joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4253b7
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.004253b7
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push 0
lea ebx, [ebp + 8]
push ebx
call fcn.0042501c
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x4253f7
mov dword [ebp - 0x98], 1
jmp 0x425465
lea ebx, [ebp + 8]
push ebx
call dword [sym.imp.KERNEL32.DLL_RemoveDirectoryA]
fldcw word [ebp - 0x10]
test eax, eax
je 0x42541b
mov dword [ebp - 0x98], 1
jmp 0x425465
push 0
lea ebx, [ebp + 8]
add ebx, 0x100
mov ecx, 0x41
push dword [ebx]
sub ebx, 4
dec ecx
jne 0x42542b
call fcn.004250f8
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x425465
lea ebx, [ebp + 8]
add ebx, 0x100
mov ecx, 0x41
push dword [ebx]
sub ebx, 4
dec ecx
jne 0x425452
call fcn.00425482
mov dword [ebp - 0x98], eax
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104

Function at 0x425482
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00425482
xor esi, esi
mov ecx, 0xd
push esi
dec ecx
jne 0x42549c
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov eax, 1
call fcn.00454296
mov edx, 0x18609d8
call fcn.0045d0ba
call fcn.0045c602
jne 0x4254fe
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov ecx, 1
mov eax, 1
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov dword [ebp - 0x30], eax
call fcn.0045d088
sub eax, dword [ebp - 0x30]
call fcn.00454232
lea ebx, [ebp + 8]
mov ecx, 0x104
call fcn.0045ced6
mov word [ebp - 0xa8], 0x414
mov dword [ebp - 0xa0], 0
mov dword [ebp - 0xb8], 0
mov dword [ebp - 0x9c], 0
mov dword [ebp - 0xb4], 3
lea ebx, [ebp + 8]
mov eax, ebx
mov dword [ebp - 0xb0], eax
mov dword [ebp - 0xac], 0
push 0
lea ebx, [ebp - 0xb8]
push ebx
call dword [sym.imp.SHELL32.DLL_SHFileOperationA]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x425568
mov dword [ebp - 0x98], 1
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x425856
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00425856
xor esi, esi
xor edi, edi
mov ecx, 0x4a
push esi
dec ecx
jne 0x425872
mov esi, 0x41
nop
nop
nop
nop
push 0
push 0x1000
lea ebx, [ebp - 0x1a4]
push ebx
push 0
mov eax, esi
call fcn.0045004c
call fcn.0044fffd
mov edx, 0x18609e8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp + 8]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_QueryDosDeviceA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
test eax, eax
je 0x425961
lea ebx, [ebp - 0x1a4]
call fcn.0045ce8d
xor eax, eax
call fcn.00452fc5
lea ebx, [ebp - 0x1a4]
mov ecx, 0x104
call fcn.0045ced6
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov eax, 1
lea ebx, [ebp - 0x1a4]
call fcn.0045ce8d
call fcn.004512ed
test eax, eax
je 0x425961
lea ebx, [ebp - 0x1a4]
call fcn.0045ce8d
push 0
mov eax, esi
call fcn.0045004c
call fcn.0044fffd
mov edx, 0x18609e8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp + 8]
push ebx
call fcn.0045ce8d
call fcn.0045ab3c
pop ebx
mov ecx, 0x104
call fcn.0045ced6
jmp 0x42596c
inc esi
cmp esi, 0x5a
jle 0x425880
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x98]
call fcn.0045c2a9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x427207
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00427207
xor esi, esi
xor edi, edi
mov ecx, 0xd
push esi
dec ecx
jne 0x427223
mov edx, dword [ebp + 8]
call fcn.0045d0a3
mov ecx, 1
mov eax, 8
call fcn.00454232
lea ebx, [ebp - 0xa0]
mov ecx, 9
call fcn.0045ced6
mov edx, dword [ebp + 8]
call fcn.0045d0a3
mov eax, 5
mov edx, dword [ebp + 8]
call fcn.0045d0a3
mov ecx, 1
mov edx, 0x1862f88
call fcn.0045d0ba
xchg ecx, eax
call fcn.004512ed
add eax, ecx
mov ecx, eax
mov eax, 0x7fffffff
call fcn.00454232
lea ebx, [ebp + 8]
call fcn.0045c2a9
mov edx, dword [ebp + 8]
call fcn.0045d0a3
call fcn.0045d088
mov esi, eax
push 0
lea ebx, [ebp - 0xa0]
call fcn.0045ce8d
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
call fcn.0045ad27
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ebx, esp
mov eax, dword [ebx]
call fcn.00457d88
add esp, 4
