joyce8/EMBER2024-capa huggingface dataset:
Function at 0x416f50
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x148], 0
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
cmp eax, 0x5c
jne 0x416f95
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp + 8]
movsx eax, byte [edx + ecx]
cmp eax, 0x5c
je 0x416fc5
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + edx]
push ecx
call fcn.00439e43
add esp, 4
test eax, eax
je 0x416fdd
mov edx, 1
shl edx, 0
mov eax, dword [ebp + 8]
movsx ecx, byte [eax + edx]
cmp ecx, 0x3a
jne 0x416fdd
mov edx, dword [ebp + 8]
push edx
push 0x46890c
push 0x474738
call fcn.00439aa0
add esp, 0xc
jmp 0x416ff8
mov eax, dword [ebp + 8]
push eax
push 0x5ad620
push 0x468910
push 0x474738
call fcn.00439aa0
add esp, 0x10
push 0x474738
mov ecx, dword [ebp + 8]
push ecx
push 0x5ad620
mov edx, dword [ebp + 0xc]
push edx
push str.FindFileAny_in__u___s____s______s__r_n
call fcn.004147f0
add esp, 0x14
lea eax, [ebp - 0x144]
push eax
push 0x474738
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x14c], eax
cmp dword [ebp - 0x14c], 0xffffffff
je 0x417112
lea ecx, [ebp - 0x144]
push ecx
call fcn.00416f20
add esp, 4
test eax, eax
jne 0x4170e9
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x150], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x150], 0
jne 0x4170e9
mov ecx, dword [ebp + 8]
push ecx
push 0x474738
call fcn.004392f0
add esp, 8
push 0x5c
push 0x474738
call fcn.0043a8c0
add esp, 8
mov dword [ebp - 0x148], eax
cmp dword [ebp - 0x148], 0
je 0x4170ae
mov edx, dword [ebp - 0x148]
add edx, 1
mov dword [ebp - 0x148], edx
jmp 0x4170b8
mov dword [ebp - 0x148], 0x474738
lea eax, [ebp - 0x144]
push eax
call fcn.00416ef0
add esp, 4
push eax
mov ecx, dword [ebp - 0x148]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x474738
push str.____s_r_n
call fcn.004147f0
add esp, 8
jmp 0x417105
lea edx, [ebp - 0x144]
push edx
mov eax, dword [ebp - 0x14c]
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41703c
mov ecx, dword [ebp - 0x14c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp - 0x148], 0
jne 0x41711f
xor eax, eax
jmp 0x417124
mov eax, 0x474738
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret

Function at 0x417140
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 8]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x417171
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x417450
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
and eax, 0x80
je 0x41746f
mov dword [ebp - 8], 1
jmp 0x417476
mov dword [ebp - 8], 0
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx ecx, ax
and ecx, 0x80
je 0x417492
mov dword [ebp - 0xc], 2
jmp 0x417499
mov dword [ebp - 0xc], 0
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
movsx edx, ax
and edx, 0x80
je 0x4174b5
mov dword [ebp - 0x10], 4
jmp 0x4174bc
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
or eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
xor ecx, dword [ebp - 4]
and ecx, 1
je 0x4174fb
mov edx, dword [ebp + 8]
and edx, 1
je 0x4174e4
mov dword [ebp - 0x14], 0
jmp 0x4174eb
mov dword [ebp - 0x14], 2
push 0
mov eax, dword [ebp - 0x14]
push eax
push 0x2a
push 0x10
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [ebp + 8]
xor ecx, dword [ebp - 4]
and ecx, 2
je 0x41752e
mov edx, dword [ebp + 8]
and edx, 2
je 0x417517
mov dword [ebp - 0x18], 0
jmp 0x41751e
mov dword [ebp - 0x18], 2
push 0
mov eax, dword [ebp - 0x18]
push eax
push 0x1d
push 0x11
call dword [sym.imp.USER32.dll_keybd_event]
mov ecx, dword [ebp + 8]
xor ecx, dword [ebp - 4]
and ecx, 4
je 0x417561
mov edx, dword [ebp + 8]
and edx, 4
je 0x41754a
mov dword [ebp - 0x1c], 0
jmp 0x417551
mov dword [ebp - 0x1c], 2
push 0
mov eax, dword [ebp - 0x1c]
