joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40563b
Capabilities:
Get disk information
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x540
push ebx
push esi
push edi
push dword [ebp + 0x7c]
lea eax, [ebp - 0x2c4]
push eax
call fcn.00404497
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp - 0x7c]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x7c]
call fcn.004043d0
mov esi, eax
push esi
mov dword [ebp + 0x68], esi
call fcn.004043ee
add esp, 0x10
test eax, eax
je 0x405852
movzx esi, word [esi]
xor eax, eax
cmp si, 0x2a
sete al
mov edi, 0x206
xor ebx, ebx
push edi
push ebx
mov word [ebp - 0x284], bx
mov dword [ebp + 0x6c], eax
lea eax, [ebp - 0x282]
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [0x401bf8]
mov dword [ebp - 0x3c], eax
mov eax, dword [0x401bfc]
push 0x98
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x34]
push ebx
push eax
call sub.MSVCRT.dll_memset
push dword [ebp - 0x78]
mov word [ebp - 0x3c], si
mov word [ebp - 0x36], bx
call fcn.004043d0
push eax
call fcn.00402b60
push 0x401ca8
push 0x401c50
mov dword [ebp + 0x70], eax
lea eax, [ebp - 0x284]
push 0x401c34
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x30
call fcn.00405308
test eax, eax
je 0x4057d6
cmp dword [ebp + 0x70], 0x1e
jbe 0x40571c
mov dword [ebp + 0x70], 0xa
xor eax, eax
cmp dword [ebp + 0x70], ebx
sete al
mov dword [ebp + 0x64], eax
xor eax, eax
cmp dword [ebp + 0x6c], 1
sete al
cmp eax, ebx
jne 0x405751
lea eax, [ebp - 0x3c]
push eax
call fcn.00403582
cmp eax, 3
pop ecx
je 0x405751
cmp eax, 2
je 0x405751
cmp eax, 6
jne 0x405852
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [ebp + 0x6c]
push eax
push 4
push 0x401c10
lea eax, [ebp - 0x284]
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
cmp dword [ebp + 0x6c], 1
je 0x4057a5
mov eax, dword [ebp + 0x68]
movzx eax, word [eax]
push eax
mov word [ebp - 0x3c], 0x5c
call fcn.00402ad5
mov word [ebp - 0x3a], ax
pop ecx
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x284]
push eax
mov word [ebp - 0x38], bx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 4
pop ebx
push ebx
lea eax, [ebp + 0x70]
push eax
push ebx
push 0x401c00
lea eax, [ebp - 0x284]
push eax
push edi
call esi
push ebx
lea eax, [ebp + 0x64]
push eax
push ebx
push 0x401ba4
lea eax, [ebp - 0x284]
push eax
push edi
call esi
xor eax, eax
jmp 0x405855
cmp dword [ebp + 0x6c], 1
jne 0x40583a
push edi
lea eax, [ebp - 0x4ca]
push ebx
push eax
mov word [ebp - 0x4cc], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x4cc]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x4cc], bx
lea esi, [ebp - 0x4cc]
je 0x4057d2
lea eax, [ebp - 0x284]
push eax
push dword [ebp + 0x70]
push esi
call fcn.004054e0
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x405815
jmp 0x4057d2
lea eax, [ebp - 0x284]
push eax
push dword [ebp + 0x70]
lea eax, [ebp - 0x3c]
push eax
call fcn.004054e0
add esp, 0xc
jmp 0x405855
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret
Function at 0x405cef
Capabilities:
Get disk information

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x4bc
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x23e]
push edi
push eax
mov dword [ebp + 0x70], edi
mov word [ebp - 0x240], di
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x446]
push edi
push eax
mov word [ebp - 0x448], di
call sub.MSVCRT.dll_memset
push 0x9e
lea eax, [ebp - 0x36]
push edi
push eax
mov word [ebp - 0x38], di
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyW]
add esp, 0x24
cmp dword [ebp + 0x7c], 5
jne 0x405d5d
push 0x401d24
lea eax, [ebp - 0x38]
push eax
call esi
cmp dword [ebp + 0x7c], 2
jne 0x405d6e
push 0x401d1c
lea eax, [ebp - 0x38]
push eax
call esi
cmp word [ebp - 0x38], di
je 0x405e64
lea eax, [ebp - 0x448]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x448], di
mov word [ebp + 0x6a], 0x3a
mov word [ebp + 0x6c], di
lea esi, [ebp - 0x448]
je 0x405e64
push ebx
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
cmp word [esi], 0x42
jbe 0x405e23
push esi
call fcn.00403582
cmp eax, dword [ebp + 0x7c]
pop ecx
jne 0x405e23
mov ax, word [esi]
inc dword [ebp + 0x70]
mov word [ebp + 0x68], ax
lea eax, [ebp + 0x68]
push eax
