joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad0bb60
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
push ebx
push esi
push edi
push 2
pop esi
jne 0x4ad0bb76
push 3
pop esi
mov ebx, dword [ebp + 0x14]
mov edi, dword [sym.imp.KERNEL32.dll_MoveFileExW]
and dword [ebx], 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
test eax, eax
je 0x4ad15acc
xor eax, eax
inc eax
mov dword [ebx], eax
pop edi
pop esi
pop ebx
pop ebp
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x4ad15b13
push 0x400023d4
push 0x400023d3
push dword [ebp + 0xc]
call fcn.4ad1fe1b
sub eax, 0
je 0x4ad15b0b
dec eax
dec eax
jne 0x4ad15afa
mov eax, dword [ebp + 0x10]
and dword [eax], 0
or esi, 1
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call edi
jmp 0x4ad0bb96
xor eax, eax
inc eax
jmp 0x4ad0bb98
xor eax, eax
jmp 0x4ad0bb98
Function at 0x4ad0c2f7
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x224]
xor esi, esi
push eax
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x214], esi
call fcn.4ad0c44e
test eax, eax
jne 0x4ad10616
cmp dword [ebp - 0x224], esi
je 0x4ad10616
xor ebx, ebx
inc ebx
push 0x40002748
mov dword [ebp - 0x218], ebx
call fcn.4ad0c56b
pop ecx
mov dword [ebp - 0x214], eax
cmp eax, esi
je 0x4ad15d9c
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4ad0c365
sub eax, edx
sar eax, 1
mov esi, 0x104
mov dword [ebp - 0x21c], eax
cmp eax, esi
jae 0x4ad0c410
push 0x208
call fcn.4ad01896
mov dword [ebp - 0x210], eax
test eax, eax
je 0x4ad0c410
push dword [ebp - 0x214]
mov dword [ebp - 0x220], ebx
push esi
push eax
call fcn.4ad0185a
test edi, edi
je 0x4ad133d3
mov edi, dword [edi + 0x3c]
test edi, edi
je 0x4ad15d87
push edi
push esi
push dword [ebp - 0x210]
call fcn.4ad020a9
test eax, eax
jne 0x4ad0c3fc
xor esi, esi
cmp dword [ebp - 0x210], esi
je 0x4ad0c3ee
push dword [ebp - 0x210]
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov byte [0x4ad24083], 0
mov dword [ebp - 0x218], esi
cmp dword [ebp - 0x220], esi
je 0x4ad0c410
cmp dword [ebp - 0x210], 0
je 0x4ad0c410
push dword [ebp - 0x210]
call fcn.4ad0142e
xor esi, esi
cmp dword [ebp - 0x214], esi
je 0x4ad0c426
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x218], esi
jne 0x4ad15d9c
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x218]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 4
cmp edi, esi
je 0x4ad13420
push esi
push dword [edi + 0x3c]
call fcn.4ad02b0d
mov dword [ebp - 0x210], eax
cmp eax, esi
je 0x4ad0c3ee
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4ad10638
sub eax, edx
sar eax, 1
cmp eax, 0x104
jb 0x4ad0c3d1
jmp 0x4ad15d92
lea ebx, [ebp - 0x20c]
push esi
mov eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
test eax, eax
je 0x4ad0c3fc
push dword [ebp - 0x214]
mov edi, dword [sym.imp.msvcrt.dll_wcsstr]
mov eax, ebx
push eax
call edi
pop ecx
pop ecx
test eax, eax
jne 0x4ad15d5e
push ebx
push esi
push dword [ebp - 0x210]
call fcn.4ad020a9
test eax, eax
je 0x4ad0c3d1
jmp 0x4ad0c3fc
mov dword [ebp - 0x210], esi
jmp 0x4ad0c3d1
mov eax, dword [ebp - 0x21c]
add eax, eax
mov dword [ebp - 0x21c], eax
add ebx, dword [ebp - 0x21c]
push dword [ebp - 0x214]
push ebx
call edi
pop ecx
pop ecx
test eax, eax
je 0x4ad13406
jmp 0x4ad15d6c
and dword [ebp - 0x218], edi
jmp 0x4ad0c3fc
mov dword [ebp - 0x218], 1
push esi
push 8
call fcn.4ad06d44
pop ecx
pop ecx
jmp 0x4ad0c432
Function at 0x4ad100dd