push eax
push 0x38
push 0x12
call dword [sym.imp.USER32.dll_keybd_event]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret

Function at 0x417cb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
push eax
push 0x64
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x417cd5
push 0x4689dc
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx]
test eax, eax
je 0x417d05
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp + 0xc]
movsx eax, byte [edx + eax - 1]
cmp eax, 0x5c
je 0x417d05
push 0x4689e0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.00417c20
add esp, 0xc
mov eax, dword [ebp + 0xc]
push eax
call fcn.004150e0
add esp, 4
test eax, eax
jne 0x417d15
push 0
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll__lcreat]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x417d58
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll__lclose]
mov esp, ebp
pop ebp
ret
Function at 0x4180c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp dword [0x4740f0], 0
je 0x4180ec
mov eax, dword [0x4740f0]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4180ec
mov ecx, dword [0x4740f0]
push ecx
call dword [sym.imp.USER32.dll_DestroyWindow]
mov dword [0x4740f0], 0
lea edx, [ebp - 8]
push edx
push 0
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
call fcn.0043aa18
add esp, 0x18
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x418125
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41812c
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x418480
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 4]
mov dword [ebp - 8], ecx
cmp dword [ebp + 0xc], 0
jle 0x4185bb
mov dword [ebp - 4], 0
mov edx, 1
imul eax, edx, 0
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov al, byte [esi + eax]
mov byte [edx + ecx], al
mov ecx, 1
shl ecx, 0
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov cl, byte [esi + ecx]
mov byte [eax + edx], cl
mov edx, 1
shl edx, 1
mov eax, 1
imul ecx, eax, 0
mov eax, dword [ebp - 8]
mov esi, dword [ebp + 8]
mov dl, byte [esi + edx]
mov byte [eax + ecx], dl
mov eax, dword [ebp - 4]
shr eax, 0x12
and eax, 0x3f
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 0x10]
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov al, byte [esi + eax]
mov byte [ecx + edx], al
mov ecx, dword [ebp - 4]
shr ecx, 0xc
and ecx, 0x3f
mov edx, 1
shl edx, 0
mov eax, dword [ebp + 0x10]
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov cl, byte [esi + ecx]
mov byte [eax + edx], cl
mov edx, dword [ebp - 4]
shr edx, 6
and edx, 0x3f
mov eax, 1
shl eax, 1
mov ecx, dword [ebp + 0x10]
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov dl, byte [esi + edx]
mov byte [ecx + eax], dl
mov eax, dword [ebp - 4]
and eax, 0x3f
mov ecx, 1
imul edx, ecx, 3
mov ecx, dword [ebp + 0x10]
mov esi, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov al, byte [esi + eax]
mov byte [ecx + edx], al
cmp dword [ebp + 0xc], 3
jge 0x418587
mov ecx, 1
imul edx, ecx, 3
mov eax, dword [ebp + 0x10]
mov byte [eax + edx], 0x3d
cmp dword [ebp + 0xc], 2
jge 0x41859b
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp + 0x10]
mov byte [edx + ecx], 0x3d
mov eax, dword [ebp + 0xc]
sub eax, 3
mov dword [ebp + 0xc], eax
mov ecx, dword [ebp + 0x10]
add ecx, 4
mov dword [ebp + 0x10], ecx
mov edx, dword [ebp + 8]
add edx, 3
mov dword [ebp + 8], edx
jmp 0x418493
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4185d0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
test ecx, ecx
je 0x418723
mov edx, 1
shl edx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
test ecx, ecx
je 0x418723
mov edx, 1
shl edx, 1
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
test ecx, ecx
je 0x418723
mov edx, 1
imul eax, edx, 3