push dword [ebp + 0x70]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x240]
push 0x401d0c
push eax
call ebx
push edi
lea eax, [ebp - 0x240]
push 1
push eax
call fcn.00405318
add esp, 0x20
cmp dword [ebp + 0x70], 1
jne 0x405e23
lea eax, [ebp + 0x68]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x240]
push 0x401b40
push eax
call ebx
push edi
lea eax, [ebp - 0x240]
push 1
push eax
call fcn.00405318
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], di
jne 0x405dae
cmp dword [ebp + 0x70], edi
je 0x405e63
push dword [ebp + 0x70]
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x240]
push 0x401cfc
push eax
call ebx
push edi
lea eax, [ebp - 0x240]
push 1
push eax
call fcn.00405318
add esp, 0x1c
pop ebx
mov eax, dword [ebp + 0x70]
pop edi
pop esi
add ebp, 0x74
leave
ret
Function at 0x406ba1
Capabilities:
Enumerate files on windows
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push edi
push 0x401e0c
call esi
mov edi, eax
test edi, edi
jne 0x406c6b
push 0x104
lea eax, [ebp - 0x458]
push eax
push 0x401de0
call fcn.00405202
add esp, 0xc
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x458]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x406ccc
lea eax, [ebp - 0x458]
push eax
call fcn.00402c6d
pop ecx
cmp word [ebp - 0x224], 0x2e
je 0x406c4e
test byte [ebp - 0x250], 0x10
je 0x406c4e
lea eax, [ebp - 0x224]
push eax
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x660]
push 0x401dbc
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x660]
push eax
call esi
mov edi, eax
test edi, edi
jne 0x406c60
lea eax, [ebp - 0x250]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406c09
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
test edi, edi
je 0x406ccc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x401dac
push edi
call esi
push 0x401d9c
push edi
mov dword [0x4152dc], eax
call esi
push 0x401d88
push edi
mov dword [0x415b68], eax
call esi
push 0x401d74
push edi
mov dword [0x415b6c], eax
call esi
push 0x401d60
push edi
mov dword [0x415b70], eax
call esi
push 0x401d48
push edi
mov dword [0x415b74], eax
call esi
push 0x401d30
push edi
mov dword [0x415b78], eax
call esi
mov dword [0x415b7c], eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x407183
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
push 0xffffffffffffffff
push 0xffffffffffffffff
push dword [0x4152d4]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push 0xa
call dword [sym.imp.KERNEL32.dll_Sleep]
nop
call esi
sub eax, edi
cmp eax, dword [esp + 0xc]
jb 0x40719f
pop edi
pop esi
ret

Function at 0x407317
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
xor edi, edi
cmp word [ebp - 0x208], di
lea esi, [ebp - 0x208]
je 0x407395
push ebx
mov ebx, dword [ebp + 0xc]
add ebx, 0x10
push esi
call fcn.004033af
cmp eax, ebx
pop ecx
jbe 0x407383
push esi
call fcn.00403582
dec eax
dec eax
pop ecx
je 0x407380
dec eax
jne 0x407383
movzx eax, word [esi]
cmp ax, word [ebp + 8]
movzx edi, ax
jae 0x407394
jmp 0x407383
movzx edi, word [esi]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x407359
pop ebx
mov ax, di
pop edi
pop esi
leave
ret
Function at 0x40739c
Capabilities:
Get disk information
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x648
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x20
push esi
call edi
mov ebx, eax
test ebx, ebx
je 0x4073fc
and word [ebx], 0
inc ebx
inc ebx
push ebx
call fcn.00402b60
pop ecx
push 0x20
push ebx
mov dword [ebp - 0xc], eax
call edi
test eax, eax
je 0x4073ee
and word [eax], 0
add eax, 2
push eax
call fcn.00402b60
pop ecx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jae 0x4073fc
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
call fcn.0040466e
cmp eax, dword [ebp - 4]
jae 0x407591
xor eax, eax
lea edi, [ebp - 0x12]
stosd dword es:[edi], eax
stosw word es:[edi], ax
movzx eax, word [esi]
push eax
call fcn.00402ae9
push dword [ebp - 4]
mov word [ebp - 0x14], ax
mov word [ebp - 0x12], 0x3a
push dword [ebp - 0x14]
call fcn.00407317
add esp, 0xc
mov word [ebp - 0x14], ax
mov word [esi], ax
push 0x104
lea eax, [ebp - 0x440]
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
lea eax, [esi + 4]
push eax
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x440]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
