joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e00
Capabilities:
Set registry value

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
mov ebp, ecx
xor edi, edi
push esi
call ebx
inc eax
add esi, eax
add edi, eax
cmp eax, 1
jne 0x409e12
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [ebp]
push edi
push eax
push 7
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop edi
pop esi
pop ebp
pop ebx
ret 8

Function at 0x40a930
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x11c
mov eax, dword [0x42482c]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
mov esi, ecx
mov dword [esp + 0x120], eax
mov eax, dword [esi + 8]
push edi
xor edi, edi
cmp eax, edi
je 0x40a968
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov dword [esi + 8], edi
mov dword [esi + 4], edi
mov dword [esp + 0x14], edi
xor eax, eax
test ebx, ebx
mov byte [esp + 0x18], 0
mov ecx, 0x40
lea edi, [esp + 0x19]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
je 0x40a989
mov edi, ebx
jmp 0x40a991
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea eax, [eax*4 + 4]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
call dword [sym.imp.USER32.dll_CharUpperA]
push 0x104
lea ecx, [esp + 0x1c]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp byte [edi], 0
jne 0x40a9da
lea edx, [esp + 0x18]
mov dword [esp + 0x10], edx
jmp 0x40a9de
mov dword [esp + 0x10], ebx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x14]
push eax
lea edi, [esi + 4]
push edi
push 0
push 0
push ecx
mov ecx, esi
call fcn.0040a690
mov edx, dword [edi]
mov eax, dword [esp + 0x14]
lea ecx, [eax + edx*4 + 4]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [esi + 8], eax
jne 0x40aa32
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [edi]
lea edx, [esp + 0x14]
push edx
push edi
lea edx, [eax + ecx*4]
push edx
push eax
mov eax, dword [esp + 0x20]
push eax
mov ecx, esi
call fcn.0040a690
push ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004144ff
mov esp, ebp
pop ebp
ret 4
Function at 0x40aa90
Capabilities:
Query or enumerate registry value

Disassembly:
push esi
mov esi, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x14]
mov eax, dword [edi]
lea edx, [esp + 0x14]
push edx
mov edx, dword [esp + 0x10]
push esi
mov dword [esp + 0x1c], eax
lea eax, [esp + 0x18]
push eax
push 0
mov dword [edi], 0
mov eax, dword [ecx]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40aaf1
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x40aad3
cmp eax, 2
jne 0x40aae3
test esi, esi
mov eax, dword [esp + 0x14]
je 0x40aaed
mov cl, byte [eax + esi - 1]
test cl, cl
je 0x40aaed
pop edi
mov eax, 0xd
pop esi
ret 0xc
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
ret 0xc

