joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4018dd
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
lea esi, [ebp - 0x108]
push esi
call sub.KERNEL32.DLL_GetCommandLineA
pop esi
mov dword [esi], eax
lea esi, [ebp - 0x134]
push esi
mov eax, dword [ebp - 0x108]
push eax
call fcn.0040108b
pop esi
mov dword [esi], eax
mov eax, dword [ebp - 0x108]
push eax
lea esi, [ebp - 0x104]
push esi
mov eax, dword [ebp - 0x134]
push eax
mov eax, 1
pop ecx
add eax, ecx
push eax
call fcn.004010a9
lea esi, [ebp - 0x130]
mov eax, 1
mov dword [esi], eax
lea esi, [ebp - 0x128]
push esi
mov eax, dword [ebp - 0x130]
mov ecx, 1
sub eax, ecx
pop esi
lea esi, [esi + eax*4]
push esi
lea esi, [ebp - 0x104]
mov eax, esi
pop esi
mov dword [esi], eax
lea esi, [ebp - 0x12c]
push esi
push 1
mov eax, dword [ebp - 0x134]
pop ecx
pop esi
mov dword [esi], ecx
sub eax, ecx
inc eax
push eax
cmp dword [esp], 0
jg 0x401984
jmp 0x401a7a
lea esi, [ebp - 0x104]
mov eax, dword [ebp - 0x12c]
dec eax
lea esi, [esi + eax]
movzx eax, byte [esi]
cmp eax, 0x20
jle 0x4019a3
jmp 0x4019ba
lea esi, [ebp - 0x104]
mov eax, dword [ebp - 0x12c]
dec eax
lea esi, [esi + eax]
mov eax, 0
mov byte [esi], al
mov eax, dword [ebp - 0x12c]
cmp eax, 1
mov eax, 1
jg 0x4019ce
xor eax, eax
test eax, eax
jne 0x4019d7
jmp 0x4019f8
lea esi, [ebp - 0x104]
mov eax, dword [ebp - 0x12c]
dec eax
lea esi, [esi + eax]
movzx eax, byte [esi]
cmp eax, 0x20
mov eax, 1
jg 0x4019f8
xor eax, eax
test eax, eax
jne 0x401a01
jmp 0x401a2b
lea esi, [ebp - 0x104]
push esi
mov eax, dword [ebp - 0x12c]
mov ecx, 1
sub eax, ecx
pop esi
dec eax
lea esi, [esi + eax]
movzx eax, byte [esi]
cmp eax, 0
mov eax, 1
je 0x401a2b
xor eax, eax
test eax, eax
jne 0x401a34
jmp 0x401a6a
lea esi, [ebp - 0x130]
inc dword [esi]
lea esi, [ebp - 0x128]
push esi
mov eax, dword [ebp - 0x130]
mov ecx, 1
sub eax, ecx
pop esi
lea esi, [esi + eax*4]
push esi
lea esi, [ebp - 0x104]
mov eax, dword [ebp - 0x12c]
dec eax
lea esi, [esi + eax]
mov eax, esi
pop esi
mov dword [esi], eax
lea esi, [ebp - 0x12c]
inc dword [esi]
dec dword [esp]
jmp 0x401979
add esp, 4
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0x130]
mov ecx, eax
pop eax
cmp eax, ecx
jl 0x401a99
jmp 0x401abc
mov eax, dword [ebp + 8]
push eax
lea esi, [ebp - 0x128]
mov eax, dword [ebp + 0xc]
lea esi, [esi + eax*4]
mov eax, dword [esi]
push eax
call fcn.00401095
jmp 0x401acd
mov eax, dword [ebp + 8]
push eax
push 0x406355
call fcn.00401095
lea esi, [ebp - 4]
mov eax, dword [ebp - 0x130]
mov dword [esi], eax
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 8
Function at 0x100732b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100ae5d0
push 0x1007ac28
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x100b0008]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0
xor esi, esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x2c], esi
xor ebx, ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x20], 0x100
mov eax, dword [ecx]
mov edi, dword [eax + 0x28]
mov dword [ebp - 0x40], edi
test edi, edi
jne 0x10073319
xor eax, eax
jmp 0x1007348f
mov dword [ebp - 4], ebx
push str.InitializeSecurityDescriptor
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007345a
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x1007345a
push str.AllocateAndInitializeSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007345a
lea ecx, [ebp - 0x28]
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 1
lea ecx, [ebp - 0x24]
push ecx
call eax
test eax, eax
je 0x1007345a
push str.GetLengthSid
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007345a
push dword [ebp - 0x28]
call eax
add eax, 0x10
mov dword [ebp - 0x30], eax
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
mov dword [ebp - 0x3c], esi
test esi, esi
je 0x1007345a
push str.InitializeAcl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007345a
push 2