mov word [ebp - 0x1c], ax
mov eax, dword [ebp - 0x1c]
add eax, 2
mov word [ebp - 0x1a], ax
lea eax, [ebp - 0x440]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
shl eax, 0x14
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
xor ebx, ebx
shl eax, 0x14
push 0x401e74
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], ebx
call fcn.004070de
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00403f24
add esp, 0x14
cmp eax, ebx
mov dword [ebp - 0x20], eax
jne 0x40758c
push 0x206
lea eax, [ebp - 0x236]
push ebx
push eax
mov dword [ebp - 8], 0x208
mov word [ebp - 0x238], bx
call sub.MSVCRT.dll_memset
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x401e50
push 0x401ad0
lea eax, [ebp - 0x238]
push 0x401a18
push eax
call edi
add esp, 0x1c
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x648]
push eax
push ebx
push 0x401e38
lea eax, [ebp - 0x238]
push eax
mov ebx, reloc.OLEAUT32.dll_SysReAllocString
push ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x407538
xor eax, eax
jmp 0x40753e
mov eax, dword [ebp - 8]
shr eax, 1
dec eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
push dword [ebp - 0xc]
lea eax, [ebp + eax*2 - 0x648]
push esi
push 0x401e24
push eax
call edi
mov ecx, dword [ebp - 8]
lea eax, [ecx + eax + 1]
add esp, 0x14
mov dword [ebp - 8], eax
add eax, eax
and word [ebp + eax - 0x648], 0
push eax
lea eax, [ebp - 0x648]
push eax
push 7
push 0x401e38
lea eax, [ebp - 0x238]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov eax, dword [ebp - 0x20]
jmp 0x407593
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x407598
Capabilities:
Start service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push 0xf003f
push ebx
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x407611
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp word [eax], 0x21
sete cl
cmp ecx, ebx
mov dword [ebp - 8], ecx
je 0x4075cd
inc eax
inc eax
push esi
push edi
push 0x30
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
cmp esi, ebx
je 0x40760a
cmp dword [ebp - 8], ebx
je 0x4075fb
lea eax, [ebp - 0x28]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x407604
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push esi
mov dword [ebp - 4], eax
call edi
push dword [ebp - 0xc]
call edi
pop edi
pop esi
xor eax, eax
cmp dword [ebp - 4], ebx
pop ebx
sete al
leave
ret
Function at 0x40761c
Capabilities:
Hash data via wincrypt
Hash data with md5
Initialize hashing via wincrypt
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x170
push ebx
push edi
push 4
pop edi
lea eax, [ebp + 0x58]
push eax
lea eax, [ebp + 0x5c]
push eax
lea eax, [ebp + 0x64]
push eax
push 0x401f94
push 0x401f74
xor ebx, ebx
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [ebp + 0x77], bl
mov dword [ebp + 0x64], edi
mov dword [ebp + 0x58], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
je 0x407663
xor eax, eax
jmp 0x4077ba
push ebx
push 1
push ebx
push ebx
lea eax, [ebp + 0x68]
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x40765c
lea eax, [ebp + 0x70]
push eax
push ebx
push ebx
push 0x8003
push dword [ebp + 0x68]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x40765c
mov al, byte [ebp + 0x77]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptHashData]
push ebx
mov byte [ebp + 0x6d], al
push edi
lea eax, [ebp + 0x6c]
push eax
push dword [ebp + 0x70]
mov byte [ebp + 0x6c], bl
mov byte [ebp + 0x6e], bl
mov byte [ebp + 0x6f], bl
call esi
test eax, eax
je 0x40779a
push ebx
push edi
lea eax, [ebp + 0x5c]
push eax
push dword [ebp + 0x70]
call esi
test eax, eax
je 0x40779a
push ebx
lea eax, [ebp + 0x60]
push eax
lea eax, [ebp + 0x48]
push eax
push 2
push dword [ebp + 0x70]
mov dword [ebp + 0x60], 0x10
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
test eax, eax
je 0x40779a
cmp dword [ebp + 0x70], ebx
je 0x407703
push dword [ebp + 0x70]
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
test eax, eax
je 0x40779a
cmp dword [ebp + 0x68], ebx
je 0x40771a
push ebx
push dword [ebp + 0x68]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test eax, eax
je 0x40779a
push 0x11
pop ecx
push 0x5c
lea eax, [ebp - 0xb4]
push ebx
mov esi, 0x401f30
