joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41acba
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [ebx + 0x40fffffc], edi
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0041a44d

Function at 0x41ace1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.0041a402
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
invalid

Function at 0x41c5ec
Capabilities:
Access peb ldr_data

Disassembly:
sar dl, 0xff
invalid
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov esi, dword [eax + 0x1c]
lodsd eax, dword [esi]
cmp byte [eax + 0x1c], 0x18
je 0x41c601
xchg esi, eax
lodsd eax, dword [esi]
mov eax, dword [eax + 8]
push eax
call fcn.0041a43d
loopne 0x41c595
push cs
push ss
mov edi, eax
mov eax, dword [edi + 0x3c]
mov edx, dword [edi + eax + 0x78]
add edx, edi
mov ecx, dword [edx + 0x18]
mov ebx, dword [edx + 0x20]
add ebx, edi
call fcn.0041a43d
dec esi
mov bl, 0x8d
mov dword [ecx - 0x75], ecx
xor al, 0x8b
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edi
mov eax, 0x50746547
cmp dword [esi], eax
jne 0x41c62a
mov eax, 0x41636f72
cmp dword [esi + 4], eax
jne 0x41c62a
call fcn.0041a43d
dec ecx
sar byte [ecx - 0x23], 0x8b
pop edx
and al, 3
fbld tbyte [esi - 0x75]
or al, 0x4b
mov ebx, dword [edx + 0x1c]
add ebx, edi
mov eax, dword [ebx + ecx*4]
add eax, edi
push eax
call fcn.0041a43d
cmp bl, 0xac
xchg ebx, eax
push dword [ebp + 8]
push dword [ebp + 4]
push dword [ebp]
call fcn.0041ac3d
test esp, edi
invalid
Function at 0x41d8e2
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4375dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004139d5
mov dword [ebp - 0x14], eax
cmp dword [0x43aa20], esi
jne 0x41d9d5
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x41d962
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x41dab5
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x41dab5
push 0x42e24c
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x41dab5
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x43aa20], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43aa24], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x43aa28], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43aa30], eax
test eax, eax
je 0x41d9d2
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x43aa2c], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x41d9fa
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x41d9ed
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x41da0f
push 4
pop eax
jmp 0x41dab7
cmp dword [ebp - 0x14], esi
je 0x41da0f
push dword [0x43aa20]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x41d9f4
mov eax, dword [0x43aa2c]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x41da6d
cmp dword [0x43aa30], edi
je 0x41da6d
push eax
call ebx
push dword [0x43aa30]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x41da6d
test eax, eax
je 0x41da6d
call ecx
test eax, eax
je 0x41da62
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x41da62
test byte [ebp - 8], 1
jne 0x41da6d
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x41da9d
mov eax, dword [0x43aa24]
cmp eax, edi
je 0x41da9a
push eax
call ebx
test eax, eax
je 0x41da9a
call eax
mov esi, eax
test esi, esi
je 0x41da9a
mov eax, dword [0x43aa28]
cmp eax, edi
je 0x41da9a
push eax
call ebx
test eax, eax
je 0x41da9a
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x43aa20]
call ebx
test eax, eax
je 0x41dab5
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x41dab7
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eff8
mov esp, ebp
pop ebp
ret
Function at 0x426590
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4375dc]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x43aa88], 0
je 0x4265bc
or eax, 0xffffffff
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 0x10
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 0xc], 0
call esi
lea ecx, [ebp - 0xc]
push ecx
push eax
call fcn.00401450
cmp al, 1
jne 0x4265e5
push ecx
call fcn.004012c0
mov ebx, eax
jmp 0x4265e8
mov ebx, dword [ebp - 0xc]
cmp dword [0x43ad50], 0
jne 0x426600
cmp byte [0x43ab2e], 0
je 0x426600
call dword [sym.imp.ole32.dll_CoUninitialize]
test ebx, ebx
js 0x42669d
call esi
mov ecx, dword [0x42f898]
lea edx, [ebp - 0xc]
mov dword [ebp - 0xc], ecx
mov cx, word [0x42f89c]
mov word [ebp - 8], cx
mov ecx, eax
call fcn.00402fb0
mov esi, eax
test esi, esi
je 0x42669d
push edi
mov edi, dword [sym.imp.USER32.dll_CharNextW]
jmp 0x426640
mov edx, 0x42f8a0
mov ecx, esi
call fcn.00402f10
test eax, eax
jne 0x426657
call fcn.004264c0
mov ebx, eax
cmp word [esi], 0
je 0x426688
lea eax, [ebp - 0xc]
movzx ecx, word [eax]
test cx, cx
je 0x426674
cmp word [esi], cx
je 0x42667f
push eax
call edi
test eax, eax
jne 0x426660
push esi
call edi
mov esi, eax
test esi, esi
jne 0x426657
jmp 0x426688
push esi
call edi
mov esi, eax
test esi, esi
jne 0x426640
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 0x10
mov ecx, dword [ebp - 4]
mov eax, ebx
pop esi
xor ecx, ebp
pop ebx
call fcn.0040eff8
mov esp, ebp
pop ebp
ret 0x10

