joyce8/EMBER2024-capa huggingface dataset:
Function at 0x424db0
Capabilities:
Check os version
Set global application hook

Disassembly:
sub esp, 0xac
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x7c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [ebx + 0x80]
mov ebp, dword [ebx + 0x7c]
mov edi, eax
xor eax, eax
inc edi
sub ecx, edi
add edi, ebp
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_GetFocus]
mov ecx, ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x10], 0
call sub.MFC42.DLL_CDialog::PreModal
mov dword [ebx + 0x64], eax
call sub.MFC42.DLL_AfxUnhookWindowCreate
mov eax, dword [ebx + 0x64]
test eax, eax
je 0x424e2d
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x424e2d
mov eax, dword [ebx + 0x64]
push 0
push eax
mov dword [esp + 0x18], 1
call dword [sym.imp.USER32.dll_EnableWindow]
call sub.MFC42.DLL_AfxGetThreadState
mov ecx, dword [ebx + 0x94]
mov dword [esp + 0x18], eax
test ecx, 0x80000
je 0x424e49
mov dword [eax + 0x18], ebx
jmp 0x424e4f
push ebx
call sub.MFC42.DLL_AfxHookWindowCreate
lea ebp, [ebx + 0x1fc]
mov ecx, 0x16
xor eax, eax
mov edi, ebp
rep stosd dword es:[edi], eax
lea esi, [ebx + 0x60]
mov ecx, 0x13
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ecx, 0x27
lea edi, [esp + 0x20]
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x20]
mov dword [esp + 0x20], 0x9c
push ecx
call esi
test eax, eax
jne 0x424ea3
lea edx, [esp + 0x20]
mov dword [esp + 0x20], 0x94
push edx
call esi
test eax, eax
je 0x424eba
mov eax, dword [esp + 0x30]
sub eax, 2
jne 0x424eba
cmp dword [esp + 0x24], 5
jb 0x424eba
mov dword [ebp], 0x58
mov dword [0x5340c4], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x425020
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x5340c0], eax
mov eax, dword [ebx + 0xac]
test eax, eax
push ebp
je 0x424ef2
call dword [sym.imp.comdlg32.dll_GetOpenFileNameA]
jmp 0x424ef8
call dword [sym.imp.comdlg32.dll_GetSaveFileNameA]
mov dword [esp + 0x14], eax
mov eax, dword [0x5340c0]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x5340c4]
test eax, eax
je 0x424f19
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
call dword [sym.imp.comdlg32.dll_CommDlgExtendedError]
lea eax, [ebx + 0x60]
mov ecx, 0x13
mov esi, ebp
mov edi, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [esp + 0x18]
mov dword [eax], 0x4c
mov eax, dword [esp + 0x10]
test eax, eax
mov dword [ecx + 0x18], 0
je 0x424f55
mov edx, dword [ebx + 0x200]
push 1
push edx
call dword [sym.imp.USER32.dll_EnableWindow]
mov esi, dword [esp + 0x1c]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x424f6b
push esi
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, ebx
call sub.MFC42.DLL_CDialog::PostModal
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
test eax, eax
pop ebx
jne 0x424f83
mov eax, 2
add esp, 0xac
ret
Function at 0x425140
Capabilities:
Check os version
Set global application hook

Disassembly:
sub esp, 0xa0
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov ecx, dword [esi + 0x24]
mov edi, dword [esi + 0x20]
mov edx, eax
add esp, 4
inc edx
xor eax, eax
sub ecx, edx
shl ecx, 1
lea edi, [edi + edx*2]
mov edx, ecx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
call dword [sym.imp.USER32.dll_GetFocus]
mov dword [esp + 0x10], eax
xor ebx, ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebp, dword [sym.imp.USER32.dll_EnableWindow]
mov dword [esi + 8], eax
test eax, eax
je 0x4251b0
push eax
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
je 0x4251b0
mov eax, dword [esi + 8]
push 0
push eax
mov ebx, 1
call ebp
mov ecx, 0x27
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
lea ecx, [esp + 0x14]
push ecx
mov dword [esp + 0x18], 0x9c
call edi
test eax, eax
jne 0x4251e9
lea edx, [esp + 0x14]
mov dword [esp + 0x14], 0x94
push edx
call edi
test eax, eax
je 0x425200
mov eax, dword [esp + 0x24]
sub eax, 2
jne 0x425200
cmp dword [esp + 0x18], 5
jb 0x425200
mov dword [esi + 4], 0x58
mov dword [0x5340cc], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x4252a0
push 3
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x5340c8], eax
mov eax, dword [esi]
test eax, eax
je 0x425237
lea eax, [esi + 4]
push eax
call dword [sym.imp.comdlg32.dll_GetOpenFileNameW]
jmp 0x425241
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.comdlg32.dll_GetSaveFileNameW]
mov edx, dword [0x5340c8]
mov edi, eax
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x5340cc]
test eax, eax
je 0x425261
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
call dword [sym.imp.comdlg32.dll_CommDlgExtendedError]
test ebx, ebx
je 0x425273
mov eax, dword [esi + 8]
push 1
push eax
call ebp
mov esi, dword [esp + 0x10]
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x425289
push esi
call dword [sym.imp.USER32.dll_SetFocus]
test edi, edi
mov eax, edi
jne 0x425294
mov eax, 2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa0
ret

Function at 0x425800
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 8]
add ecx, 4
push ecx
mov ecx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push ecx
push 0
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
ret 0x10

Function at 0x425830
Capabilities:
Read .ini file

Disassembly:
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
add ecx, 4
push ecx
mov ecx, dword [esp + 0xc]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
ret 0xc
Function at 0x4269f0
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e3fa4
push eax
mov eax, dword [esp + 0x14]
mov dword fs:[0], esp
sub esp, 0x120
test eax, eax
push ebp
push esi
push edi
jne 0x426a1d
xor eax, eax
jmp 0x426beb
push ecx
mov dword [esp + 0x14], esp
mov ebp, esp
push 0xc
call sub.MFC42.DLL_operatornew
mov esi, eax
add esp, 4
mov dword [esp + 0x14], esi
mov edi, dword [esp + 0x140]
mov dword [esp + 0x138], 0
test esi, esi
je 0x426a74
push edi
mov dword [esi + 4], 0
mov dword [esi + 8], 1
call fcn.004ddbdd
test eax, eax
mov dword [esi], eax
jne 0x426a76
test edi, edi
je 0x426a76
push 0x8007000e
call fcn.004ddb30
jmp 0x426a76
xor esi, esi
test esi, esi
mov dword [esp + 0x138], 0xffffffff
mov dword [ebp], esi
jne 0x426a92
push 0x8007000e
call fcn.004ddb30
mov ecx, dword [esp + 0x144]
call fcn.00427f10
cmp ax, 0xffff
je 0x426be6
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, eax
lea eax, [esp + 0x28]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x28]
lea edx, [esp + 0x28]
push ecx
push 0
push 0
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0
push 0x80
push 2
push 0
push 0
lea eax, [esp + 0x3c]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 0x134], 1
jne 0x426b0b
xor eax, eax
jmp 0x426beb
lea ecx, [esp + 0x24]
push 0
push ecx
push ebp
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x426b2d
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x426beb
or edi, 0xffffffff
push esi
mov dword [esp + 0x14], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x28]
mov word [esp + 0x14], 8
push edx
call fcn.004ddbdd
test eax, eax
mov dword [esp + 0x1c], eax
jne 0x426b6a
lea ecx, [esp + 0x28]
test ecx, ecx
je 0x426b6a
push 0x8007000e
call fcn.004ddb30
mov eax, dword [esp + 0x1c]
mov ebp, dword [esp + 0x14]
lea ecx, [esp + 0xe]
push ecx
mov esi, dword [esp + 0x144]
sub esp, 0x10
mov byte [esp + 0x148], 2
mov ecx, esp
mov edx, dword [esi]
push esi
mov dword [ecx], ebp
mov ebp, dword [esp + 0x30]
mov dword [ecx + 4], ebp
mov dword [ecx + 8], eax
mov eax, dword [esp + 0x38]
mov dword [ecx + 0xc], eax
call dword [edx + 0xe8]
test eax, eax
jge 0x426bb3
push 0x5267c8
push esi
push eax
call fcn.004ddb3e
lea ecx, [esp + 0x14]
mov byte [esp + 0x134], 1
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
test eax, eax
jge 0x426bd0
push eax
call fcn.004ddb30
lea edx, [esp + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp word [esp + 0xe], di
je 0x426be6
xor eax, eax
jmp 0x426beb
mov eax, 1
mov ecx, dword [esp + 0x12c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebp
add esp, 0x12c
ret
Function at 0x426c10
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4e3fb8
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x426c47
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
jge 0x426c71
push eax
call fcn.004ddb30
mov esi, dword [esp + 0x2c]
mov word [esp + 0xc], 8
push esi
call fcn.004ddbdd
test eax, eax
mov dword [esp + 0x14], eax
jne 0x426c98
test esi, esi
je 0x426c98
push 0x8007000e
call fcn.004ddb30
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0xc]
sub esp, 0x10
mov eax, esp
mov edx, dword [edi]
push edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0xc], ecx
call dword [edx + pe_nt_image_headers32]
mov esi, eax
test esi, esi
jge 0x426ce6
push 0x5267c8
push edi
push esi
call fcn.004ddb3e
test esi, esi
mov dword [esp + 0x24], 0xffffffff
je 0x426d15
lea edx, [esp + 0xc]
push edx
call ebx
test eax, eax
jge 0x426d01
push eax
call fcn.004ddb30
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0xc]
push eax
call ebx
test eax, eax
jge 0x426d26
push eax
call fcn.004ddb30
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret

Function at 0x426db0
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x426dcf
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x426e19
xor eax, eax
add esp, 0x14
ret
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x427160
Capabilities:
Get file version info

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push esi
lea ecx, [esp + 0x10]
push edi
lea eax, [esp + 0x18]
push ecx
push edx
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x4271da
push ebx
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x4271da
mov eax, dword [esp + 0x2c]
push ebp
push ebx
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4271d1
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x5268d0
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4271d1
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
or esi, eax
or edi, ecx
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x4272d0
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push 0x534138
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x534138
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push str.Storm_
push 0x534138
call esi
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x42731d
push eax
push 0x534138
call esi
push 0x534138
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov eax, 0x534138
jne 0x427399
mov cl, byte [0x534138]
test cl, cl
je 0x427394
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x5268d0
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov esi, eax
test esi, esi
je 0x427394
mov edx, esi
sub edx, 0x534138
test edx, edx
jle 0x42738a
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
inc edx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x14]
push 0x534138
push eax
call ebx
lea ecx, [esp + 0x10]
push 0
push ecx
call ebp
mov cl, byte [esi + 1]
lea eax, [esi + 1]
test cl, cl
jne 0x427347
mov eax, 0x534138
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x427490
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push str.mee.db
stosw word es:[edi], ax
push ecx
push str._s_s
lea edx, [esp + 0x11c]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [esp + 0x110]
push 0
push 0x80
push 3
push 0
push 3
push closesocket
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x427582
mov edx, dword [esp + 0x218]
lea ecx, [esp + 8]
push 0
push ecx
push 8
push edx
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
je 0x42757c
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret

Function at 0x427590
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push esi
push 0x104
push eax
call fcn.004273b0
add esp, 8
test eax, eax
jne 0x42760d
push eax
push 0x80
push 3
push eax
push 3
lea ecx, [esp + 0x1c]
push closesocket
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42760d
mov eax, dword [esp + 0x110]
lea edx, [esp + 4]
push 0
push edx
push 8
push eax
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
je 0x427607
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x108
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x108
ret

Function at 0x427710
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x3c
push edi
mov ecx, 0xe
xor eax, eax
lea edi, [esp + 8]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x44]
mov ecx, dword [esp + 0x48]
lea edx, [esp + 4]
mov dword [esp + 8], 0x40
push edx
mov dword [esp + 8], 0x3c
mov dword [esp + 0x24], 5
mov dword [esp + 0x14], str.open
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ecx
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
pop edi
je 0x42778f
mov eax, dword [esp + 0x38]
push 0xffffffffffffffff
push eax
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov ecx, dword [esp + 0x38]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [esp + 0x38]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add esp, 0x3c
ret
xor eax, eax
add esp, 0x3c
ret
Function at 0x4278e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x464
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x60]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x165]
mov byte [esp + 0x164], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x164]
stosb byte es:[edi], al
lea eax, [esp + 0x60]
push eax
push str._sStormtray.exe
push 0x104
push ecx
call esi
add esp, 0x10
lea edx, [esp + 0x164]
push ebx
push edx
call fcn.004da340
test eax, eax
je 0x427a1f
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x269]
mov byte [esp + 0x268], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x164]
lea ecx, [esp + 0x268]
push eax
push str.__s___storm
push 0x208
push ecx
call esi
xor edx, edx
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x30]
mov dword [esp + 0x20], edx
add esp, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 0x14], edx
lea eax, [esp + 0xc]
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x1c]
push eax
lea edx, [esp + 0x64]
push ecx
push edx
push ebx
push ebx
push ebx
push ebx
lea eax, [esp + 0x284]
push ebx
push eax
push ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x427a1f
mov ecx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0xc]
push edx
call esi
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x464
ret
pop edi
pop esi
mov eax, 0x80004005
pop ebx
add esp, 0x464
ret
Function at 0x427a30
Capabilities:
Query environment variable
Set environment variable

Disassembly:
sub esp, 0x208
lea eax, [esp + 0x104]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea edx, [esp + 0x10]
push str.Codec
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push 0
push str.PATH
call ebp
mov edi, eax
lea ebx, [edi + 0x208]
push ebx
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
test edi, edi
jne 0x427acd
lea eax, [esp + 0x10]
lea ecx, [esp + 0x114]
push eax
push ecx
push 0x528da0
push 0x208
push esi
jmp 0x427b03
push ebx
push esi
push str.PATH
call ebp
push 0x5269cc
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x114]
push edx
push eax
push str.__s__s
push 0x208
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
push esi
push str.Path
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x427b30
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4e4049
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push esi
lea eax, [esp + 0x160]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x15c], 0
call sub.MFC42.DLL_CString::CString_1
mov bl, 1
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
mov byte [esp + 0x160], bl
call sub.MFC42.DLL_CString::Replace_1
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x15c], 2
call fcn.004dcf56
lea ecx, [esp + 0xc]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x160]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x427c2e
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edi
mov edi, dword [esp + 0x16c]
lea ecx, [esp + 0x44]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_operator_2
push eax
mov ecx, edi
mov byte [esp + 0x164], 3
call sub.MFC42.DLL_CStringList::AddTail
lea ecx, [esp + 0x14]
mov byte [esp + 0x160], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
push ecx
push esi
call ebp
test eax, eax
jne 0x427be5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebp
lea ecx, [esp + 8]
mov byte [esp + 0x158], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x160]
mov dword [esp + 0x158], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x150]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x154
ret