joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407539
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x18], eax
call fcn.0040723c
push 0x208
mov edi, eax
call fcn.00407e3d
mov dword [esp], 0x208
mov ebx, eax
push 0
push ebx
call sub.VCRUNTIME140.dll_memset
and dword [ebp - 8], 0
add esp, 0xc
mov dword [ebp - 0xc], 4
push ebx
push esi
call fcn.004076bb
cmp dword [ebp + 0x10], 0
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x20019
mov eax, 0x20119
cmove eax, ecx
xor esi, esi
push eax
push esi
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4075d2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4075d2
mov dword [ebp - 8], esi
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.00407af4
mov eax, dword [ebp - 8]
pop ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407ae6
leave
ret 0xc

Function at 0x4075f6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x10], eax
call fcn.0040723c
mov edi, 0x208
mov ebx, eax
push edi
call fcn.00407e3d
push edi
push 0
push eax
mov dword [ebp - 0xc], eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
mov eax, 0xf003f
cmp dword [ebp + 0x14], 0
mov edi, 0xf013f
cmove edi, eax
push dword [ebp - 0xc]
push esi
call fcn.004076bb
xor esi, esi
lea eax, [ebp - 8]
push esi
push eax
push esi
push edi
push esi
push esi
push esi
push dword [ebp - 0xc]
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push edi
mov edi, dword [ebp - 0xc]
push esi
push edi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4076a1
push 4
lea eax, [ebp + 0x10]
push eax
push 4
push esi
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc esi
push edi
call fcn.00407af4
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407ae6
leave
ret 0x10
Function at 0x407728
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x10], eax
call fcn.0040723c
mov ebx, 0x208
mov edi, eax
push ebx
call fcn.00407e3d
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], eax
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
push dword [ebp - 0xc]
push esi
call fcn.004076bb
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push 0x20019
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4077a1
push ebx
push ebx
push ebx
push ebx
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
xor ecx, ecx
inc ecx
test eax, eax
cmove ebx, ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00407af4
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407ae6
leave
ret 0xc

Function at 0x4077c4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push esi
call fcn.0040723c
push 0x208
mov edi, eax
call fcn.00407e3d
mov dword [esp], 0x208
push ebx
push eax
mov dword [ebp - 0xc], eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push dword [ebp - 0xc]
push esi
call fcn.004076bb
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push ebx
push eax
push ebx
push 0xf023f
push ebx
push ebx
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf023f
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407865
push 0x1c
push str.23.008.20555.1
push 1
push ebx
push str.ProductVersion
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebx
push esi
call fcn.00407af4
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407ae6
leave
ret 0xc
Function at 0x40787f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x410040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push esi
mov dword [ebp - 0x10], eax
call fcn.0040723c
mov ebx, 0x208
mov edi, eax
push ebx
call fcn.00407e3d
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], eax
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x10
push dword [ebp - 0xc]
push esi
call fcn.004076bb
mov esi, dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
push 0xf003f
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4078f4
push dword [ebp - 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
xor ecx, ecx
inc ecx
test eax, eax
cmove ebx, ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call fcn.00407af4
pop ecx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00407ae6
leave
ret 8

Function at 0x408512
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x408551
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x408551
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x408551
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x408551
cmp dword [ecx + 0x74], 0xe
jbe 0x408551
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4e2063]
shl eax, 2
mov dword [0x4e2067], eax
push edi
push ecx
xor eax, eax
mov edi, 0x605d08
mov ecx, 0x646978
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.004d3967