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
test edx, edx
je 0x418723
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
jmp 0x418650
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x4186a3
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 8]
movzx edx, byte [ecx]
push edx
mov eax, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
push eax
call fcn.00439480
add esp, 8
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x418680
mov dword [ebp - 0x10], 0
jmp 0x41868f
mov ecx, dword [ebp - 0xc]
sub ecx, dword [str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
and ecx, 0x3f
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 4]
shl edx, 6
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
or eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x418647
mov ecx, dword [ebp - 4]
shr ecx, 0x10
and ecx, 0xff
mov edx, dword [ebp + 0xc]
mov byte [edx], cl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, 1
shl ecx, 1
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x3d
je 0x4186ea
mov ecx, dword [ebp - 4]
shr ecx, 8
and ecx, 0xff
mov edx, dword [ebp + 0xc]
mov byte [edx], cl
mov eax, dword [ebp + 0xc]
add eax, 1
mov dword [ebp + 0xc], eax
mov ecx, 1
imul edx, ecx, 3
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x3d
je 0x418715
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp + 0xc]
mov byte [eax], dl
mov ecx, dword [ebp + 0xc]
add ecx, 1
mov dword [ebp + 0xc], ecx
mov edx, dword [ebp + 8]
add edx, 4
mov dword [ebp + 8], edx
jmp 0x4185dc
mov eax, dword [ebp + 0xc]
sub eax, dword [ebp - 0x14]
mov esp, ebp
pop ebp
ret

Function at 0x4190e0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
movsx ecx, byte [eax]
test ecx, ecx
jne 0x4190f4
mov eax, 0x102
jmp 0x41911b
mov edx, dword [ebp + 8]
push edx
push 0
call fcn.004191c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebp
ret

Function at 0x419120
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push 0
call fcn.004191c0
push eax
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
push 0xffffffffffffffff
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebp
ret
Function at 0x41bcc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov dword [ebp - 4], 0x3e8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
cmp dword [ebp + 8], 0
je 0x41bd1a
mov ecx, dword [ebp + 8]
movsx edx, byte [ecx]
test edx, edx
je 0x41bd1a
mov eax, dword [ebp + 8]
push eax
call fcn.004396d4
add esp, 4
mov dword [ebp - 4], eax
push 0x4692b0
mov ecx, dword [ebp + 8]
push ecx
call fcn.00413e00
add esp, 8
test eax, eax
jne 0x41bd1a
imul edx, dword [ebp - 4], 0x3e8
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0x1f4
jbe 0x41bd2c
mov dword [ebp - 0x10], 0x64
jmp 0x41bd33
mov dword [ebp - 0x10], 0xa
mov eax, dword [ebp - 8]
add eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, 1
test ecx, ecx
je 0x41bda6
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 0xc]
sub edx, dword [ebp - 8]
jns 0x41bd58
jmp 0x41bda6
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageA]
test eax, eax
je 0x41bd9a
cmp dword [ebp - 0x28], 0x12
jne 0x41bd76
jmp 0x41bda6
push 0
push 0
push 0
lea ecx, [ebp - 0x2c]
push ecx
call dword [sym.imp.USER32.dll_GetMessageA]
lea edx, [ebp - 0x2c]
push edx
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x41bd3c
mov esp, ebp
pop ebp
ret
Function at 0x41bdb0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x460
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x408], 1
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
test ecx, ecx
jne 0x41bdde
xor eax, eax
jmp 0x41bf06
push 0x469190
call fcn.00439775
add esp, 4
test eax, eax
jne 0x41bdf6
xor eax, eax
jmp 0x41bf06
mov edx, dword [ebp + 8]
push edx
