joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a13e
Capabilities:
Delete registry key

Disassembly:
push 0x234
mov eax, 0x597027
call fcn.00410ff3
push 0x208
lea eax, [ebp - 0x218]
push 0
push eax
call fcn.00431720
push 0x59baf0
lea eax, [ebp - 0x218]
push str._sService
push eax
call fcn.00402189
add esp, 0x18
lea ecx, [ebp - 0x240]
call fcn.00415179
and dword [ebp - 4], 0
call fcn.004158de
test al, al
je 0x40a1b0
push edi
push eax
push esp
pop edx
pop edx
pop edx
pop ebp
push ebp
pop ebp
push edx
pop ecx
push esp
push ebp
push ebp
push esi
pop esi
push ebx
push eax
pop ecx
pop esi
pop edx
push ebx
pop esp
pop esi
pop ebp
push ebp
pop esp
push ecx
pop edx
pop ebp
pop edi
call fcn.00415899
test al, al
je 0x40a1d4
push ebx
pop ecx
push edi
pop ebx
push esi
pop ebx
pop ecx
push ecx
pop esi
pop edi
pop ecx
pop edx
push ebx
push esp
pop esi
pop esp
pop edx
push esp
pop ecx
pop edx
push ecx
push edi
push ecx
pop edx
push esi
pop esi
pop ebp
lea ecx, [ebp - 0x240]
call fcn.004151ad
test eax, eax
je 0x40a22d
lea eax, [ebp - 0x21c]
push eax
push 0xf013f
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
call fcn.004155e7
test al, al
je 0x40a229
push edi
pop ecx
push esi
push ebx
push edi
push ebp
push ebp
push esp
pop eax
pop edi
pop ecx
pop ebp
pop ecx
pop esp
push esi
pop eax
pop ebp
push ebp
push ebp
push eax
pop edi
push edx
push eax
push eax
pop ebp
push ebx
pop edx
push ebp
pop esi
test ebx, ebx
jmp 0x40a2a7
call fcn.0041555d
test al, al
je 0x40a247
push ebx
push edx
pop edi
pop esp
push esp
pop eax
push edx
pop edi
pop ebp
push esi
push edi
push edi
push edi
push ebp
pop esi
pop ebp
pop esi
call fcn.00415a37
test al, al
je 0x40a26d
push edx
pop esi
push esp
pop ebx
pop eax
push edi
push ebp
push eax
pop ebx
pop esp
push edi
push esp
pop edx
pop edx
push edi
push edx
push esi
pop ecx
pop eax
pop ebx
pop eax
push esp
pop edi
push ecx
pop esp
pop ebp
pop esp
pop ebp
push esi
call fcn.00415ac1
test al, al
je 0x40a287
pop edi
pop esi
push edx
push esp
pop eax
push esp
pop edx
push ebp
push edx
push edx
push edx
push edi
pop ebp
push esp
pop eax
pop esi
pop esp
lea eax, [ebp - 0x21c]
push eax
push 0xf003f
push 0
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40a2c8
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x21c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0x240]
call fcn.0041518c
call fcn.00410fae
ret
Function at 0x40c136
Capabilities:
Delete registry value

Disassembly:
push 0x424
mov eax, 0x5973a1
call fcn.00410ff3
push 0x208
xor esi, esi
lea eax, [ebp - 0x218]
push esi
push eax
call fcn.00431720
lea eax, [ebp - 0x218]
push 0x59baf0
push eax
call fcn.0043fbd8
lea eax, [ebp - 0x218]
push 0x59c93c
push eax
call fcn.0043841c
add esp, 0x1c
lea eax, [ebp - 0x218]
lea ecx, [ebp - 0x430]
push eax
call fcn.00429a8f
lea ecx, [ebp - 0x430]
mov dword [ebp - 4], esi
call fcn.004212c6
test eax, eax
jne 0x40c240
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x428]
push eax
mov ebx, 0xf003f
push ebx
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_accept
call edi
test eax, eax
jne 0x40c240
lea eax, [ebp - 0x424]
push eax
push ebx
push esi
push 0x59bf64
push dword [ebp - 0x428]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c235
push 0x208
lea eax, [ebp - 0x420]
push esi
push eax
call fcn.00431720
push 0x59bf70
push 0x59baf0
lea eax, [ebp - 0x420]
push 0x59bb90
push eax
call fcn.00402189
add esp, 0x1c
lea eax, [ebp - 0x420]
push eax
push dword [ebp - 0x424]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x424]
call edi
push dword [ebp - 0x428]
call edi