pop ecx
push 0x4e202c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4e206b], eax
push 0
jmp fcn.004df014

Function at 0x4017c0
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x4e22e0]
dec eax
je 0x401884
mov dword [0x4e22e0], 1
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapCompact
call fcn.004ddeb8
push 0
call sub.USER32.dll_MessageBeep
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.dll_GlobalMemoryStatus
test ebx, ebx
jne 0x40180c
mov ebx, dword [ebp - 0x18]
jmp 0x401811
mov eax, dword [ebp - 0x14]
add ebx, eax
push 4
push 0x1000
push ebx
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
test esi, esi
je 0x40187c
xor ecx, ecx
xor eax, eax
mov edx, esi
cmp ebx, eax
jbe 0x401848
mov byte [edx], 0
add ecx, 0x800
add edx, 0x1000
add eax, 0x1000
cmp ebx, eax
ja 0x401830
mov eax, 0x800
lea edx, [esi + 0x800]
cmp ebx, eax
jbe 0x40186f
mov byte [edx], 0
add ecx, 0x800
add edx, 0x1000
add eax, 0x1000
cmp ebx, eax
ja 0x401857
push 0x8000
push 0
push esi
call sub.KERNEL32.dll_VirtualFree
xor ecx, ecx
mov dword [0x4e22e0], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403f4c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
or ebx, 0xffffffff
mov esi, dword [ebp + 8]
push 0x15
push esi
call fcn.00403dc0
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403f7a
push 0x11
push esi
call fcn.00403dc0
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x403f98
push 0
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
lea eax, [ebp - 4]
push eax
call fcn.00403e94
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x40410c
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x404125
push ebx
call fcn.00404034
pop ecx
jmp 0x404179
push ebx
call fcn.00404034
pop ecx
test eax, eax
jne 0x404134
xor eax, eax
jmp 0x404179
push ebx
call fcn.00403fa0
pop ecx
mov edi, eax
push 2
push esi
push ebx
call fcn.00404004
add esp, 0xc
push ebx
call sub.KERNEL32.dll_SetEndOfFile
test eax, eax
jne 0x40415e
push ebx
call fcn.00404034
pop ecx
xor eax, eax
jmp 0x404179
push edi
push ebx
call fcn.00403fc0
add esp, 8
mov dword [0x4e2074], 0x613
push ebx
call fcn.00404034
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4041b8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
lea esi, [ebp + 0x10]
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
jne 0x4041d2
mov eax, dword [ebp + 0x10]
jmp 0x404219
mov edx, dword [ebp + 0x10]
push edx
push 0
push ebx
call fcn.004d2d9c
add esp, 0xc
push 0
push esi
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
push edi
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x404203
test ebx, ebx
je 0x404203
push edi
call fcn.00404034
pop ecx
test ebx, ebx
jne 0x40420c
xor edx, edx
mov dword [ebp + 0x10], edx
mov dword [0x4e2074], 0x615
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4042d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
lea esi, [ebp + 0x10]
cmp dword [ebp + 0x10], 0
jne 0x4042e6
mov eax, dword [ebp + 0x10]
jmp 0x404335
push ebx
call fcn.00404074
pop ecx
test eax, eax
je 0x40430d
mov edx, dword [ebp + 0x10]
push edx
push ebx
call fcn.0040410c
add esp, 8
mov ecx, dword [ebp + 0x10]
neg ecx
push ecx
push ebx
call fcn.004040c0
add esp, 8
push 0
push esi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
push ebx
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x404326
xor eax, eax
jmp 0x404335
mov dword [0x4e2074], 0x617
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x4046bc
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.dll_GetSystemTime
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_SystemTimeToFileTime
lea eax, [ebp - 8]
push eax
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_SetFileTime
mov esp, ebp
pop ebp
ret
Function at 0x404c44
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
mov dword [0x4e2074], 0x627
push ebx
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
je 0x404c6e
test al, 1
je 0x404c6e
and eax, 0xfffffffe
push eax
push ebx
call sub.KERNEL32.dll_SetFileAttributesA
push ebx
call sub.KERNEL32.dll_DeleteFileA
pop ebx
pop ebp
ret

Function at 0x404e70
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push 0x5e4463
call fcn.00403700
pop ecx
mov esi, eax
push 0x5e4477
call fcn.00403700
pop ecx
mov edi, eax
push 0x5e448a
call fcn.00403700
pop ecx
mov dword [ebp - 4], eax
push 1
push 0x5e449c
call fcn.004038e4
add esp, 8
push 1
push 0x5e44b0
call fcn.004038e4
add esp, 8
push 1
push 0x5e44c3
call fcn.004038e4
add esp, 8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x404ee3
