joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415817
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
push ebx
push edi
mov byte [ebp - 1], 1
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push 1
push eax
call fcn.00452f80
add esp, 0x10
push 0x18ee
push 4
lea eax, [ebp - 0x14]
push eax
call fcn.0041536f
lea eax, [ebp - 0x14]
push str.FILE
push eax
mov byte [ebp - 0x10], 0
call fcn.00452590
test eax, eax
pop ecx
pop ecx
jne 0x41596c
push dword [esi]
lea eax, [ebp - 0xc]
push 1
push 4
push eax
call fcn.00452f80
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xadbc
lea ebx, [edi + edi]
push ebx
lea eax, [ebp - 0x228]
push 1
push eax
call fcn.00452f80
add esp, 0x20
add edi, 0xb33f
push edi
push ebx
lea eax, [ebp - 0x228]
push eax
call fcn.0041536f
and word [ebp + ebx - 0x228], 0
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x438]
push eax
call fcn.0044f88d
push dword [esi]
lea eax, [ebp - 0xc]
push 1
push 4
push eax
call fcn.00452f80
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0xf820
lea ebx, [edi + edi]
push ebx
lea eax, [ebp - 0x228]
push 1
push eax
call fcn.00452f80
add esp, 0x28
add edi, 0xf479
push edi
push ebx
lea eax, [ebp - 0x228]
push eax
call fcn.0041536f
and word [ebp + ebx - 0x228], 0
lea eax, [ebp - 0x228]
push eax
push dword [ebp + 0xc]
call fcn.0044f88d
push dword [ebp + 8]
lea eax, [ebp - 0x438]
push eax
call fcn.0045190a
add esp, 0x10
test eax, eax
je 0x415983
xor edi, edi
inc edi
push edi
push edi
push dword [esi]
call fcn.00452925
add esp, 0xc
push dword [esi]
lea eax, [ebp - 8]
push edi
push 4
push eax
call fcn.00452f80
xor dword [ebp - 8], 0x87bc
mov eax, dword [ebp - 8]
push edi
add eax, 0x18
push eax
push dword [esi]
call fcn.00452925
add esp, 0x1c
jmp 0x415970
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 1
je 0x415826
push 6
pop eax
pop edi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x41597d
Function at 0x41d8ae
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, eax
mov eax, dword [edi + 4]
mov eax, dword [eax]
cmp dword [eax + 8], 4
jne 0x41d914
push 0x60
call fcn.0044f907
test eax, eax
pop ecx
je 0x41d8d5
call fcn.0040d004
mov ebx, eax
jmp 0x41d8d7
xor ebx, ebx
mov eax, dword [edi + 4]
mov esi, dword [eax]
call fcn.00412367
push eax
xor eax, eax
inc eax
mov ecx, ebx
call fcn.0040d014
test al, al
jne 0x41d951
test ebx, ebx
je 0x41d902
mov esi, ebx
call fcn.0040d1e6
push ebx
call fcn.0044f971
pop ecx
mov esi, dword [ebp + 8]
push 0
call fcn.00412945
pop esi
xor eax, eax
pop ebx
pop ebp
ret 8
call fcn.00412462
mov ecx, eax
dec ecx
js 0x41d902
mov eax, dword [edi + 4]
mov eax, dword [eax]
call fcn.004136e2
test al, al
je 0x41d902
cmp ecx, dword [esi + 0x374]
jge 0x41d902
mov eax, dword [esi + 0x370]
mov ecx, dword [eax + ecx*4]
cmp dword [ecx], 0
je 0x41d902
mov ecx, dword [ecx]
cmp dword [ecx], 0
jne 0x41d902
mov ebx, dword [ecx + 4]
test byte [ebx], 3
je 0x41d902
mov eax, dword [edi + 4]
mov eax, dword [eax + 4]
cmp dword [eax + 8], 0xb
je 0x41d9d1
test byte [ebx], 0x10
jne 0x41d9d1
mov esi, eax
call fcn.00412367
mov ecx, eax
mov esi, ebx
call fcn.0040d2a8
cmp byte [ebp + 0xc], 0
je 0x41da08
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
call fcn.00412367
push eax
call fcn.0045179a
test eax, eax
pop ecx
je 0x41d9c3
mov ecx, dword [edi + 4]
mov esi, dword [ecx + 4]
lea eax, [eax + eax - 2]
mov dword [ebp + 0xc], eax
call fcn.00412367
mov ecx, dword [ebp + 0xc]
cmp word [eax + ecx], 0xd
je 0x41da08
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
call fcn.00412367
mov ecx, dword [ebp + 0xc]
cmp word [eax + ecx], 0xa
je 0x41da08
mov ecx, 0x46d1e0
mov esi, ebx
call fcn.0040d2a8
jmp 0x41da08
call fcn.004123cc
push dword [ebx + 4]
mov edx, eax
mov eax, dword [edi + 4]
mov ecx, dword [eax + 4]
call fcn.0041232c
push eax
push 1
push edx
call fcn.00452b74
push dword [ebx + 4]
call fcn.00452796
add esp, 0x14
test eax, eax
je 0x41da08
mov esi, dword [ebp + 8]
push 0
call fcn.00412945
mov eax, dword [edi + 4]
mov eax, dword [eax]
cmp dword [eax + 8], 4
jne 0x41d90c
mov esi, ebx
call fcn.0040d1e6
call fcn.0040d1e6
push ebx
call fcn.0044f971
pop ecx
jmp 0x41d90c
Function at 0x41de9e
Capabilities:
Enumerate files on windows
Enumerate files recursively
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
push edi
lea eax, [ebp - 0x258]
push eax
push dword [ebp + 8]
mov ebx, ecx
call esi
mov edi, eax
cmp edi, 0xffffffff
je 0x41df1e
lea eax, [ebp - 0x22c]
push 0x46d028
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x41df0c
lea eax, [ebp - 0x22c]
push 0x46fe2c
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x41df0c
push dword [ebp + 0x10]
lea eax, [ebp - 0x22c]
push dword [ebp + 0xc]
push eax
call fcn.0040df7e
add esp, 0xc
test al, al
je 0x41df36
lea eax, [ebp - 0x258]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x41dec5
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindClose]
call edi
cmp byte [ebp + 0x14], 0
jne 0x41df41
mov al, 1
pop edi
pop esi
pop ebx
leave
ret 0x10
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor al, al
jmp 0x41df2f
lea eax, [ebp - 0x258]
push eax
push 0x46fe24
call esi
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
je 0x41dfcf
mov esi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
test byte [ebp - 0x258], 0x10
je 0x41dfbb
lea eax, [ebp - 0x22c]
push 0x46d028
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x41dfbb
lea eax, [ebp - 0x22c]
push 0x46fe2c
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x41dfbb
lea eax, [ebp - 0x22c]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, ebx
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0041de9e
test al, al
je 0x41dfd3
push 0x46fe2c
call esi
lea eax, [ebp - 0x258]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x41df5d
mov bl, 1
jmp 0x41dfd5
xor bl, bl
push dword [ebp - 4]
call edi
mov al, bl
jmp 0x41df2f
Function at 0x41f44e
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
push ebx
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push str.___s
push eax
call fcn.00451a26
lea eax, [ebp - 0x208]
push eax
call fcn.0045179a
add esp, 0x10
xor ebx, ebx
cmp word [ebp + eax*2 - 0x20a], 0x5c
jne 0x41f4b5
lea eax, [ebp - 0x208]
push eax
call fcn.0045179a
cmp word [ebp + eax*2 - 0x20c], 0x3a
pop ecx
je 0x41f4b5
lea eax, [ebp - 0x208]
push eax
call fcn.0045179a
pop ecx
mov word [ebp + eax*2 - 0x20a], bx
push ebx
push edi
call dword [sym.imp.KERNEL32.DLL_CreateDirectoryW]
test eax, eax
jne 0x41f4ca
cmp byte [ebp + 8], bl
je 0x41f596
push esi
push ebx
push 0x2200000
push 3
push ebx
push ebx
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x41f581
push 0x14
lea eax, [ebp - 0x820]
push ebx
push eax
call fcn.00451720
lea eax, [ebp - 0x208]
push eax
mov dword [ebp - 0x820], 0xa0000003
call fcn.0045179a
add eax, eax
mov word [ebp - 0x816], ax
mov eax, dword [ebp - 0x816]
add eax, 2
mov word [ebp - 0x814], ax
push 0x104
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x810]
push eax
call fcn.004517b0
mov eax, dword [ebp - 0x816]
add esp, 0x1c
push ebx
add eax, 0xc
mov word [ebp - 0x81c], ax
lea ecx, [ebp + 0xc]
push ecx
push ebx
movzx eax, ax
push ebx
add eax, 8
push eax
lea eax, [ebp - 0x820]
push eax
push 0x900a4
push esi
call dword [sym.imp.KERNEL32.DLL_DeviceIoControl]
test eax, eax
push esi
jne 0x41f58c
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryW]
xor eax, eax
jmp 0x41f595
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
xor eax, eax
inc eax
pop esi
pop ebx
leave
ret 8
Function at 0x420118
Capabilities:
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set current directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x25c
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
push edi
lea eax, [esp + 0x18]
push eax
push dword [ebp + 8]
mov dword [esp + 0x1c], ecx
call esi
mov edi, eax
cmp edi, 0xffffffff
jne 0x42014d
xor al, al
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov ebx, dword [sym.imp.KERNEL32.DLL_FindNextFileW]
lea eax, [esp + 0x44]
push 0x46d028
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x4201a2
lea eax, [esp + 0x44]
push 0x46fe2c
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x4201a2
lea eax, [esp + 0x44]
push eax
call dword [sym.imp.KERNEL32.DLL_GetFileAttributesW]
or eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
not ecx
and eax, ecx
push eax
lea eax, [esp + 0x48]
push eax
call dword [sym.imp.KERNEL32.DLL_SetFileAttributesW]
test eax, eax
je 0x4201c1
lea eax, [esp + 0x18]
push eax
push edi
call ebx
test eax, eax
jne 0x420153
push edi
mov edi, dword [sym.imp.KERNEL32.DLL_FindClose]
call edi
cmp byte [ebp + 0x14], 0
jne 0x4201cd
mov al, 1
jmp 0x420144
push edi
call dword [sym.imp.KERNEL32.DLL_FindClose]
jmp 0x420142
lea eax, [esp + 0x18]
push eax
push 0x46fe24
call esi
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x42024f
mov esi, dword [sym.imp.KERNEL32.DLL_SetCurrentDirectoryW]
test byte [esp + 0x18], 0x10
je 0x420240
lea eax, [esp + 0x44]
push 0x46d028
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x420240
lea eax, [esp + 0x44]
push 0x46fe2c
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x420240
lea eax, [esp + 0x44]
push eax
call esi
push dword [ebp + 0x14]
mov ecx, dword [esp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00420118
test al, al
je 0x420253
push 0x46fe2c
call esi
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x14]
call ebx
test eax, eax
jne 0x4201e8
mov bl, 1
jmp 0x420255
xor bl, bl
push dword [esp + 0x10]
call edi
mov al, bl
jmp 0x420144
Function at 0x420bc5
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
push dword [ebp + 8]
lea esi, [ebp - 0xc]
mov dword [ebp - 0x10], ecx
call fcn.00410005
mov edi, esi
lea esi, [ebp - 0x20]
call fcn.00410051
push 0x46fe24
mov eax, edi
call fcn.00410258
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0xc]
mov byte [ebp + 0xb], 1
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x14], eax
je 0x420d18
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp - 0x10]
call fcn.0041b437
cmp eax, 1
je 0x420d14
cmp eax, 0xb
jne 0x420c38
push 0xa
call dword [sym.imp.KERNEL32.DLL_Sleep]
jmp 0x420c18
lea eax, [ebp - 0x244]
push 0x46d028
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x420cfa
lea eax, [ebp - 0x244]
push 0x46fe2c
push eax
call fcn.0045190a
test eax, eax
pop ecx
pop ecx
je 0x420cfa
lea ebx, [ebp - 0x20]
lea eax, [ebp - 0xc]
call fcn.00410194
lea eax, [ebp - 0x244]
push eax
lea eax, [ebp - 0xc]
call fcn.00410258
test byte [ebp - 0x270], 0x10
je 0x420cd2
mov edi, dword [ebp + 0x14]
xor ebx, ebx
cmp byte [ebp + 0x18], bl
je 0x420ca1
add dword [edi], 1
adc dword [edi + 4], ebx
cmp byte [ebp + 0x1c], bl
je 0x420cfa
push 0x46c6b8
lea eax, [ebp - 0xc]
call fcn.00410258
push dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x10]
push dword [ebp + 0x18]
push edi
push esi
push dword [ebp + 0xc]
push dword [ebp - 0xc]
call fcn.00420bc5
cmp al, bl
mov byte [ebp + 0xb], al
je 0x420d18
jmp 0x420cfa
mov eax, dword [ebp - 0x250]
mov edx, dword [ebp - 0x254]
xor ecx, ecx
xor edi, edi
or ecx, eax
mov eax, dword [ebp + 0xc]
or edx, edi
add dword [eax], ecx
adc dword [eax + 4], edx
cmp byte [ebp + 0x18], 0
je 0x420cfa
add dword [esi], 1
adc dword [esi + 4], edi