xor esi, esi
inc esi
lea ecx, [ebp - 0x430]
call fcn.00429aa4
mov eax, esi
call fcn.00410fae
ret

Function at 0x40cf50
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x597493
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x620290]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0xffffffff
mov dword [esi + 4], 0xffffffff
mov dword [esi + 0xc], 0
mov dword [esi + 0x20], 0x625070
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
lea ecx, [esi + 0x34]
mov dword [esi], vtable.TiXmlDocument.0
mov dword [ebp - 4], 0
mov dword [ecx], 0x625070
mov dword [esi + 0x40], 0xffffffff
mov dword [esi + 0x3c], 0xffffffff
push 0
push 0x59b66c
mov byte [ebp - 4], 1
mov dword [esi + 0x38], 4
mov byte [esi + 0x44], 0
mov byte [esi + 0x2c], 0
mov dword [esi + 0x30], 0
call fcn.00410b40
mov dword [esi + 0x40], 0
mov eax, esi
mov dword [esi + 0x3c], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4122af
Capabilities:
Set registry value

Disassembly:
push 0x2c
mov eax, 0x5979e5
call fcn.00410fbf
xor esi, esi
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00415179
lea ecx, [ebp - 0x38]
mov dword [ebp - 4], esi
call fcn.004151ad
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x4122e8
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x412358
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x59baf0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x412325
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x412358
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push 1
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x38]
call fcn.0041518c
call fcn.00410f99
ret 8
Function at 0x41285d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x30
mov eax, 0x597aa9
call fcn.00410fbf
xor esi, esi
mov dword [ebp - 0x18], 0x104
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], esi
call fcn.00415179
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], esi
call fcn.004151ad
test eax, eax
mov edi, 0xf013f
lea eax, [ebp - 0x10]
push eax
jne 0x41289d
mov edi, 0xf003f
push edi
push esi
push str.SoftWare
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4128ff
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x59baf0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4128da
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4128ff
lea eax, [ebp - 0x18]
push eax
push dword [ebp + 0xc]
push esi
push esi
push dword [ebp + 8]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x14]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x10]
call esi
lea ecx, [ebp - 0x3c]
call fcn.0041518c
call fcn.00410f99
ret 8

Function at 0x412a5e
Capabilities:
Read .ini file

Disassembly:
push 0x838
mov eax, 0x597acf
call fcn.00410ff3
mov edi, ecx
mov ecx, dword [ebp + 0xc]
lea eax, [edi + 0x8c]
cmp dword [eax + 0x14], 8
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x844], ecx
jb 0x412a89
mov eax, dword [eax]
push eax
push dword [ebp + 0x10]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esi, eax
cmp esi, dword [ebp + 0x10]
jne 0x412b67
xor esi, esi
mov dword [ebp - 0x814], 7
push esi
xor eax, eax
mov dword [ebp - 0x818], esi
push 0x59b670
lea ecx, [ebp - 0x828]
mov word [ebp - 0x828], ax
call fcn.00401f62
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.00431720
push dword [ebp + 0x10]
lea eax, [ebp - 0x810]
push 0x59d454
push eax
call fcn.00402189
add esp, 0x18
lea eax, [ebp - 0x810]
cmp byte [edi + 5], 0
mov ecx, edi
push eax
push dword [ebp - 0x844]
lea eax, [ebp - 0x840]
push ebx
push eax
je 0x412b1c
call fcn.0041297a
jmp 0x412b21
call fcn.00412a34
push eax
lea ecx, [ebp - 0x828]
call fcn.00404595
push esi
push 1
lea ecx, [ebp - 0x840]
call fcn.00401bfd
cmp dword [ebp - 0x814], 8
lea eax, [ebp - 0x828]
cmovae eax, dword [ebp - 0x828]
push eax
call fcn.00440e5f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x828]
mov esi, eax
call fcn.00401bfd
mov eax, esi
call fcn.00410fae
ret 0xc
Function at 0x412b71
Capabilities:
Read .ini file

Disassembly:
push 0x82c
mov eax, 0x597b19
call fcn.00410ff3
mov edi, ecx
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x830], eax
mov eax, dword [ebp + 0x10]
push 0x800
mov dword [ebp - 0x82c], eax
lea eax, [ebp - 0x810]
push ecx
push eax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x838], esi
mov dword [ebp - 0x834], ecx
call fcn.00431720
lea eax, [edi + 0x8c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x412bce
mov eax, dword [eax]
push eax
push 0x400
lea eax, [ebp - 0x810]
push eax
push ebx
push dword [ebp - 0x82c]
push dword [ebp - 0x830]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.0040135f
and dword [ebp - 4], 0
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x834], 1
jb 0x412c14
mov eax, dword [esi]
jmp 0x412c16
mov eax, esi
push ebx
push eax
call fcn.004383dc
pop ecx
pop ecx
test eax, eax
jne 0x412c62
cmp byte [edi + 5], 0
lea eax, [ebp - 0x828]
push ebx
push dword [ebp - 0x82c]
mov ecx, edi
push dword [ebp - 0x830]
push eax
je 0x412c46
call fcn.0041297a
jmp 0x412c4b
call fcn.00412a34
push eax
mov ecx, esi
call fcn.00404595
push 0
push 1
lea ecx, [ebp - 0x828]
call fcn.00401bfd
mov eax, esi
call fcn.00410fae
ret 0x10
Function at 0x413803
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa44
mov eax, dword [0x620290]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x208
xor esi, esi
lea eax, [ebp - 0x20c]
push esi
push eax
mov edi, ecx
call fcn.00431720
lea eax, [edi + 0x2c]
add esp, 0xc
cmp dword [eax + 0x14], 8
jb 0x41383c
mov eax, dword [eax]
push str.conf
push eax
lea eax, [ebp - 0x20c]
push 0x59d3e0
push eax
call fcn.00402189
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x413874
lea eax, [ebp - 0x20c]
push eax
call fcn.004178ac
pop ecx
push 0x208
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.00431720
push str.vstginf.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push 0x59bb90
push eax
call fcn.00402189
add esp, 0x1c
cmp word [ebp - 0x414], si
jne 0x4138b3
mov eax, esi
jmp 0x4138c0
lea eax, [ebp - 0x414]
push eax
call fcn.00434fd1
pop ecx
push eax
lea eax, [ebp - 0x414]
push eax
lea ecx, [edi + 0x8c]
call fcn.00401f62
push 0x208
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.00431720
push str.useCache.ini
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x61c]
push 0x59bb90
push eax
call fcn.00402189
add esp, 0x1c
cmp word [ebp - 0x61c], si
jne 0x413912
mov eax, esi
jmp 0x41391f
lea eax, [ebp - 0x61c]
push eax
call fcn.00434fd1
pop ecx
push eax
lea eax, [ebp - 0x61c]
push eax
lea ecx, [edi + 0xa4]
call fcn.00401f62
push 0x208
lea eax, [ebp - 0x824]
push esi
push eax
call fcn.00431720
lea eax, [ebp - 0xa44]
push str.DSKXRoad
push eax
call fcn.00418cef
add esp, 0x14
cmp dword [eax + 0x14], 8
jb 0x413960
mov eax, dword [eax]
push eax
lea eax, [ebp - 0x824]
push 0x59bb7c
push eax
call fcn.00402189
add esp, 0xc
lea ecx, [ebp - 0xa44]
push esi
push 1
call fcn.00401bfd
lea eax, [ebp - 0x824]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4139a1
lea eax, [ebp - 0x824]
push eax
call fcn.004178ac
pop ecx
push 0x208
lea eax, [ebp - 0xa2c]
push esi
push eax
call fcn.00431720
push str.useCache.ini
lea eax, [ebp - 0x824]
push eax
lea eax, [ebp - 0xa2c]
push 0x59bb90
push eax
call fcn.00402189
add esp, 0x1c
cmp word [ebp - 0xa2c], si
je 0x4139eb
lea eax, [ebp - 0xa2c]
push eax
call fcn.00434fd1
pop ecx
mov esi, eax
push esi
lea eax, [ebp - 0xa2c]
push eax
lea ecx, [edi + 0xbc]
call fcn.00401f62
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00410f88
mov esp, ebp
pop ebp
ret
Function at 0x414011
Capabilities:
Read .ini file

Disassembly:
push 0x23c
mov eax, 0x597c13
call fcn.00410ff3
mov ebx, ecx
call fcn.00412851
lea edi, [ebx + 0xd4]
push eax
mov ecx, edi
call fcn.00401f3b
mov esi, str.GoodZip.ini
push esi
call fcn.00434fd1
pop ecx
push eax
push esi
mov ecx, edi
call fcn.00401cf3
push str.gdysgf
push 0x59c9c0
push str.GDsftinf
lea eax, [ebp - 0x230]
mov ecx, ebx
push eax
call fcn.00412b71
lea esi, [ebx + 0xec]
push eax
mov ecx, esi
call fcn.00404595
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00401bfd
push str.gdysgf
mov ecx, esi
call fcn.00405c82
test eax, eax
jne 0x414100
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00431720
add esp, 0xc
cmp dword [edi + 0x14], 8
jb 0x4140b1
mov edi, dword [edi]
push edi
push 0x104
lea eax, [ebp - 0x218]
mov edi, str.gdysgf
push eax
push edi
push 0x59c9c0
push str.GDsftinf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x4140e2
xor eax, eax
jmp 0x4140ef
lea eax, [ebp - 0x218]
push eax
call fcn.00434fd1
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401f62
jmp 0x414105
mov edi, str.gdysgf
push edi
mov ecx, esi
call fcn.00405c82
test eax, eax
jne 0x4141c8
push 0x208
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.00431720
add esp, 0xc
lea eax, [ebx + 0x5c]
lea ecx, [ebp - 0x230]
push eax
call fcn.00402647
and dword [ebp - 4], 0
push str.GoodZip.ini
call fcn.00434fd1
pop ecx
push eax
push str.GoodZip.ini
lea ecx, [ebp - 0x230]
call fcn.00401cf3
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x230]
cmovae eax, dword [ebp - 0x230]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
push edi
push 0x59c9c0
push str.GDsftinf
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x218], 0
jne 0x414199
xor eax, eax
jmp 0x4141a6
lea eax, [ebp - 0x218]
push eax
call fcn.00434fd1
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00401f62
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x230]
push 0
push 1
call fcn.00401bfd
push edi
mov ecx, esi
call fcn.00405c82
test eax, eax
jne 0x414204
push edi
push 0x59c9c0
push str.GDsftinf
lea eax, [ebp - 0x248]
mov ecx, ebx
push eax
call fcn.00412a0a
push eax
mov ecx, esi
call fcn.00404595
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.00401bfd
call fcn.00410fae
ret
Function at 0x414b07
Capabilities:
Enumerate processes

Disassembly:
push 0x284
mov eax, 0x5989bd
call fcn.00410ff3
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x290], ebx
test eax, eax
je 0x414d0d
push eax
lea ecx, [ebp - 0x40]
call fcn.0040135f
lea eax, [ebp - 0x40]
xor esi, esi
push eax
mov dword [ebp - 4], esi
call fcn.0041a64e
mov dword [esp], 0x22c
lea eax, [ebp - 0x284]
push esi
push eax
call fcn.00431720
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x28c], eax
cmp eax, 0xffffffff
je 0x414cff
call fcn.00415671
test al, al
je 0x414b92
push ebp
pop esi
pop edi
pop eax
push esp
pop edx
push ecx
pop ecx
pop ebx
push ecx
push eax
push esi
push esp
push ebp
push ebp
push edx
push edi
push edi
pop ecx
push esi
push esi
mov ebx, dword [ebp - 0x290]
call fcn.00415740
test al, al
je 0x414bab
pop eax
pop edi
pop ecx
push esp
push esp
push edi
push edi
pop esp
pop eax
pop esi
pop esi
pop ebp
pop esi
pop edi
push edi
pop esi