push dword [ebp - 0x30]
push esi
call eax
test eax, eax
je 0x1007345a
push str.AddAccessAllowedAce
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1007345a
push dword [ebp - 0x28]
push 0x10000000
push 2
push esi
call eax
test eax, eax
je 0x1007345a
push str.SetSecurityDescriptorDacl
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x30], eax
test eax, eax
je 0x1007345a
mov ecx, dword [ebp - 0x2c]
test ecx, ecx
je 0x10073443
push 0
push ecx
push 1
push dword [ebp - 0x34]
call eax
test eax, eax
je 0x10073430
mov ebx, 1
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x2c], 0
je 0x10073440
jmp 0x1007345a
push dword [ebp - 0x2c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
push 0
push esi
push 1
push dword [ebp - 0x34]
call eax
mov ecx, 1
test eax, eax
cmovne ebx, ecx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 4], 0xfffffffe
call fcn.100734b6
test ebx, ebx
jne 0x1007348d
test esi, esi
je 0x1007347f
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor esi, esi
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x1007348d
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, esi
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1007a1a9
mov esp, ebp
pop ebp
ret 0xc
Function at 0x41a4e78
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
xor edx, edx
mov dword [ebp - 4], edx
xor edx, edx
push ebp
push 0x41a4f0f
push dword fs:[edx]
mov dword fs:[edx], esp
mov ecx, eax
mov dl, 1
mov eax, dword [sym.imp.adortl60.bpl__Adodb_TADOQuery_]
call sub.adortl60.bpl__Adodb_TADOQuery__bctr_qqrp18Classes_TComponent
mov ebx, eax
call sub.VEDatasets.bpl__Vedataset_Connection_qqrv
mov edx, eax
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x268]
lea eax, [ebp - 4]
push eax
call sub.VEDatasets.bpl__Vedataset_FirmaNo_qqrv
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0
call sub.VEDatasets.bpl__Vedataset_DonemNo_qqrv
mov dword [ebp - 0xc], eax
mov byte [ebp - 8], 0
lea edx, [ebp - 0x14]
mov ecx, 1
mov eax, 0x41a4f28
call sub.rtl60.bpl__Sysutils_Format_qqrx17System_AnsiStringpx14System_TVarRecxi
mov eax, dword [ebp - 4]
push eax
mov eax, ebx
call sub.adortl60.bpl__Adodb_TADOQuery_GetSQL_qqrv
pop edx
mov ecx, dword [eax]
call dword [ecx + 0x2c]
mov eax, ebx
call sub.dbrtl60.bpl__Db_TDataSet_Open_qqrv
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41a4f16
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41b22b8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41b2318
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__Sysutils_FileExists_qqrx17System_AnsiString
test al, al
je 0x41b2302
push 3
push 0x41b2324
push 0x41b2324
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrToPChar_qqrx17System_AnsiString
push eax
push 0x41b2328
push 0
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b231f
lea eax, [ebp - 4]
call sub.rtl60.bpl__System__LStrClr_qqrpv
ret

Function at 0x41b579c
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xffffffd4
mov eax, 0x41b5828
mov dword [esp], eax
mov eax, 0x41b5848
mov dword [esp + 4], eax
mov eax, 0x41b5868
mov dword [esp + 8], eax
mov eax, 0x41b5888
mov dword [esp + 0xc], eax
mov eax, 0x41b58ac
mov dword [esp + 0x10], eax
mov eax, 0x41b58cc
mov dword [esp + 0x14], eax
mov eax, 0x41b58f0
mov dword [esp + 0x18], eax
mov eax, 0x41b5910
mov dword [esp + 0x1c], eax
mov eax, 0x41b5930
mov dword [esp + 0x20], eax
mov eax, 0x41b5950
mov dword [esp + 0x24], eax
mov eax, 0x41b5970
mov dword [esp + 0x28], eax
mov eax, esp
mov edx, 0xa
call fcn.041ab388
mov edx, 0x41b5990
mov eax, 0x41b670c
call fcn.041ab748
add esp, 0x2c
ret
Function at 0x41b6720
Capabilities:
Reference sql statements

Disassembly:
add esp, 0xffffffdc
mov eax, 0x41b679c
mov dword [esp], eax
mov eax, 0x41b67b8
mov dword [esp + 4], eax
mov eax, 0x41b67d8
mov dword [esp + 8], eax
mov eax, 0x41b67f8
mov dword [esp + 0xc], eax
mov eax, 0x41b6818
