joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4024dc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jne 0x402523
mov eax, 0x5d3c00
jmp 0x4026ee
cmp dword [ebp + 0x14], 0
je 0x402537
mov eax, 0x100
jmp 0x40253c
mov eax, 0x200
mov dword [ebp - 0x1c], eax
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 0x1c]
push 2
mov ebx, 0x4b7d20
call fcn.004b7854
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x402585
add eax, 8
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegOpenKeyExW
cmp dword [ebp - 0x1c], esp
je 0x4025aa
push 0xbc
push 0x41721b4
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4025c1
mov eax, 0x5d3c00
jmp 0x4026ee
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x4025e2
add eax, 8
push eax
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
cmp dword [ebp - 0x1c], esp
je 0x402607
push 0x184
push 0x41721b4
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40269e
push 0x80000301
push 0
push dword [ebp - 0x14]
push 1
mov ebx, 0x4b99e0
call fcn.004b7854
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x402647
push ebx
call fcn.004b784e
add esp, 4
pop eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
call fcn.004022dc
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x402676
add eax, 8
push eax
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
cmp dword [ebp - 0x20], esp
je 0x40269b
push 0x269
push 0x41721b4
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4026a8
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x1c], esp
je 0x4026cf
push 0x2f0
push 0x41721b4
push 6
call fcn.004b785a
add esp, 0xc
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4026e9
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004b7848
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4026ee
push eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x4026ff
push ebx
call fcn.004b784e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40303c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x403084
mov eax, 0x5d3c00
push eax
push 1
mov ebx, 0x4b7f40
call fcn.004b7854
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x4030a9
jmp 0x40321b
push dword [ebp + 8]
call fcn.00402d78
mov dword [ebp - 8], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x5d3bf8]
fstp qword [ebp - 0x28]
mov dword [ebp - 0x2c], esp
fld qword [ebp - 0x28]
call fcn.004020b4
push eax
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
cmp dword [ebp - 0x2c], esp
je 0x4030f8
push 0x129
push 0x4170f25
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 0xc], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fsub qword [0x5d3bf8]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.004020b4
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x4031f1
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.00403224
mov word [ebp - 0x14], ax
cmp word [ebp - 0x14], 0x2f
jne 0x40314e
mov word [ebp - 0x14], 0x5c
cmp word [ebp - 0x14], 0
jne 0x40318f
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CreateDirectoryW
cmp dword [ebp - 0x1c], esp
je 0x403185
push 0x26e
push 0x4170f25
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x4031f1
cmp word [ebp - 0x14], 0x5c
jne 0x4031d8
cmp dword [ebp - 0x18], 0
jle 0x4031d0
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CreateDirectoryW
cmp dword [ebp - 0x1c], esp
je 0x4031d0
push 0x30f
push 0x4170f25
push 6
call fcn.004b785a
add esp, 0xc
inc dword [ebp - 0x18]
jmp 0x4031d8
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00403248
pop ebx
pop ecx
pop edx
add ecx, 2
jmp 0x403121
add esp, 0xc
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_LocalFree
cmp dword [ebp - 0x1c], esp
je 0x40321b
push 0x3c0
push 0x4170f25
push 6
call fcn.004b785a
add esp, 0xc
mov esp, ebp
pop ebp
ret 4
Function at 0x40682c
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x406864
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x406852
mov al, 1
jmp 0x4068c3
cmp dword [ebx + 0x54], ecx
jne 0x40685b
mov al, 2
jmp 0x4068c3
cmp dword [ebx + 0x7c], ecx
jne 0x4068c3
mov al, 3
jmp 0x4068c3
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x406879
mov al, 4
jmp 0x4068c3
cmp ecx, 5
jne 0x406899
cmp ebx, 0
jne 0x406887
mov al, 5
jmp 0x4068c3
cmp ebx, 1
jne 0x406890
mov al, 6
jmp 0x4068c3
cmp ebx, 2
jne 0x406899
mov al, 7
jmp 0x4068c3
cmp ecx, 6
jne 0x4068c1
cmp ebx, 0
jne 0x4068a7
mov al, 8
jmp 0x4068c3
cmp ebx, 1
jne 0x4068ae
mov al, 9
cmp ebx, 2
jne 0x4068b5
mov al, 0xa
cmp ebx, 3
jne 0x4068bc
mov al, 0xb
cmp ebx, 4
jne 0x4068c3
mov al, 0xc
pop ebx
leave
ret
Function at 0x408a9c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp + 8], 0
