joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409fa0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x248
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x244], eax
mov ecx, dword [esp + 0x24c]
push ebx
push ecx
mov dword [esp + 0x10], 0
call fcn.00407e40
push eax
add ecx, 2
push ecx
lea eax, [esp + 0x4c]
push 0x5516e0
push eax
call fcn.00525f70
add esp, 0x14
push 0
push 0
push 3
push 0
push 7
push 0xc0000000
lea ecx, [esp + 0x58]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 8], ebx
cmp ebx, 0xffffffff
jne 0x40a01e
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x244]
xor ecx, esp
call fcn.00524d83
add esp, 0x248
ret
push 0
push 0
push 0x1200
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x1200
jne 0x40a1b8
push 0
lea edx, [esp + 0x20]
push edx
push 0x1000
push 0x5b38e0
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a1b8
cmp dword [esp + 0x1c], 0x1000
jne 0x40a1b8
mov eax, dword [0x5b3af0]
mov edx, dword [0x5b3af8]
push ebp
push esi
push edi
mov ecx, 0x7c
mov esi, 0x5b38f0
mov edi, 0x5c18e0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x5b3af4]
mov dword [0x5c1ad0], eax
mov eax, dword [0x5b3afc]
mov dword [0x5c1ad4], ecx
mov dword [0x5c1ad8], edx
mov dword [0x5c1adc], eax
call fcn.0044b8f0
mov ebp, eax
xor esi, esi
cmp ebp, esi
jne 0x40a0fb
cmp dword [0x5b2ebc], esi
je 0x40a1b5
mov ecx, dword [0x5b2ec0]
push 1
push 0x3f58
mov dword [esp + 0x34], 1
mov dword [esp + 0x3c], ecx
call fcn.00525178
lea edx, [esp + 0x34]
add esp, 8
mov dword [esp + 0x18], eax
mov dword [eax + 0x734], edx
mov dword [eax + 0x35c], 0x1000
mov ebp, eax
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], esi
mov ebx, dword [ebp + 0x734]
mov dword [esp + 0x1c], esi
cmp dword [ebx], esi
jbe 0x40a1b1
mov dword [esp + 0x10], esi
lea esp, [esp]
mov eax, dword [ebp + 0x35c]
mov edx, dword [esp + 0x10]
push 0
push 0x5b38e0
push eax
lea ecx, [esp + 0x2c]
push ecx
push eax
mov eax, dword [edx + ebx + 8]
push eax
call fcn.00413640
add esp, 0x18
test eax, eax
je 0x40a15d
mov ecx, 0x12
mov esi, 0x5b3a95
mov edi, 0x5c1a95
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov edx, dword [esp + 0x10]
mov ecx, 0x80
mov esi, 0x5c18e0
mov edi, 0x5b38e0
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp + 0x35c]
push 0x5b38e0
push eax
lea ecx, [esp + 0x28]
push ecx
push eax
mov eax, dword [edx + ebx + 8]
push eax
call fcn.004136f0
add esp, 0x14
test eax, eax
je 0x40a1b1
mov eax, dword [esp + 0x1c]
mov ebx, dword [ebp + 0x734]
add dword [esp + 0x10], 0x18
inc eax
mov dword [esp + 0x1c], eax
cmp eax, dword [ebx]
jb 0x40a120
mov ebx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
test ebx, ebx
je 0x40a1c3
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40a1d4
push eax
call fcn.005251b8
add esp, 4
cmp dword [0x5b2db8], 0
je 0x40a1e2
call fcn.0041e380
mov ecx, dword [esp + 0x248]
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x248
ret
Function at 0x40a200
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x228], eax
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x36c], 0
push ebx
push esi
push edi
jne 0x40a449
cmp dword [ecx + 0x370], 0
jne 0x40a449
push ecx
call fcn.00407e40
push eax
add ecx, 2
push ecx
lea eax, [esp + 0x34]
push 0x5516e0
push eax
call fcn.00525f70
add esp, 0x14
push 0
push 0
push 3
push 0
push 7
push 0xc0000000
lea ecx, [esp + 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [esp + 0x14], ebx
cmp ebx, 0xffffffff
jne 0x40a293
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x228]
xor ecx, esp
call fcn.00524d83
mov esp, ebp
pop ebp
ret
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x40a442
cmp eax, 0x2200
jb 0x40a442
push 0
push 0
push 0x1200
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x1200
jne 0x40a427
push 0
lea edx, [esp + 0x28]
push edx
push 0x1000
push 0x5b38e0
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a427
cmp dword [esp + 0x24], 0x1000
jne 0x40a427
mov eax, dword [0x5b3af0]
mov edx, dword [0x5b3af8]
mov ecx, 0x7c
mov esi, 0x5b38f0
mov edi, 0x5c18e0
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x5b3af4]
mov dword [0x5c1ad0], eax
mov eax, dword [0x5b3afc]
mov dword [0x5c1adc], eax
mov ax, word [0x5b3afe]
mov dword [0x5c1ad4], ecx
mov dword [0x5c1ad8], edx
cmp al, 0x55
jne 0x40a427
cmp ah, 0xaa
jne 0x40a427
push 1
push 0x1000
call fcn.00525178
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40a423
xor eax, eax
push eax
push ebx
push 0x1000
lea ecx, [esp + 0x24]
push ecx
push 0x1000
push eax
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], eax
mov dword [esp + 0x28], eax
call fcn.00413640
add esp, 0x18
test eax, eax
je 0x40a41a
jmp 0x40a3a0
mov edx, dword [ebx + 0x1b5]
lea esi, [ebx + 0x1b5]
cmp edx, dword [0x5c1a95]
jne 0x40a3f2
mov ecx, 0x12
mov edi, 0x5c1a95
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push ebx
movsb byte es:[edi], byte [esi]
push 0x200
lea eax, [esp + 0x20]
push eax
mov ecx, 0x80
mov esi, 0x5c18e0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x1c]
push 0x200
push ecx
call fcn.004136f0
add esp, 0x14
test eax, eax
je 0x40a41a
mov eax, dword [esp + 0x10]
push 0
push ebx
push 0x1000
lea edx, [esp + 0x24]
push edx
inc eax
push 0x1000
push eax
mov dword [esp + 0x28], eax
call fcn.00413640
add esp, 0x18
test eax, eax
jne 0x40a3a0
push ebx
call fcn.005251b8
add esp, 4
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x40a432
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x5b2db8], 0
je 0x40a449
call fcn.0041e380
jmp 0x40a449
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x234]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00524d83
mov esp, ebp
pop ebp
ret
Function at 0x40a470
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
mov ebx, dword [esp + 0x21c]
push esi
mov esi, dword [esp + 0x21c]
push edi
push 0x200
push 0
push ebx
call fcn.00526520
add esp, 0xc
cmp dword [esi + 0x370], 0
jne 0x40a4bb
cmp dword [esi + 0x36c], 0
je 0x40a59c
push esi
call fcn.00407e40
push eax
add esi, 2
push esi
lea eax, [esp + 0x1c]
push 0x5516e0
push eax
call fcn.00525f70
add esp, 0x14
push 0
push 0
push 3
push 0
push 7
push closesocket
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a517
push 0
push 0
push 0x1200
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x1200
je 0x40a531
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00524d83
add esp, 0x210
ret
push 0
lea edx, [esp + 0x10]
push edx
push 0x1000
push 0x5b38e0
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40a517
cmp dword [esp + 0xc], 0x1000
jne 0x40a517
mov ecx, 0x7c
mov esi, 0x5b38f0
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
mov eax, dword [0x5b3af0]
mov dword [ebx + 0x1f0], eax
mov ecx, dword [0x5b3af4]
mov dword [ebx + 0x1f4], ecx
mov edx, dword [0x5b3af8]
mov dword [ebx + 0x1f8], edx
mov eax, dword [0x5b3afc]
mov dword [ebx + 0x1fc], eax
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x210
ret
Function at 0x40a8b0
Capabilities:
Delete file
Set file attributes

Disassembly:
sub esp, 0x20c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x208], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x21c]
push edi
push esi
mov ebp, 1
lea edi, [esi + 2]
call fcn.00407ec0
push eax
push edi
lea eax, [esp + 0x1c]
push 0x5516e0
push eax
call fcn.00525f70
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
add esp, 0x14
push 0x26
lea ecx, [esp + 0x14]
push ecx
call ebx
test eax, eax
je 0x40a911
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ebp, eax
push esi
call fcn.00407e40
push eax
push edi
lea eax, [esp + 0x1c]
push 0x5516e0
push eax
call fcn.00525f70
add esp, 0x14
push 0x26
lea ecx, [esp + 0x14]
push ecx
call ebx
test eax, eax
je 0x40a945
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40a947
mov eax, ebp
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0x20c
ret

Function at 0x40a960
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov esi, dword [esp + 0x218]
push edi
mov edi, dword [esp + 0x220]
push 0x800
push 0
push edi
call fcn.00526520
push esi
call fcn.00407e40
push eax
add esi, 2
push esi
lea eax, [esp + 0x24]
push 0x5516e0
push eax
call fcn.00525f70
add esp, 0x20
push 0
push 0
push 3
push 0
push 7
push closesocket
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40a9e7
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x40aa00
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00524d83
add esp, 0x210
ret
push 0
lea edx, [esp + 0xc]
push edx
push 0x800
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40a9e7
cmp dword [esp + 8], 0x800
jne 0x40a9e7
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x210
ret
Function at 0x40aa50
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x20c], eax
mov ecx, dword [esp + 0x214]
push esi
push edi
mov edi, dword [esp + 0x220]
push ecx
call fcn.00407e40
push eax
add ecx, 2
push ecx
lea eax, [esp + 0x18]
push 0x5516e0
push eax
call fcn.00525f70
add esp, 0x14
push 0
push 0
push 3
push 0
push 7
push 0xc0000000
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40aaca
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x40aae3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00524d83
add esp, 0x210
ret
push 0
lea edx, [esp + 0xc]
push edx
push 0x800
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40aaca
cmp dword [esp + 8], 0x800
jne 0x40aaca
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x210
ret

Function at 0x40ab30
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x210
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x20c], eax
mov ecx, dword [esp + 0x214]
push esi
push edi
mov edi, dword [esp + 0x220]
push ecx
call fcn.00407e40
push eax
add ecx, 2
push ecx
lea eax, [esp + 0x18]
push 0x5516e0
push eax
call fcn.00525f70
add esp, 0x14
push 0
push 0x26
push 4
push 0
push 7
push 0xc0000000
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40abaa
push 0
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
test eax, eax
je 0x40abc3
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.00524d83
add esp, 0x210
ret
push 0
lea edx, [esp + 0xc]
push edx
push 0x1000
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40abaa
cmp dword [esp + 8], 0x1000
jne 0x40abaa
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x210
ret
Function at 0x40ac10
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
push edi
mov edi, dword [esp + 0x224]
push 0xa0
push 0
push edi
mov dword [esp + 0x14], 0
call fcn.00526520
add esp, 0xc
cmp dword [esi + 0x370], 0
jne 0x40ac62
cmp dword [esi + 0x36c], 0
je 0x40ad05
lea eax, [esp + 8]
push eax
call fcn.00408520
add esp, 4
test eax, eax
je 0x40ad05
cmp word [esp + 8], 0
je 0x40ad05
cmp dword [esi + 0x3b40], 0
jne 0x40ad65
mov eax, 0xaaaaaaaa
cmp dword [esi + 0x8a8], eax
jne 0x40aca9
cmp dword [esi + 0x8ac], eax
je 0x40ad65
push esi
call fcn.00407e40
push eax
add esi, 2
push esi
lea ecx, [esp + 0x1c]
push 0x5516e0
push ecx
call fcn.00525f70
add esp, 0x14
push 0
push 0
push 3
push 0
push 7
push closesocket
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ad05
push 0
push 0
push 0x115a
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x115a
je 0x40ad1e
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00524d83
add esp, 0x214
ret
push 0
lea eax, [esp + 0x10]
push eax
push 0xa0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40ad05
cmp dword [esp + 0xc], 0xa0
jne 0x40ad05
pop edi
mov eax, 1
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00524d83
add esp, 0x214
ret
push edi
push esi
call fcn.004075d0
mov ecx, dword [esp + 0x220]
add esp, 8
pop edi
pop esi
xor ecx, esp
call fcn.00524d83
add esp, 0x214
ret

Function at 0x40ad90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x210], eax
push esi
mov esi, dword [esp + 0x21c]
cmp dword [esi + 0x370], 0
push edi
mov edi, dword [esp + 0x224]
mov dword [esp + 8], 0
jne 0x40adce
cmp dword [esi + 0x36c], 0
je 0x40ae4d
cmp dword [esp + 0x228], 0
je 0x40adf1
lea eax, [esp + 8]
push eax
call fcn.00408520
add esp, 4
test eax, eax
je 0x40ae4d
cmp word [esp + 8], 0
je 0x40ae4d
push esi
call fcn.00407e40
push eax
add esi, 2
push esi
lea ecx, [esp + 0x1c]
push 0x5516e0
push ecx
call fcn.00525f70
add esp, 0x14
push 0
push 0
push 3
push 0
push 7
push 0xc0000000
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ae4d
push 0
push 0
push 0x115a
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x115a
je 0x40ae66
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00524d83
add esp, 0x214
ret
push 0
lea eax, [esp + 0x10]
push eax
push 0xa0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x40ae4d
cmp dword [esp + 0xc], 0xa0
jne 0x40ae4d
mov ecx, dword [esp + 0x218]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x214
ret
Function at 0x40aeb0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa3c
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0xa38], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
push ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0x1c], ecx
mov ecx, dword [ebp + 0x18]
push esi
push edi
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
call fcn.0044b8f0
mov esi, eax
call fcn.0044b920
test esi, esi
je 0x40af09
cmp dword [esi + 0x37c], 0
jne 0x40af20
test eax, eax
je 0x40b093
cmp dword [eax + 0x37c], 0
je 0x40b093
mov esi, eax
push esi
call fcn.00407e40
push eax
add esi, 2
push esi
lea edx, [esp + 0x844]
push 0x5516e0
push edx
call fcn.00525f70
add esp, 0x14
push 0
push 0
push 3
push 0
push 7
push closesocket
lea eax, [esp + 0x850]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40b093
push 0
push 0
push 0x1400
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0x1400
jne 0x40b08c
push 0
lea ecx, [esp + 0x24]
push ecx
push 0xa00
push 0x5c1ae0
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b08c
cmp dword [esp + 0x20], 0xa00
jne 0x40b08c
mov edx, dword [esp + 0x18]
mov ecx, 0x78
mov esi, 0x5c1b00
lea edi, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x7c
mov esi, 0x5c1cf0
lea edi, [esp + 0x208]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x7c
mov esi, 0x5c1ef0
lea edi, [esp + 0x3f8]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x7c
mov esi, 0x5c20f0
lea edi, [esp + 0x5e8]
rep movsd dword es:[edi], dword [esi]
mov ecx, 0x17
mov esi, 0x5c22f0
lea edi, [esp + 0x7d8]
lea eax, [esp + 0x28]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
sub edx, ecx
lea esp, [esp]
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x40b020
mov edi, dword [esp + 0x24]
mov ecx, 0x1dd
lea esi, [esp + 0x68]
rep movsd dword es:[edi], dword [esi]
movzx edx, word [esp + 0x830]
mov eax, dword [esp + 0x14]
movsb byte es:[edi], byte [esi]
mov edi, dword [esp + 0x10]
mov ecx, 0x14
lea esi, [esp + 0x7dd]
rep movsd dword es:[edi], dword [esi]
movzx ecx, word [esp + 0x832]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
mov dword [eax], edx
mov edx, dword [esp + 0x1c]
push ebx
mov dword [edx], ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0xa38]
xor ecx, esp
call fcn.00524d83
mov esp, ebp
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xa44]
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00524d83
mov esp, ebp
pop ebp
ret
Function at 0x40b0b0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 0x214
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x210], eax
mov ecx, dword [esp + 0x21c]
push ebx
push 0
call fcn.00407e40
push eax
push ecx
lea eax, [esp + 0x18]
push 0x5516e0
push eax
call fcn.00525f70
add esp, 0x14
push 0
push 0
push 3
push 0
push 7
push 0xc0000000
lea ecx, [esp + 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40b120
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00524d83
add esp, 0x214
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
push 0
push 0x1400
push ebx
call ebp
cmp eax, 0x1400
jne 0x40b229
push 0
lea edx, [esp + 0x10]
push edx
push 0xa00
push 0x5c1ae0
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b229
cmp dword [esp + 0xc], 0xa00
jne 0x40b229
mov eax, dword [esp + 0x220]
push esi
push edi
mov esi, eax
mov ecx, 0x78
mov edi, 0x5c1b00
rep movsd dword es:[edi], dword [esi]
lea esi, [eax + 0x1e0]
mov ecx, 0x7c
mov edi, 0x5c1cf0
rep movsd dword es:[edi], dword [esi]
push 0
lea esi, [eax + 0x3d0]
mov ecx, 0x7c
mov edi, 0x5c1ef0
rep movsd dword es:[edi], dword [esi]
push 0
lea esi, [eax + 0x5c0]
mov ecx, 0x7c
mov edi, 0x5c20f0
rep movsd dword es:[edi], dword [esi]
push 0x1400
lea esi, [eax + 0x7b0]
mov ecx, 0x17
mov edi, 0x5c22f0
push ebx
rep movsd dword es:[edi], dword [esi]
call ebp
pop edi
pop esi
cmp eax, 0x1400
jne 0x40b229
push 0
lea eax, [esp + 0xc]
push eax
push 0x86c
push 0x5c1ae0
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40b229
cmp dword [esp + 8], 0x86c
jne 0x40b229
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.00524d83
add esp, 0x214
ret
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0x218]
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00524d83
add esp, 0x214
ret
Function at 0x40d1f0
Capabilities:
Delete registry value

Disassembly:
sub esp, 0x48
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x44], eax
cmp dword [0x5b2904], 0
push esi
mov esi, dword [esp + 0x50]
jne 0x40d21a
cmp dword [0x5b2908], 0
mov eax, 0xf003f
je 0x40d21f
mov eax, 0xf013f
cmp dword [esi + 0x3b24], 0
jne 0x40d259
cmp dword [esp + 0x54], 0
je 0x40d247
push 0x40
push 0
push 0xef1c
push 0xefd6
mov ecx, 0x5b2810
call fcn.00405df0
xor eax, eax
pop esi
mov ecx, dword [esp + 0x44]
xor ecx, esp
call fcn.00524d83
add esp, 0x48
ret
lea ecx, [esp + 4]
push ecx
push eax
push 0
push str.SYSTEMCurrentControlSetServices_bcfntBootEnum
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40d247
mov edx, dword [esi + 0x3b30]
push edx
lea eax, [esp + 0xc]
push 0x550694
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov edx, dword [esp + 0x10]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [esp + 4]
push eax
mov dword [esi + 0x3b24], 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [esp + 0x54], 0
je 0x40d2d3
push 0x40
push 0
push 0xef1c
push 0xefd5
mov ecx, 0x5b2810
call fcn.00405df0
mov ecx, dword [esp + 0x48]
pop esi
xor ecx, esp
mov eax, 1
call fcn.00524d83
add esp, 0x48
ret
Function at 0x41320a
Capabilities:
Create thread

Disassembly:
sub esp, 8
cmp dword [0x5b2934], 0
push esi
mov esi, ecx
push edi
mov edi, dword [esi + 0x20]
jne 0x413246
cmp dword [0x5b2930], 0
je 0x413246
lea eax, [esp + 8]
push eax
mov ecx, 0x5b2930
call fcn.00463cd0
cmp dword [esp + 8], 0
je 0x41323c
push edi
call dword [0x5b2950]
add esp, 4
push edi
call dword [0x5b2944]
add esp, 4
mov ecx, esi
call fcn.005088f4
mov edx, dword [esi + 0x1e4]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextA]
lea ecx, [esi + 0x26c]
push ecx
push edx
call edi
mov ecx, dword [esi + 0x238]
lea eax, [esi + 0x474]
push eax
push ecx
call edi
mov eax, dword [esi + 0x13c]
lea edx, [esi + 0x578]
push edx
push eax
call edi
movzx ecx, word [esi + 0x780]
mov edx, dword [esi + 0x190]
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
shl ecx, 0x10
push ecx
push 0
push 0x401
push edx
call edi
mov eax, dword [esi + 0x190]
push 0
push 1
push 0x404
push eax
call edi
lea ecx, [esp + 0xc]
push ecx
push 0
push esi
push 0x413080
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x788], eax
test eax, eax
jne 0x4132f2
push 0x10
push 0x54ffac
push 0x553300
mov ecx, esi
call fcn.00503258
pop edi
xor eax, eax
pop esi
add esp, 8
ret
pop edi
mov eax, 1
pop esi
add esp, 8
ret

Function at 0x414e90
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x664
mov eax, dword [0x5b0c20]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
push edi
mov ebx, ecx
xor eax, eax
jmp 0x414eb0
movzx ecx, word [eax + 0x5b2994]
mov word [esp + eax + 0x464], cx
add eax, 2
test cx, cx
jne 0x414eb0
lea edi, [esp + 0x464]
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x414ed1
mov ecx, 6
mov esi, str.Themes.vth
rep movsd dword es:[edi], dword [esi]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x468]
push ecx
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x414fc4
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, 1
jmp 0x414f20
xor eax, eax
jmp 0x414f30
movzx ecx, word [esp + eax + 0x3c]
mov word [esp + eax + 0x260], cx
add eax, 2
test cx, cx
jne 0x414f30
lea eax, [esp + 0x260]
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x414f50
sub eax, edx
sar eax, 1
test eax, eax
jle 0x414f8a
cmp word [esp + eax*2 + 0x260], 0x2e
je 0x414f80
xor edx, edx
mov word [esp + eax*2 + 0x260], dx
sub eax, edi
test eax, eax
jg 0x414f63
jmp 0x414f8a
xor ecx, ecx
mov word [esp + eax*2 + 0x260], cx
mov eax, dword [ebx + 0xa10]
lea edx, [esp + 0x260]
push edx
push 0
push 0x143
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
add dword [ebx + 0xcac], edi
lea ecx, [esp + 0x10]
push ecx
push esi
call ebp
test eax, eax
jne 0x414f20
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00524d83
add esp, 0x664
ret