push str.comspec
call fcn.00439775
add esp, 4
push eax
push str._s__c__s
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea ecx, [ebp - 0x404]
push ecx
push 0x4691ac
call fcn.004145f0
add esp, 8
mov edx, dword [ebp + 8]
push edx
push str.SystemCall___s__r_n
call fcn.00426800
add esp, 8
push 0x44
push 0
lea eax, [ebp - 0x460]
push eax
call fcn.0043a830
add esp, 0xc
mov dword [ebp - 0x460], 0x44
xor ecx, ecx
mov word [ebp - 0x430], cx
mov dword [ebp - 0x428], 0
mov dword [ebp - 0x424], 0
mov dword [ebp - 0x420], 0
lea edx, [ebp - 0x41c]
push edx
lea eax, [ebp - 0x460]
push eax
push 0
push 0
push 0x8000000
push 1
push 0
push 0
lea ecx, [ebp - 0x404]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov dword [ebp - 0x40c], eax
cmp dword [ebp - 0x40c], 0
je 0x41beec
mov edx, dword [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xffffffffffffffff
mov eax, dword [ebp - 0x41c]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x41c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x41bf00
mov dword [ebp - 0x408], 0
push 0
call fcn.0041c710
add esp, 4
mov eax, dword [ebp - 0x408]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret
Function at 0x41df60
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x41df8d
xor eax, eax
jmp 0x41dfa8
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041cf20
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret

Function at 0x41dfc0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x41dfed
xor eax, eax
jmp 0x41e008
mov ecx, dword [ebp + 0xc]
push ecx
push 0
push 0
lea edx, [ebp - 0x404]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0041cf20
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret
Function at 0x41e020
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa14
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0xa04]
push eax
call fcn.0041bca0
add esp, 8
test eax, eax
jne 0x41e052
xor eax, eax
jmp 0x41e218
push str._fonts_
lea ecx, [ebp - 0xa04]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edx, dword [ebp + 0xc]
push edx
push 0
lea eax, [ebp - 0x604]
push eax
lea ecx, [ebp - 0xa04]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0041cf20
add esp, 0x14
mov dword [ebp - 0xa14], eax
cmp dword [ebp - 0xa14], 1
jne 0x41e216
lea eax, [ebp - 0x604]
push eax
call fcn.004150e0
add esp, 4
test eax, eax
je 0x41e216
lea ecx, [ebp - 0x604]
push ecx
call dword [sym.imp.GDI32.dll_AddFontResourceA]
push 0x5c
lea edx, [ebp - 0x604]
push edx
call fcn.0043a8c0
add esp, 8
mov dword [ebp - 0xa08], eax
cmp dword [ebp - 0xa08], 0
je 0x41e0ec
mov eax, dword [ebp - 0xa08]
add eax, 1
mov dword [ebp - 0xa08], eax
jmp 0x41e0f8
lea ecx, [ebp - 0x604]
mov dword [ebp - 0xa08], ecx
push 0x1e0
lea edx, [ebp - 0x204]
push edx
lea eax, [ebp - 0x604]
push eax
call fcn.0041fd10
add esp, 0xc
test eax, eax
je 0x41e1de
push 0x200
push str.__TrueType_
lea ecx, [ebp - 0x204]
push ecx
call fcn.004140e0
add esp, 0xc
cmp dword [0x4677e8], 0
je 0x41e149
mov dword [ebp - 0xa10], 0x100
jmp 0x41e153
mov dword [ebp - 0xa10], 0
push 0
lea edx, [ebp - 0xa0c]
push edx
push 0
mov eax, dword [ebp - 0xa10]
or eax, 0xf003f
push eax
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionFonts
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x41e1de
mov ecx, dword [ebp - 0xa08]
push ecx
call fcn.004393f0
add esp, 4
add eax, 1
push eax
mov edx, dword [ebp - 0xa08]
push edx
push 1
push 0
lea eax, [ebp - 0x204]
push eax
mov ecx, dword [ebp - 0xa0c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0xa0c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0xa08]
push eax
lea ecx, [ebp - 0x204]
push ecx
push str.Registry:_store__s_as__s_r_n
call fcn.004145f0
add esp, 0xc
push 0
push 0
push 0x1d
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
push str.fonts
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteProfileStringA]
mov eax, 1
jmp 0x41e218
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret
Function at 0x41e3a0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
push ecx
push 0x469f5c
call fcn.004145f0
add esp, 8
mov edx, dword [ebp + 8]
push edx
push str.Create_Directory___s__r_n
call fcn.00426800
add esp, 8
mov eax, dword [ebp - 4]
push eax
call fcn.00415180
add esp, 4
test eax, eax
je 0x41e3e3
mov eax, 1
jmp 0x41e44a
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
test edx, edx
jne 0x41e3f1
xor eax, eax
jmp 0x41e44a
push 0x5c
mov eax, dword [ebp - 4]
add eax, 1
push eax
call fcn.00439480
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x41e425
mov ecx, dword [ebp - 4]
mov byte [ecx], 0
push 0
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov eax, dword [ebp - 4]
mov byte [eax], 0x5c
jmp 0x41e3f1
push 0
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov edx, dword [ebp + 8]
push edx
call fcn.00415220
add esp, 4
test eax, eax
jne 0x41e445
xor eax, eax
jmp 0x41e44a
mov eax, 1
mov esp, ebp
pop ebp
ret

Function at 0x41e450
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
push eax
push 0x469f8c
call fcn.004145f0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
push str.Remove_Directory___s__r_n
call fcn.00426800
add esp, 8
mov edx, dword [ebp + 8]
movsx eax, byte [edx]
test eax, eax
jne 0x41e486
xor eax, eax
jmp 0x41e4fd
mov ecx, dword [ebp + 8]
push ecx
call fcn.00415220
add esp, 4
test eax, eax
jne 0x41e49d
mov eax, 1
jmp 0x41e4fd
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [ebp + 8]
push eax
call fcn.00415220
add esp, 4
test eax, eax
jne 0x41e4c0
mov dword [ebp - 4], 1
jmp 0x41e4c7
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
cmp dword [ebp - 0xc], 0
je 0x41e4dc
mov dword [ebp - 8], 0x469fbc
jmp 0x41e4e3
mov dword [ebp - 8], 0x469fc4
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp + 8]
push eax
push str.Remove_Directory___s___s_r_n
call fcn.004145f0
add esp, 0xc
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x41f550
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push str.Change_the_Directory___s__r_n
call fcn.004145f0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41f576
xor eax, eax
jmp 0x41f57b
mov eax, 1
pop ebp
ret

Function at 0x41f580
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push eax
push str.Change_the_Drive___s__r_n
call fcn.004145f0
add esp, 8
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
test eax, eax
jne 0x41f5a6
xor eax, eax
jmp 0x41f5ab
mov eax, 1
pop ebp
ret

Function at 0x420270
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc04
mov eax, dword [0x4713e0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x400
lea eax, [ebp - 0x804]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x400
lea edx, [ebp - 0xc04]
push edx
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push 0x400
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edx, [ebp - 0x404]
push edx
call fcn.004393f0
add esp, 4
movzx eax, byte [ebp + eax - 0x405]
cmp eax, 0x5c
je 0x4202ef
push 0x4697f4
lea ecx, [ebp - 0x404]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.wininit.ini
lea edx, [ebp - 0x404]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0xc04]
push eax
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 0x404]
push edx
push str.Windows_9x_Move_via__s___s____s__r_n
call fcn.004145f0
add esp, 0x10
lea eax, [ebp - 0x404]
push eax
lea ecx, [ebp - 0x804]
push ecx
lea edx, [ebp - 0xc04]
push edx
push str.rename
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00439b24
mov esp, ebp
pop ebp
ret