mov dword [esp + 0x10], eax
mov eax, 0x41b6834
mov dword [esp + 0x14], eax
mov eax, 0x41b6854
mov dword [esp + 0x18], eax
mov eax, 0x41b6874
mov dword [esp + 0x1c], eax
mov eax, 0x41b6898
mov dword [esp + 0x20], eax
mov eax, esp
mov edx, 8
call fcn.041ab388
mov edx, 0x41b68b8
mov eax, 0x41b755c
call fcn.041ab748
add esp, 0x24
ret

Function at 0x41b7654
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x41b765d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__System__LStrAddRef_qqrpv
xor eax, eax
push ebp
push 0x41b7773
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x18]
push eax
push edi
lea eax, [ebp - 0x1c]
push eax
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 8]
call sub.rtl60.bpl__Sysutils_QuotedStr_qqrx17System_AnsiString
mov ecx, dword [ebp - 0x24]
lea eax, [ebp - 0x20]
mov edx, 0x41b778c
call sub.rtl60.bpl__System__LStrCat3_qqrv
mov edx, dword [ebp - 0x20]
mov ecx, esi
mov eax, dword [0x419d968]
call fcn.0419df68
mov ecx, dword [ebp - 0x1c]
mov edx, ebx
mov eax, dword [0x419d968]
call fcn.0419dbac
lea eax, [ebp - 0x18]
call sub.rtl60.bpl__System__VarToInt_qqrrx14System_Variant
test eax, eax
jle 0x41b7720
push edi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x41b77d4
mov edx, 0x41b77ec
mov eax, dword [ebp - 4]
call sub.JVCL200_R60.bpl__Jvstrutils_ReplaceStr_qqrx17System_AnsiStringt1t1
mov edx, dword [ebp - 0x2c]
mov ecx, esi
mov eax, dword [0x419d968]
call fcn.0419df68
mov ecx, dword [ebp - 0x28]
mov edx, ebx
mov eax, dword [0x419d968]
call fcn.0419dad0
jmp 0x41b7743
push edi
lea eax, [ebp - 0x30]
push eax
mov ecx, esi
mov edx, dword [ebp - 4]
mov eax, dword [0x419d968]
call fcn.0419df68
mov ecx, dword [ebp - 0x30]
mov edx, ebx
mov eax, dword [0x419d968]
call fcn.0419dad0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41b777a
lea eax, [ebp - 0x30]
mov edx, 6
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
lea eax, [ebp - 0x18]
call sub.rtl60.bpl__System__VarClr_qqrr14System_Variant
lea eax, [ebp - 8]
mov edx, 2
call sub.rtl60.bpl__System__LStrArrayClr_qqrpvi
ret
Function at 0x4015f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x5543c8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push 0x104
push 0
push eax
mov dword [ebp - 0x10c], esi
call fcn.004cf400
add esp, 0xc
lea eax, [ebp - 0x108]
push 0
push dword [ebp + 0xc]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
mov dword [esi + 0x10], 0
lea ecx, [ebp - 0x108]
mov dword [esi + 0x14], 0
lea edx, [ecx + 1]
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x401665
sub ecx, edx
lea eax, [ebp - 0x108]
push ecx
push eax
mov ecx, esi
call fcn.00403350
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004cd2ac
mov esp, ebp
pop ebp
ret
Function at 0x401690
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa3bf
mov eax, dword fs:[0]
push eax
sub esp, 0x260
mov eax, dword [0x5543c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov ebx, dword [ebp + 0xc]
push 0x228
mov dword [ebp - 0x260], eax
lea eax, [ebp - 0x250]
push edi
push eax
mov dword [ebp - 0x25c], edi
call fcn.004cf400
add esp, 0xc
push edi
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x258], eax
cmp eax, 0xffffffff
jne 0x401702
xor al, al
jmp 0x401884
lea ecx, [ebp - 0x254]
mov dword [ebp - 0x254], 0x22c
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x401876
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
lea eax, [ebp - 0x230]
mov dword [ebp - 4], 0
push eax
push 0
mov dword [ebp - 0x28], 0
or edi, 1
push 0x3a8
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
mov dword [ebp - 0x25c], edi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push 0
lea ecx, [ebp - 0x28]
lea esi, [eax - 1]
push esi
call fcn.00402810
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x230]
push 0
push esi
push ecx
push 0xffffffffffffffff
push eax
push 0
push 0x3a8
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov eax, dword [ebp - 0x260]
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x4017ae
mov ecx, dword [eax]
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
push ecx
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x401821
cmp dword [ebx + 4], 0x15555555
mov eax, dword [ebp - 0x24c]
mov esi, dword [ebx]
mov dword [ebp - 0x264], eax
je 0x4018a5
mov dword [ebp - 0x26c], ebx
mov byte [ebp - 4], 1
push 0xc
mov dword [ebp - 0x268], 0
call fcn.004cd26e
mov ecx, dword [ebp - 0x264]
add esp, 4
mov dword [ebp - 0x268], 0
mov dword [eax + 8], ecx
inc dword [ebx + 4]
mov ecx, dword [esi + 4]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [esi + 4], eax
mov dword [ecx], eax
mov dword [ebp - 4], 0xffffffff
and edi, 0xfffffffe
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x40185b
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x401851
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4018a0
push ecx
push edx
call fcn.004cd29e
add esp, 8
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x401722
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd2ac
mov esp, ebp
pop ebp
ret
call fcn.004d2fbf
push str.list_too_long
call fcn.0041d570
int3
Function at 0x4020f0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa51d
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x5543c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0xf
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x2c]
mov dword [ebp - 4], 0
push edx
push dword [ebp + 0x1c]
mov dword [ebp - 0x2c], 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40219d
push eax
push dword [ebp + 0x18]
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x30], eax
call fcn.00402810
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp + 0x18]
push ecx
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
lea eax, [ebp - 0x30]
push eax
push 0
push edi
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x14], 0x10
lea edx, [ebp - 0x28]
mov dword [esi + 0x10], 0
cmovae edx, dword [ebp - 0x28]
mov ecx, edx
mov dword [esi + 0x14], 0
mov dword [esi], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
lea edi, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4021d2
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.00403350
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x402214
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x40220a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x402231
push ecx
push edx
call fcn.004cd29e
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd2ac
mov esp, ebp
pop ebp
ret
call fcn.004d2fbf
int3

Function at 0x402240
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0x18]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40228e
mov eax, dword [ebp + 0x14]
mov ecx, eax
cmp dword [eax + 0x14], 0x10
jb 0x402271
mov ecx, dword [eax]
push dword [eax + 0x10]
push ecx
push 1
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret
Function at 0x402300
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x402325
xor al, al
mov esp, ebp
pop ebp
ret
push esi
push 0
push 0
push 0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
mov esp, ebp
pop ebp
ret

Function at 0x402350
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40237b
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov esp, ebp
pop ebp
ret
Function at 0x406520
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa84d
mov eax, dword fs:[0]
push eax
sub esp, 0x6c
mov eax, dword [0x5543c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x406708
cmp byte [esi], 0
je 0x406708
push 0x5c
push esi
call fcn.004cf740
mov edi, eax
add esp, 8
test edi, edi
je 0x406708
mov ecx, esi
mov dword [ebp - 0x18], 0
xorps xmm0, xmm0
mov dword [ebp - 0x14], 0
movups xmmword [ebp - 0x28], xmm0
lea edx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406590
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404480
sub edi, esi
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
lea eax, [edi + 1]
push eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x78]
push 0
push eax
call fcn.00402600
mov edi, eax
lea eax, [ebp - 0x28]
cmp eax, edi
je 0x4065f3
mov ecx, eax
call fcn.00403880
movups xmm0, xmmword [edi]
movups xmmword [ebp - 0x28], xmm0
movq xmm0, qword [edi + 0x10]
movq qword [ebp - 0x18], xmm0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0xf
mov byte [edi], 0
lea ecx, [ebp - 0x78]
call fcn.00403880
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 1
je 0x4066f7
cmp eax, 5
je 0x4066f7
push esi
lea ecx, [ebp - 0x58]
call fcn.00402990
push 0xffffffffffffffff
push dword [ebp - 0x60]
lea eax, [ebp - 0x78]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x58]
call fcn.00402600
push eax
lea ecx, [ebp - 0x58]
call fcn.00402910
lea ecx, [ebp - 0x78]
call fcn.00403880
push 8
xorps xmm0, xmm0
mov dword [ebp - 0x30], 0
push 0x501bc0
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x2c], 0
movups xmmword [ebp - 0x40], xmm0
call fcn.00404480
mov ecx, dword [ebp - 0x30]
or eax, 0xffffffff
xor esi, esi
mov byte [ebp - 4], 2
test ecx, ecx
je 0x4066d3
mov edx, dword [ebp - 0x48]
cmp ecx, esi
jbe 0x406727
cmp dword [ebp - 0x2c], 0x10
lea eax, [ebp - 0x40]
lea edi, [ebp - 0x58]
cmovae eax, dword [ebp - 0x40]
cmp dword [ebp - 0x44], 0x10
cmovae edi, dword [ebp - 0x58]
mov al, byte [eax + esi]
test edx, edx
je 0x4066c8
push edx
movsx eax, al
push eax
push edi
call fcn.004cf870
add esp, 0xc
test eax, eax
je 0x4066c5
sub eax, edi
jns 0x4066d3
mov ecx, dword [ebp - 0x30]
jmp 0x4066cb
mov ecx, dword [ebp - 0x30]
or eax, 0xffffffff
mov edx, dword [ebp - 0x48]
inc esi
cmp esi, ecx
jb 0x406685
cmp eax, 0xffffffff
lea ecx, [ebp - 0x40]
sete byte [ebp - 0x59]
call fcn.00403880
lea ecx, [ebp - 0x58]
call fcn.00403880
lea ecx, [ebp - 0x28]
call fcn.00403880
mov al, byte [ebp - 0x59]
jmp 0x40670a
lea ecx, [ebp - 0x28]
mov byte [ebp - 0x59], 0
call fcn.00403880
mov al, byte [ebp - 0x59]
jmp 0x40670a
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd2ac
mov esp, ebp
pop ebp
ret 4
call fcn.00402cc0
int3
Function at 0x406a10
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fa8cd
mov eax, dword fs:[0]
push eax
sub esp, 0x5c
mov eax, dword [0x5543c8]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
xorps xmm0, xmm0
mov eax, dword [ebp + 0x10]
mov ecx, esi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x68], eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0
lea edx, [ecx + 1]
mov dword [ebp - 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406a60
sub ecx, edx
push ecx
push esi
lea ecx, [ebp - 0x28]
call fcn.00404480
mov ecx, edi
mov dword [ebp - 4], 0
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x406a80
sub ecx, edx
push ecx
push edi
lea ecx, [ebp - 0x28]
call fcn.00402880
cmp dword [ebp - 0x14], 0x10
lea eax, [ebp - 0x28]
xorps xmm0, xmm0
mov dword [ebp - 0x64], 0x3c
cmovae eax, dword [ebp - 0x28]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x64]
push eax
movlpd qword [ebp - 0x40], xmm0
movlpd qword [ebp - 0x38], xmm0
movlpd qword [ebp - 0x30], xmm0
mov dword [ebp - 0x60], 0x440
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x58], 0
mov dword [ebp - 0x4c], esi
mov dword [ebp - 0x48], 0
mov dword [ebp - 0x44], 0
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
mov eax, dword [ebp - 0x2c]
test eax, eax
je 0x406b00
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0x14]
cmp ecx, 0x10
jb 0x406b30
mov edx, dword [ebp - 0x28]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x406b26
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x406b4d
push ecx
push edx
call fcn.004cd29e
add esp, 8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004cd2ac
mov esp, ebp
pop ebp
ret 0xc
call fcn.004d2fbf
int3