joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404510
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
mov eax, dword [esi + 0x114]
mov ecx, dword [esi + 8]
push edi
mov edi, dword [esp + 0x10]
mov edx, dword [edi]
push 0
push 0
add eax, edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov eax, dword [edi + 4]
mov ecx, dword [esp + 0x14]
push 0
lea edx, [esp + 0x10]
push edx
mov edx, dword [esi + 8]
push eax
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404554
pop edi
pop esi
ret
mov edx, dword [edi + 4]
mov ecx, dword [esp + 0xc]
xor eax, eax
cmp ecx, edx
pop edi
sete al
pop esi
ret
Function at 0x4069d0
Capabilities:
Write file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 8]
mov eax, dword [ebx + 0x120]
push ebp
push esi
push edi
push 0
push 0x290
push str.C:SrcToolsMoPaq_srcMPQAPI.cpp
push eax
call sub.Storm.dll_Ordinal_401
mov ecx, dword [ebx + 0x120]
mov esi, dword [ebx + 0x128]
mov edx, ecx
mov ebp, eax
shr ecx, 2
mov edi, ebp
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebx + 0x11c]
push eax
push ebp
call fcn.00406a80
mov ecx, dword [ebx + 0x11c]
shl ecx, 4
push 3
push str._block_table_
mov dword [esp + 0x24], ecx
call fcn.00407220
mov edx, dword [esp + 0x24]
push eax
push edx
push ebp
call fcn.004071c0
mov ecx, dword [esp + 0x30]
mov edx, dword [ebx + 8]
add esp, 0x1c
push 0
lea eax, [esp + 0x18]
push eax
push ecx
push ebp
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
push 0x29e
push str.C:SrcToolsMoPaq_srcMPQAPI.cpp
push ebp
mov esi, eax
call sub.Storm.dll_Ordinal_403
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x406ac0
Capabilities:
Write file on windows

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push 3
push str._hash_table_
lea edi, [esi + 0x130]
call fcn.00407220
mov ecx, dword [esi + 0x138]
push eax
mov eax, dword [edi]
push eax
push ecx
call fcn.004071c0
mov edx, dword [edi]
mov eax, dword [esi + 0x138]
mov ecx, dword [esi + 8]
add esp, 0x14
push 0
push edi
push edx
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
pop esi
ret

Function at 0x406b10
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x20
mov eax, dword [esp + 0x28]
push esi
mov esi, dword [esp + 0x28]
mov ecx, dword [esi + 8]
push 0
push 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esi + 0x124]
mov edx, dword [esi + 0x14c]
mov eax, dword [esi + 0x134]
push 0
mov dword [esp + 0x10], edx
mov edx, dword [esi + 0x12c]
mov dword [esp + 0x1c], ecx
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esi + 0x11c]
mov dword [esp + 0x24], edx
push 0x20
lea edx, [esp + 0x10]
mov dword [esp + 0x2c], eax
mov eax, dword [esi + 8]
push edx
push eax
mov dword [esp + 0x18], 0x1a51504d
mov dword [esp + 0x1c], 0x20
mov word [esp + 0x24], 0
mov word [esp + 0x26], 3
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
add esp, 0x20
ret

Function at 0x407160
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
shr edi, 2
test edi, edi
mov ecx, 0xeeeeeeee
je 0x4071bb
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 8]
push ebx
push esi
nop
lea esp, [esp]
mov esi, eax
and esi, 0xff
add ecx, dword [esi*4 + 0x852f20]
mov ebx, dword [edx]
lea esi, [ecx + eax]
imul ecx, ecx, 0x21
xor ebx, esi
mov esi, ebx
lea ecx, [ecx + esi + 3]
mov esi, eax
not esi
shl esi, 0x15
add esi, 0x11111111
shr eax, 0xb
mov dword [edx], ebx
add edx, 4
or eax, esi
dec edi
jne 0x407180
pop esi
pop ebx
pop edi
ret
Function at 0x4071c0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push edi
mov edi, dword [esp + 0xc]
shr edi, 2
test edi, edi
mov ecx, 0xeeeeeeee
je 0x407219
mov eax, dword [esp + 0x10]
push ebx
push esi
mov esi, dword [esp + 0x10]
nop
lea esp, [esp]
mov edx, dword [esi]
mov ebx, eax
and ebx, 0xff
add ecx, dword [ebx*4 + 0x852f20]
lea ebx, [ecx + eax]
imul ecx, ecx, 0x21
xor ebx, edx
lea ecx, [ecx + edx + 3]
mov edx, eax
not edx
shl edx, 0x15
add edx, 0x11111111
shr eax, 0xb
mov dword [esi], ebx
add esi, 4
or eax, edx
dec edi
jne 0x4071e0
pop esi
pop ebx
pop edi
ret

Function at 0x407560
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x2c
push ebx
push esi
push edi
push 0x2e
push eax
call dword [sym.imp.MSVCR80.dll_strrchr]
add esp, 8
test eax, eax
je 0x407672
push str..wav
push eax
call dword [sym.imp.MSVCR80.dll__stricmp]
add esp, 8
test eax, eax
jne 0x407672
mov esi, dword [esp + 0x40]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
push eax
push eax
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea ecx, [esp + 0x40]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push esi
call edi
test eax, eax
je 0x407672
cmp dword [esp + 0x24], 0x46464952
jne 0x407672
cmp dword [esp + 0x2c], 0x45564157
jne 0x407672
lea eax, [esp + 0xc]
push eax
push 0x20746d66
push esi
call fcn.00407680
add esp, 0xc
test eax, eax
je 0x407672
cmp dword [esp + 0xc], 0x10
jb 0x407672
push 0
lea ecx, [esp + 0x40]
push ecx
push 0x10
lea edx, [esp + 0x20]
push edx
push esi
call edi
test eax, eax
je 0x407672
mov eax, dword [esp + 0xc]
push 1
push 0
add eax, 0xfffffff0
push eax
push esi
call ebx
cmp word [esp + 0x14], 1
jne 0x407672
cmp word [esp + 0x22], 0x10
jne 0x407672
lea ecx, [esp + 0xc]
push ecx
push 0x61746164
push esi
call fcn.00407680
add esp, 0xc
test eax, eax
je 0x407672
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x44]
mov ecx, dword [esp + 0xc]
mov dword [edx], eax
lea edx, [eax + ecx - 1]
mov eax, dword [esp + 0x48]
xor ecx, ecx
cmp word [esp + 0x16], 2
mov dword [eax], edx
mov edx, dword [esp + 0x4c]
sete cl
mov dword [edx], ecx
pop edi
pop esi
pop ebx
add esp, 0x2c
ret

Function at 0x407680
Capabilities:
Read file on windows

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
lea eax, [esp + 0x20]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
test eax, eax
je 0x4076dc
mov ebp, dword [esp + 0x20]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp dword [esp + 0x10], ebp
mov edx, dword [esp + 0x14]
push 1
push 0
je 0x4076e6
push edx
push esi
call ebx
cmp eax, 0xffffffff
je 0x4076dc
push 0
lea eax, [esp + 0x20]
push eax
push 8
lea ecx, [esp + 0x1c]
push ecx
push esi
call edi
test eax, eax
jne 0x4076b0
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x2c]
push 0
push esi
mov dword [edi], edx
call ebx
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [edi + 4], eax
setne cl
pop edi
pop esi
pop ebp
pop ebx
mov eax, ecx
add esp, 8
ret
Function at 0x407730
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x408240
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push esi
mov esi, dword [esp + 0x10]
xor eax, eax
test esi, esi
je 0x40824d
mov eax, dword [esi]
push ebx
mov bl, byte [esp + 0x18]
test bl, 1
je 0x40825a
or eax, 0xffffffff
test bl, 2
je 0x40828f
mov edx, dword [esp + 0x10]
test edx, edx
mov ecx, dword [esp + 0xc]
je 0x40828f
push ebp
push edi
lea ecx, [ecx]
movzx ebp, byte [ecx]
mov edi, eax
and edi, 0xff
xor edi, ebp
mov edi, dword [edi*4 + 0x827460]
shr eax, 8
xor eax, edi
inc ecx
dec edx
jne 0x408270
pop edi
pop ebp
test bl, 4
pop ebx
je 0x408297
not eax
test esi, esi
je 0x40829d
mov dword [esi], eax
pop esi
ret
Function at 0x408700
Capabilities:
Get common file path
Get disk size