Function at 0x40af00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x42482c]
push ebx
mov ebx, dword [0x420000]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [0x41fffc]
lea edx, [esp + 0x10]
push edx
push 0x20019
xor eax, ebp
push 0
mov dword [esp + 0x148], eax
mov eax, dword [0x41fff4]
mov dword [esp + 0x24], ecx
mov ecx, dword [0x41fff8]
push 0x41f950
push SysReAllocString
mov dword [esp + 0x34], eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40aff4
mov byte [esp + 0x30], al
mov ecx, 0x40
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x1c]
push eax
mov eax, dword [edi + 0x10]
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x18]
lea edx, [esp + 0x1c]
push edx
push 0
push eax
push ecx
mov dword [esp + 0x34], 0x104
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40afce
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x34]
push eax
mov ecx, edi
call fcn.0040ad10
mov ebx, dword [esp + 0x2c]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x24]
mov edx, esi
mov dword [edx], eax
mov eax, dword [esp + 0x28]
mov dword [edx + 4], ecx
mov dword [edx + 8], eax
mov dword [edx + 0xc], ebx
jmp 0x40b009
mov edx, dword [esp + 0x20]
mov eax, dword [esp + 0x24]
mov ecx, esi
mov dword [ecx], edx
mov dword [ecx + 4], eax
mov dword [ecx + 8], edi
mov dword [ecx + 0xc], ebx
mov ecx, dword [esp + 0x13c]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004144ff
mov esp, ebp
pop ebp
ret 4
Function at 0x40b030
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x134
mov eax, dword [0x42482c]
push ebx
mov ebx, dword [ebp + 0x14]
xor eax, ebp
push esi
push edi
mov dword [esp + 0x13c], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x1c], eax
xor eax, eax
mov dword [esp + 0x14], ecx
mov edx, dword [ebp + 0x10]
mov byte [esp + 0x30], 0
mov ecx, 0x40
lea edi, [esp + 0x31]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov esi, dword [ebp + 8]
mov eax, ebx
shr eax, 0x10
movzx ecx, ah
push ecx
movzx eax, al
push eax
movzx ecx, bh
push ecx
movzx eax, bl
push eax
mov eax, edx
mov ecx, edx
shr ecx, 0x18
push ecx
shr eax, 0x10
movzx eax, al
push eax
movzx eax, word [esp + 0x36]
movzx ecx, dh
push ecx
movzx ecx, word [esp + 0x38]
mov dword [esp + 0x3c], edx
movzx edx, dl
push edx
push eax
push ecx
push esi
push 0x41f91c
lea edx, [esp + 0x60]
push 0x104
push edx
mov dword [esp + 0x5c], ebx
call fcn.004150a8
add esp, 0x38
lea eax, [esp + 0x10]
push eax
push 0x41f950
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x40b119
lea ecx, [esp + 0x10]
push ecx
push 0x41f950
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40b119
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x130]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret 0x10
lea edx, [esp + 0x30]
push edx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x14]
mov edx, dword [ecx + 0x10]
inc eax
push eax
lea eax, [esp + 0x34]
push eax
mov eax, dword [esp + 0x18]
push esi
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x40b14c
xor esi, esi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x13c]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.004144ff
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40b170
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x35c
mov eax, dword [0x42482c]
push ebx
mov ebx, dword [ebp + 8]
xor eax, ebp
push esi
push edi
mov dword [esp + 0x364], eax
xor eax, eax
test ebx, ebx
mov ecx, 0x82
lea edi, [esp + 0x151]
mov byte [esp + 0x150], 0
rep stosd dword es:[edi], eax
je 0x40b2f0
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call esi