Capabilities:
Set current directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x3d
pop eax
mov word [ebp - 0xc], ax
mov eax, dword [ebp + 8]
add eax, 0x40
mov word [ebp - 0xa], ax
push 0x3a
pop eax
mov word [ebp - 8], ax
xor eax, eax
mov word [ebp - 6], ax
lea eax, [ebp - 0xc]
push eax
call fcn.4ad02070
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov ebx, dword [sym.imp.KERNEL32.dll_SetErrorMode]
mov edi, eax
test edi, edi
je 0x4ad19bb1
push edi
call esi
test al, al
je 0x4ad19ba7
push 0
push 0x104
push 0x4ad25260
call fcn.4ad02c56
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 4
push 1
call ebx
mov dword [ebp - 0x218], eax
mov ax, word [ebp - 0xa]
mov word [ebp - 0x214], ax
mov ax, word [ebp - 8]
mov word [ebp - 0x212], ax
mov ax, word [0x4ad40664]
mov word [ebp - 0x210], ax
xor eax, eax
mov word [ebp - 0x20e], ax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.4ad01730
lea eax, [ebp - 0x214]
push eax
call esi
test eax, eax
jne 0x4ad19c09
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad06d44
pop ecx
pop ecx
test edi, edi
je 0x4ad1013d
push dword [ebp - 0x218]
call ebx
jmp 0x4ad1013d

Function at 0x4ad110a5
Capabilities:
Delete file
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
push edi
push esi
push dword [ebp + 0x10]
mov dword [ebp - 4], edi
push dword [ebp + 0xc]
mov dword [0x4ad24120], edi
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__get_osfhandle]
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x4ad18796
mov edx, dword [esi]
cmp edx, edi
je 0x4ad18749
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx + 0x1c]
test eax, 0xc000
jne 0x4ad11118
cmp edx, 2
jb 0x4ad11110
mov edi, dword [ebp + 0xc]
mov edx, 0xfeff
cmp word [edi], dx
je 0x4ad18769
or eax, 0x8000
mov dword [ecx + 0x1c], eax
mov ecx, dword [ecx + 0x1c]
mov eax, 0x8002
xor ebx, ebx
and ecx, eax
inc ebx
cmp ecx, eax
je 0x4ad18773
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x1c
call ebx
cmp eax, 0x3e3
je 0x4ad18796
mov edx, dword [esi]
cmp edx, edi
jne 0x4ad110ed
mov dword [0x4ad24128], edi
xor eax, eax
jmp 0x4ad1112f
or eax, 0x4000
jmp 0x4ad11115
mov edi, dword [esi]
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push ebx
call fcn.4ad1e4dc
cmp edi, dword [esi]
je 0x4ad1112d
mov dword [0x4ad24120], ebx
jmp 0x4ad1112d
call ebx
push dword [ebp + 8]
mov dword [0x4ad24128], eax
call fcn.4ad03ab3
push dword [ebp + 0x1c]
call fcn.4ad03b03
push dword [ebp + 0x1c]
test eax, eax
jne 0x4ad187c4
call fcn.4ad03ab3
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x4ad187c9
call fcn.4ad03ab3
push 1
push dword [0x4ad24128]
call fcn.4ad1f2d7
int3
Function at 0x4ad11be3
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx + 0x20]
mov dword [ebp - 4], 0x1a
test eax, eax
je 0x4ad18719
push esi
push edi
push eax
call fcn.4ad11c6c
mov edi, dword [ebp + 0x10]
mov esi, dword [sym.imp.msvcrt.dll__get_osfhandle]
test eax, eax
jne 0x4ad18720
mov eax, dword [ebp + 8]
test eax, eax
je 0x4ad11c55
test byte [eax + 0x1c], 0x80
jne 0x4ad11c55
push edi
call fcn.4ad03b03
test eax, eax
jne 0x4ad11c55
mov eax, dword [0x4ad24168]
cmp eax, 3
je 0x4ad11c55
cmp dword [ebp + 0x14], 0
je 0x4ad11c55
cmp eax, 2
je 0x4ad11c55
push dword [ebp + 0x14]
push 0
push 0
push edi
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push edi
call fcn.4ad03ab3
inc dword [0x4ad24164]
pop edi
pop esi
leave
ret 0x10
mov eax, ecx
jmp 0x4ad11bfe
push edi
call fcn.4ad03b03
test eax, eax
jne 0x4ad11c17
push eax
lea eax, [ebp + 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
push edi
call esi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad11c17
Function at 0x4ad12eca
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x830
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x828], eax
mov eax, dword [ebp + 0xc]
push eax
mov edi, 0x104
push edi
lea eax, [ebp - 0x418]
push eax
call fcn.4ad0185a
lea eax, [ebp - 0x418]
lea edx, [eax + 2]
xor ebx, ebx
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4ad12f0c
sub eax, edx
sar eax, 1
mov esi, 0x106
push esi
lea ecx, [ebp - 0x210]
push ecx
inc eax
push eax
lea eax, [ebp - 0x418]
push eax
call fcn.4ad0a2c1
test al, al
je 0x4ad1aaa8
push 0x4ad02ec8
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4ad020a9
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x830]
push eax
push edi
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad1aaaf
cmp word [ebp - 0x210], 0x5c
je 0x4ad1aad1
xor eax, eax
mov word [ebp - 0x20e], ax
cmp word [ebp - 0x624], bx
jne 0x4ad1aae7
lea eax, [ebp - 0x210]
push eax
push 1
push 0x235e
push dword [ebp - 0x828]
call fcn.4ad1301f
add esp, 0x10
cmp eax, ebx
jne 0x4ad12fff
mov ecx, dword [ebp - 0x830]
cmp ecx, ebx
je 0x4ad13010
movzx eax, cx
push eax
shr ecx, 0x10
push ecx
push str._04X__04X
lea eax, [ebp - 0x824]
push 0x100
push eax
call fcn.4ad0179d
lea eax, [ebp - 0x824]
push eax
push 1
push 0x235b
push dword [ebp - 0x828]
call fcn.4ad1301f
add esp, 0x24
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 8
cmp dword [ebp - 0x82c], ebx
jne 0x4ad12fc5
jmp 0x4ad12fff
xor eax, eax
jmp 0x4ad12fff
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 0x90
je 0x4ad1aaa8
push ebx
call esi
push eax
call fcn.4ad06d44
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4ad12fff
lea eax, [ebp - 0x210]
push eax
call fcn.4ad02ed1
xor ecx, ecx
mov word [eax], cx
jmp 0x4ad12f8e
lea eax, [ebp - 0x624]
push eax
lea eax, [ebp - 0x210]
push eax
push 2
push 0x235f
push dword [ebp - 0x828]
call fcn.4ad1301f
add esp, 0x14
jmp 0x4ad12fb7
Function at 0x4ad13185
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.4ad0aa4f
push esi
mov esi, 0x106
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4ad0185a
lea eax, [ebp - 0x210]
push eax
call fcn.4ad12620
test eax, eax
jne 0x4ad1abf6
and dword [ebp - 0x214], 0
and dword [ebp - 0x218], 0
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
push 6
push edi
call fcn.4ad12cb6
push esi
lea eax, [ebp - 0x210]
push eax
push 0xe
lea eax, [ebp - 0x218]
push eax
push dword [ebp + 0x10]
call fcn.4ad1292f
lea eax, [ebp - 0x210]
push eax
push dword [ebp + 0x14]
push 0x4ad13258
call fcn.4ad09a2c
push eax
push 2
push 0x2379
push edi
call fcn.4ad1301f
mov ecx, dword [ebp - 4]
add esp, 0x14
pop edi
xor ecx, ebp
pop esi
call fcn.4ad013a9
leave
ret 0x10
push 0x4ad02ec8
push esi
lea eax, [ebp - 0x210]
push eax
call fcn.4ad020a9
jmp 0x4ad131cf
Function at 0x4ad1d003
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x14
push 0x4ad1d0d8
call fcn.4ad0264a
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], esi
mov eax, dword [ebp + 0xc]
cmp eax, esi
je 0x4ad1d042
cmp word [eax], si
je 0x4ad1d042
lea edx, [ebp - 0x1c]
push edx
push 1
push esi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
