joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40820a
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x20
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x40822b
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408230
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x408264
push 0x20
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp - 4]
jmp 0x40826c
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40871d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x49ff88
push 0x430ce0
call fcn.0041d138
add esp, 8
mov dword [0x42d8c0], 0
jmp 0x40875d
inc dword [0x42d8c0]
cmp dword [0x42d8c0], 0x3000
jge 0x40878a
mov eax, dword [0x42d8c0]
mov byte [eax + 0x431100], 0
mov eax, dword [0x42d8c0]
mov byte [eax + 0x42d8d0], 0
jmp 0x408757
lea eax, [ebp - 4]
push eax
push 0x42d8d0
push 0x430ce0
call fcn.0040bc13
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4087b3
mov eax, 0xffffffff
jmp 0x4089c1
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x42d8d0
push 0x49ff94
call fcn.004095d8
add esp, 0x10
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x4087e1
xor eax, eax
jmp 0x4089c1
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
push eax
push 0x42d8d0
push 0x49ffa0
call fcn.004095d8
add esp, 0x10
test eax, eax
jne 0x4088da
mov ebx, dword [ebp - 4]
and ebx, 0xffff
mov eax, dword [ebp - 0xc]
and eax, 0xffff
sub ebx, eax
push 0x49ffa8
call fcn.0041d0c4
add esp, 4
add ebx, eax
push ebx
push 0x49ffb4
call fcn.0041d0c4
add esp, 4
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push ecx
push 0x431100
call fcn.0041d6c4
add esp, 0xc
push 0x49ffc0
call fcn.0041d0c4
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
mov edx, dword [ebp - 0xc]
and edx, 0xffff
sub ecx, edx
add eax, ecx
push eax
push 0x431100
push 0x49ffcc
call fcn.0041d0c4
add esp, 4
mov ecx, dword [ebp - 0x1c]
add ecx, eax
push ecx
call fcn.0041d6c4
add esp, 0xc
push 0x49ffd4
call fcn.0041d0c4
add esp, 4
push eax
push 0x49ffdc
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041d6c4
add esp, 0xc
push 0x49ffe4
call fcn.0041d0c4
add esp, 4
mov ecx, dword [ebp - 4]
and ecx, 0xffff
lea ebx, [ecx + eax]
push 0x49ffec
call fcn.0041d0c4
add esp, 4
sub ebx, eax
mov word [ebp - 4], bx
jmp 0x4089a0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 0x49fff8
call fcn.004095d8
add esp, 0x10
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x408991
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
mov eax, dword [ebp - 0x10]
push eax
push 0x431100
call fcn.0041d6c4
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 0xc]
and ecx, 0xffff
sub eax, ecx
mov ecx, dword [ebp - 8]
and ecx, 0xffff
sub eax, ecx
dec eax
push eax
push 0x431100
mov eax, dword [ebp - 0x1c]
push eax
call fcn.0041d6c4
add esp, 0xc
mov eax, dword [ebp - 4]
and eax, 0xffff
mov ecx, dword [ebp - 8]
and ecx, 0xffff
inc ecx
sub eax, ecx
mov word [ebp - 4], ax
jmp 0x4089a0
mov eax, dword [ebp - 0xc]
and eax, 0xffff
sub eax, 2
mov word [ebp - 4], ax
lea eax, [ebp - 4]
push eax
push 0x42d8d0
push 0x430ce0
call fcn.0040bd5c
add esp, 0xc
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
jmp 0x4089c1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4091a4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a007c
push 0x430ce0
call fcn.0041d138
add esp, 8
push 0x4a0080
push 0x430ce0
call fcn.0041d138
add esp, 8
cmp dword [ebp + 8], 0
je 0x409280
mov eax, dword [ebp + 8]
push eax
push 0x430ef0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a0090
push 0x430ef0
call fcn.0041d138
add esp, 8
push 0x4a0094
push 0x430ef0
call fcn.0041d138
add esp, 8
push 0
push 0x430ef0
call fcn.00422138
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x409280
mov eax, dword [ebp - 8]
push eax
call fcn.004202c7
add esp, 4
push 0
push 0x430ce0
push 0x430ef0
call fcn.0040cb2d
add esp, 0xc