test eax, eax
jle 0x40b2f0
push ebx
call esi
cmp eax, 0x209
jbe 0x40b1e5
mov eax, 0x6f
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret
push ebx
lea eax, [esp + 0x154]
push 0x41f990
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
je 0x40b2d9
lea esp, [esp]
mov edi, 0x41f98c
lea esi, [esp + 0x3c]
mov ecx, 2
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x40b2a0
mov edi, 0x41f988
lea esi, [esp + 0x3c]
mov ecx, 3
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x40b2a0
lea eax, [esp + 0x3c]
push eax
push ebx
lea ecx, [esp + 0x158]
push 0x41f980
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
mov eax, dword [esp + 0x20]
add esp, 0x10
cmp eax, 0x10
jne 0x40b27f
lea edx, [esp + 0x150]
push edx
call fcn.0040b170
add esp, 4
jmp 0x40b2a0
push 0x80
lea eax, [esp + 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x150]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40b220
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x40b220
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, ebp
call fcn.004144ff
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 0x364]
pop edi
pop esi
xor ecx, ebp
or eax, 0xffffffff
pop ebx
call fcn.004144ff
mov esp, ebp
pop ebp
ret

Function at 0x40b310
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x110
mov eax, dword [0x42482c]
push esi
xor eax, ebp
push edi
mov dword [esp + 0x114], eax
xor eax, eax
push 0x104
mov byte [esp + 0xc], 0
mov ecx, 0x41
lea edi, [esp + 0xd]
rep stosd dword es:[edi], eax
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea ecx, [esp + 8]
push 0x5c
push ecx
call fcn.00414acc
mov esi, eax
add esp, 8
test esi, esi
je 0x40b391
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ebx, [ebx]
push 0
lea edx, [esp + 0xc]
push edx
mov byte [esi], 0
call edi
mov byte [esi], 0x5c
push 0x5c
inc esi
push esi
call fcn.00414acc
mov esi, eax
add esp, 8
test esi, esi
jne 0x40b370
mov ecx, dword [esp + 0x114]
pop edi
xor ecx, ebp
pop esi
call fcn.004144ff
mov esp, ebp
pop ebp
ret
Function at 0x40b490
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push ebx
mov ebx, dword [esp + 0x5c]
push esi
mov eax, ebx
push edi
lea edx, [eax + 1]
nop
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b4a0
mov edi, dword [esp + 0x68]
sub eax, edx
mov edx, eax
mov eax, edi
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40b4b4
sub eax, esi
add eax, edx
lea eax, [eax + eax + 4]
push eax
call fcn.004144c9
mov esi, eax
add esp, 4
test esi, esi
je 0x40b539
push edi
push ebx
push 0x41f998
push esi
call fcn.00414a74
xor eax, eax
mov ecx, 0x11
lea edi, [esp + 0x2c]
rep stosd dword es:[edi], eax
add esp, 0x10
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
xor edx, edx
mov dword [esp + 0xc], edx
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
lea ecx, [esp + 0x20]
push ecx
push edx
push edx
push edx
push edx
push edx
push edx
push esi
push edx
mov dword [esp + 0x40], edx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
push esi
jne 0x40b544
call fcn.00414948
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x54
ret 0x10
call fcn.00414948
mov eax, dword [esp + 0x70]
add esp, 4
test eax, eax
je 0x40b571
mov edx, dword [esp + 0xc]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 0x70]
mov ecx, dword [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edx, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push edx
call esi
mov eax, dword [esp + 0xc]
push eax
call esi
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 0x54
ret 0x10