cmp eax, esi
je 0x4ad1d042
push eax
jmp 0x4ad1d0a5
lea eax, [ebp - 0x24]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push dword [ebp - 0x1c]
mov edi, dword [sym.imp.KERNEL32.dll_RegQueryValueExW]
call edi
cmp eax, 2
jne 0x4ad1d06c
push 0x4ad03afc
call fcn.4ad019d6
mov dword [ebp - 0x20], eax
jmp 0x4ad1d0ab
cmp eax, esi
jne 0x4ad1d03f
push dword [ebp - 0x24]
call fcn.4ad01896
mov ebx, eax
mov dword [ebp - 0x20], ebx
cmp ebx, esi
je 0x4ad1d0a3
lea eax, [ebp - 0x24]
push eax
push ebx
lea eax, [ebp + 0xc]
push eax
push esi
push esi
push dword [ebp - 0x1c]
call edi
mov edi, eax
cmp edi, esi
je 0x4ad1d0ab
push ebx
call fcn.4ad0142e
mov dword [ebp - 0x20], esi
push edi
jmp 0x4ad1d0a5
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 0xfffffffe
call fcn.4ad1d0c7
mov eax, dword [ebp - 0x20]
call fcn.4ad013b6
ret 8
Function at 0x4ad1d0f9
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
mov dword [ebp - 0x214], esi
cmp eax, ebx
jne 0x4ad1d1e5
mov dword [ebp - 0x210], ebx
push 0x104
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov esi, eax
cmp esi, ebx
jne 0x4ad1d1be
cmp word [ebp - 0x20c], 0x2e
jne 0x4ad1d1a3
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x214]
call fcn.4ad1d003
mov edi, eax
cmp edi, ebx
je 0x4ad1d1d1
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4ad1d176
sub eax, edx
sar eax, 1
je 0x4ad1d19d
push edi
lea eax, [ebp - 0x20c]
push eax
push str._s_s_r_n
call fcn.4ad058f3
add esp, 0xc
mov esi, eax
push edi
call fcn.4ad0142e
cmp dword [0x4ad241b4], ebx
jne 0x4ad1d1e0
inc dword [ebp - 0x210]
cmp esi, ebx
jne 0x4ad1d257
jmp 0x4ad1d12d
cmp esi, 0x103
jne 0x4ad1d257
xor esi, esi
jmp 0x4ad1d257
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.4ad06d44
pop ecx
pop ecx
xor eax, eax
inc eax
jmp 0x4ad1d259
push ebx
push eax
call fcn.4ad02b0d
push eax
call fcn.4ad019d6
mov edi, eax
cmp edi, ebx
je 0x4ad1d1e0
push 0x20
push edi
call fcn.4ad02148
cmp eax, ebx
je 0x4ad1d209
xor ecx, ecx
mov word [eax], cx
push edi
push esi
call fcn.4ad1d003
mov ebx, eax
test ebx, ebx
je 0x4ad1d239
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x4ad1d219
sub eax, edx
sar eax, 1
je 0x4ad1d239
push ebx
push edi
push str._s_s_r_n
call fcn.4ad058f3
mov esi, eax
jmp 0x4ad1d248
xor esi, esi
push edi
inc esi
push esi
push 0x400023a3
call fcn.4ad06d44
add esp, 0xc
push ebx
call fcn.4ad0142e
push edi
call fcn.4ad0142e
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 8
Function at 0x4ad1d26f
Capabilities:
Delete registry key
Delete registry value
Set registry value

Disassembly:
push 0xc
push 0x4ad1d398
call fcn.4ad0264a
mov edi, dword [ebp + 0x10]
xor esi, esi
cmp edi, esi
je 0x4ad1d2e6
cmp word [edi], si
je 0x4ad1d2e6
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, si
jne 0x4ad1d28e
sub eax, edx
sar eax, 1
push eax
push edi
push 1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
jne 0x4ad1d2cb
push edi
push dword [ebp + 0xc]
push str._s_s_r_n
call fcn.4ad058f3
add esp, 0xc
jmp 0x4ad1d355
push esi
push ebx
call fcn.4ad06d44
push dword [ebp + 0xc]
push 1
push 0x235d
call fcn.4ad06d44
add esp, 0x14
jmp 0x4ad1d355
push esi
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegDeleteKeyExW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
je 0x4ad1d359
lea eax, [ebp + 0xc]
push eax
push 0x2000000
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov ebx, eax