test eax, eax
jne 0x409279
push 0x4000c
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x409300
xor eax, eax
jmp 0x409300
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a00a4
push 0x430ce0
call fcn.0041d138
add esp, 8
push 0x4a00a8
push 0x430ce0
call fcn.0041d138
add esp, 8
push 0
push 0x430ce0
push 0
call fcn.004196ba
add esp, 4
push eax
push 0x505920
call fcn.00419362
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x430ce0
push 1
call fcn.004196ba
add esp, 4
push eax
push 0x515920
call fcn.00419362
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x409300
pop edi
pop esi
pop ebx
leave
ret

Function at 0x409305
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a00b8
push 0x430ce0
call fcn.0041d138
add esp, 8
cmp dword [ebp + 8], 0
je 0x4093bd
mov eax, dword [ebp + 8]
push eax
push 0x430ef0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a00c8
push 0x430ef0
call fcn.0041d138
add esp, 8
push 0
push 0x430ef0
call fcn.00422138
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4093bd
mov eax, dword [ebp - 8]
push eax
call fcn.004202c7
add esp, 4
push 0
push 0x430ce0
push 0x430ef0
call fcn.0040cb2d
add esp, 0xc
test eax, eax
jne 0x4093b6
push 0x4000c
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4093e1
xor eax, eax
jmp 0x4093e1
push 0
push 0x430ce0
push 0xbc00
push 0x494378
call fcn.00419362
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4093e1
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4093e6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a00d8
push 0x430ce0
call fcn.0041d138
add esp, 8
cmp dword [ebp + 8], 0
je 0x40949e
mov eax, dword [ebp + 8]
push eax
push 0x430ef0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a00e4
push 0x430ef0
call fcn.0041d138
add esp, 8
push 0
push 0x430ef0
call fcn.00422138
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x40949e
mov eax, dword [ebp - 8]
push eax
call fcn.004202c7
add esp, 4
push 0
push 0x430ce0
push 0x430ef0
call fcn.0040cb2d
add esp, 0xc
test eax, eax
jne 0x409497
push 0x4000c
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4094de
xor eax, eax
jmp 0x4094de
push 0
push 0x430ce0
push 0xffff
push 0x4820d0
call fcn.00419362
add esp, 0x10
mov dword [ebp - 4], eax
push 1
push 0x430ce0
push 0x22a3
push 0x4920d0
call fcn.00419362
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4094de
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4094e3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
call fcn.004081f5
test eax, eax
jne 0x409500
xor eax, eax
jmp 0x4095d3
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a00f0
push 0x430ce0
call fcn.0041d138
add esp, 8
cmp dword [ebp + 8], 0
je 0x4095af
mov eax, dword [ebp + 8]
push eax
push 0x430ef0
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x4a0100
push 0x430ef0
call fcn.0041d138
add esp, 8
push 0
push 0x430ef0
call fcn.00422138
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x4095af
mov eax, dword [ebp - 8]
push eax
call fcn.004202c7
add esp, 4
push 0
push 0x430ce0
push 0x430ef0
call fcn.0040cb2d
add esp, 0xc
test eax, eax
jne 0x4095a8
push 0x4000c
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x4095d3
xor eax, eax
jmp 0x4095d3
push 0
push 0x430ce0
push 0xde00
push 0x4742d0
call fcn.00419362
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x4095d3
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4096c3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov dword [0x42d8c0], 0
jmp 0x4096e1
inc dword [0x42d8c0]
cmp dword [0x42d8c0], 0x3000
jge 0x409702
mov eax, dword [0x42d8c0]
mov byte [eax + 0x42d8d0], 0
jmp 0x4096db
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a0110
push 0x430ce0
call fcn.0041d138
add esp, 8
push 0x434100
push 0x42d8d0
push 0x430ce0
call fcn.0040bc13
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40974e
mov eax, 0xffffffff
jmp 0x4098ad