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x420c18
jmp 0x420d18
mov byte [ebp + 0xb], 0
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.DLL_FindClose]
push dword [ebp - 0x20]
call fcn.0044f971
pop ecx
push dword [ebp - 0xc]
call fcn.0044f971
mov al, byte [ebp + 0xb]
pop ecx
pop edi
pop esi
pop ebx
leave
ret 0x18
Function at 0x428cfd
Capabilities:
Set socket configuration

Disassembly:
push ebx
push edi
push dword [esp + 0x10]
or eax, 0xffffffff
mov word [esi], 2
call fcn.0040fc7c
pop ecx
mov ebx, eax
push ebx
call sub.WSOCK32.dll_inet_addr
push ebx
mov edi, eax
call fcn.0044f971
cmp edi, 0xffffffff
pop ecx
jne 0x428d2d
push 0
push 1
jmp 0x428d51
mov eax, dword [esp + 0x14]
lea ecx, [eax - 1]
cmp ecx, 0xfffe
mov dword [esi + 4], edi
ja 0x428d4d
push eax
call sub.WSOCK32.dll_htons
mov word [esi + 2], ax
mov al, 1
jmp 0x428d5c
push 0
push 2
mov eax, dword [esp + 0x14]
call fcn.0041c7b4
xor al, al
pop edi
pop ebx
ret 0xc

Function at 0x4299ce
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x284
and dword [ebp - 8], 0
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0xc], 0x80004002
mov dword [ebp - 4], 0x28
call fcn.0040ffb3
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x10]
push eax
mov ebx, 0x20019
push ebx
push 0
push str.interface
mov edi, SysReAllocString
push edi
call esi
test eax, eax
je 0x429a2c
mov esi, 0x80004002
push dword [ebp - 0x20]
call fcn.0044f971
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 0x28]
push eax
xor eax, eax
push eax
push eax
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 8]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x429afa
mov eax, dword [ebp - 4]
and word [ebp + eax*2 - 0x78], 0
push str.interface_
lea eax, [ebp - 0x20]
mov dword [ebp - 4], 0x1fe
call fcn.004101c0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x20]
call fcn.00410258
lea eax, [ebp - 0x14]
push eax
push ebx
push 0
push dword [ebp - 0x20]
push edi
call esi
test eax, eax
jne 0x429ae5
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x280]
push eax
xor eax, eax
push eax
push eax
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x429adc
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
and word [ebp + eax*2 - 0x280], 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x280]
push eax
call fcn.0044f7d2
test eax, eax
pop ecx
pop ecx
jne 0x429adc
push dword [ebp + 8]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.ole32.dll_IIDFromString]
mov dword [ebp - 0xc], eax
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0xc], 0
je 0x429afa
inc dword [ebp - 8]
mov dword [ebp - 4], 0x28
jmp 0x429a2c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0xc]
jmp 0x429a1c
Function at 0x429b0b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
push ebx
push esi
push edi
lea ecx, [ebp - 0x20]
call fcn.0040ffb3
fld1
lea eax, [ebp - 0xc]
fstp qword [ebp - 0x28]
push eax
push dword [ebp + 8]
call dword [sym.imp.ole32.dll_StringFromIID]
mov esi, eax
xor edi, edi
cmp esi, edi
jl 0x429ca2
push dword [ebp - 0xc]
call fcn.0040f3d2
mov esi, eax
lea eax, [ebp - 0x20]
mov dword [esp], str.interface_
call fcn.004101c0
push esi
lea eax, [ebp - 0x20]
call fcn.00410258
push str.TypeLib
lea eax, [ebp - 0x20]
call fcn.00410258
push esi
call fcn.0044f971
pop ecx
push dword [ebp - 0xc]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
lea eax, [ebp - 8]
push eax
push 0x20019
push edi
push dword [ebp - 0x20]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, edi
jne 0x429ca2
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push edi
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
call ebx
mov esi, eax
cmp esi, edi
jne 0x429c99
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x240], di
lea eax, [ebp - 0x240]