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x114
push 0x104
push eax
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.MSVCR80.dll_strncpy]
mov al, byte [esp + 0x1c]
add esp, 0xc
test al, al
je 0x40872d
cmp byte [esp + 0x11], 0x3a
je 0x40873d
lea edx, [esp + 0x10]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x20]
push ecx
mov byte [esp + 0x27], 0
mov dword [esp + 0x14], 0x200
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [esp]
add esp, 0x114
ret

Function at 0x409a10
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov ebp, edx
mov dword [esp + 0x10], ecx
mov esi, 0x21
xor edi, edi
lea eax, [esi + 0x7b5]
xor edx, edx
mov ecx, 0x34
div ecx
mov ebx, edx
xor edx, edx
lea eax, [ebx + 0x7b5]
div ecx
mov eax, dword [esp + 0x10]
mov esi, edx
xor edx, edx
mov dl, byte [edi + eax]
mov cl, byte [edx + 0x798e10]
mov byte [esp + 0x14], cl
mov ecx, 5
mov eax, dword [esp + 0x14]
and eax, 0xff
cdq
idiv ecx
inc edi
cmp edi, 0x1a
mov byte [ebx + ebp], al
mov byte [esi + ebp], dl
jb 0x409a24
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x409be0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov ebp, 0x1d
push edi
mov edi, ecx
mov dword [esp + 0x14], ebp
mov eax, 0x1d0
mov esi, ebp
mov ecx, ebp
and esi, 7
mov edx, 3
shr ecx, 3
shl esi, 2
mov dword [esp + 0x18], ecx
sub edx, ecx
mov ebx, 0xf
mov ecx, esi
mov edx, dword [edi + edx*4]
shl ebx, cl
and edx, ebx
shr edx, cl
cmp eax, 0x1d0
mov byte [esp + 0x10], dl
mov edx, 0x1d
jge 0x409c80
mov ebx, edx
mov ecx, edx
shr ebx, 3
mov ebp, 3
and ecx, 7
sub ebp, ebx
mov ebx, 0xf
shl ecx, 2
mov ebp, dword [edi + ebp*4]
shl ebx, cl
and ebp, ebx
xor ebx, ebx
shr ebp, cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov bl, byte [ecx + eax + 0x798c30]
and ebp, 0xff
xor ebp, ebx
dec edx
mov cl, byte [eax + ebp + 0x798c30]
mov ebp, dword [esp + 0x14]
cmp edx, ebp
mov byte [esp + 0x10], cl
jg 0x409c2f
lea edx, [ebp - 1]
test edx, edx
mov dword [esp + 0x14], edx
jl 0x409cda
mov ebx, edx
mov ecx, edx
shr ebx, 3
mov ebp, 3
and ecx, 7
sub ebp, ebx
mov ebx, 0xf
shl ecx, 2
mov ebp, dword [edi + ebp*4]
shl ebx, cl
and ebp, ebx
xor ebx, ebx
shr ebp, cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov bl, byte [ecx + eax + 0x798c30]
and ebp, 0xff
xor ebp, ebx
dec edx
mov cl, byte [eax + ebp + 0x798c30]
mov byte [esp + 0x10], cl
jns 0x409c8b
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov ebp, 3
sub ebp, ecx
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov bl, byte [ecx + eax + 0x798c30]
mov ecx, esi
and ebx, 0xf
shl ebx, cl
mov ecx, 0xf
mov dword [esp + 0x18], ecx
mov ecx, esi
mov esi, dword [esp + 0x18]
shl esi, cl
mov ecx, dword [edi + ebp*4]
not esi
and esi, ecx
or ebx, esi
sub eax, 0x10
mov dword [edi + ebp*4], ebx
mov ebp, edx
mov dword [esp + 0x14], ebp
jns 0x409bf7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x411993
Capabilities:
Enumerate pe sections

Disassembly:
sub esp, 0x20
push esi
mov esi, ecx
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
lea edx, [esi + 0x48]
lea ecx, [esi + 0x44]
mov dword [esi + 0x40], 1
call fcn.0040cb50
mov ecx, dword [esi + 0x14]
push 1
push ecx
call dword [sym.imp.USER32.dll_GetParent]
mov edx, eax
lea ecx, [esp + 0x18]
call fcn.0040f8e0
mov edx, dword [esi + 0x14]
push 0
lea ecx, [esp + 8]
call fcn.0040f8e0
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
mov dword [esi + 0x4c], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 0x50], eax
mov eax, dword [esp + 0x18]
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], edx
sub dword [esi + 0x50], eax
sub dword [esi + 0x58], eax
mov eax, dword [esp + 0x14]
sub dword [esi + 0x4c], eax
sub dword [esi + 0x54], eax
mov ecx, esi
pop esi
add esp, 0x20
jmp fcn.0040f850

Function at 0x412770
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x7716cb
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x84dea4]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
xor eax, eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x20]
push eax
call fcn.00412510
mov ecx, dword [0x853394]
push Ordinal_2
push ecx
lea edx, [esi + 8]
push edx
call sub.Storm.dll_Ordinal_501
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [esi + 4], eax
mov al, byte [esp + 0x1c]
mov byte [esi], al
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret 8

Function at 0x4132b0
Capabilities:
Get graphical window text

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebp, ecx
call fcn.0040ad10
mov ebx, eax
lea esi, [ebx + 1]
cmp esi, dword [0x853380]
jbe 0x413304
cmp esi, dword [0x85337c]
jbe 0x413304
mov ecx, dword [0x853388]
test ecx, ecx
jne 0x4132e7
push esi
mov ecx, 0x85337c
call fcn.0040ddf0
mov ecx, eax
xor edx, edx
mov eax, esi
div ecx
mov edi, esi
test edx, edx
je 0x4132f9
sub ecx, edx
add ecx, esi
mov edi, ecx
push edi
mov ecx, 0x85337c
call fcn.0040de50
mov dword [0x853380], esi
lea esi, [ebx + ebx + 2]
cmp esi, dword [0x853390]
jbe 0x413352
cmp esi, dword [0x85338c]
jbe 0x413352
mov ecx, dword [0x853398]
test ecx, ecx
jne 0x413335
push esi
mov ecx, 0x85338c
call fcn.0040db00
mov ecx, eax
xor edx, edx
mov eax, esi
div ecx
mov edi, esi
test edx, edx
je 0x413347
sub ecx, edx
add ecx, esi
mov edi, ecx
push edi
mov ecx, 0x85338c
call fcn.0040db60
mov dword [0x853390], esi
or dword [ebp + 4], 0x80
mov eax, dword [0x853390]
mov ecx, dword [0x853394]
mov edx, dword [ebp + 0x14]
push eax
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
and dword [ebp + 4], 0xffffff7f
pop edi
pop esi
pop ebp
pop ebx
jmp fcn.0040e4b0
Function at 0x416db0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x416def
mov eax, 1
add esp, 0x24
ret

Function at 0x417170
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
add esp, 0x20
ret

Function at 0x419250
Capabilities:
Get file attributes

Disassembly:
test ecx, ecx
jne 0x41925e
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret

Function at 0x419270
Capabilities:
Set file attributes

Disassembly:
test ecx, ecx
jne 0x41927e
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
ret
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x4192e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x104], eax
push edi
mov edi, ecx
test edi, edi
jne 0x41931a
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00735f58
add esp, 0x108
ret
test edx, edx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
je 0x419380
push esi
push 0x104
push edi
lea eax, [esp + 0x14]
push eax
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0xc]
call fcn.004189f0
lea ecx, [esp + 0xc]
call fcn.00418800
lea ecx, [esp + eax + 0xc]
mov dl, 0x5c
call sub.Storm.dll_Ordinal_569
mov esi, eax
test esi, esi
je 0x41937f
lea esp, [esp]
push 0
lea ecx, [esp + 0x10]
push ecx
mov byte [esi], 0
call ebx
lea ecx, [esi + 1]
mov dl, 0x5c
mov byte [esi], 0x5c
call sub.Storm.dll_Ordinal_569
mov esi, eax
test esi, esi
jne 0x419360
pop esi
push 0
push edi
call ebx
mov ecx, dword [esp + 0x10c]
pop ebx
pop edi
xor ecx, esp
call fcn.00735f58
add esp, 0x108
ret
Function at 0x419540
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x364
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
mov ebx, dword [esp + 0x370]
push esi
push edi
mov edi, dword [esp + 0x374]
push Ordinal_2
push ecx
lea eax, [esp + 0x270]
push eax
mov esi, edx
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0x268]
call fcn.004189b0
push Ordinal_2
push esi
lea ecx, [esp + 0x270]
push ecx
call sub.Storm.dll_Ordinal_503
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], eax
je 0x419691
push ebp
push Ordinal_2
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x24]
push edx
call sub.Storm.dll_Ordinal_501
mov edx, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
xor eax, eax
or eax, edx
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x14c]
xor ebp, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x12c]
or ecx, ebp
test al, 0x10
mov dword [esp + 0x128], ecx
mov dword [esp + 0x18], ebp
je 0x41961e
mov dword [esp + 0x18], 0x10
test al, 1
je 0x419627
or dword [esp + 0x18], 1
mov ecx, eax
and ecx, 2
je 0x419633
or dword [esp + 0x18], 2
and eax, 4
je 0x41963d
or dword [esp + 0x18], 4
cmp dword [esp + 0x380], 0
jne 0x41964b
test ecx, ecx
jne 0x419665
cmp dword [esp + 0x384], 0
jne 0x419659
test eax, eax
jne 0x419665
mov edx, ebx
lea ecx, [esp + 0x14]
call edi
test eax, eax
jne 0x419682
lea ecx, [esp + 0x12c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4195c1
mov edi, dword [esp + 0x10]
jmp 0x419687
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00735f58
add esp, 0x364
ret 0x10

Function at 0x4196b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push Ordinal_2
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x4196db
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push esi
lea eax, [esp + 0x14]
push eax
push 0
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
push 0x79923f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 0xc], 1
jne 0x41971b
test esi, esi
sete al
pop esi
add esp, 0xc
ret 4

Function at 0x419730
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push 0
lea eax, [esp + 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push Ordinal_2
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x419782
push esi
call sub.Storm.dll_Ordinal_506
mov ecx, dword [esp + 4]
add eax, 1
push eax
push esi
push 1
push 0
push 0x79923f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret
Function at 0x419890
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, 2
mov esi, edx
cmp eax, esi
sbb eax, eax
neg eax
sub eax, 1
push edi
mov edi, dword [esp + 0x21c]
jne 0x4198cb
push 0x57
call sub.Storm.dll_Ordinal_465
jmp 0x419964
push 0x104
lea edx, [esp + 0x114]
call fcn.004196b0
test eax, eax
je 0x419964
push Ordinal_2
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x14]
push edx
call sub.Storm.dll_Ordinal_501
mov eax, dword [esi*4 + 0x799cac]
push Ordinal_2
push eax
lea ecx, [esp + 0x14]
push ecx
call sub.Storm.dll_Ordinal_503
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x419964
push edi
call sub.Storm.dll_Ordinal_506
mov ecx, dword [esp + 8]
add eax, 1
push eax
push edi
push 1
push 0
push 0x79923f
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.00735f58
add esp, 0x210
ret 4

Function at 0x419995
Capabilities:
Get disk size

Disassembly:
sub esp, 0x120
mov eax, dword [0x84dea4]
xor eax, esp
mov dword [esp + 0x11c], eax
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp esi, ebx
jne 0x4199b9
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00735f58
add esp, 0x120
ret
push edi
push str.GetDiskFreeSpaceExA
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x104
mov edi, eax
push esi
lea eax, [esp + 0x2c]
push eax
call sub.Storm.dll_Ordinal_501
mov dl, 0x5c
lea ecx, [esp + 0x24]
call sub.Storm.dll_Ordinal_570
cmp eax, ebx
je 0x4199f4
mov byte [eax], bl
cmp edi, ebx
je 0x419a58
push ebx
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x30]
push eax
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
call edi
test eax, eax
jne 0x419a38
pop edi
pop esi
xor edx, edx
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00735f58
add esp, 0x120
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x11c]
xor ecx, esp
call fcn.00735f58
add esp, 0x120
ret
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov eax, dword [esp + 0x20]
mul dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
push ebx
push ecx
push edx
push eax
call fcn.00736550
mov ecx, dword [esp + 0x128]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00735f58
add esp, 0x120
ret