mov ebx, 0xffffff87
jmp 0x404ef6
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_SetFileAttributesA
test eax, eax
jne 0x404ef6
mov ebx, 0xffffff7d
push esi
push 0x5e44d5
call fcn.004038e4
add esp, 8
push edi
push 0x5e44e9
call fcn.004038e4
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x5e44fc
call fcn.004038e4
add esp, 8
test ebx, ebx
je 0x404f2b
xor eax, eax
jmp 0x404f2d
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x404f34
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x5e450e
call fcn.00403700
pop ecx
mov edi, eax
push 0x5e4522
call fcn.00403700
pop ecx
mov dword [ebp - 4], eax
push 0x5e4535
call fcn.00403700
pop ecx
mov dword [ebp - 8], eax
push 1
push 0x5e4547
call fcn.004038e4
add esp, 8
push 1
push 0x5e455b
call fcn.004038e4
add esp, 8
push 1
push 0x5e456e
call fcn.004038e4
add esp, 8
push esi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x404fab
mov ebx, 0xffffff87
jmp 0x405014
test al, 0x80
je 0x404fb4
and eax, 0xffffff7f
test bh, 1
je 0x404fbc
or eax, 1
test bh, 2
je 0x404fc4
and eax, 0xfffffffe
test bh, 0x10
je 0x404fcc
or eax, 4
test bh, 0x20
je 0x404fd4
and eax, 0xfffffffb
test ebx, 0x10000
je 0x404fdf
or eax, 0x20
test ebx, 0x20000
je 0x404fea
and eax, 0xffffffdf
test ebx, 0x100000
je 0x404ff5
or eax, 2
test ebx, 0x200000
je 0x405000
and eax, 0xfffffffd
push eax
push esi
call sub.KERNEL32.dll_SetFileAttributesA
test eax, eax
jne 0x405012
mov ebx, 0xffffff73
jmp 0x405014
xor ebx, ebx
push edi
push 0x5e4580
call fcn.004038e4
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x5e4594
call fcn.004038e4
add esp, 8
mov edx, dword [ebp - 8]
push edx
push 0x5e45a7
call fcn.004038e4
add esp, 8
test ebx, ebx
je 0x40504c
xor eax, eax
jmp 0x40504e
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x405860
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x405873
xor eax, eax
jmp 0x4058ae
test esi, esi
jne 0x40587b
xor eax, eax
jmp 0x4058ae
push esi
push ebx
call fcn.004d30a0
add esp, 8
test eax, eax
jne 0x405890
mov eax, 1
jmp 0x4058ae
push esi
push ebx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x40589f
xor eax, eax
jmp 0x4058ae
mov dword [0x4e2074], 0x630
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x405938
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x200
push ebx
call fcn.00404f34
add esp, 8
push 4
push 0
push ebx
call sub.KERNEL32.dll_MoveFileExA
pop ebx
pop ebp
ret
Function at 0x40595c
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffaac
mov ecx, 0x50
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 8]
push esi
push edi
lea edi, [ebp - 0x144]
mov esi, 0x4e250c
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
push esi
push edi
lea edi, [ebp - 0x554]
mov esi, 0x4e264c
mov ecx, 0x104
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
call sub.KERNEL32.dll_GetTickCount
push 0x5e4726
push esi
lea eax, [ebp - 0x554]
push eax
call fcn.004058b4
add esp, 0xc
lea edx, [ebp - 0x144]
push edx
lea ecx, [ebp - 0x554]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, 0xffffffff
je 0x405ae3
lea ebx, [ebp - 0x14]
test ebx, ebx
jne 0x4059e3
lea ebx, [ebp - 0x118]
mov al, byte [ebx]
test al, al
jne 0x4059ef
lea ebx, [ebp - 0x118]
test ebx, ebx
je 0x405ada
mov al, byte [ebx]
test al, al
je 0x405ada
movsx edx, byte [ebx]
cmp edx, 0x2e
jne 0x405a14
mov cl, byte [ebx + 1]
test cl, cl
je 0x405ac2
movsx eax, byte [ebx]
cmp eax, 0x2e
jne 0x405a30
movsx edx, byte [ebx + 1]
cmp edx, 0x2e
jne 0x405a30
mov cl, byte [ebx + 2]
test cl, cl
je 0x405ac2
lea eax, [ebp - 0x554]
push eax
call fcn.004d2f1c
pop ecx
push eax
push ebx
call fcn.004d2f1c
pop ecx
pop edx
add edx, eax
add edx, 2
cmp edx, 0x410
ja 0x405ada
test byte [ebp - 0x144], 0x10
je 0x405aa2
inc dword [edi]
push ebx
push esi
lea ecx, [ebp - 0x554]
push ecx
call fcn.004058b4
add esp, 0xc
test byte [ebp - 0x143], 4
je 0x405a8b
lea eax, [ebp - 0x554]
push eax
call fcn.00405938
pop ecx
jmp 0x405ac2
push edi
mov edx, dword [ebp + 0xc]
inc edx
push edx
lea ecx, [ebp - 0x554]
push ecx
call fcn.0040595c
add esp, 0xc
jmp 0x405ac2
inc dword [edi]
push ebx
push esi
lea eax, [ebp - 0x554]
push eax
call fcn.004058b4
add esp, 0xc
lea edx, [ebp - 0x554]
push edx
call fcn.00405938
pop ecx
lea ecx, [ebp - 0x144]
push ecx
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x4059d6
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
push esi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x554]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x554]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0
push esi
push eax
call fcn.004058b4