push eax
call fcn.0040f3d2
pop ecx
lea ecx, [ebp - 0x38]
push ecx
push eax
mov dword [ebp - 0x14], eax
call dword [sym.imp.ole32.dll_CLSIDFromString]
push dword [ebp - 0x14]
mov esi, eax
call fcn.0044f971
cmp esi, edi
pop ecx
jl 0x429c99
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x240]
push eax
push edi
push edi
push str.Version
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
call ebx
test eax, eax
jne 0x429c44
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x240], di
lea eax, [ebp - 0x240]
push eax
call fcn.0045257a
fstp qword [ebp - 0x28]
pop ecx
fld1
lea eax, [ebp - 0x10]
push eax
push edi
sub esp, 0x10
fstp qword [esp + 8]
fld qword [ebp - 0x28]
fstp qword [esp]
call fcn.004544e0
add esp, 0x10
call fcn.00466d26
fld qword [ebp - 0x28]
push eax
call fcn.00466d26
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.OLEAUT32.dll_RegisterTypeLib]
mov esi, eax
cmp esi, edi
jl 0x429c99
push dword [ebp + 0xc]
mov eax, dword [ebp - 0x10]
push dword [ebp + 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x20]
call fcn.0044f971
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x429cb2
Capabilities:
Connect network resource
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
push ebx
push esi
xor esi, esi
push edi
lea ecx, [ebp - 0x24]
mov edi, eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], esi
call fcn.0040ffb3
lea ecx, [ebp - 0x18]
call fcn.0040ffb3
lea ecx, [ebp - 0x30]
call fcn.0040ffb3
push str.SOFTWAREClasses_
lea eax, [ebp - 0x24]
call fcn.004101c0
push dword [ebp + 8]
lea eax, [ebp - 0x24]
call fcn.00410258
push str.CLSID
lea eax, [ebp - 0x24]
call fcn.00410258
push 0x46bf80
lea eax, [ebp - 0x18]
call fcn.004101c0
cmp edi, esi
je 0x429d39
cmp word [edi], 0x5c
je 0x429d39
cmp word [edi + 2], 0x5c
je 0x429d39
push 0x470924
lea eax, [ebp - 0x18]
call fcn.004101c0
push edi
lea eax, [ebp - 0x18]
call fcn.00410258
cmp dword [ebp + 0x10], esi
je 0x429d88
push 0x20
lea eax, [ebp - 0x50]
push esi
push eax
call fcn.00451720
add esp, 0xc
lea ebx, [ebp - 0x18]
lea eax, [ebp - 0x30]
mov dword [ebp - 0x4c], esi
call fcn.00410194
push str.IPC_
lea eax, [ebp - 0x30]
call fcn.00410258
mov eax, dword [ebp - 0x30]
push esi
push dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push dword [ebp + 0x14]
lea eax, [ebp - 0x50]
push eax
call sub.MPR.dll_WNetAddConnection2W
mov edi, eax
cmp edi, esi
jne 0x429e24
lea eax, [ebp - 0xc]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov edi, eax
cmp edi, esi
jne 0x429e24
lea eax, [ebp - 8]
push eax
push 0x20019
push esi
push dword [ebp - 0x24]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edi, eax
cmp edi, esi
jne 0x429e1f
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x258]
push eax
push esi
push esi
push esi
push dword [ebp - 8]
mov dword [ebp - 4], 0x1fe
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, eax
cmp edi, esi
jne 0x429e1a
shr dword [ebp - 4], 1
mov eax, dword [ebp - 4]
mov word [ebp + eax*2 - 0x258], si
lea eax, [ebp - 0x258]
push eax
call fcn.0040f3d2
pop ecx
push dword [ebp + 0xc]
mov esi, eax
push esi
call dword [sym.imp.ole32.dll_CLSIDFromString]
push esi
mov edi, eax
call fcn.0044f971
pop ecx
push dword [ebp - 8]
call ebx
push dword [ebp - 0xc]
call ebx
push dword [ebp - 0x30]
call fcn.0044f971
push dword [ebp - 0x18]
call fcn.0044f971
push dword [ebp - 0x24]
call fcn.0044f971
add esp, 0xc
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x42f1fe
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2018
call fcn.00454df0
push ebx
push esi
push edi
lea ecx, [ebp - 0xc]
call fcn.0040ffb3
lea ecx, [ebp - 0x18]
call fcn.0040ffb3
mov esi, dword [ebp + 8]
xor edi, edi
call fcn.00412367
mov esi, eax
movzx eax, word [esi]
xor bl, bl
test ax, ax
je 0x42f32c
inc edi
cmp ax, 0x25
jne 0x42f2eb
cmp word [esi + edi*2], ax
jne 0x42f25b
push 0x25
lea eax, [ebp - 0xc]
mov bl, 1
call fcn.0041029f
inc edi
jmp 0x42f2f4
push 0x46bf80
lea eax, [ebp - 0x18]
call fcn.004101c0
jmp 0x42f27c
test ax, ax
je 0x42f286
movzx eax, ax
push eax
lea eax, [ebp - 0x18]
call fcn.0041029f
inc edi
movzx eax, word [esi + edi*2]
cmp ax, 0x25
jne 0x42f26a
cmp word [esi + edi*2], 0
je 0x42f303
and word [ebp - 0x2018], 0
push 0xfff
lea eax, [ebp - 0x2018]
push eax
push dword [ebp - 0x18]
inc edi
call dword [sym.imp.KERNEL32.DLL_GetEnvironmentVariableW]
test eax, eax
je 0x42f2c2
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0xc]
call fcn.00410258
mov bl, 1
jmp 0x42f2f4
push 0x4716f8
lea eax, [ebp - 0xc]
mov bl, 1
call fcn.00410258
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0xc]
call fcn.0041021c
push 0x4716f8
lea eax, [ebp - 0xc]
call fcn.00410258
jmp 0x42f2f4
push eax
lea eax, [ebp - 0xc]
call fcn.0041029f
movzx eax, word [esi + edi*2]
test ax, ax
jne 0x42f238
jmp 0x42f31d
push 0x4716f8
lea eax, [ebp - 0xc]
mov bl, 1
call fcn.00410258
lea eax, [ebp - 0x18]
lea ecx, [ebp - 0xc]
call fcn.0041021c
test bl, bl
je 0x42f32c
mov ebx, dword [ebp + 8]
lea edi, [ebp - 0xc]
call fcn.00412a3d
push dword [ebp - 0x18]
call fcn.0044f971
push dword [ebp - 0xc]
call fcn.0044f971
pop ecx
pop ecx
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x432579
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push ebx
push esi
push edi
push str.open
lea esi, [ebp - 0x18]
mov edi, eax
call fcn.00410005
xor ebx, ebx
push 0x3c
lea eax, [ebp - 0x54]
push ebx
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], 1
call fcn.00451720
add esp, 0xc
cmp dword [ebp + 0x10], 2
jb 0x4325da
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
call fcn.00412367
cmp word [eax], bx
je 0x4325da
mov eax, dword [edi + 4]
mov esi, dword [eax + 4]
call fcn.00412367
push eax
call fcn.0040f3d2
pop ecx
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 3
jb 0x4325f5
mov eax, dword [edi + 4]
mov esi, dword [eax + 8]
call fcn.00412367
push eax
call fcn.0040f3d2
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp + 0x10], 4
jb 0x432622
mov eax, dword [edi + 4]
mov esi, dword [eax + 0xc]
call fcn.00412367
cmp word [eax], bx
je 0x432622
mov eax, dword [edi + 4]
mov esi, dword [eax + 0xc]
call fcn.00412389
mov ebx, eax
lea eax, [ebp - 0x18]
call fcn.00410194
xor ebx, ebx
cmp dword [ebp + 0x10], 5
jb 0x432639
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x10]
call fcn.00412462
movzx eax, ax
mov dword [ebp - 0xc], eax
push 0x3c
pop esi
push esi
lea eax, [ebp - 0x54]
push ebx
push eax
call fcn.00451720
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [edi + 4]
mov dword [ebp - 0x54], esi
mov dword [ebp - 0x50], 0x40
mov dword [ebp - 0x4c], ebx
mov esi, dword [eax]
add esp, 0xc
call fcn.00412367
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x54]
push eax
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], edi
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
cmp esi, ebx
mov dword [ebp + 0x10], eax
je 0x432694
push esi
call fcn.0044f971
pop ecx
cmp edi, ebx
je 0x43269f
push edi
call fcn.0044f971
pop ecx
cmp dword [ebp + 0x10], ebx
jne 0x4326ba
mov eax, dword [ebp + 8]
push ebx
push 1
call fcn.0041c7b4
mov esi, dword [ebp + 0x14]
push ebx
call fcn.00412945
jmp 0x4326e5
cmp byte [ebp + 0xc], bl
je 0x4326cd
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x554], eax
jmp 0x4326e5
mov esi, dword [ebp + 0x14]
push 1
call fcn.00412945
cmp dword [ebp - 0x1c], ebx
je 0x4326e5
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
push dword [ebp - 0x18]
call fcn.0044f971
pop ecx
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 0x10