mov esi, dword [ebp - 0x28c]
lea eax, [ebp - 0x284]
push eax
push esi
mov dword [ebp - 0x284], 0x22c
call sub.KERNEL32.dll_Process32FirstW
jmp 0x414c8d
and dword [ebp - 0x18], 0
xor eax, eax
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x414bf4
lea eax, [ebp - 0x260]
push eax
call fcn.00434fd1
pop ecx
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.00401f62
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.0041a64e
pop ecx
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040296f
test eax, eax
je 0x414c48
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00419877
pop ecx
pop ecx
push eax
lea ecx, [ebp - 0x40]
or ebx, 1
call fcn.0040296f
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x414c4f
mov byte [ebp - 0x285], 1
test bl, 1
je 0x414c63
push 0
push 1
lea ecx, [ebp - 0x58]
and ebx, 0xfffffffe
call fcn.00401bfd
cmp byte [ebp - 0x285], 0
jne 0x414d13
push 0
push 1
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00401bfd
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x414bcd
call fcn.0041555d
test al, al
je 0x414cb5
push esi
push edx
push edx
push ecx
pop eax
push ebp
push esp
pop edx
pop edi
push eax
push edx
pop ecx
pop ecx
push edi
push ebx
pop edx
pop esi
push esi
push edi
pop edx
pop eax
push eax
push eax
call fcn.004155a2
test al, al
je 0x414cd5
pop esi
push ebp
pop ebx
push ecx
pop esp
pop ebx
push esi
push ecx
pop ebp
pop esi
pop edi
pop ebp
push esp
pop esi
pop edx
push ebp
push esp
push ecx
pop edx
pop esi
pop esp
pop eax
pop ebx
call fcn.00415968
test al, al
je 0x414cf1
pop esi
push eax
pop edx
pop esp
push edi
push ebp
push eax
push esp
pop edx
push esp
pop esi
pop esi
pop ebp
pop ebx
pop eax
pop eax
pop edi
pop ebx
push esi
push dword [ebp - 0x28c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00401bfd
mov eax, esi
call fcn.00410fae
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
push 0
push 1
call fcn.00401bfd
jmp 0x414cff
Function at 0x4150b2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00414b07
mov edi, eax
pop ecx
test edi, edi
jg 0x4150d0
xor eax, eax
jmp 0x415172
call fcn.004155a2
test al, al
je 0x4150eb
pop eax
push edx
push edi
pop esi
push edx
push esi
push edi
push esi
push eax
push eax
pop esp
pop ebp
push edi
pop ecx
push esp
pop esp
pop esi
push ebx
call fcn.00415a37
test al, al
je 0x415104
push ebx
pop esi
pop esi
push ebp
pop edx
push ecx
pop ebx
pop eax
pop ecx
pop esp
pop esi
pop ecx
pop edx
push ebp
pop edx
push edi
push edi
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 4], eax
test eax, eax
je 0x4150c9
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov dword [ebp - 8], eax
call fcn.004157ca
test al, al
je 0x415143
pop edx
pop ebx
pop esi
push edi
pop edi
push ecx
pop edx
push ebp
pop eax
pop ebp
push edx
push eax
push eax
pop edx
push edi
pop esp
pop eax
push ebx
pop edi
pop edx
push edx
pop eax
push esi
call fcn.00415449
test al, al
je 0x415166
pop esp
push ebx
push eax
pop edi
pop ecx
pop edx
push ebp
push eax
pop ecx
push edi
pop eax
pop ebx
push edi
pop ecx
push ebx
pop edi
push eax
pop ecx
push edi
pop esp
push ebx
pop edi
push edx
pop edi
push edx
pop esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415ec6
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x620290]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00431720
push 0x59baf0
lea eax, [ebp - 0x20c]
push str.C:log_s.log
push eax
call fcn.00402189
add esp, 0x18
call fcn.004159f2
test al, al
je 0x415f2b
push edi
pop esp
push esp
pop edi
push esi
pop edx
push ecx
pop edx
push esi
pop edx
push esi
push eax