add esp, 0xc
lea edx, [ebp - 0x554]
push edx
call fcn.00405938
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405b34
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
test eax, eax
jne 0x405b5e
xor eax, eax
mov dword [ebp - 4], eax
lea ecx, [ebp - 4]
push ecx
push 0
push edx
call fcn.0040595c
movsx edx, al
add esp, 0xc
mov eax, edx
pop ecx
pop ebp
ret
push 4
push eax
push edx
call sub.KERNEL32.dll_MoveFileExA
pop ecx
pop ebp
ret
Function at 0x405c58
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov byte [ebp - 1], 0
test esi, 0x200
je 0x405c7c
mov byte [ebp - 1], 1
test esi, 0x100
je 0x405c86
mov bl, 1
test esi, 0x200
jne 0x405c9c
test esi, 0x100
jne 0x405c9c
mov byte [ebp - 1], 1
mov bl, 1
test edi, edi
je 0x405df5
mov al, byte [edi]
test al, al
je 0x405df5
test esi, 0x1000
je 0x405cc5
push edi
call fcn.00405c20
pop ecx
test al, al
jne 0x405df5
lea edx, [ebp - 0x108]
push edx
push edi
call fcn.00405b90
add esp, 8
mov cl, byte [ebp - 0x108]
test cl, cl
je 0x405d0e
lea eax, [ebp - 0x108]
push eax
call fcn.004d2f1c
pop ecx
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
jne 0x405d0e
lea ecx, [ebp - 0x108]
push ecx
call fcn.004d2f1c
pop ecx
mov byte [ebp + eax - 0x109], 0
lea eax, [ebp - 0x248]
push eax
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x405d63
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jne 0x405d58
movsx eax, byte [ebp - 0x107]
cmp eax, 0x3a
jne 0x405d58
mov dl, byte [ebp - 0x106]
test dl, dl
jne 0x405d58
push edi
call sub.KERNEL32.dll_FindClose
mov eax, 1
jmp 0x405df7
push edi
call sub.KERNEL32.dll_FindClose
jmp 0x405df5
mov dl, byte [ebp - 1]
test dl, dl
je 0x405d92
test byte [ebp - 0x248], 0x10
je 0x405d92
test esi, 0x2000
jne 0x405d92
push edi
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x405df7
mov eax, 1
jmp 0x405df7
test bl, bl
je 0x405dda
test byte [ebp - 0x248], 0x10
jne 0x405dda
test esi, 0x2000
je 0x405dc3
mov edx, dword [ebp - 0x22c]
test edx, edx
jne 0x405dc3
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x405dc3
push edi
call sub.KERNEL32.dll_FindClose
jmp 0x405def
push edi
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x405df7
mov eax, 1
jmp 0x405df7
lea edx, [ebp - 0x248]
push edx
push edi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x405d63
push edi
call sub.KERNEL32.dll_FindClose
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405e00
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x405e59
call fcn.00401298
push eax
push 0x5e4728
push ebx
call fcn.004d75f8
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x405e59
push ebx
push 0
push 0x5e4734
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
je 0x405e59
mov eax, 1
jmp 0x405e5b
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406668
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
push ebx
push esi
push edi
or ebx, 0xffffffff
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 4], eax
test edi, edi
je 0x4067ba
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4067ba
lea ecx, [ebp - 4]
push ecx
push 0x20106
push 0
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x4066ed
cmp esi, 0xfffffffe
jne 0x4066bd
mov ebx, 1
jmp 0x4067ba
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
push edx
push 0
push 0xf013f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
je 0x4066ed
mov ebx, 0xffffff9b
jmp 0x4067ba
cmp esi, 0xfffffffe
jne 0x406714
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegDeleteValueA
test eax, eax
je 0x40670a
mov ebx, 0xffffff37
jmp 0x4067ba
mov ebx, 1
jmp 0x4067ba
mov eax, dword [ebp + 0x1c]
sub eax, 4
jne 0x406756
mov edx, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x406730
mov dword [ebp - 8], 4
jmp 0x406733
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push ecx
push eax
mov edx, dword [ebp + 0x1c]
push edx
push 0
push edi
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x4067ba
mov ebx, 1
jmp 0x4067ba
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4067ba
cmp esi, 0xffffffff
jne 0x406796
mov edx, dword [ebp + 0x1c]
sub edx, 7
je 0x406779
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004d2f1c
pop ecx
mov dword [ebp - 8], eax
jmp 0x406799
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x14]
mov eax, edx
mov dl, byte [eax]
test dl, dl
jne 0x406790
mov cl, byte [eax + 1]
test cl, cl
je 0x406799
inc dword [ebp - 8]
inc eax
jmp 0x406783
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x4067ba
mov ebx, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x4067ca
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret