joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407487
Capabilities:
Get file size

Disassembly:
push ebx
push esi
push edi
xor ebx, ebx
mov edi, edx
push ebx
push 0x80
push 3
push ebx
push 3
push 0x80000000
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4074be
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x4074be
mov dword [edi], eax
mov bl, 1
test esi, esi
je 0x4074c9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov al, bl
pop ebx
ret

Function at 0x409265
Capabilities:
Delete directory
Delete file

Disassembly:
push 0x24
mov eax, 0x432a44
call fcn.0041e952
mov edi, ecx
mov dword [ebp - 0x14], edi
cmp byte [edi + 0xc0], 0
je 0x4093dc
cmp byte [edi + 0xd8], 0
jne 0x4093dc
xor ebx, ebx
inc ebx
cmp dword [edi + 0x90], 3
je 0x4092bd
call fcn.00409e38
mov eax, dword [edi + 0x90]
cmp eax, 2
je 0x4092bd
cmp eax, ebx
je 0x4092bd
test byte [edi + 0x44], 0x48
je 0x4092bd
mov ecx, edi
call fcn.004094ac
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], bl
mov ebx, ecx
mov eax, dword [edi + 0xa8]
mov dword [ebp - 0x18], eax
test eax, eax
jle 0x40932b
lea eax, [edi + 0xa4]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x10], eax
push ebx
mov ecx, eax
call fcn.0040325c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x409320
mov ecx, dword [ebp - 0x10]
push ebx
call fcn.0040325c
push eax
lea ecx, [ebp - 0x30]
call fcn.004032bc
mov eax, dword [ebp - 0x10]
inc ebx
cmp ebx, edi
jl 0x4092f2
mov edi, dword [ebp - 0x14]
mov ebx, dword [edi + 0xb4]
sub ebx, 1
js 0x409376
lea eax, [edi + 0xb0]
mov dword [ebp - 0x18], eax
mov edi, eax
push ebx
mov ecx, edi
call fcn.0040325c
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x40936e
push ebx
mov ecx, edi
call fcn.0040325c
push eax
lea ecx, [ebp - 0x24]
call fcn.004032bc
sub ebx, 1
jns 0x409341
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0xa4]
call fcn.0040a6ce
lea ebx, [edi + 0xb0]
mov ecx, ebx
call fcn.00403283
mov esi, dword [ebp - 0x20]
jmp 0x4093a8
push esi
lea ecx, [ebp - 0x24]
call fcn.0040325c
push eax
mov ecx, ebx
call fcn.004032bc
sub esi, 1
jns 0x409397
cmp dword [edi + 0xa8], 0
jne 0x4093c4
cmp dword [edi + 0xb4], 0
jne 0x4093c4
xor eax, eax
inc eax
jmp 0x4093c6
xor eax, eax
lea ecx, [ebp - 0x24]
mov byte [edi + 0xd8], al
call fcn.00403283
lea ecx, [ebp - 0x30]
call fcn.00403283
call fcn.0041e92c
ret
Function at 0x409e38
Capabilities:
Delete file

Disassembly:
push 0x1c
mov eax, 0x432c37
call fcn.0041e952
mov edi, ecx
test byte [edi + 0x44], 1
je 0x409e56
test byte [edi + 0x44], 0x40
je 0x409f97
mov eax, dword [edi + 0x7c]
xor ebx, ebx
mov dword [ebp - 0x1c], eax
test eax, eax
jle 0x409f97
lea eax, [edi + 0x78]
push ebx
mov ecx, eax
call fcn.0040a5d0
mov esi, eax
cmp byte [esi + 0x1c], 0
je 0x409f8a
cmp dword [esi], 1
je 0x409eaf
cmp dword [esi], 3
je 0x409eaf
cmp dword [esi], 7
je 0x409eaf
cmp dword [esi], 8
je 0x409eaf
cmp dword [esi], 0x64
jb 0x409ed6
mov eax, dword [edi + 0x90]
cmp eax, 2
je 0x409f8a
cmp eax, 5
jne 0x409ed6
jmp 0x409f8a
mov eax, dword [edi + 0x90]
cmp eax, 4
je 0x409ed6
cmp eax, 2
je 0x409f8a
cmp eax, 1
je 0x409f8a
test byte [esi + 8], 1
jne 0x409f8a
push dword [esi + 4]
mov ecx, edi
call fcn.0040a54a
mov dword [ebp - 0x14], eax
mov ecx, dword [eax]
sub ecx, 0x10
call fcn.00404554
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
mov eax, dword [esi + 0x18]
push dword [eax - 0xc]
push eax
call fcn.00403d7b
mov esi, dword [ebp - 0x10]
cmp dword [esi - 4], 1
jle 0x409f1d
push dword [esi - 0xc]
lea ecx, [ebp - 0x10]
call fcn.00403fdd
mov esi, dword [ebp - 0x10]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x409f5a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x20
jne 0x409f5a
push 0
push ecx
lea ecx, [ebp - 0x28]
call fcn.00401d11
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 1
push eax
lea ecx, [ebp - 0x28]
call fcn.00401d40
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 0
call fcn.00401de1
lea edx, [ebp - 0x10]
lea ecx, [ebp - 0x18]
call fcn.004069fe
mov edx, dword [ebp - 0x14]
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00406e01
mov ecx, dword [ebp - 0x18]
lea ecx, [ecx - 0x10]
call fcn.004045ed
or dword [ebp - 4], 0xffffffff
lea ecx, [esi - 0x10]
call fcn.004045ed
inc ebx
lea eax, [edi + 0x78]
cmp ebx, dword [ebp - 0x1c]
jl 0x409e69
call fcn.0041e92c
ret

Function at 0x40ab1c
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
or dword [ebp - 0x14], 0xffffffff
push esi
push edi
xor edi, edi
mov dword [ebp - 0x10], eax
push edi
push edi
mov esi, 0x4431c0
mov dword [ebp - 0x18], edi
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call fcn.004150d5
mov ecx, dword [ebp - 0x18]
call fcn.0040a942
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], edi
je 0x40ab9e
push dword [ebp - 0x14]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp dword [ebp - 0x14], 0xffffffff
je 0x40ab95
lea eax, [ebp + 8]
mov dword [ebp + 8], edi
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x40ab95
cmp dword [ebp + 8], 0x103
jne 0x40ab95
push edi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x40ad5e
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x2c
mov eax, dword [0x44a078]
xor eax, esp
mov dword [esp + 0x24], eax
push ebp
push esi
mov ebp, ecx
push 2
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
xorps xmm0, xmm0
lea eax, [esp + 0x1c]
push eax
push esi
movups xmmword [esp + 0x24], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
xor eax, eax
cmp byte [ebp + 0x2c], al
push 5
pop ecx
cmovne eax, ecx
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
push 0
push esi
call dword [sym.imp.USER32.dll_InvalidateRect]
push 0x3e9
push dword [ebp + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
lea ecx, [esp + 0xc]
mov dword [esp + 8], eax
push ecx
xorps xmm0, xmm0
push eax
movups xmmword [esp + 0x14], xmm0
call dword [sym.imp.USER32.dll_GetWindowRect]
cmp dword [ebp + 0x30], 0
jne 0x40ade2
mov eax, dword [esp + 0x14]
mov dword [ebp + 0x30], eax
cmp byte [ebp + 0x2c], 0
je 0x40aded
mov eax, dword [ebp + 0x30]
jmp 0x40adf1
mov eax, dword [esp + 0x24]
mov dword [esp + 0x14], eax
lea eax, [esp + 0xc]
push 0x206
push eax
push ecx
lea ecx, [esp + 0x14]
call fcn.0040b09f
mov ecx, dword [esp + 0x2c]
pop esi
pop ebp
xor ecx, esp
call fcn.0041df7e
add esp, 0x2c
ret

Function at 0x40b266
Capabilities:
Read file on windows

Disassembly:
push 0x20
mov eax, 0x432d5c
call fcn.0041e952
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax - 0xc], 0
jne 0x40b287
xor eax, eax
jmp 0x40b33c
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 4], ebx
push 2
pop esi
cmp edi, 0xffffffff
je 0x40b32f
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x20]
and dword [ebp - 0x20], 0
sub ebx, esi
push 0
push eax
push esi
push edi
mov dword [ebp - 0x24], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40b32f
mov eax, ebx
lea ecx, [ebp + 8]
shr eax, 1
push eax
push 0x78
call fcn.004077ac
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
cmp dword [eax - 4], 1
jle 0x40b2fc
push dword [eax - 0xc]
lea ecx, [ebp + 8]
call fcn.00403fdd
mov eax, dword [ebp + 8]
push 0
lea ecx, [ebp - 0x14]
push ecx
push ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40b324
cmp dword [ebp - 0x14], 0
je 0x40b324
mov ecx, dword [ebp - 0x18]
lea eax, [ebp + 8]
push eax
call fcn.0040c645
movzx esi, al
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.004045ed
test edi, edi
je 0x40b33a
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
call fcn.0041e92c
ret 0xc
Function at 0x40c2fb
Capabilities:
Print debug messages