fldcw word [ebp - 0x10]
fild dword [0x186d738]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
call fcn.0045c1ac
ficomp dword [0x186d6a4]
fnstsw ax
sahf
jne 0x427489
fild dword [0x186d738]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
call fcn.0045c195
fistp qword [ebp - 0x6c]
mov edi, dword [ebp - 0x6c]
mov dword [ebp - 0xb8], edi
mov dword [ebp - 0xac], 1
jmp 0x427477
fild dword [0x186d738]
fild dword [0x186d6e4]
mov eax, dword [ebp - 0xac]
call fcn.0045c27b
fsubrp st(1)
fmulp st(1)
lea ebx, [ebp + 8]
call fcn.0045d1af
mov eax, ebx
call fcn.0045c27b
faddp st(1)
fistp qword [ebp - 0x6c]
mov ebx, dword [ebp - 0x6c]
mov eax, dword [ebx]
mov dword [ebp - 0xb0], eax
push 0
lea ebx, [ebp - 0xa0]
call fcn.0045ce8d
mov eax, dword [ebp - 0xb0]
call fcn.0045c27b
call fcn.0045ad27
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_OutputDebugStringA]
mov ebx, esp
mov eax, dword [ebx]
call fcn.00457d88
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0xa0]
call fcn.0045ce8d
lea ebx, [ebp - 0x50]
call fcn.0045c323
mov edx, 0x1862f94
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x427402
mov eax, dword [ebp - 0x50]
call fcn.00457d88
push dword [ebp - 0xb0]
call fcn.0041a1fb
jmp 0x427471
mov edx, 0x1862fa4
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x427437
mov eax, dword [ebp - 0x50]
call fcn.00457d88
push dword [ebp - 0xb0]
call fcn.0041a311
jmp 0x427471
mov edx, 0x1862fb4
call fcn.0045d0ba
mov edx, dword [ebp - 0x50]
call fcn.0045d0a3
call fcn.0045c602
jne 0x427469
mov eax, dword [ebp - 0x50]
call fcn.00457d88
push dword [ebp - 0xb0]
call fcn.0041a286
jmp 0x427471
mov eax, dword [ebp - 0x50]
call fcn.00457d88
inc dword [ebp - 0xac]
mov eax, dword [ebp - 0xac]
cmp eax, dword [ebp - 0xb8]
jbe 0x427340
call fcn.0045cf2c
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42b556
Capabilities:
Copy file
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042b556
xor esi, esi
xor edi, edi
mov ecx, 0x99
push esi
dec ecx
jne 0x42b572
push 0
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186359c
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp + 4]
call fcn.0045c36b
call dword [sym.imp.ZLIBWAPI.DLL_zipOpen]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov edi, eax
mov eax, edi
test eax, eax
je 0x42b756
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x1863508
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x2e4]
mov ecx, 0x104
call fcn.0045ced6
push 0
lea ebx, [ebp - 0x1e0]
push ebx
lea ebx, [ebp - 0x2e4]
call fcn.0045ce8d
mov edx, 0x1862af8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp + 4]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov dword [ebp - 0xa0], eax
fild qword [0x186cd80]
mov eax, dword [ebp - 0xa0]
call fcn.0045c27b
fcompp
fnstsw ax
sahf
je 0x42b748
nop
fild dword [0x186cd30]
fild dword [0x186cd30]
mov eax, dword [ebp - 0x1e0]
call fcn.0045c27b
call fcn.0045c106
fcompp
fnstsw ax
sahf
je 0x42b71b
lea ebx, [ebp - 0x1b4]
call fcn.0045ce8d
mov eax, 3
call fcn.00454296
xor eax, eax
call fcn.00452fc5
lea ebx, [ebp - 0x2e8]
mov ecx, 4
call fcn.0045ced6
lea ebx, [ebp - 0x2e8]
call fcn.0045ce8d
mov edx, 0x1863500
call fcn.0045d0ba
call fcn.0045c602
je 0x42b6df
lea ebx, [ebp - 0x2e8]
call fcn.0045ce8d
mov edx, 0x18635ac
call fcn.0045d0ba
call fcn.0045c602
jne 0x42b71b
push 0
lea ebx, [ebp - 0x2e4]
call fcn.0045ce8d
lea ebx, [ebp - 0x1b4]
call fcn.0045ce8d
call fcn.0045c56d
push 0
mov ebx, esp
call fcn.0045c2a9
mov eax, edi
push eax
call fcn.00413db8
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x42b71b
inc esi
lea ebx, [ebp - 0x1e0]
push ebx
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x42b650
push dword [ebp - 0xa0]
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
push 0
mov eax, edi
push eax
call dword [sym.imp.ZLIBWAPI.DLL_zipClose]
fldcw word [ebp - 0x10]
mov eax, esi
test eax, eax
je 0x42b7ca
push 0
push 0
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x18635b4