mov ax, word [0x434100]
mov word [ebp - 4], ax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
jmp 0x40984a
push 0x4a011c
push 0x434110
call fcn.0041d13c
add esp, 8
test byte [ebp + 0xc], 2
je 0x4097a4
push 0x434100
push 0x42d8d0
call fcn.00409b87
add esp, 8
cmp eax, 0xffffffff
jne 0x4097a4
mov eax, 0xffffffff
jmp 0x4098ad
test byte [ebp + 0xc], 1
je 0x4097d3
push 0x434100
push 0x42d8d0
call fcn.00409d8b
add esp, 8
cmp eax, 0xffffffff
jne 0x4097d3
mov eax, 0xffffffff
jmp 0x4098ad
jmp 0x409863
mov ax, word [0x434100]
mov word [ebp - 4], ax
test byte [ebp + 0xc], 1
je 0x409811
push 0x434100
push 0x42d8d0
call fcn.0040a086
add esp, 8
cmp eax, 0xffffffff
jne 0x409811
mov eax, 0xffffffff
jmp 0x4098ad
test byte [ebp + 0xc], 2
je 0x409840
push 0x434100
push 0x42d8d0
call fcn.004098b2
add esp, 8
cmp eax, 0xffffffff
jne 0x409840
mov eax, 0xffffffff
jmp 0x4098ad
jmp 0x409863
cmp dword [ebp - 8], 1
je 0x4097d8
cmp dword [ebp - 8], 2
je 0x409763
jmp 0x409863
mov eax, dword [ebp - 4]
and eax, 0xffff
xor ecx, ecx
mov cx, word [0x434100]
cmp eax, ecx
je 0x4098a6
push 0x434100
push 0x42d8d0
push 0x430ce0
call fcn.0040bd5c
add esp, 0xc
cmp eax, 0xffffffff
jne 0x4098a6
mov eax, 0xffffffff
jmp 0x4098ad
xor eax, eax
jmp 0x4098ad
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a98f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a030c
push 0x430ce0
call fcn.0041d138
add esp, 8
push 0x430ce0
call fcn.0040cb00
add esp, 4
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x4a0318
push 0x430ce0
call fcn.0041d138
add esp, 8
push 0x430ce0
call fcn.0040cb00
add esp, 4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40aa55
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push ebx
push esi
push edi
mov dword [ebp - 0x204], 0
push 0x200
push 0x4308d0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test byte [ebp + 8], 2
je 0x40ab31
push 0x4308d0
lea eax, [ebp - 0x200]
push eax
call fcn.0041d13c
add esp, 8
push 0x4a0328
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040a9f8
add esp, 4
test eax, eax
je 0x40aadb
push 0x200400b
call fcn.0040648e
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x4308d0
lea eax, [ebp - 0x200]
push eax
call fcn.0041d13c
add esp, 8
push 0x4a0334
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040a9f8
add esp, 4
test eax, eax
je 0x40ab31
push 0x200400a
call fcn.0040648e
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
test byte [ebp + 8], 1
je 0x40abfb
push 0x4308d0
lea eax, [ebp - 0x200]
push eax
call fcn.0041d13c
add esp, 8
push 0x4a0344
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
push 0x4a0348
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040a9f8
add esp, 4
test eax, eax
je 0x40aba5
push 0x2004017
call fcn.0040648e
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
push 0x4308d0
lea eax, [ebp - 0x200]
push eax
call fcn.0041d13c
add esp, 8
push 0x4a0358
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.0040a9f8
add esp, 4
test eax, eax
je 0x40abfb
push 0x2004015
call fcn.0040648e
add esp, 4
mov dword [ebp - 0x204], 0xffffffff
mov eax, dword [ebp - 0x204]
jmp 0x40ac06
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ac0b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push 0x430ce0
push 0x434120
call fcn.0041d13c
add esp, 8
push 0x4a0368
push 0x430ce0
call fcn.0041d138
add esp, 8
push 2
push 0x430ce0
call fcn.00426209
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40acc8
cmp dword [0x518a70], 2
je 0x40aca4
cmp dword [ebp - 4], 0
je 0x40ac9f
push 0x2010003
call fcn.0040648e
add esp, 4
push 0x80005
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40ad3e
jmp 0x40acc8
push 0x2010003
call fcn.0040648e
add esp, 4
push 0x80006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40ad3e
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4a0374
push 0x430ce0
call fcn.0041d138