Disassembly:
push 0xc
mov eax, 0x432e20
call fcn.0041e952
mov esi, ecx
cmp byte [0x44be08], 0
je 0x40c341
lea ecx, [ebp - 0x14]
call fcn.0040d2f1
and dword [ebp - 4], 0
mov ecx, eax
push dword [esi]
call fcn.0040d305
push eax
mov ecx, 0x44bdd8
call fcn.0040f355
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004045ed
cmp byte [0x44a8c0], 0
push dword [esi]
je 0x40c39d
lea ecx, [ebp - 0x14]
call fcn.00404200
mov dword [ebp - 4], 1
call fcn.00404409
push eax
lea ecx, [ebp - 0x10]
call fcn.0040385f
push 0x10
lea eax, [ebp - 0x10]
mov byte [ebp - 4], 2
push eax
call dword [sym.imp.USER32.dll_GetActiveWindow]
lea edx, [ebp - 0x14]
mov ecx, eax
call fcn.00414a18
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.004045ed
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.004045ed
jmp 0x40c3a3
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.0041e92c
ret
Function at 0x40dcc3
Capabilities:
Create process on windows
Delete file
Get common file path
Write and execute a file
Write file on windows

Disassembly:
push 0x4c0
mov eax, 0x4331b7
call fcn.0041e986
mov dword [ebp - 0x4c4], ecx
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x424]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x4c0], eax
test eax, eax
je 0x40dedd
lea eax, [ebp - 0x21c]
xor ebx, ebx
push eax
push ebx
push 0x4418c0
lea eax, [ebp - 0x424]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
je 0x40dedd
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.00404200
push str..url
lea ecx, [ebp - 0x4b0]
mov dword [ebp - 4], ebx
call fcn.004036da
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
push dword [ebp - 0x4b0]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
mov dword [ebp - 0x4c8], ebx
mov dword [ebp - 0x4cc], edi
or ebx, 0xffffffff
mov byte [ebp - 4], 1
cmp edi, ebx
je 0x40dec4
call fcn.00404409
push eax
lea ecx, [ebp - 0x4b8]
call fcn.0040385f
mov byte [ebp - 4], 2
lea eax, [ebp - 0x4a8]
push 3
push dword [esi]
lea ecx, [ebp - 0x4ac]
mov dword [ebp - 0x4ac], eax
call fcn.0040e7d5
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x4bc]
push dword [ebp - 0x4ac]
call fcn.004033f8
lea eax, [ebp - 0x4a8]
mov byte [ebp - 4], 5
cmp dword [ebp - 0x4ac], eax
je 0x40ddec
push dword [ebp - 0x4ac]
call fcn.004223ea
pop ecx
push dword [ebp - 0x4bc]
lea eax, [ebp - 0x4b8]
push str._InternetShortcut__r_nURL_s_r_n
push eax
call fcn.00403a50
mov esi, dword [ebp - 0x4b8]
lea eax, [ebp - 0x4c0]
add esp, 0xc
push 0
push eax
push dword [esi - 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x4b4], eax
test edi, edi
je 0x40de3f
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x4b4]
xor edi, edi
mov dword [ebp - 0x4cc], edi
test eax, eax
je 0x40de5c
push 5
push 0
push 0
push dword [ebp - 0x4b0]
push 0x43f394
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
push 0x5c
push dword [ebp - 0x4b0]
call fcn.00420a94
pop ecx
pop ecx
test eax, eax
je 0x40de79
mov ebx, eax
sub ebx, dword [ebp - 0x4b0]
sar ebx, 1
push ebx
lea eax, [ebp - 0x4b4]
push eax
lea ecx, [ebp - 0x4b0]
call fcn.0040762c
mov edx, dword [ebp - 0x4c4]
mov ecx, eax
add edx, 0x1c
mov byte [ebp - 4], 6
call fcn.00406e01
mov ecx, dword [ebp - 0x4b4]
lea ecx, [ecx - 0x10]
call fcn.004045ed
mov ecx, dword [ebp - 0x4bc]
lea ecx, [ecx - 0x10]
call fcn.004045ed
lea ecx, [esi - 0x10]
call fcn.004045ed
test edi, edi
je 0x40decf
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0x4b0]
lea ecx, [ecx - 0x10]
call fcn.004045ed
call fcn.0041e941
ret 4
Function at 0x40f100
Capabilities:
Create thread

Disassembly:
push 0xc
mov eax, 0x43277d
call fcn.0041e952
mov esi, ecx
mov dword [ebp - 0x14], esi
mov edx, dword [0x44ade0]
lea ebx, [esi + 4]
push ecx
mov ecx, dword [ebx]
call fcn.004149c8
mov ecx, ebx
call fcn.0040b0c6
mov eax, dword [esi + 0x28]
mov edi, dword [sym.imp.USER32.dll_SetWindowTextW]
push dword [eax]
push dword [ebx]
call edi
call fcn.00404409
push eax
lea ecx, [ebp - 0x10]
call fcn.0040385f
and dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
push 0xdc
call fcn.00403f6a
push 0x40a
push dword [ebx]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, dword [ebp - 0x10]
push esi
push eax
call edi
mov edi, dword [ebp - 0x14]
push dword [ebx]
lea ecx, [edi + 0x40]
call fcn.00419f05
lea eax, [ebp - 0x18]
xor ecx, ecx
push eax
push ecx
lea eax, [edi + 0x30]
push eax
push 0x40f1a5
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [esi - 0x10]
mov dword [edi + 0x38], eax
call fcn.004045ed
xor eax, eax
call fcn.0041e92c
ret 0x10

Function at 0x40f473
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x21c
mov eax, dword [0x44a078]
xor eax, esp
mov dword [esp + 0x214], eax
push ebx
push ebp
mov ebx, ecx
xor ebp, ebp
push esi
push edi
lea esi, [ebx + 0x28]
cmp dword [esi], ebp
jne 0x40f5be
lea edi, [ebx + 0x20]
mov eax, dword [edi]
cmp dword [eax - 0xc], ebp
jne 0x40f50c
mov ebp, 0x208
lea eax, [esp + 0x18]
push ebp
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
add eax, eax
cmp eax, ebp
jae 0x40f5d7
xor ecx, ecx
mov word [esp + eax + 0x18], cx
lea eax, [esp + 0x18]
push eax
mov ecx, edi
call fcn.004041d8
push 0x2e
push dword [edi]
call fcn.00420a94
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x40f4ea
or ecx, 0xffffffff
jmp 0x40f4ee
sub ecx, dword [edi]
sar ecx, 1
mov eax, dword [edi]
mov eax, dword [eax - 0xc]
sub eax, ecx
push eax
push ecx
mov ecx, edi
call fcn.00403595
push str..log
mov ecx, edi
call fcn.004036da
xor ebp, ebp
push ebp
push 0x80
push 4
push ebp
push 3
push 0xc0000000
push dword [edi]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
mov ecx, esi
call fcn.0040a772
cmp dword [esi], 0xffffffff
je 0x40f5b6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40f555
cmp dword [esi], 0
je 0x40f588
push 2
push ebp
push ebp
push dword [esi]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x40f588
test eax, eax
jne 0x40f5b6
cmp dword [esi], eax
je 0x40f5b6
push 2
pop ecx
push ebp
lea eax, [esp + 0x18]
mov dword [esp + 0x14], 0xfeff
push eax
push ecx
lea eax, [esp + 0x1c]
mov dword [esp + 0x20], ecx
push eax
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [esi], ebp
je 0x40f5be
lea eax, [ebx + 0x24]
mov ecx, ebx
push eax
call fcn.0040f5dd
lea ecx, [esp + 0x10]
call fcn.0040f60c
push eax
mov ecx, ebx
call fcn.0040f5dd
mov ecx, dword [esp + 0x10]
lea ecx, [ecx - 0x10]
call fcn.004045ed
jmp 0x40f5be
push ebp
mov ecx, esi
call fcn.0040a772
mov ecx, dword [esp + 0x224]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041df7e
add esp, 0x21c
ret
call fcn.0041e5ae
int3
Function at 0x40f5dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push 0
mov esi, ecx
mov edx, dword [eax]
lea eax, [ebp + 8]
push eax
mov eax, dword [edx - 0xc]
add eax, eax
push eax
push edx
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [esi + 0x28]
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
pop esi
pop ebp
ret 4
Function at 0x410c88
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x44a078]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.0041295d
test al, al
jne 0x410d59
push str.ProgramFilesFolder
mov ecx, edi
call fcn.00403621
mov esi, str.AppDataFolder
test eax, eax
je 0x410cdd
mov edx, str.ProgramFiles
mov ecx, edi
call fcn.00410d96
test al, al
jne 0x410cdd
push esi
mov ecx, edi
call fcn.00403621
test eax, eax
jne 0x410d59
push esi
mov ecx, edi
call fcn.00403621
neg eax
mov ecx, str.PROGRAMFILES
push 0
sbb al, al
add al, 1
pop eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
mov eax, str.APPDATA
cmove eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov esi, eax
test esi, esi
je 0x410d27
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x210], ax
inc esi
lea eax, [esi + esi]
cmp eax, 0x208
jae 0x410d6b
xor ecx, ecx
mov word [ebp + eax - 0x210], cx
cmp word [ebp - 0x210], cx
je 0x410d52
lea eax, [ebp - 0x210]
mov ecx, edi
push eax
call fcn.004041d8
test esi, esi
setne al
jmp 0x410d5b
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041df7e
mov esp, ebp
pop ebp
ret
call fcn.0041e5ae
int3
Function at 0x411870
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x1c
mov eax, 0x4339e7
call fcn.0041e952
mov ecx, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, dword [ecx]
sub ecx, 0x10
call fcn.00404554
lea esi, [eax + 0x10]
mov dword [ebp - 0x20], esi
mov dword [ebp - 4], edi
cmp byte [ebp + 0xc], 0
je 0x4118b8
push 0x5c
push esi
call fcn.00420a94
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x4118b2
or ebx, 0xffffffff
jmp 0x4118bb
sub ebx, esi
sar ebx, 1
jmp 0x4118bb
mov ebx, dword [esi - 0xc]
cmp byte [ebp + 0xc], 0
je 0x4118dc
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040343c
mov ecx, eax
xor eax, eax
inc eax
mov byte [ebp - 4], al
mov edi, dword [ebp - 0x14]
jmp 0x4118f3
lea ecx, [esi - 0x10]
call fcn.00404554
lea edi, [eax + 0x10]
mov dword [ebp - 0x14], edi
push 2
pop eax
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], eax
mov dl, byte [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
call fcn.00411fc3
and dword [ebp - 0x18], 0
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], 3
mov eax, dword [ebp - 0x10]
test al, 2
je 0x411927
and eax, 0xfffffffd
lea ecx, [edi - 0x10]
mov dword [ebp - 0x10], eax
call fcn.004045ed
mov eax, dword [ebp - 0x10]
mov byte [ebp - 4], 5
test al, 1
je 0x41193a
mov ecx, dword [ebp - 0x24]
lea ecx, [ecx - 0x10]
call fcn.004045ed
mov edi, dword [ebp - 0x1c]
test edi, edi
jne 0x411949
xor ebx, ebx
inc ebx
jmp 0x411a1a
cmp byte [ebp + 0xc], 0
jne 0x41195f
push dword [ebp + 0x14]
push edi
call fcn.00411aef
xor ebx, ebx
jmp 0x411a1a
call fcn.00404409
push eax
lea ecx, [ebp + 0xc]
call fcn.0040385f
mov ecx, dword [ebp + 8]
lea eax, [ebx + 1]
push eax
lea eax, [ebp - 0x14]
mov byte [ebp - 4], 6
push eax
call fcn.00407673
mov ebx, eax
lea eax, [ebp + 0x10]
mov byte [ebp - 4], 7
and dword [ebp + 0x10], 0
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push dword [ebx]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp + 8], eax
cmp eax, 0xea
jne 0x4119e6
push dword [ebp + 0x10]
lea ecx, [ebp + 0xc]
call fcn.004040d3
mov edi, dword [ebx]
lea eax, [ebp + 0x10]
push eax
lea ecx, [ebp + 0xc]
call fcn.004036c3
push eax
lea eax, [ebp - 0x24]
push eax
push 0
push edi
mov edi, dword [ebp - 0x1c]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push ecx
lea ecx, [ebp + 0xc]
mov dword [ebp + 8], eax
call fcn.00404244
mov eax, dword [ebp + 8]
mov byte [ebp - 4], 6
xor ebx, ebx
mov ecx, dword [ebp - 0x14]
test eax, eax
setne bl
lea ecx, [ecx - 0x10]
call fcn.004045ed
mov eax, dword [ebp + 8]
test eax, eax
jne 0x411a0f
mov ecx, dword [ebp + 0x14]
lea eax, [ebp + 0xc]
push eax
call fcn.004032bc
mov ecx, dword [ebp + 0xc]
lea ecx, [ecx - 0x10]
call fcn.004045ed
test edi, edi
je 0x411a25
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
call fcn.004045ed
mov eax, ebx
call fcn.0041e92c
ret 0x10
Function at 0x411ba7
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push 0x294
mov eax, 0x433a9c
call fcn.0041e986
mov edi, ecx
mov dword [ebp - 0x294], edi
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x290], esi
mov dword [ebp - 0x28c], eax
xor ebx, ebx
lea ecx, [ebp + 8]
mov dword [ebp - 4], ebx
call fcn.004067be
call fcn.00404409
push eax
lea ecx, [ebp - 0x288]
call fcn.0040385f
lea eax, [ebp - 0x288]
mov byte [ebp - 4], 1
push eax
push esi
push ecx
mov esi, esp
mov dword [ebp - 0x280], esi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404554
add eax, 0x10
mov dword [esi], eax
call fcn.00411e0f
test al, al
je 0x411c71
push ecx
lea eax, [ebp - 0x288]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040fca2
push ecx
lea eax, [ebp - 0x280]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040fe26
mov ecx, dword [ebp - 0x28c]
push eax
mov byte [ebp - 4], 2
call fcn.004032bc
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.004045ed
lea eax, [ebp - 0x28]
mov ecx, edi
push eax
call fcn.00411f08
test al, al
jne 0x411dad
cmp dword [ebp + 0xc], 1
jge 0x411c7f
xor ebx, ebx
inc ebx
jmp 0x411dad
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00404554
add eax, 0x10
mov dword [ebp - 0x284], eax
push 0x440b24
lea ecx, [ebp - 0x284]
mov byte [ebp - 4], 3
call fcn.004036da
mov esi, dword [ebp - 0x284]
cmp dword [esi - 4], 1
jle 0x411cc7
push dword [esi - 0xc]
lea ecx, [ebp - 0x284]
call fcn.00403fdd
mov esi, dword [ebp - 0x284]
lea eax, [ebp - 0x27c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
mov dword [ebp - 0x29c], ebx
mov dword [ebp - 0x2a0], edi
lea eax, [ebp - 0x27c]
mov byte [ebp - 4], 4
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp edi, 0xffffffff
setne al
test al, al
je 0x411d97
lea ecx, [ebp - 0x27c]
call fcn.00411de6
test al, al
je 0x411d80
lea eax, [ebp - 0x250]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x280]
call fcn.0040f6b0
pop ecx
push dword [ebp - 0x28c]
mov eax, dword [ebp + 0xc]
push dword [ebp - 0x290]
dec eax
mov byte [ebp - 4], 5
push eax
push ecx
mov ecx, dword [ebp - 0x280]
mov edi, esp
mov dword [ebp - 0x298], edi
lea ecx, [ecx - 0x10]
call fcn.00404554
mov ecx, dword [ebp - 0x294]
add eax, 0x10
mov dword [edi], eax
call fcn.00411ba7
test eax, eax
je 0x411dd0
mov byte [ebp - 4], 4
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.004045ed
mov edi, dword [ebp - 0x2a0]
lea eax, [ebp - 0x27c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x411d03
xor ebx, ebx
inc ebx
test edi, edi
je 0x411da5
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esi - 0x10]
call fcn.004045ed
mov ecx, dword [ebp - 0x288]
add ecx, 0xfffffff0
call fcn.004045ed
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.004045ed
mov eax, ebx
call fcn.0041e941
ret 0x10
mov ecx, dword [ebp - 0x280]
lea ecx, [ecx - 0x10]
call fcn.004045ed
mov edi, dword [ebp - 0x2a0]
jmp 0x411d9a