push esp
pop ebx
pop ebp
push ebx
pop ebx
push edx
push esp
pop ebp
push ebp
push edi
push ebp
pop esi
push ebx
pop ebx
call fcn.004158de
test al, al
je 0x415f45
pop ebp
push esi
pop eax
pop esp
push ecx
pop ebp
push ebx
pop ebp
pop ecx
pop edi
push edi
pop ecx
push ecx
pop eax
pop ebx
push esp
pop edx
call fcn.004155e7
test al, al
je 0x415f60
pop ecx
push esp
pop ebp
push esi
pop esp
pop eax
pop edi
push ebp
push esp
pop edi
push ecx
pop ecx
push edx
push ecx
pop ecx
push eax
push esp
push ecx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
xor ecx, ebp
pop esi
neg eax
pop ebx
call fcn.00410f88
mov esp, ebp
pop ebp
ret
Function at 0x41654e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x4165cd
push ebx
push edi
xor edi, edi
push str.f2da34836ca34ce8b141b10b95246713
mov dword [ebp + 8], edi
call fcn.00434ff0
mov ebx, dword [ebp + 0xc]
mov edx, edi
pop ecx
test ebx, ebx
je 0x41658a
mov cl, byte [edi + str.f2da34836ca34ce8b141b10b95246713]
xor byte [edx + esi], cl
inc edi
xor ecx, ecx
cmp edi, eax
cmovge edi, ecx
inc edx
cmp edx, ebx
jb 0x416574
cmp ebx, 1
jle 0x4165c1
cmp byte [esi], 0x37
jne 0x4165c1
mov al, byte [esi + 1]
cmp al, 0x7a
je 0x41659f
cmp al, 0x5a
jne 0x4165c1
lea eax, [ebp + 8]
push eax
push ebx
push esi
call fcn.0058bce0
test eax, eax
je 0x4165c1
mov edx, dword [ebp + 8]
test edx, edx
je 0x4165c1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
jmp 0x4165cb
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov eax, dword [ebp + 0x14]
mov dword [eax], ebx
pop edi
pop ebx
pop esi
pop ebp
ret

Function at 0x4178ac
Capabilities:
Check if file exists
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
push dword [ebp + 8]
call fcn.00434fd1
mov dword [ebp - 8], eax
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00411084
push dword [ebp + 8]
mov dword [ebp - 4], eax
push eax
call fcn.0043fbd8
add esp, 0x10
call fcn.004156b6
test al, al
je 0x417903
push eax
pop edx
pop edi
pop edi
push ebp
pop ecx
push ecx
push edi
push esp
push edi
push esi
push ebp
pop esi
pop ecx
pop esp
push esi
pop esp
push ecx
push esp
push eax
pop ecx
pop ecx
call fcn.00415785
test al, al
je 0x417928
pop ebx
push ecx
pop edx
push ebp
push edx
pop edi
pop edi
pop esp
push ebp
pop esi
pop edx
pop ebp
pop esi
pop edx
push edi
pop ebp
push ebp
push edi
push ebp
pop edx
push ebp
push esi
pop esi
pop esi
pop ebp
push edx
push ebp
pop esp
call fcn.004156b6
test al, al
je 0x417948
pop esi
push ebp
pop edx
pop edx
push ebp
push edi
pop eax
push ebp
pop edx
pop ecx
pop esp
push esp
pop edi
push esp
pop edx
push ebp
push esi
push edi
push edi
pop ebx
pop ebp
pop ebx
push esp
mov edi, dword [ebp - 8]
xor esi, esi
xor ebx, ebx
inc esi
test edi, edi
js 0x4179bd
mov esi, dword [ebp - 4]
cmp word [esi + ebx*2], 0x5c
jne 0x4179b5
call fcn.004155e7
test al, al
je 0x41798a
push edi
pop ecx
push esi
push ebx
push edi
push ebp
push ebp
push esp
pop eax
pop edi
pop ecx
pop ebp
pop ecx
pop esp
push esi
pop eax
pop ebp
push ebp
push ebp
push eax
pop edi
push edx
push eax
push eax
pop ebp
push ebx
pop edx
push ebp
pop esi
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
movzx eax, word [esi + ebx*2]
mov dword [ebp - 0xc], eax
xor eax, eax
push esi
mov word [esi + ebx*2], ax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4179ae
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4179cf
mov eax, dword [ebp - 0xc]
mov word [esi + ebx*2], ax
inc ebx
cmp ebx, edi
jle 0x417957
xor esi, esi
inc esi
push dword [ebp - 4]
call fcn.0041108d
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
jmp 0x4179bd