mov dword [ebp + 0x10], ebx
cmp ebx, esi
je 0x4ad1d32c
cmp ebx, 2
je 0x4ad1d355
push esi
push ebx
call fcn.4ad06d44
pop ecx
pop ecx
jmp 0x4ad1d355
push 0x4ad03afc
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegDeleteValueW]
mov ebx, eax
mov dword [ebp + 0x10], eax
cmp ebx, esi
je 0x4ad1d34c
push esi
push ebx
call fcn.4ad06d44
pop ecx
pop ecx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
cmp ebx, esi
jne 0x4ad1d389
mov dword [ebp - 4], esi
push esi
push esi
push esi
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
jmp 0x4ad1d382
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp + 0x10]
call fcn.4ad013b6
ret 0xc
Function at 0x4ad1d685
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push edi
xor edi, edi
mov dword [ebp - 0x48], edi
cmp eax, edi
jne 0x4ad1d6ab
xor eax, eax
jmp 0x4ad1d7b5
push ebx
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
mov dword [ebp - 0x4c], ebx
cmp ebx, 0xffffffff
je 0x4ad1d7b0
push esi
lea eax, [ebp - 0x44]
push eax
push ebx
push 0x40
pop esi
call fcn.4ad1d3db
test eax, eax
je 0x4ad1d6f5
mov eax, 0x5a4d
xor ecx, ecx
cmp ax, word [ebp - 0x44]
sete cl
mov eax, ecx
jmp 0x4ad1d6f7
xor eax, eax
cmp eax, edi
je 0x4ad1d7a6
push edi
push edi
push dword [ebp - 8]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
cmp eax, edi
je 0x4ad1d7a6
lea eax, [ebp - 0x50]
push eax
push ebx
push 4
pop esi
call fcn.4ad1d3db
test eax, eax
je 0x4ad1d73c
xor eax, eax
cmp dword [ebp - 0x50], 0x4550
sete al
jmp 0x4ad1d73e
xor eax, eax
cmp eax, edi
je 0x4ad1d7a6
lea eax, [ebp - 0x64]
push eax
push ebx
push 0x14
pop esi
call fcn.4ad1d3db
test eax, eax
je 0x4ad1d7a6
cmp word [ebp - 0x54], di
jbe 0x4ad1d7a6
movzx eax, word [ebp - 0x54]
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
push 8
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4ad1d7a6
movzx esi, word [ebp - 0x54]
push ebx
push dword [ebp - 0x4c]
call fcn.4ad1d3db
test eax, eax
je 0x4ad1d79a
mov edx, dword [ebp - 0x64]
mov ecx, ebx
call fcn.4ad1d3b9
test eax, eax
je 0x4ad1d79a
movzx eax, word [eax]
mov dword [ebp - 0x48], eax
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push dword [ebp - 0x4c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ax, word [ebp - 0x48]
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.4ad013a9
leave
ret 4
Function at 0x4ad1db5e
Capabilities:
Delete registry value
Persist via default file association registry key
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4ad240ac]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push ebx
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x210], eax
mov dword [ebp - 0x218], ecx
lea edx, [eax + 2]
xor ebx, ebx
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4ad1db96
mov edi, str.ShellOpenCommand
sub eax, edx
mov ecx, edi
sar eax, 1
lea esi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
cmp dx, bx
jne 0x4ad1dbae
sub ecx, esi
sar ecx, 1
lea eax, [ecx + eax + 1]
mov esi, 0x104
cmp eax, esi
jbe 0x4ad1dbde
push ebx
push 0x400023db
call fcn.4ad06d44
pop ecx
xor eax, eax
pop ecx
inc eax
jmp 0x4ad1dd95
push dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.4ad0185a
push edi
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad020a9
lea eax, [ebp - 0x214]
push eax
mov edi, 0x2000000
push edi
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_RegOpenKeyExW]
mov esi, eax
cmp esi, ebx
je 0x4ad1dcec