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp + 8]
call fcn.0045c36b
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186359c
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp + 8]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_CopyFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 8]
call fcn.00457d88
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 8
fldcw word [ebp - 0x10]
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x186359c
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42ba03
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042ba03
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x18635e8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
call fcn.00424013
mov eax, 0x1f4
call fcn.00457053
push 1
call fcn.00423bff
mov edx, 0x1862a00
call fcn.0045d0ba
lea ebx, [ebp - 0xa4]
call fcn.0045c2a9
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
push 0x20019
push 0
lea ebx, [ebp - 0xa4]
call fcn.0045d1af
push ebx
fild qword [0x186d0c4]
call fcn.0045c2a2
push eax
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x42bb23
push 0
push 0
mov ebx, 0x45fa18
call fcn.0045ce8d
mov edx, 0x1863600
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp + 4]
call fcn.0045c36b
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegSaveKeyA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x42bb17
mov eax, edi
push eax
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
call fcn.0045cf2c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42c77e
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042c77e
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoSizeA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x42c7c9
jmp 0x42c9cb
mov eax, esi
call fcn.00456d56
lea ebx, [ebp - 0xa4]
call fcn.0045c2a9
push 0
lea ebx, [ebp - 0xa4]
call fcn.0045d1af
push ebx
mov eax, esi
push eax
mov eax, edi
push eax
mov ebx, dword [ebp + 8]
push ebx
call dword [sym.imp.VERSION.DLL_GetFileVersionInfoA]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x42c809
jmp 0x42c9cb
push 0
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
lea ebx, [ebp - 0xb4]
push ebx
mov edx, 0x1863748
call fcn.0045d0ba
lea ebx, [esp + 8]
call fcn.0045c36b
lea ebx, [ebp - 0xa4]
call fcn.0045d1af
push ebx
call dword [sym.imp.VERSION.DLL_VerQueryValueA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
pop dword [ebp - 0x30]
cmp eax, dword [ebp - 0x30]
jne 0x42c880
mov edx, 0x1863768
call fcn.0045d0ba
lea ebx, [ebp - 0xa8]
call fcn.0045c2a9
jmp 0x42c8be
mov ebx, dword [ebp - 0xb4]
mov eax, dword [ebx]
movzx eax, ax
mov ecx, eax
mov eax, 4
call fcn.0044fe34
mov ebx, dword [ebp - 0xb4]
mov eax, dword [ebx]
shr eax, 0x10
mov ecx, eax
mov eax, 4
call fcn.0044fe34
call fcn.0045c56d
lea ebx, [ebp - 0xa8]
call fcn.0045c2a9
push 0
lea ebx, [ebp - 0x9c]
mov dword [ebx], esi
push ebx
lea ebx, [ebp - 0xb0]
push ebx
mov edx, 0x1863778
call fcn.0045d0ba
mov edx, dword [ebp - 0xa8]
call fcn.0045d0a3
call fcn.0045c56d
mov edx, 0x18637a4
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [esp + 8]
call fcn.0045c36b
lea ebx, [ebp - 0xa4]
call fcn.0045d1af
push ebx
call dword [sym.imp.VERSION.DLL_VerQueryValueA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
mov esi, dword [ebp - 0x9c]
fldcw word [ebp - 0x10]
test eax, eax
je 0x42c946
mov ebx, dword [ebp - 0xb0]
call fcn.0045ce8d
lea ebx, [ebp - 0xac]
call fcn.0045c2a9
mov edx, dword [ebp - 0xac]
call fcn.0045d0a3
mov edx, 0x1860a3c
call fcn.0045d0ba
call fcn.0045bdaf
lea ebx, [ebp - 0xac]
call fcn.0045c2a9
mov edx, dword [ebp - 0xac]
call fcn.0045d0a3
mov edx, 0x1861cd8
call fcn.0045d0ba
call fcn.0045bdaf
lea ebx, [ebp - 0xac]
call fcn.0045c2a9
mov edx, dword [ebp - 0xac]
call fcn.0045d0a3
mov edx, 0x186082c
call fcn.0045d0ba
call fcn.0045bdaf
lea ebx, [ebp - 0xac]
call fcn.0045c2a9
mov edx, dword [ebp - 0xac]
call fcn.0045d0a3
lea ebx, [ebp - 0x98]
call fcn.0045c2a9
call fcn.0045cf2c
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x42c9ed
