, dword [ebp - 0x2c]
sub esp, 0x20
mov dword [esp], 0xfffffff5
call esi
mov edx, dword [ebp - 0x30]
sub esp, 4
mov dword [esp + 0xc], edi
mov edi, dword [ebp - 0x34]
mov dword [esp + 8], edx
mov dword [esp + 4], edi
mov dword [esp + 0x10], 0
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_WriteFile]
mov ecx, dword [ebp - 0x3c]
sub esp, 0x14
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov eax, dword [ecx + 0x30]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_HeapFree]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x403000
Capabilities:
Get process heap force flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
and esp, 0xfffffff0
sub esp, 0x10
mov dword [esp], 1
call sym.__configure_wide_argv
call sym.__initialize_wide_environment
call sym.___p___argc
mov esi, dword [eax]
call sym.___p___wargv
mov edi, dword [eax]
call sym.__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
inc eax
mov dword [esp], eax
call sym.__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call sym._wmain
mov dword [esp], eax
call sym._exit
nop
nop
Function at 0x408125
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0x800
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x234], eax
mov esi, ecx
lea eax, [ebp - 0xc]
jne 0x4081bd
push 0x432cdc
push 4
push eax
call fcn.0041433e
push eax
call fcn.00402310
add esp, 0x10
push ebx
push edi
call fcn.004164f3
mov edi, dword [eax]
call fcn.004164f3
xor ebx, ebx
mov dword [eax], ebx
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0x234]
lea eax, [ebp - 0x230]
push esi
push 0x111
mov esi, 0x112
push esi
push eax
call fcn.00414e53
add esp, 0x18
mov dword [ebp - 0x234], eax
call fcn.004164f3
cmp dword [eax], ebx
je 0x4081d4
call fcn.004164f3
push dword [eax]
call fcn.004064e6
pop ecx
jmp 0x4081db
push 4
push eax
push 3
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x408168
jmp 0x408262
call fcn.004164f3
mov dword [eax], edi
cmp dword [ebp - 0x234], 0xffffffff
je 0x40825e
cmp dword [ebp - 0x234], esi
jae 0x40825e
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push 0x3c
mov esi, eax
lea eax, [ebp - 0x270]
push ebx
push eax
mov dword [ebp - 0x274], 0x40
call fcn.00413d10
add esp, 0xc
push 0x432a3c
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
cmp eax, ebx
je 0x40824d
push str.FindActCtxSectionStringW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x40824d
lea ecx, [ebp - 0x274]
push ecx
push esi
push 2
push ebx
push ebx
call eax
test eax, eax
je 0x40824d
push ebx
push ebx
push esi
jmp 0x408256
push ebx
push ebx
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
jmp 0x408260
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00413c2f
leave
ret

Function at 0x413c2f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x441cc0]
jne 0x413c39
repz ret
jmp fcn.004198c4
Function at 0x421ac0
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004192d3
and dword [ebp - 4], 0
cmp dword [0x445cb0], 0
mov ebx, eax
jne 0x421b71
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x421c22
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x421c22
push eax
call fcn.00419261
mov dword [esp], 0x435138
push edi
mov dword [0x445cb0], eax
call esi
push eax
call fcn.00419261
mov dword [esp], 0x435124
push edi
mov dword [0x445cb4], eax
call esi
push eax
call fcn.00419261
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x445cb8], eax
call esi
push eax
call fcn.00419261
pop ecx
mov dword [0x445cc0], eax
test eax, eax
je 0x421b71
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00419261
pop ecx
mov dword [0x445cbc], eax
mov eax, dword [0x445cbc]
cmp eax, ebx
je 0x421bc9
cmp dword [0x445cc0], ebx
je 0x421bc9
push eax
call fcn.004192dc
push dword [0x445cc0]
mov esi, eax
call fcn.004192dc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x421bc9
test edi, edi
je 0x421bc9
call esi
test eax, eax
je 0x421bc0
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x421bc0
test byte [ebp - 0xc], 1
jne 0x421bc9
or dword [ebp + 0x10], 0x200000
jmp 0x421c02
mov eax, dword [0x445cb4]
cmp eax, ebx
je 0x421c02
push eax
call fcn.004192dc
pop ecx
test eax, eax
je 0x421c02
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x421c02
mov eax, dword [0x445cb8]
cmp eax, ebx
je 0x421c02
push eax
call fcn.004192dc
pop ecx
test eax, eax
je 0x421c02
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x445cb0]
call fcn.004192dc
pop ecx
test eax, eax
je 0x421c22
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x421c24
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42aa70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x120], 0x114
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x42aaaa
mov eax, 1
jmp 0x42aaac
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c2f
mov esp, ebp
pop ebp
ret

Function at 0x42ab10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
call fcn.00402600
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebp
ret
Function at 0x42ae80
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x431259
mov eax, dword fs:[0]
push eax
sub esp, 0x228
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x234], 0
mov ax, word [0x437c64]
mov word [ebp - 0x224], ax
push 0x208
push 0
lea ecx, [ebp - 0x222]
push ecx
call fcn.00413d10
add esp, 0xc
push 0x437c68
lea ecx, [ebp - 0x228]
call fcn.00402580
mov dword [ebp - 4], 0
lea edx, [ebp - 0x224]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x42af6d
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x228]
call fcn.00402a10
call fcn.00404ad0
test eax, eax
je 0x42af5b
mov dword [ebp - 0x22c], 0xffffffff
lea ecx, [ebp - 0x22c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov edx, dword [ebp - 0x22c]
push edx
push str.unpack_d.log
lea eax, [ebp - 0x228]
push eax
call fcn.00403320
add esp, 0xc
jmp 0x42af6b
push str.unpack.log
lea ecx, [ebp - 0x228]
call fcn.00403570
jmp 0x42afe5
push 0x104
lea ecx, [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [ebp - 0x224]
push edx
lea ecx, [ebp - 0x228]
call fcn.00402a10
call fcn.00404ad0
test eax, eax
je 0x42afd5
mov dword [ebp - 0x230], 0xffffffff
lea eax, [ebp - 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
mov ecx, dword [ebp - 0x230]
push ecx
push str.Tempunpack_d.log
lea edx, [ebp - 0x228]
push edx
call fcn.00403320
add esp, 0xc
jmp 0x42afe5
push str.Tempunpack.log
lea ecx, [ebp - 0x228]
call fcn.00403570
lea eax, [ebp - 0x228]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402d90
mov ecx, dword [ebp - 0x234]
or ecx, 1
mov dword [ebp - 0x234], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00402b70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00413c2f
mov esp, ebp
pop ebp
ret
Function at 0x42b040
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x214], 0
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.00413d10
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x42b159
push 0x436c2c
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b0f8
push 0
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42b0f8
cmp dword [0x445d74], 0
je 0x42b0f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x436c40
push 0x436c48
push 3
call dword [0x445d74]
add esp, 0x10
xor eax, eax
jne 0x42b0cf
push 0x436c70
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x42b157
push 0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x42b157
cmp dword [0x445d74], 0
je 0x42b153
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x436c7c
push str.__s__ESA_Folder:_CreateFile_failed:__d
push 3
call dword [0x445d74]
add esp, 0x10
xor ecx, ecx
jne 0x42b12e
jmp 0x42b17d
push 0x104
lea edx, [ebp - 0x210]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Temp
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea ecx, [ebp - 0x210]
push ecx
mov ecx, dword [ebp + 8]
call fcn.00402580
mov edx, dword [ebp - 0x214]
or edx, 1
mov dword [ebp - 0x214], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00413c2f
mov esp, ebp
pop ebp
ret
Function at 0x42b1b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43128c
mov eax, dword fs:[0]
push eax
sub esp, 0x244
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
call fcn.00403dc0
cmp dword [ebp - 0x14], 0xffffffff
je 0x42b2da
mov dword [ebp - 0x18], 0xffffffff
mov dword [ebp - 0x24c], 0x22c
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x42b2c9
lea ecx, [ebp - 0x250]
call fcn.00402b50
mov dword [ebp - 4], 0
lea edx, [ebp - 0x228]
push edx
lea ecx, [ebp - 0x250]
call fcn.00402a10
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x250]
call fcn.00401090
test eax, eax
jne 0x42b2a3
cmp dword [ebp + 0x10], 0xffffffff
je 0x42b294
lea ecx, [ebp - 0x18]
push ecx
mov edx, dword [ebp - 0x244]
push edx
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
je 0x42b292
mov eax, dword [ebp + 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x42b292
lea ecx, [ebp - 0x244]
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.00404ae0
jmp 0x42b2a3
lea edx, [ebp - 0x244]
push edx
mov ecx, dword [ebp + 0xc]
call fcn.00404ae0
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x42b23b
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x250]
call fcn.00402b70
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413c2f
mov esp, ebp
pop ebp
ret
Function at 0x42b430
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43135b
mov eax, dword fs:[0]
push eax
sub esp, 0x820
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ax, word [0x437c10]
mov word [ebp - 0x81c], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x81a]
push ecx
call fcn.00413d10
add esp, 0xc
lea edx, [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3ff
lea edx, [ebp - 0x81c]
push edx
call fcn.00413f84
add esp, 0x10
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x18]
push eax
call fcn.00405750
lea ecx, [ebp - 0x820]
call fcn.00402b50
mov dword [ebp - 4], 0
push str._Y__m__d__H:_M:_S
lea ecx, [ebp - 0x824]
push ecx
lea ecx, [ebp - 0x18]
call fcn.00405660
mov dword [ebp - 0x828], eax
mov edx, dword [ebp - 0x828]
mov dword [ebp - 0x82c], edx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x81c]
push eax
mov ecx, dword [ebp - 0x82c]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push str.__d__s___s__Last_d_
lea eax, [ebp - 0x820]
push eax
call fcn.004021a0
add esp, 0x18
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x824]
call fcn.00402b70
lea ecx, [ebp - 0x820]
call fcn.00402600
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea ecx, [ebp - 0x820]
call fcn.00402600
push eax
call fcn.0042b3d0
add esp, 4
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x820]
call fcn.00402b70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413c2f
mov esp, ebp
pop ebp
ret
Function at 0x42b7b0
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x441cc0]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0xc], 0
lea eax, [ebp - 4]
push eax
call fcn.0042b300
add esp, 4
mov dword [ebp - 8], 0
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
call fcn.00402600
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x42b91a
mov edx, dword [ebp - 0x10]
push edx
call fcn.00414274
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x42b908
mov ax, word [0x436b24]
mov word [ebp - 0x228], ax
push 0x206
push 0
lea ecx, [ebp - 0x226]
push ecx
call fcn.00413d10
add esp, 0xc
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
lea ecx, [ebp - 4]
call fcn.00402600
push eax
call sub.VERSION.dll_GetFileVersionInfoW
lea edx, [ebp - 0x18]
push edx
lea eax, [ebp - 0x22c]
push eax
push 0x436b7c
mov ecx, dword [ebp - 0x14]
push ecx
call sub.VERSION.dll_VerQueryValueW
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0x14], 1
jne 0x42b892
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [eax + 0x10]
mov dword [edx], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [eax + 0x14]
mov dword [edx], ecx
jmp 0x42b8ae
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x22c]
mov ecx, dword [eax + 0xc]
mov dword [edx], ecx
cmp dword [ebp + 8], 0
je 0x42b908
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
push 0x436b80
push 0x104
mov edx, dword [ebp + 8]
push edx
call fcn.00414e35
add esp, 0x1c
cmp dword [ebp - 0x14], 0
je 0x42b91a
mov eax, dword [ebp - 0x14]
push eax
call fcn.004143ad
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 4]
call fcn.00402b70
mov eax, dword [ebp - 0x230]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00413c2f
mov esp, ebp
pop ebp
ret
Function at 0x42bc10
Capabilities:
Copy file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4314b4
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x441cc0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x18]
call fcn.0042fa70
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
call fcn.00402d90
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 0xc]
push ecx
lea ecx, [ebp - 0x44]
call fcn.00402d90
mov byte [ebp - 4], 2
push 0
lea ecx, [ebp - 0x1c]
call fcn.00405610
push 0
lea ecx, [ebp - 0x44]
call fcn.00405610
mov dword [ebp - 0x3c], 0
xor edx, edx
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], edx
mov word [ebp - 0x20], dx
mov eax, 0x14
mov word [ebp - 0x2c], ax
mov ecx, dword [ebp + 0x10]
movzx edx, word [ecx]
mov dword [ebp - 0x38], edx
lea ecx, [ebp - 0x1c]
call fcn.00402600
mov dword [ebp - 0x34], eax
lea ecx, [ebp - 0x44]
call fcn.00402600
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x3c]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x42bce7
lea ecx, [ebp - 0x18]
call fcn.0042fa10
lea ecx, [ebp - 0x3c]
push ecx
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov dword [ebp - 0x40], eax
mov edx, dword [ebp - 0x40]
mov dword [ebp - 0x48], edx
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x44]
call fcn.00402b70
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x1c]
call fcn.00402b70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0042fa30
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x42e4c0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 0x14]
call fcn.0042e460
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], 0x20006
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x14], 0
je 0x42e4f7
mov ecx, dword [ebp - 0x10]
or ecx, 0x100
mov dword [ebp - 0x10], ecx
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp - 0x10]
push eax
push 0
mov ecx, dword [ebp - 0x14]
add ecx, 0xc
call fcn.00402600
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42e52b
lea edx, [ebp - 4]
push edx
mov ecx, dword [ebp - 0x14]
call fcn.0042e2f0
xor eax, eax
jmp 0x42e57a
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push 0
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42e54e
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x10], 0
jne 0x42e561
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x14]
call fcn.0042e2f0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8
Function at 0x42e580
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 1
mov eax, dword [ebp + 0xc]
push eax
call fcn.00413d8a
add esp, 4
lea ecx, [eax + eax + 2]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call fcn.00414274
add esp, 4
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x42e5bf
xor eax, eax
jmp 0x42e6bd
mov eax, dword [ebp + 0xc]
push eax
call fcn.00413d8a
add esp, 4
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov word [edx + eax*2], cx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 8]
shr ecx, 1
push ecx
mov edx, dword [ebp - 0x18]
push edx
call fcn.0041433e
add esp, 0xc
mov ecx, dword [ebp - 0x1c]
call fcn.0042e460
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x20006
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x14], 0
je 0x42e611
mov ecx, dword [ebp - 0x14]
or ecx, 0x100
mov dword [ebp - 0x14], ecx
lea edx, [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0xc
call fcn.00402600
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x42e651
mov edx, dword [ebp - 0x18]
push edx
call fcn.004143ad
add esp, 4
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x1c]
call fcn.0042e2f0
xor eax, eax
jmp 0x42e6bd
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00413d8a
add esp, 4
lea edx, [eax + eax + 2]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x42e685
mov dword [ebp - 0x10], 0
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x10], 0
jne 0x42e698
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0042e2f0
mov edx, dword [ebp - 0x18]
push edx
call fcn.004143ad
add esp, 4
mov eax, dword [ebp - 0x10]
mov esp, ebp
pop ebp
ret 0xc