Function at 0x40b5a0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
push edi
push esi
call fcn.0040b170
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
xor edi, edi
nop
push esi
call ebp
cmp eax, 0xffffffff
je 0x40b5de
push 0x3e8
call ebx
push esi
call fcn.0040b170
add esp, 4
inc edi
cmp edi, 0xa
jl 0x40b5c0
push esi
call ebp
inc eax
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
inc eax
pop ebx
ret 4

Function at 0x40b8b0
Capabilities:
Resume thread

Disassembly:
push esi
mov esi, ecx
lea ecx, [esi + 4]
mov dword [esi + 0x70], 1
call fcn.00403570
mov eax, dword [esi + 0x64]
test eax, eax
je 0x40b8d7
push eax
mov dword [esi + 0x6c], 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
ret
Function at 0x40b9e0
Capabilities:
Resume thread

Disassembly:
sub esp, 0x10
push esi
mov esi, ecx
mov eax, dword [esi + 0x64]
push edi
xor edi, edi
cmp eax, edi
je 0x40b9fa
push eax
mov dword [esi + 0x6c], edi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
lea ecx, [esi + 4]
mov dword [esi + 0x74], 1
call fcn.00403570
lea eax, [esp + 8]
push eax
lea ecx, [esp + 0x10]
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0xc], 0x2714
call fcn.0040b980
lea ecx, [esi + 0xa4]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esi + 0xb8]
push eax
lea ecx, [esi + 0xb4]
push ecx
lea edx, [esi + 0xb0]
push edx
lea eax, [esi + 0xac]
push eax
mov eax, dword [esi + 0x8c]
lea ecx, [esi + 0xa8]
push ecx
lea edx, [esi + 0x9c]
push edx
push eax
call fcn.0040f180
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp eax, edi
pop edi
pop esi
je 0x40ba83
push eax
call fcn.00413af1
add esp, 4
add esp, 0x10
ret
Function at 0x40bda0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
mov ebp, dword [esp + 0xc]
push esi
push edi
push ebp
push 0x64
push 0x41f9e0
push 0x41f5dc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
mov dword [ecx], eax
mov dword [ecx + 4], 0
mov eax, dword [esi]
mov ebx, dword [eax - 4]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ecx, 1
sub ecx, ebx
mov ebx, 0x400
sub edx, ebx
or ecx, edx
jge 0x40bdf1
push ebx
mov ecx, esi
call fcn.00403730
mov edi, dword [esi]
cmp dword [edi - 8], ebx
jge 0x40be02
push 0x80070057
call fcn.004033d0
mov eax, dword [esi]
push ebp
push ebx
push edi
push 0x41f505
mov dword [eax - 0xc], ebx
mov ecx, dword [esi]
push 0x41f9d8
push 0x41f5dc
mov byte [ecx + 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esi]
test ecx, ecx
jne 0x40be32
xor edi, edi
jmp 0x40be44
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40be37
sub eax, edi
mov edi, eax
js 0x40be49
cmp edi, dword [ecx - 8]
jle 0x40be53
push 0x80070057
call fcn.004033d0
mov edx, dword [esi]
mov dword [edx - 0xc], edi
mov eax, dword [esi]
mov esi, dword [esp + 0x20]
mov byte [edi + eax], 0
mov eax, dword [esi]
mov edx, dword [eax - 4]
sub eax, 0x10
mov ecx, 1
sub ecx, edx
mov edx, dword [eax + 8]
sub edx, ebx
or ecx, edx
jge 0x40be82
push ebx
mov ecx, esi
call fcn.00403730
mov edi, dword [esi]
cmp dword [edi - 8], ebx
jge 0x40be93
push 0x80070057
call fcn.004033d0
mov eax, dword [esi]
push ebp
push ebx
push edi
push 0x41f9cc
mov dword [eax - 0xc], ebx
mov ecx, dword [esi]
push 0x41f9c8
push 0x41f5dc
mov byte [ecx + 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov eax, dword [esi]
test eax, eax
jne 0x40bec3
xor edi, edi
jmp 0x40bed3
mov edi, eax
lea edx, [edi + 1]
mov cl, byte [edi]
inc edi
test cl, cl
jne 0x40bec8
sub edi, edx
js 0x40bed8
cmp edi, dword [eax - 8]
jle 0x40bee2
push 0x80070057
call fcn.004033d0
mov edx, dword [esi]
push ebp
push 1
mov dword [edx - 0xc], edi
mov eax, dword [esi]
push 0x41f668
push 0x41f5dc
mov byte [edi + eax], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
mov ecx, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [eax - 4]
sub eax, 0x10
mov eax, dword [eax + 8]
mov edx, 1
sub edx, ecx
sub eax, ebx
or edx, eax
jge 0x40bf2a
push ebx
mov ecx, esi
call fcn.00403730
mov edi, dword [esi]
cmp dword [edi - 8], ebx
jge 0x40bf3b
push 0x80070057
call fcn.004033d0
mov ecx, dword [esi]
push ebp
push ebx
push edi
push 0x41f505
mov dword [ecx - 0xc], ebx
mov edx, dword [esi]
push 0x41f9c0
push 0x41f5dc
mov byte [edx + 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esi]
test ecx, ecx
jne 0x40bf6b
xor edi, edi
jmp 0x40bf7d
mov eax, ecx
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40bf70
sub eax, edi
mov edi, eax
js 0x40bf82
cmp edi, dword [ecx - 8]
jle 0x40bf8c
push 0x80070057
call fcn.004033d0
mov eax, dword [esi]
mov dword [eax - 0xc], edi
mov ecx, dword [esi]
mov byte [edi + ecx], 0
pop edi
pop esi
pop ebp
pop ebx
ret 0x18
Function at 0x40c350
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ebx, ebx
push eax
mov esi, ecx
mov dword [esp + 0x10], ebx
call edi
cmp eax, 0xffffffff
je 0x40c411
mov eax, dword [esp + 0x18]
test eax, eax
jne 0x40c381
mov esi, 1
jmp 0x40c3bd
push eax
push 0x41f434
add esi, 0x84
lea ecx, [esp + 0x20]
push esi
push ecx
mov ebx, 3
call fcn.0040c010
add esp, 0xc
push eax
lea edx, [esp + 0x1c]
push edx
call fcn.0040c010
mov eax, dword [eax]
add esp, 0xc
push eax
call edi
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov esi, ecx
test bl, 2
je 0x40c3e5
mov eax, dword [esp + 0x14]
add eax, 0xfffffff0
and ebx, 0xfffffffd
lea edx, [eax + 0xc]
mov ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x40c3e5
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test bl, 1
je 0x40c408
mov eax, dword [esp + 0x18]
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40c408
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
pop edi
mov eax, esi
pop esi
pop ebx
pop ecx
ret 8
pop edi
pop esi
xor eax, eax
pop ebx
pop ecx
ret 8
Function at 0x40c490
Capabilities:
Check if file exists
Create directory
Delete file
Get common file path
Get file attributes
Set file attributes