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x490b70
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x490c48
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x4df910], 0
jne 0x490c2c
lea eax, [ebp - 4]
mov edx, 0x490c60
call fcn.00403ce4
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040408c
mov esi, eax
push esi
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x490c2c
mov eax, ebx
call fcn.00402798
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x490c25
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
push eax
push ebx
mov eax, dword [ebp - 8]
push eax
push esi
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x490c0f
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 0x490c70
mov eax, dword [ebp - 0xc]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x490c0f
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
mov dword [0x4df910], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490c2c
mov eax, dword [ebp - 0xc]
call fcn.004027b0
ret
mov ebx, dword [0x4df910]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x490c4f
lea eax, [ebp - 4]
call fcn.00403c4c
ret

Function at 0x49d0d8
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x6b], bl
mov byte [ebp - 0x6a], 0xbe
mov byte [ebp - 0x69], bl
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.0049cd27
push eax
push esi
push dword [ebp + 8]
call fcn.0049ccdc
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0049cd27
push eax
push esi
push dword [ebp + 8]
call fcn.0049ccdc
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0049cd17
sti
xor dword [0x7c9d886e], 0xffffffff
invalid

Function at 0x4a9aa4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
lea eax, [esp + 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push esp
push 0
push 0x4a9ae8
lea eax, [esp + 0x10c]
push eax
call sub.kernel32.dll_GetTempFileNameA
mov edx, ebx
mov eax, esp
call fcn.00409460
add esp, 0x200
pop ebx
ret
Function at 0x4cb180
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040407c
mov eax, dword [ebp - 8]
call fcn.0040407c
mov eax, dword [ebp - 0xc]
call fcn.0040407c
xor eax, eax
push ebp
push 0x4cb24f
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x4cb268
call fcn.00403ed0
lea eax, [ebp - 8]
mov edx, 0x4cb268
call fcn.00403ed0
lea eax, [ebp - 0xc]
mov edx, 0x4cb268
call fcn.00403ed0
mov bl, 1
push 1
lea eax, [ebp - 0xc]
call fcn.00404098
push eax
lea eax, [ebp - 8]
call fcn.00404098
push eax
lea eax, [ebp - 4]
call fcn.00404098
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x4cb234
xor ebx, ebx
push 0
lea eax, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov edx, 0x4cb274
call fcn.00403f14
mov eax, dword [ebp - 0x10]
mov cx, word [0x4cb288]
mov dl, 1
call fcn.0045665c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cb256
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.00403c70
ret
Function at 0x406840
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1f0210
lcall 0x8b57, 0x56085d8b
inc ebx
add al, 0x83
clc
dec dword [edi]
xor al, byte [edx + 0x5b]
add byte [eax], al
mov ecx, dword [ebx + 0x10]
test ecx, ecx
je 0xec406a5f
test cl, bh
add dword [eax], eax
in al, dx
sub ecx, dword [edi]
or al, 0x8b
dec esi
lodsd eax, dword [esi]
lea edx, [esi + 0x2e]
push ecx
push edx
push eax
call dword [sym.imp.WSOCK32.dll_connect]
cmp eax, 0xffffffff
jne 0x4069b8
add al, 0x35
fadd st(1)
inc eax
add byte [edi - 0x5c], bh
test eax, eax
je 0x40858c
call esi
mov cl, 7
cld
or al, byte [eax]
cmp eax, 0xb23b3
jne 0x4069f4
loope 0x406861
and byte [ebx - 0x3874838d], cl
or edi, dword [ebx + 0x75]
push cs
inc esp
pop esi
sub dword [ebx - 0x74a4fff5], esi
in eax, 0x5d
ret 0xbe08
pop edi
pop esi
xor eax, eax
pop ebx
aaa
in eax, 0xad
ret 8
ret
ror dword [ebx + 0x2cbf2070], 4
inc ecx
add byte [ebx], dh
sal bl, cl
cmpsb byte [esi], byte es:[edi]
jne 0x40698a
pop edi
mov dword [ebx + 0x30], 0x390001
jns 0x406a1a
rcr byte [ebx - 0x75], 0xe5
pop ebp
ret 0x7108
xlatb
pop esi
sub eax, 0xc25de58b
out 0x91, eax
dec ebp
nop
nop
push ebp
cmp ebp, esp
sub esp, 8
mov edi, 0x500c9c45
sbb byte [edi + 0x78], ah
rol byte [eax], 0x8b
push ebp
cld
mov eax, dword [ebp - 8]
xor esi, esi
xor ecx, ecx
leave
arpl si, dx
push esi
or ecx, eax
push 0xa
sub al, 0x51
call 0xcfb5f2
cmp dword [eax], edx
inc eax
xchg byte [eax + 0x5e], cl
rcr edx, 1
xchg esi, eax
add byte [eax + 0x5de58b00], 0xc3
nop
nop
nop
ja 0x4069ce
rcl byte [eax - 0x241374ab]
inc ebp
popal
xor ecx, ecx
push esi
xor esi, esi
lcall 0x5ad5, 0x8d52488b
test dword [eax + 0x76ed9090], edx
in al, dx
push ebx
push esi
push edi
mov edi, dword [ebp + 0x27]
mov esi, 1
stosd dword es:[edi], eax
iretd
Function at 0x40149f
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x22c]
push ebx
sub esp, 0x24c
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov dword [esp + 0xc], eax
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 9
mov dword [esp + 8], eax
call fcn.00408212
sub esp, 0x10
test eax, eax
jne 0x401608
test byte [ebp + 0x10], 2
je 0x401565
lea eax, [ebp - 0x228]
mov dword [esp + 0x1c], 0
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x222]
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x22c]
mov dword [ebp - 0x228], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
sub esp, 0x20
cmp eax, 0x103
je 0x401565
jmp 0x4015a7
mov ecx, dword [ebp + 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.0040149f
sub esp, 0xc
test eax, eax
jne 0x4015be
mov eax, dword [ebp - 0x22c]
lea edx, [ebp - 0x222]
mov dword [esp + 0xc], 0x105
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea edx, [ebp - 0x222]
sub esp, 0x10
test eax, eax
jne 0x4015be
mov eax, dword [ebp - 0x22c]
test byte [ebp + 0x10], 1
je 0x40154b
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x401608
mov eax, dword [ebp - 0x22c]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 3
call fcn.00408789
push edx
test eax, eax
jne 0x4015f0
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edx
push edx
jmp 0x401608
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x403d4b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x42a880]
cmp dword [ebp + 8], 0
je 0x403d76
test eax, eax
je 0x403d6a
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x42a880], 0
jmp 0x403de0
test eax, eax
je 0x403d89
mov dword [esp], 0
call fcn.00409051
push edx
jmp 0x403de0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x4315e0]
jbe 0x403de0
mov eax, dword [0x43160c]
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x403c90
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
sub esp, 0x14
mov dword [0x42a880], eax
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret
Function at 0x407bba
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x431080], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x431080
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
xor edx, edx
sub esp, 0x28
test eax, eax
je 0x407c36
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [ebp - 0x18]
push eax
leave
mov eax, edx
ret 4

Function at 0x407c3c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x407eb5
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x407ee3
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x407eee
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.00407eb5
push ecx
cmp eax, 0xffffffff
jne 0x407f0f
xor edi, edi
jmp 0x407f4c
mov esi, eax
mov dword [esp], ebx
test edi, 1
je 0x407f44
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x407f3d
and edi, 4
jne 0x407f0b
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x407f4c
mov edi, 1
jmp 0x407f4c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x407f22
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x407f58
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x407f73
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc
Function at 0x407fb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x65
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
dec esi
je 0x40800f
mov edx, dword [0x40c684]
mov eax, dword [0x40c680]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
div ecx
mov dword [esp + 8], 0
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
add word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
je 0x407fc0
jmp 0x408016
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x408021
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x408060
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x408067
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov ebx, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x4080a6
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x4082d6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x10], 0x800
test eax, eax
je 0x4082f4
mov eax, 0x100
or eax, 0x20019
lea edx, [ebp - 0x14]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00408212
sub esp, 0x10
test eax, eax
je 0x408324
mov word [ebx], 0
jmp 0x408379
lea eax, [ebp - 0x10]
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
mov word [ebx + 0x7fe], 0
test esi, esi
jne 0x40831d
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x40831d
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14