add esp, 8
push 2
push 0x430ce0
call fcn.00426209
add esp, 8
mov dword [ebp - 4], eax
cmp dword [0x518a70], 2
je 0x40ad37
cmp dword [ebp - 4], 0
je 0x40ad37
push 0x2010004
call fcn.0040648e
add esp, 4
push 0x80005
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40ad3e
xor eax, eax
jmp 0x40ad3e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c30d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push ebx
push esi
push edi
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x30], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
mov eax, dword [ebp + 8]
mov dword [eax + 0x34], 0
push 0x200
push 0x4308d0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x4308d0
lea eax, [ebp - 0x200]
push eax
call fcn.0041d13c
add esp, 8
push 0x4a07b8
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
push 0x4a07bc
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.00419571
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x28], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x28], 0xffffffff
jne 0x40c3b9
mov eax, dword [ebp + 8]
mov dword [eax + 0x28], 0
push 0x4308d0
lea eax, [ebp - 0x200]
push eax
call fcn.0041d13c
add esp, 8
push str.Api_1lnm.dll
lea eax, [ebp - 0x200]
push eax
call fcn.0041d138
add esp, 8
lea eax, [ebp - 0x200]
push eax
call fcn.004195ae
add esp, 4
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x2c], eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0x2c], 0xffffffff
jne 0x40c40d
mov eax, dword [ebp + 8]
mov dword [eax + 0x2c], 0
mov eax, dword [ebp + 8]
push eax
call fcn.0040c425
add esp, 4
xor eax, eax
jmp 0x40c420
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40c7ad
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push ebx
push esi
push edi
push 0x200
push 0x430ce0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str._system.ini
push 0x430ce0
call fcn.0041d138
add esp, 8
cmp dword [ebp + 0x10], 0
je 0x40c7fe
push str._hasp_
lea eax, [ebp - 0x88]
push eax
call fcn.0041d13c
add esp, 8
jmp 0x40c812
push str._HARDLOCK_
lea eax, [ebp - 0x88]
push eax
call fcn.0041d13c
add esp, 8
mov dword [0x42d8c0], 0
jmp 0x40c827
inc dword [0x42d8c0]
cmp dword [0x42d8c0], 0x3000
jge 0x40c848
mov eax, dword [0x42d8c0]
mov byte [eax + 0x42d8d0], 0
jmp 0x40c821
push 0x434100
push 0x42d8d0
push 0x430ce0
call fcn.0040bc13
add esp, 0xc
cmp eax, 0xffffffff
jne 0x40c872
mov eax, 0xffffffff
jmp 0x40c9c9
push 0x430ee4
mov ax, word [0x434100]
push eax
push 0x42d8d0
lea eax, [ebp - 0x88]
push eax
call fcn.004095d8
add esp, 0x10
mov dword [ebp - 0x8c], eax
cmp dword [ebp - 0x8c], 0
jne 0x40c8bc
push 0x80002
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40c9c9
push 0x434370
xor eax, eax
mov ax, word [0x434100]
xor ecx, ecx
mov cx, word [0x430ee4]
sub eax, ecx
push eax
mov eax, dword [ebp - 0x8c]
inc eax
push eax
push 0x4a0838
call fcn.004095d8
add esp, 0x10
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
je 0x40c90c
mov ax, word [0x434370]
mov word [ebp - 4], ax
jmp 0x40c923
xor eax, eax
mov ax, word [0x434100]
xor ecx, ecx
mov cx, word [0x430ee4]
sub eax, ecx
mov word [ebp - 4], ax
push 0x430ee6
mov eax, dword [ebp - 4]
push eax
mov eax, dword [ebp - 0x8c]
push eax
mov eax, dword [ebp + 0xc]
push eax
call fcn.004095d8
add esp, 0x10
mov dword [ebp - 0x90], eax
cmp dword [ebp - 0x90], 0
je 0x40c9b1
push pe_nt_image_headers32
mov eax, dword [ebp + 0xc]
push eax
call fcn.0041d0c4
add esp, 4
mov ecx, dword [ebp - 0x90]
add ecx, eax
inc ecx
push ecx
mov eax, dword [ebp + 8]
push eax
call fcn.0041d114
add esp, 0xc
push 0x49ff78
mov eax, dword [ebp + 8]
push eax
call fcn.0041d3d4
add esp, 8
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x40c9a2
mov eax, dword [ebp - 8]
mov byte [eax], 0
jmp 0x40c9ac
mov eax, dword [ebp + 8]
mov byte [eax + 0x80], 0
jmp 0x40c9c2
push 0x4a083c
mov eax, dword [ebp + 8]
push eax
call fcn.0041d13c
add esp, 8
xor eax, eax
jmp 0x40c9c9
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cb2d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
push ebx
push esi
push edi
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40cb66
push 0x180
mov eax, dword [ebp + 0xc]
push eax
call fcn.004262c1
add esp, 8
mov eax, dword [ebp - 4]
jmp 0x40cb6e
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d608
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], 0
push 0x42d5b4
push 0xf003f
push 0
push 0x4dc024
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40d683
cmp dword [0x42cf90], 2
je 0x40d67e
push 0x2002000
call fcn.0040648e
add esp, 4
push 0x10001
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40d8b5
jmp 0x40d6cc
mov dword [ebp - 0x20], 1
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40d6cc
push 0x2002000
call fcn.0040648e
add esp, 4
push 0x10002
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40d8b5
push 0x42d5b4
push 0xf003f
push 0
push 0x4dc05c
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40d743
cmp dword [0x42cf90], 2
je 0x40d730
push 0x2002000
call fcn.0040648e
add esp, 4
push 0x10001
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40d8b5
cmp dword [ebp - 0x20], 1
jne 0x40d73e
or dword [ebp - 0x10], 2
jmp 0x40d8ad
or dword [ebp - 0x10], 1
mov dword [ebp - 8], 0xc
push 0x4dc088
push 0x42cf50
call fcn.0041d13c
add esp, 8
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40d7a9
push 0x4dc090
lea eax, [ebp - 0x1c]
push eax
call fcn.0041d13c
add esp, 8
lea eax, [ebp - 0x1c]
push eax
push 0x434110
call fcn.0041d13c
add esp, 8
push 0x4dc098
lea eax, [ebp - 0x1c]
push eax
call fcn.0041d434
add esp, 8
test eax, eax
jge 0x40d7e6
cmp dword [ebp - 0x20], 1
jne 0x40d7e1
or dword [ebp - 0x10], 2
jmp 0x40d86b
push 0x4dc0a0
lea eax, [ebp - 0x1c]
push eax
call fcn.0041d434
add esp, 8
test eax, eax
jg 0x40d808
or dword [ebp - 0x10], 2
jmp 0x40d86b
push 0x4dc0a8
push 0x42cf50
call fcn.0041d13c
add esp, 8
mov dword [ebp - 0xc], 4
mov dword [ebp - 8], 4
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40d85d
or dword [ebp - 0x10], 2
test byte [ebp - 4], 2
je 0x40d86b
or dword [ebp - 0x10], 2
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40d8ad
push 0x2002000
call fcn.0040648e
add esp, 4
push 0x10002
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40d8b5
mov eax, dword [ebp - 0x10]
jmp 0x40d8b5
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d8ba
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
push 0x42d5b4
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServicesHaspnt
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40d91a
push 0x2002007
call fcn.0040648e
add esp, 4
push 0x10001
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40da5a
mov dword [ebp - 4], 0xc
push 0x4dc0dc
push 0x42cf50
call fcn.0041d13c
add esp, 8
mov dword [ebp - 8], 1
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40d98f
push 0x2002000
call fcn.0040648e
add esp, 4
push 0x10006
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40da5a
push 0x4dc0e4
lea eax, [ebp - 0x14]
push eax
call fcn.0041d434
add esp, 8
test eax, eax
jl 0x40da11
push 0x4dc0ec
push 0x42cf50
call fcn.0041d13c
add esp, 8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 4
lea eax, [ebp - 0x18]
push eax
push 4
push 0
push 0x42cf50
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40da11
push 0x2002007
call fcn.0040648e
add esp, 4
push 0x10003
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40da5a
mov eax, dword [0x42d5b4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [0x42cf90], eax
cmp dword [0x42cf90], 0
je 0x40da53
push 0x2002007
call fcn.0040648e
add esp, 4
push 0x10002
call fcn.004064f2
add esp, 4
mov eax, 0xffffffff
jmp 0x40da5a
xor eax, eax
jmp 0x40da5a
pop edi
pop esi
pop ebx
leave
ret