jne 0x408ace
mov eax, 0
jmp 0x408c8a
cmp dword [ebp + 0x1c], 0
je 0x408ae2
mov eax, 0x100
jmp 0x408ae7
mov eax, 0x200
mov dword [ebp - 0x10], eax
push 0x80000301
push 0
push 0x20006
push 0x80000301
push 0
push dword [ebp - 0x10]
push 2
mov ebx, 0x4b7d20
call fcn.004b7854
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 0x10], esp
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x408b30
add eax, 8
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegOpenKeyExW
cmp dword [ebp - 0x10], esp
je 0x408b55
push 0xbd
push 0x41721b5
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
jne 0x408bb9
mov dword [ebp - 0x10], esp
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp - 4]
push 0
push 0
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x408b91
add eax, 8
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegCreateKeyExW
cmp dword [ebp - 0x10], esp
je 0x408bb6
push 0x141
push 0x41721b5
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408bcd
mov eax, 0
jmp 0x408c8a
push dword [ebp + 0x18]
call fcn.004022dc
mov dword [ebp - 0x10], eax
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebx]
test eax, eax
jne 0x408bed
mov eax, 0x5d3c00
push eax
push 1
mov ebx, 0x4b7f40
call fcn.004b7854
add esp, 0x10
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp + 0x10]
push 0
mov ebx, dword [ebp + 0x14]
mov eax, dword [ebx]
test eax, eax
je 0x408c20
add eax, 8
push eax
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegSetValueExW
cmp dword [ebp - 0x18], esp
je 0x408c45
push 0x26a
push 0x41721b5
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x408c52
mov dword [ebp - 0x10], esp
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x10], esp
je 0x408c79
push 0x2e8
push 0x41721b5
push 6
call fcn.004b785a
add esp, 0xc
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x408c8a
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x4091f8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x4b8a20
call fcn.004b7854
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
call fcn.00409274
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
cmp dword [ebp - 0xc], esp
je 0x409267
push 0x60
push 0x4170426
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x40926c
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40aabc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x40ab04
mov eax, 0x5d3c00
push eax
push 1
mov ebx, 0x4b7f40
call fcn.004b7854
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x40ab29
jmp 0x40ac9b
push dword [ebp + 8]
call fcn.0040a7f8
mov dword [ebp - 8], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x5d3bf8]
fstp qword [ebp - 0x28]
mov dword [ebp - 0x2c], esp
fld qword [ebp - 0x28]
call fcn.004020b4
push eax
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
cmp dword [ebp - 0x2c], esp
je 0x40ab78
push 0x129
push 0x416a418
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 0xc], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fsub qword [0x5d3bf8]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.004020b4
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x40ac71
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.0040aca4
mov word [ebp - 0x14], ax
cmp word [ebp - 0x14], 0x2f
jne 0x40abce
mov word [ebp - 0x14], 0x5c
cmp word [ebp - 0x14], 0
jne 0x40ac0f
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CreateDirectoryW
cmp dword [ebp - 0x1c], esp
je 0x40ac05
push 0x26e
push 0x416a418
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x40ac71
cmp word [ebp - 0x14], 0x5c
jne 0x40ac58
cmp dword [ebp - 0x18], 0
jle 0x40ac50
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CreateDirectoryW
cmp dword [ebp - 0x1c], esp
je 0x40ac50
push 0x30f
push 0x416a418
push 6
call fcn.004b785a
add esp, 0xc
inc dword [ebp - 0x18]
jmp 0x40ac58
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.0040acc8
pop ebx
pop ecx
pop edx
add ecx, 2
jmp 0x40aba1
add esp, 0xc
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_LocalFree
cmp dword [ebp - 0x1c], esp
je 0x40ac9b
push 0x3c0
push 0x416a418
push 6
call fcn.004b785a
add esp, 0xc
mov esp, ebp
pop ebp
ret 4

Function at 0x40c3bc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push reloc.OLEAUT32.dll_SysStringLen
push 0
push dword [ebp + 8]
push 1
mov ebx, 0x4b8a20
call fcn.004b7854
add esp, 0x10
mov dword [ebp - 4], eax
push dword [ebp + 0x14]
call fcn.0040c438
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push dword [ebp - 8]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
push 0
push 0
call sub.KERNEL32.DLL_CreateThread
cmp dword [ebp - 0xc], esp
je 0x40c42b
push 0x60
push 0x4169919
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x40c430
mov esp, ebp
pop ebp
ret 0x14
Function at 0x40c454
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call sub.KERNEL32.DLL_GetExitCodeThread
cmp dword [ebp - 8], esp
je 0x40c48f
push 0
push 0x4169938
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], esp
push dword [ebp - 4]
push dword [ebp + 8]
call sub.KERNEL32.DLL_TerminateThread
cmp dword [ebp - 8], esp
je 0x40c4b9
push 0x33
push 0x4169938
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x40c4be
mov esp, ebp
pop ebp
ret 4
Function at 0x40fde8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x40fe00
add eax, 8
push eax
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x40fe0d
add eax, 8
push eax
call sub.KERNEL32.DLL_MoveFileW
cmp dword [ebp - 4], esp
je 0x40fe2f
push 0x12
push 0x4170f98
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x40fe34
mov esp, ebp
pop ebp
ret 8
Function at 0x412a5c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x412a7b
add eax, 8
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp dword [ebp - 8], esp
je 0x412a9d
push 0x19
push 0x4180a8c
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x412ab4
mov eax, 0
jmp 0x412af0
push 0x80000301
push 0
push 0x10
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x4b7d00
call fcn.004b7854
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x412af0
mov esp, ebp
pop ebp
ret 4
Function at 0x4145cc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jne 0x414613
mov eax, 0
jmp 0x414790
cmp dword [ebp + 0x14], 0
je 0x414627
mov eax, 0x100
jmp 0x41462c
mov eax, 0x200
mov dword [ebp - 0x1c], eax
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 0x1c]
push 2
mov ebx, 0x4b7d20
call fcn.004b7854
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x414675
add eax, 8
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegOpenKeyExW
cmp dword [ebp - 0x1c], esp
je 0x41469a
push 0xc3
push 0x416a44d
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4146b1
mov eax, 0
jmp 0x414790
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x4146d2
add eax, 8
push eax
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
cmp dword [ebp - 0x1c], esp
je 0x4146f7
push 0x192
push 0x416a44d
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x414757
lea eax, [ebp - 0x18]
push eax
call fcn.00414798
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x41472f
add eax, 8
push eax
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
cmp dword [ebp - 0x20], esp
je 0x414754
push 0x243
push 0x416a44d
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x414761
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x1c], esp
je 0x414788
push 0x2ca
push 0x416a44d
push 6
call fcn.004b785a
add esp, 0xc
mov eax, dword [ebp - 0x18]
jmp 0x414790
mov esp, ebp
pop ebp
ret 0x14

Function at 0x414bd8
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call sub.KERNEL32.DLL_MoveFileA
cmp dword [ebp - 4], esp
je 0x414c0f
push 0x12
push 0x416986a
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x414c14
mov esp, ebp
pop ebp
ret 8
Function at 0x420b2c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
call sub.USER32.dll_GetWindowTextLengthW
cmp dword [ebp - 0xc], esp
je 0x420b6a
push 0x19
push 0x4180a43
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x420b81
mov eax, 0x5d3c00
jmp 0x420c2b
inc dword [ebp - 4]
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x5d3bf8]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.004020b4
push 0x80000301
push 0
push eax
push 1
mov ebx, 0x4b99e0
call fcn.004b7854
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x420bcf
push ebx
call fcn.004b784e
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.0041254c
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp - 0xc]
push dword [ebp + 8]
call sub.USER32.dll_GetWindowTextW
cmp dword [ebp - 0x10], esp
je 0x420c0c
push 0x136
push 0x4180a43
push 6
call fcn.004b785a
add esp, 0xc
mov eax, dword [ebp - 8]
test eax, eax
je 0x420c26
push eax
mov eax, dword [eax + 4]
add eax, 8
push eax
call fcn.004b7848
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x420c2b
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x420c3c
push ebx
call fcn.004b784e
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x421edc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
je 0x421efb
add eax, 8
push eax
call sub.KERNEL32.DLL_GetFileAttributesW
cmp dword [ebp - 8], esp
je 0x421f1d
push 0x19
push 0x416a47f
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x421f34
mov eax, 0
jmp 0x421f70
push 0x80000301
push 0
push 0x10
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x4b7d00
call fcn.004b7854
add esp, 0x1c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x421f70
mov esp, ebp
pop ebp
ret 4

Function at 0x432f2c
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call sub.KERNEL32.DLL_CopyFileA
cmp dword [ebp - 4], esp
je 0x432f66
push 0x12
push 0x4169816
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x432f6b
mov esp, ebp
pop ebp
ret 0x10
Function at 0x4342ec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
cmp dword [ebp + 8], 0
jne 0x434333
mov eax, 0
jmp 0x4344b0
cmp dword [ebp + 0x14], 0
je 0x434347
mov eax, 0x100
jmp 0x43434c
mov eax, 0x200
mov dword [ebp - 0x1c], eax
push 0x80000301
push 0
push 1
push 0x80000301
push 0
push dword [ebp - 0x1c]
push 2
mov ebx, 0x4b7d20
call fcn.004b7854
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebx]
test eax, eax
je 0x434395
add eax, 8
push eax
push dword [ebp + 8]
call sub.ADVAPI32.dll_RegOpenKeyExW
cmp dword [ebp - 0x1c], esp
je 0x4343ba
push 0xc3
push 0x4180a5a
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4343d1
mov eax, 0
jmp 0x4344b0
mov dword [ebp - 0x1c], esp
lea eax, [ebp - 0x14]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x4343f2
add eax, 8
push eax
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
cmp dword [ebp - 0x1c], esp
je 0x434417
push 0x192
push 0x4180a5a
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x434477
lea eax, [ebp - 0x18]
push eax
call fcn.004344b8
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], esp
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push eax
push 0
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebx]
test eax, eax
je 0x43444f
add eax, 8
push eax
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegQueryValueExW
cmp dword [ebp - 0x20], esp
je 0x434474
push 0x243
push 0x4180a5a
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x434481
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
call sub.ADVAPI32.dll_RegCloseKey
cmp dword [ebp - 0x1c], esp
je 0x4344a8
push 0x2ca
push 0x4180a5a
push 6
call fcn.004b785a
add esp, 0xc
mov eax, dword [ebp - 0x18]
jmp 0x4344b0
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4345f8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], 0
push reloc.WS2_32.dll_getpeername
push 0
mov ebx, dword [ebp + 8]
mov eax, dword [ebx]
test eax, eax
jne 0x434640
mov eax, 0x5d3c00
push eax
push 1
mov ebx, 0x4b7f40
call fcn.004b7854
add esp, 0x10
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 8
jge 0x434665
jmp 0x4347d7
push dword [ebp + 8]
call fcn.0041254c
mov dword [ebp - 8], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fadd qword [0x5d3bf8]
fstp qword [ebp - 0x28]
mov dword [ebp - 0x2c], esp
fld qword [ebp - 0x28]
call fcn.004020b4
push eax
push 0x40
call sub.KERNEL32.DLL_LocalAlloc
cmp dword [ebp - 0x2c], esp
je 0x4346b4
push 0x129
push 0x4180a25
push 6
call fcn.004b785a
add esp, 0xc
mov dword [ebp - 0xc], eax
fild dword [ebp - 4]
fstp qword [ebp - 0x20]
fld qword [ebp - 0x20]
fsub qword [0x5d3bf8]
fstp qword [ebp - 0x28]
fld qword [ebp - 0x28]
call fcn.004020b4
push eax
lea eax, [ebp - 0x10]
mov ebx, eax
mov ecx, 0
pop edx
push edx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, edx
jg 0x4347ad
push dword [ebp - 0x10]
push dword [ebp - 8]
call fcn.004347e0
mov word [ebp - 0x14], ax
cmp word [ebp - 0x14], 0x2f
jne 0x43470a
mov word [ebp - 0x14], 0x5c
cmp word [ebp - 0x14], 0
jne 0x43474b
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CreateDirectoryW
cmp dword [ebp - 0x1c], esp
je 0x434741
push 0x26e
push 0x4180a25
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x4347ad
cmp word [ebp - 0x14], 0x5c
jne 0x434794
cmp dword [ebp - 0x18], 0
jle 0x43478c
mov dword [ebp - 0x1c], esp
push 0
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_CreateDirectoryW
cmp dword [ebp - 0x1c], esp
je 0x43478c
push 0x30f
push 0x4180a25
push 6
call fcn.004b785a
add esp, 0xc
inc dword [ebp - 0x18]
jmp 0x434794
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call fcn.00434804
pop ebx
pop ecx
pop edx
add ecx, 2
jmp 0x4346dd
add esp, 0xc
mov dword [ebp - 0x1c], esp
push dword [ebp - 0xc]
call sub.KERNEL32.DLL_LocalFree
cmp dword [ebp - 0x1c], esp
je 0x4347d7
push 0x3c0
push 0x4180a25
push 6
call fcn.004b785a
add esp, 0xc
mov esp, ebp
pop ebp
ret 4

Function at 0x434a9c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call sub.KERNEL32.DLL_MoveFileA
cmp dword [ebp - 4], esp
je 0x434ad3
push 0x12
push 0x417fe77
push 6
call fcn.004b785a
add esp, 0xc
jmp 0x434ad8
mov esp, ebp
pop ebp
ret 8