mov eax, dword [ebp - 0x218]
cmp eax, ebx
je 0x4ad1dcd2
cmp word [eax], bx
je 0x4ad1dcd2
lea esi, [ebp - 0x20c]
jmp 0x4ad1dc51
cmp word [esi], 0x5c
je 0x4ad1dc56
inc esi
inc esi
cmp word [esi], bx
jne 0x4ad1dc49
movzx eax, word [esi]
mov dword [ebp - 0x224], eax
xor eax, eax
mov word [esi], ax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push edi
push ebx
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x21c]
call dword [sym.imp.KERNEL32.dll_RegCreateKeyExW]
mov dword [ebp - 0x220], eax
cmp eax, ebx
jne 0x4ad1dcb2
mov eax, dword [ebp - 0x224]
cmp ax, bx
je 0x4ad1dcec
push dword [ebp - 0x214]
mov word [esi], ax
inc esi
inc esi
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
jmp 0x4ad1dc51
push dword [ebp - 0x210]
push 1
push 0x400023a5
call fcn.4ad06d44
mov eax, dword [ebp - 0x220]
add esp, 0xc
jmp 0x4ad1dd95
push dword [ebp - 0x210]
push 1
push 0x400023a5
call fcn.4ad06d44
add esp, 0xc
jmp 0x4ad1dd93
mov edi, dword [ebp - 0x218]
cmp edi, ebx
je 0x4ad1dd5f
cmp word [edi], bx
je 0x4ad1dd5f
mov eax, edi
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
cmp cx, bx
jne 0x4ad1dd00
sub eax, edx
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edi
push 2
push ebx
push 0x4ad03afc
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_RegSetValueExW]
mov esi, eax
cmp esi, ebx
jne 0x4ad1dd41
push edi
push dword [ebp - 0x210]
push str._s_s_r_n
call fcn.4ad058f3
jmp 0x4ad1dd84
push ebx
push esi
call fcn.4ad06d44
push dword [ebp - 0x210]
push 1
push 0x235d
call fcn.4ad06d44
add esp, 0x14
jmp 0x4ad1dd87
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_RegDeleteValueW]
mov esi, eax
cmp esi, ebx
je 0x4ad1dd87
push dword [ebp - 0x210]
push 1
push 0x400023a5
call fcn.4ad06d44
add esp, 0xc
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.4ad013a9
leave
ret 0xc
Function at 0x4ad1f354
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
xor ebx, ebx
push ebx
push 2
push dword [ebp + 8]
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.4ad1fdfd
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
jne 0x4ad1f388
push 0x6e
call fcn.4ad1056b
push 1
push ebx
call fcn.4ad1f2d7
mov edi, dword [sym.imp.msvcrt.dll__get_osfhandle]
push esi
mov esi, dword [ebp + 0xc]
push ebx
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 8]
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad1f43f
mov eax, dword [esi + 0x1c]
mov ecx, dword [ebp - 4]
mov dword [ebp + 0xc], ecx
test eax, 0xc000
jne 0x4ad1f3e7
cmp ecx, 2
jbe 0x4ad1f3df
mov ebx, dword [ebp + 0x10]
mov edx, 0xfeff
cmp word [ebx], dx
jne 0x4ad1f3dd
or eax, 0x4000
xor ebx, ebx
jmp 0x4ad1f3e4
xor ebx, ebx
or eax, 0x8000
mov dword [esi + 0x1c], eax
cmp ecx, ebx
je 0x4ad1f413
mov ecx, dword [esi + 0x1c]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
mov eax, 0x8002
and ecx, eax
sub ecx, eax
neg ecx
sbb ecx, ecx
inc ecx
push ecx
call fcn.4ad1e4dc
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], eax
cmp ecx, dword [ebp + 0x14]
je 0x4ad1f392
pop esi
cmp dword [ebp - 8], ebx
jne 0x4ad1f436
sub ecx, dword [ebp + 0xc]
push 1
push ebx
push ecx
push dword [ebp + 8]
call edi
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret 0x10
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp + 8]
mov dword [0x4ad24128], eax
call fcn.4ad03ab3
push ebx
push dword [0x4ad24128]
call fcn.4ad06d44
pop ecx
pop ecx
jmp 0x4ad1f380