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov eax, dword [esi]
mov ebx, dword [eax - 4]
mov edx, dword [eax - 8]
sub eax, 0x10
mov ebp, ecx
mov ecx, 1
sub ecx, ebx
mov ebx, 0x400
sub edx, ebx
or ecx, edx
push edi
jge 0x40c4bf
push ebx
mov ecx, esi
call fcn.00403730
mov edi, dword [esi]
cmp dword [edi - 8], ebx
jge 0x40c4d0
push 0x80070057
call fcn.004033d0
mov eax, dword [esi]
mov dword [eax - 0xc], ebx
mov ecx, dword [esi]
push edi
push ebx
mov byte [ecx + 0x400], 0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40c535
mov edx, dword [esi]
test edx, edx
jne 0x40c4f4
xor edi, edi
jmp 0x40c50d
mov eax, edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c500
sub eax, edi
mov edi, eax
js 0x40c512
cmp edi, dword [edx - 8]
jle 0x40c51c
push 0x80070057
call fcn.004033d0
mov edx, dword [esi]
mov dword [edx - 0xc], edi
mov eax, dword [esi]
push 7
push 0x41f9ec
mov ecx, esi
mov byte [edi + eax], 0
call fcn.00403f20
mov edx, dword [esi]
test edx, edx
jne 0x40c53f
xor edi, edi
jmp 0x40c551
mov eax, edx
lea edi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40c544
sub eax, edi
mov edi, eax
js 0x40c556
cmp edi, dword [edx - 8]
jle 0x40c560
push 0x80070057
call fcn.004033d0
mov ecx, dword [esi]
mov dword [ecx - 0xc], edi
mov edx, dword [esi]
mov byte [edi + edx], 0
mov eax, dword [esi]
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push eax
call edi
cmp eax, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
je 0x40c585
test al, 0x10
jne 0x40c59b
mov edx, dword [esi]
call fcn.0040b310
mov eax, dword [esi]
push 0
push eax
call ebx
test eax, eax
je 0x40c61d
push 0x41f434
mov ecx, esi
call fcn.0040bfa0
push 1
push 0x41f434
mov ecx, esi
call fcn.00403e90
mov eax, dword [ebp + 0xa4]
mov ecx, dword [eax - 0xc]
push ecx
push eax
mov ecx, esi
call fcn.00403e90
push 3
push 0x41f9e8
mov ecx, esi
call fcn.00403e90
mov eax, dword [esi]
push eax
call edi
cmp eax, 0xffffffff
je 0x40c601
mov edx, dword [esi]
push edx
call fcn.0040b170
mov eax, dword [esi]
add esp, 4
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esi]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, dword [esi]
call fcn.0040b310
mov edx, dword [esi]
push 0
push edx
call ebx
mov esi, dword [esi]
push esi
call edi
cmp eax, 0xffffffff
je 0x40c61d
test al, 0x10
jne 0x40c626
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret 4
Function at 0x40cb90
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [0x4259a0]
push ebp
push esi
push edi
mov ecx, 0x4259a0
xor ebp, ebp
call dword [eax + 0xc]
mov edi, eax
add edi, 0x10
push 0x41fa6c
lea ecx, [esp + 0x14]
mov dword [esp + 0x10], edi
call fcn.004048b0
mov edx, dword [esp + 0x20]
test edx, edx
jne 0x40cbc8
xor eax, eax
jmp 0x40cbd9
mov eax, edx
lea esi, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40cbd0
sub eax, esi
push eax
push edx
lea ecx, [esp + 0x18]
call fcn.00403e90
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
push 0x2001f
push 0
push esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x34], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cd38
mov eax, dword [esp + 0x20]
lea edx, [esp + 0x14]
push edx
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push 0x41fa5c
mov ebp, eax
push eax
mov dword [esp + 0x38], ebp
mov dword [esp + 0x2c], 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40cd38
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x40cc56
cmp eax, 2
jne 0x40cd38
mov eax, dword [esp + 0x14]
test eax, eax
mov dword [esp + 0x14], eax
jbe 0x40cd38
lea edx, [esp + 0x14]
push edx
dec eax
push eax
lea ecx, [esp + 0x14]
call fcn.0040bb40
push eax
push 0x41fa5c
lea ecx, [esp + 0x2c]
call fcn.0040aa90
test eax, eax
jne 0x40cd34
mov eax, dword [esp + 0xc]
mov ecx, dword [eax - 0xc]
test ecx, ecx
jne 0x40ccbe
lea ecx, [esp + 0x10]
call fcn.00403ae0
lea ecx, [esp + 0xc]
call fcn.00403ae0
lea ecx, [esp + 0x20]
call fcn.0040b780
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10
ret 8
mov ecx, dword [esp + 0x14]
add ecx, 0xfffffffe
push ecx
lea ecx, [esp + 0x10]
call fcn.00403a80
cmp al, 0x5c
lea ecx, [esp + 0xc]
push 0x41f434
je 0x40cce8
call fcn.00404730
mov edx, dword [esp + 0x24]
push edx
jmp 0x40ccf2
call fcn.00404730
mov eax, dword [esp + 0x24]
push eax
lea ecx, [esp + 0x10]
call fcn.00404730
mov edi, dword [esp + 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40cd38
lea ecx, [esp + 0x10]
call fcn.00403ae0
lea ecx, [esp + 0xc]
call fcn.00403ae0
lea ecx, [esp + 0x20]
call fcn.0040b780
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10
ret 8
mov edi, dword [esp + 0xc]
lea eax, [esi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd52
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
lea eax, [edi - 0x10]
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x40cd6c
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
test ebp, ebp
je 0x40cd77
push ebp
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10
ret 8