lea edi, [ebp - 0xf8]
push eax
rep movsd dword es:[edi], dword [esi]
call sub.MSVCRT.dll_memset
mov esi, 0x401f20
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 0x92
lea eax, [ebp - 0x4a]
push ebx
push eax
movsw word es:[edi], word [esi]
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add esp, 0x18
push 0x10
lea eax, [ebp + 0x48]
push eax
push 3
push 0x401f08
push 0x401ea8
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
call esi
test eax, eax
jne 0x40779a
push 1
lea eax, [ebp + 0x77]
push eax
push 3
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xf8]
push eax
push SysReAllocString
call esi
test eax, eax
je 0x40779e
xor eax, eax
jmp 0x4077b9
push 1
lea eax, [ebp + 0x77]
push eax
push 3
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0xf8]
push eax
push edi
call esi
neg eax
sbb eax, eax
inc eax
pop esi
pop edi
pop ebx
add ebp, 0x78
leave
ret
Function at 0x407a6e
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
push esi
push edi
lea eax, [ebp - 0x250]
push eax
push dword [ebp + 8]
xor esi, esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407adc
test edi, edi
jbe 0x407adc
test byte [ebp - 0x250], 0x10
je 0x407ab5
lea eax, [ebp - 0x224]
push eax
call fcn.00404b60
test eax, eax
pop ecx
jne 0x407ac3
mov esi, dword [ebp + 0xc]
jmp 0x407abf
xor eax, eax
cmp dword [ebp + 0xc], eax
sete al
mov esi, eax
test esi, esi
jne 0x407ad5
lea eax, [ebp - 0x250]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407a96
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, esi
pop esi
leave
ret

Function at 0x407ae2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa08
push edi
mov edi, dword [ebp + 8]
cmp word [edi], 0x5c
jne 0x407b88
and word [ebp - 0x208], 0
push esi
push 0x206
lea eax, [ebp - 0x206]
push 0
inc edi
push eax
inc edi
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
cmp word [ebp - 0x208], 0
lea esi, [ebp - 0x208]
je 0x407b87
push edi
push esi
lea eax, [ebp - 0xa08]
push 0x401ce0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xa08]
push eax
call fcn.00402c8c
add esp, 0x14
test eax, eax
jne 0x407b76
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x407b3c
jmp 0x407b87
lea eax, [ebp - 0xa08]
push eax
add edi, 0xfffffffe
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop esi
pop edi
leave
ret

Function at 0x407c2f
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x660
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x660]
push 0x401a24
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x458]
push eax
lea eax, [ebp - 0x660]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
test edi, edi
je 0x407cfd
cmp edi, 0xffffffff
je 0x407cfd
push ebx
lea eax, [ebp - 0x458]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
and word [ebp - 0x208], 0
push 0x206
mov ebx, eax
lea eax, [ebp - 0x206]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x42c]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push 0x401a18
push eax
call esi
add esp, 0x1c
test byte [ebp - 0x458], 0x10
je 0x407ceb
lea eax, [ebp - 0x42c]
push eax
call fcn.00404b60
test eax, eax
pop ecx
jne 0x407cf8
lea eax, [ebp - 0x208]
push eax
call fcn.00407c2f
pop ecx
jmp 0x407cf8
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test ebx, ebx
jne 0x407c7c
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
neg eax
sbb eax, eax
pop edi
inc eax
pop esi
leave
ret
Function at 0x407d32
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x874
and dword [ebp - 4], 0
push esi
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x874]
push 0x401a24
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x464]
push eax
lea eax, [ebp - 0x874]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
test eax, eax
mov dword [ebp - 8], eax
je 0x407e5d
cmp eax, 0xffffffff
je 0x407e5d
push ebx
push edi
mov ebx, 0x206
mov edi, 0x401a18
lea eax, [ebp - 0x464]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
and word [ebp - 0x66c], 0
push ebx
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x66a]
push 0
push eax
call sub.MSVCRT.dll_memset
and word [ebp - 0x214], 0
push ebx
lea eax, [ebp - 0x212]
push 0
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x66c]
push edi
push eax
call esi
lea eax, [ebp - 0x438]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x214]
push edi
push eax
call esi
add esp, 0x38
test byte [ebp - 0x464], 0x10
je 0x407e3b
lea eax, [ebp - 0x438]
push eax
call fcn.00404b60
test eax, eax
pop ecx
jne 0x407e51
lea eax, [ebp - 0x214]
push eax
call fcn.00407d16
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x66c]
push eax
call fcn.00407d32
add esp, 0xc
add dword [ebp - 4], eax
jmp 0x407e51
push 1
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp dword [ebp - 0xc], 0
jne 0x407d8e
pop edi
pop ebx
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 4]
pop esi
leave
ret

Function at 0x407fd0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
xor edi, edi
mov esi, 0x206
push esi
lea eax, [ebp - 0x20e]
push edi
push eax
mov word [ebx], di
mov word [ebp - 0x210], di
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 8]
push eax
push 0x208
lea eax, [ebp - 0x210]
push eax
push edi
push 9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.SETUPAPI.dll_SetupDiGetDeviceRegistryPropertyW]
test eax, eax
je 0x4080a0
push esi
lea eax, [ebp - 0x416]
push edi
push eax
mov word [ebp - 0x418], di
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x210]
push eax
push 0x402018
lea eax, [ebp - 0x418]
push 0x401ce0
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
push eax
push 0x401ff0
lea eax, [ebp - 0x418]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], 1
mov dword [ebp + 0x10], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4080a0
lea eax, [ebp - 0x210]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x40868e
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4a4
push ebx
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x94]
push eax
call fcn.00404497
pop ecx
pop ecx
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 0x50]
mov eax, dword [ebp - 0x54]
xor ebx, ebx
cmp esi, ebx
mov dword [ebp - 0x14], eax
mov dword [ebp - 8], esi
jne 0x4086cf
push 3
pop eax
jmp 0x408842
cmp dword [ebp - 0x48], ebx
mov dword [ebp - 0xc], ebx
je 0x4086f7
push 0x23
push ebx
push dword [ebp - 0x48]
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, ebx
je 0x4086f7
mov word [eax], bx
add eax, 2
push eax
call fcn.00402b60
pop ecx
mov dword [ebp - 0xc], eax
push ebx
lea eax, [ebp - 0x29c]
push eax
mov edi, 0x104
push edi
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
je 0x40871d
lea eax, [ebp - 0x29c]
mov dword [ebp - 8], eax
jmp 0x408728
push esi
call fcn.00402cb4
test eax, eax
pop ecx
je 0x4086c7
push ebx
call dword [sym.imp.ole32.dll_CoInitialize]
lea eax, [ebp - 4]
push eax
push 0x402978
push 1
push ebx
push 0x402988
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov esi, eax
cmp esi, ebx
jne 0x40883a
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 0x10]
push edx
push 0x402998
push eax
call dword [ecx]
mov esi, eax
cmp esi, ebx
jne 0x408831
mov eax, dword [ebp - 0x54]
cmp word [eax], 0x21
jne 0x408784
lea esi, [eax + 2]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push 2
push eax
call dword [ecx + 0x3c]
jmp 0x408787
mov esi, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
push dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
mov eax, dword [ebp - 4]
push dword [ebp - 0x4c]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
push dword [ebp - 0xc]
mov eax, dword [ebp - 4]
push dword [ebp - 0x48]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
mov eax, dword [ebp - 4]
push dword [ebp - 0x44]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
push dword [ebp - 0x40]
call fcn.004043ee
test eax, eax
pop ecx
je 0x4087d9
push dword [ebp - 0x40]
call fcn.00402cb4
test eax, eax
pop ecx
je 0x4087d9
push dword [ebp - 0x40]
jmp 0x4087ea
push dword [ebp - 8]
call fcn.00402c6d
cmp eax, dword [ebp - 8]
pop ecx
je 0x4087f3
push dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
push 0x402224
push esi
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push edi
push esi
lea eax, [ebp - 0x4a4]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyNW]
push esi
call fcn.00402cdc
mov eax, dword [ebp - 0x10]
pop ecx
mov ecx, dword [eax]
push ebx
lea edx, [ebp - 0x4a4]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret