joyce8/EMBER2024-capa huggingface dataset:
Function at 0x57742b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.005773a7
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x57759a
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x57759a
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x57754f
jg 0x577487
test eax, eax
je 0x577545
push 1
push 0x1000
call fcn.00569965
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x5774aa
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x57753c
push 0x8000
push ebx
call fcn.00566f6a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x5774d3
jg 0x5774ce
cmp ecx, 0x1000
jb 0x5774d3
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.005706b1
add esp, 0x10
cmp eax, 0xffffffff
je 0x577518
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x5774ce
jl 0x5774ff
test ecx, ecx
jne 0x5774c0
push dword [ebp - 0xc]
push ebx
call fcn.00566f6a
push esi
call fcn.00568443
add esp, 0xc
xor ebx, ebx
jmp 0x5775a8
cmp byte [edi + 0x24], 0
je 0x57752f
cmp dword [edi + 0x20], 5
jne 0x57752f
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x57753a
mov ebx, dword [edi + 0x18]
jmp 0x57753c
xor ebx, ebx
push esi
call fcn.00568443
pop ecx
jmp 0x5775a8
test ecx, ecx
jg 0x577511
jl 0x57754f
test eax, eax
jae 0x577511
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.005717a9
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x57756f
cmp byte [edi + 0x1c], 0
je 0x577511
jmp 0x5775a0
push ebx
call fcn.005665f8
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x577511
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x5775a8
cmp byte [edi + 0x1c], 0
je 0x5775a5
mov ebx, dword [edi + 0x18]
jmp 0x5775a8
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.005717a9
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x577c50
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x577c7d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x577c7d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x406a06
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a2a
xor eax, eax
test eax, eax
je 0x406a3d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a3d
xor ecx, ecx
jmp 0x406a40
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b63
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406b9a
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b74
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b6f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406bcb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bad
pop edi
not eax
pop esi
ret 0xc

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x41eb90
Capabilities:
Accept command line arguments
Delete directory
Get common file path
Write file on windows

Disassembly:
mov eax, 0x1820
call fcn.0040c510
cmp dword [0x227d25c], 0x37
jne 0x41ec4f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push 0x403298
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_AddConsoleAliasA]
push 0
lea eax, [esp + 0x824]
push eax
push 0x4032d0
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push 0
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 4]
push edx
push 0
lea eax, [esp + 0x14]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_PeekConsoleInputW]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumTimeFormatsW]
lea ecx, [esp + 8]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetCompressedFileSizeA]
lea edx, [esp + 0x1020]
push edx
push 0
push 0x403364
push 0x403394
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0
push 0x4033b4
push 0x4033bc
call dword [sym.imp.KERNEL32.dll_CreateHardLinkA]
mov eax, dword [0x227d260]
mov dword [esp], eax
mov eax, 0x5d1
add dword [esp], eax
mov ecx, dword [esp]
mov dl, byte [ecx + esi]
mov eax, dword [0x4403ec]
mov byte [eax + esi], dl
add esp, 0x1820
ret

Function at 0x41ec80
Capabilities:
Manipulate console buffer

Disassembly:
sub esp, 0x60
mov ecx, dword [esp + 0x64]
mov eax, dword [ecx]
mov edx, dword [0x437f44]
push ebx
push ebp
push esi
mov esi, dword [ecx + 4]
mov ecx, dword [0x437f40]
mov dword [esp + 0x1c], ecx
mov ecx, dword [0x437f48]
mov dword [esp + 0x20], edx
mov edx, dword [0x437f4c]
push edi
mov dword [esp + 0x14], eax
mov edi, 0xc6ef3720
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], edx
mov ebp, 0x20
jmp 0x41ecd4
mov eax, dword [esp + 0x14]
mov ecx, eax
shr ecx, 5
add ecx, dword [esp + 0x18]
mov edx, eax
shl edx, 4
add edx, dword [esp + 0x1c]
add eax, edi
xor ecx, edx
xor ecx, eax
sub esi, ecx
mov ecx, esi
shl ecx, 4
mov dword [0x227320c], 0
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x20]
add dword [esp + 0x10], eax
cmp dword [0x227d25c], 0x1be
lea ebx, [edi + esi]
jne 0x41ed29
lea edx, [esp + 0x28]
push edx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
mov eax, esi
shr eax, 5
add eax, dword [esp + 0x24]
mov dword [0x2273210], 0xff6b3619
xor eax, ebx
xor dword [esp + 0x10], eax
mov dword [0x2273214], 0xffffffff
mov eax, dword [esp + 0x10]
sub dword [esp + 0x14], eax
add edi, 0x61c88647
dec ebp
jne 0x41ecd0
cmp dword [0x227d25c], 0x8d4
jne 0x41ed8f
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, dword [esp + 0x74]
mov edx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], edx
pop ebx
add esp, 0x60
ret 4
mov eax, dword [esp + 0x74]
mov ecx, dword [esp + 0x14]
pop edi
mov dword [eax + 4], esi
pop esi
pop ebp
mov dword [eax], ecx
pop ebx
add esp, 0x60
ret 4
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x28765598
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x56542410
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x40345b
pop dword [ebp - 0x10]
mov eax, 0x33c60c41
add eax, 0xcc7a281a
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x3d1b62f1
add dword [ebp - 0x20], 0x1136e25a
mov dword [ebp - 0x1c], 0x3c23f40d
add dword [ebp - 0x1c], 0xf60f5838
mov dword [ebp - 0x18], 0x3442cc43
sub dword [ebp - 0x18], 0xe7f68815
mov dword [ebp - 0x14], 0x9a163c37
sub dword [ebp - 0x14], 0x9a163c37
lea eax, [ebp - 0x20]
push eax
mov eax, 0xba7eb995
sub eax, 0xba3e7941
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0x42dde77a
add dword [ebp - 0x20], 0x319481dc
mov dword [ebp - 0x1c], 0xaadc8b3a
add dword [ebp - 0x1c], 0x968fd63b
mov dword [ebp - 0x18], 0x6b79d2e3
add dword [ebp - 0x18], 0xf7f59989
mov dword [ebp - 0x14], 0x85752495
add dword [ebp - 0x14], 0x7a8adb6b
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, 0x8da7feee
sub eax, 0x8d67be9e
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x33ceb
push 0
call eax
mov ecx, 0x3bc5
xor esi, esi
add esi, eax
mov edi, 0x408400
add edi, dword [ebp - 0x10]
mov edx, 0xf6682201
add edx, 0x13883575
mov dword [ebp - 8], 0xbe340dc2
mov ebx, dword [edi]
xor dword [ebp - 0xc], 0xa8d8d41e
xor ebx, edx
xor dword [ebp - 4], edx
mov dword [esi], ebx
mov dword [ebp - 4], 0xef233587
add esi, 4
add edi, 0xe1f7889a
add edi, 0x1e08776a
loop 0x403573
add eax, 0xe1e7
xor ebx, ebx
add ebx, eax
add eax, 0xd90e4fbc
sub eax, 0xd90e4fb7
mov ecx, 0xfc3f03bc
add ecx, 0x400fc44
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
mov eax, section..text
nop
mov ebx, 0x408ed0
nop
nop
mov ecx, 0x86e6184
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
mov ecx, 0x452d5411
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x41a141
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x41a150
pop dword [ebp - 0x40]
mov eax, 0x189cfa2
add eax, 0xfeb7d1ae
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3e720
push 0
mov eax, 0x496e3d29
add eax, 0xb6d414ef
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0x4aaa
xor esi, esi
add esi, eax
mov edx, 0xe31408ac
add edx, 0x1d2f4b54
add edx, dword [ebp - 0x40]
mov edi, 0x94d514e3
add edi, 0x91e4eff
mov dword [ebp - 0x2c], 0xd481101a
mov ebx, dword [edx]
mov dword [ebp - 0x38], 0xb5ed71bd
xor ebx, edi
add dword [ebp - 0x24], 0x88b9afc7
mov dword [esi], ebx
add esi, 0x3d73ea60
sub esi, 0x3d73ea5c
add edx, 0x853bd7c0
sub edx, 0x853bd7bc
loop 0x41a1ab
add eax, 0x1c994a3c
sub eax, 0x1c982cc1
mov ebx, eax
add eax, 0x9997dda5
add eax, 0x66682260
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401430
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x43601c
push 0x80000002
call dword [0x43610c]
test eax, eax
jne 0x40145c
mov eax, 0xd903
jmp 0x401506
mov dword [0x436104], 0x24e1
mov ecx, dword [0x436104]
sub ecx, 0x24e1
mov dword [0x436104], ecx
mov edx, 1
test edx, edx
je 0x401506
mov eax, dword [0x436104]
cmp eax, dword [ebp + 0xc]
jb 0x401491
jmp 0x401506
cmp dword [0x436104], 0
jne 0x4014af
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x4014af
xor eax, eax
jmp 0x401506
mov ecx, dword [ebp + 8]
add ecx, dword [0x436104]
mov edx, dword [ecx]
add edx, dword [0x436104]
mov eax, dword [ebp + 8]
add eax, dword [0x436104]
mov dword [eax], edx
mov dword [ebp - 8], 0x3c615bf
mov ecx, dword [0x436104]
mov edx, dword [ebp - 8]
lea eax, [edx + ecx + 2]
push eax
mov ecx, dword [ebp + 8]
add ecx, dword [0x436104]
push ecx
call fcn.004011f0
add esp, 8
mov edx, dword [0x436104]
add edx, 4
mov dword [0x436104], edx
jmp 0x401478
mov esp, ebp
pop ebp
ret
Function at 0x401523
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x22c]
push ebx
sub esp, 0x25c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov esi, dword [ebp + 0xc]
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 9
mov dword [esp + 8], eax
call fcn.00408098
sub esp, 0x10
test eax, eax
jne 0x40169b
test byte [ebp + 0x10], 2
je 0x4015cd
lea eax, [ebp - 0x228]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x222]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x228], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
cmp eax, 0x103
jne 0x40163a
mov eax, dword [ebp + 0x10]
and eax, 1
mov dword [ebp - 0x23c], eax
jmp 0x4015f5
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00401523
sub esp, 0xc
test eax, eax
jne 0x401651
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x222]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea edx, [ebp - 0x222]
sub esp, 0x10
test eax, eax
jne 0x401651
cmp dword [ebp - 0x23c], 0
mov eax, dword [ebp - 0x22c]
je 0x4015db
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x40169b
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 3
call fcn.00408e52
push edx
test eax, eax
jne 0x401683
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edx
push edx
jmp 0x40169b
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x403d07
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42a980]
cmp dword [ebp + 8], 0
je 0x403d32
test eax, eax
je 0x403d26
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x42a980], 0
jmp 0x403d9c
test eax, eax
je 0x403d45
mov dword [esp], 0
call fcn.00408ec4
push edx
jmp 0x403d9c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x416920]
jbe 0x403d9c
mov eax, dword [0x42aa48]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403c4c
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
sub esp, 0x14
mov dword [0x42a980], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret
Function at 0x40797c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x38]
lea edi, [ebp - 0x2c]
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40001
mov dword [ebp - 0x28], 0x40c890
mov dword [ebp - 0x24], 0x40c890
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x40c880
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edx
push edx
test eax, eax
je 0x4079d9
xor eax, eax
jmp 0x407a06
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x407a06
mov dword [esp + 8], edi
mov dword [esp + 4], 0x80000007
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
sub esp, 0xc
test eax, eax
jne 0x4079d5
call ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x407a3e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x4339c0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x4339c0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x407abc
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x407ac0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x407d38
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x407d66
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407d71
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.00407d38
push ecx
cmp eax, 0xffffffff
jne 0x407d92
xor edi, edi
jmp 0x407dcf
mov dword [esp], ebx
mov esi, eax
test edi, 1
je 0x407dc7
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x407dc0
and edi, 4
jne 0x407d8e
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x407dcf
mov edi, 1
jmp 0x407dcf
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407da5
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x407ddb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x407df6
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x407e33
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x65
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
dec esi
je 0x407e8f
mov dword [ebp - 0x10], 0x73006e
mov dword [ebp - 0xc], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
div ecx
mov dword [esp + 8], 0
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
add word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
je 0x407e43
jmp 0x407e96
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x407ea1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x407ee0
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x407ee7
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x407f26
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc
Function at 0x40815c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x10], 0x800
test eax, eax
je 0x40817a
mov eax, 0x100
or eax, 0x20019
lea edx, [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00408098
sub esp, 0x10
test eax, eax
je 0x4081aa
mov word [ebx], 0
jmp 0x4081ff
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov word [ebx + 0x7fe], 0
test esi, esi
jne 0x4081a3
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x4081a3
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14