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042c9ed
xor esi, esi
xor edi, edi
mov ecx, 0x8a
push esi
dec ecx
jne 0x42ca09
call dword [sym.imp.USER32.DLL_GetForegroundWindow]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x42ca22
jmp 0x42cb86
lea ebx, [ebp - 0x1a4]
mov dword [ebx], edi
push ebx
push 0x3e8
push 3
lea ebx, [ebp - 0x1a0]
push ebx
push 0x104
push 0xd
mov eax, esi
push eax
call dword [sym.imp.USER32.DLL_SendMessageTimeoutA]
mov edi, dword [ebp - 0x1a4]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x1a0]
call fcn.0045ce8d
call fcn.0045d088
test eax, eax
je 0x42cb86
mov ebx, 0x1860174
call fcn.0045ce8d
lea ebx, [ebp - 0x1a0]
call fcn.0045ce8d
call fcn.0045c602
je 0x42caa0
lea ebx, [ebp - 0x1a0]
call fcn.0045ce8d
mov ebx, 0x1860174
mov ecx, 0x104
call fcn.0045ced6
push 0x104
lea ebx, [ebp - 0x2a8]
push ebx
mov eax, esi
push eax
call dword [sym.imp.USER32.DLL_GetClassNameA]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x2a8]
call fcn.0045ce8d
mov edx, 0x1861f28
call fcn.0045d0ba
call fcn.0045c602
jne 0x42cb22
lea ebx, [ebp - 0x2ac]
push ebx
mov eax, esi
push eax
call dword [sym.imp.USER32.DLL_GetWindowThreadProcessId]
fldcw word [ebp - 0x10]
test eax, eax
je 0x42cb1d
push dword [ebp - 0x2ac]
call fcn.00423827
call fcn.0045d0d1
mov edx, 0x18637b8
call fcn.0045d0ba
call fcn.0045c602
jne 0x42cb1d
jmp 0x42cb86
jmp 0x42cb70
lea ebx, [ebp - 0x2a8]
call fcn.0045ce8d
mov edx, 0x18637cc
call fcn.0045d0ba
call fcn.0045c602
jne 0x42cb70
lea ebx, [ebp - 0x1a0]
call fcn.0045ce8d
mov edx, 0x1861f70
call fcn.0045d0ba
call fcn.0045c602
jne 0x42cb70
push 0
mov eax, esi
push eax
call dword [sym.imp.USER32.DLL_ShowWindow]
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x1a0]
call fcn.0045ce8d
lea ebx, [ebp - 0x98]
call fcn.0045c2a9
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42d173
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042d173
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x42d18d
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov edx, 0x1862af8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x2e0]
mov ecx, 0x104
call fcn.0045ced6
lea ebx, [ebp - 0x1dc]
push ebx
lea ebx, [ebp - 0x2e0]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186cd80]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x42d2e5
nop
fild dword [0x186cd30]
fild dword [0x186cd30]
mov eax, dword [ebp - 0x1dc]
call fcn.0045c27b
call fcn.0045c106
fcompp
fnstsw ax
sahf
je 0x42d257
push 0
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
jmp 0x42d2be
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
mov edx, 0x1860a3c
call fcn.0045d0ba
call fcn.0045c602
je 0x42d2be
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
mov edx, 0x1862b08
call fcn.0045d0ba
call fcn.0045c602
je 0x42d2be
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
call fcn.0045c56d
mov eax, 0x80000104
call fcn.00454915
call fcn.004253b7
lea ebx, [ebp - 0x1dc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x42d1f0
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x42d302
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042d302
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x42d31c
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov edx, 0x1862af8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x2e0]
mov ecx, 0x104
call fcn.0045ced6
lea ebx, [ebp - 0x1dc]
push ebx
lea ebx, [ebp - 0x2e0]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186cd80]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x42d4c6
nop
nop
fild dword [0x186cd30]
fild dword [0x186cd30]
mov eax, dword [ebp - 0x1dc]
call fcn.0045c27b
call fcn.0045c106
fcompp
fnstsw ax
sahf
je 0x42d438
xor eax, eax
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
mov ecx, 1
mov edx, 0x1860a3c
call fcn.0045d0ba
xchg ecx, eax
call fcn.004512ed
cmp eax, ecx
jne 0x42d433
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
xor eax, eax
call fcn.00452fc5
mov edx, 0x18638ec
call fcn.0045d0ba
call fcn.0045c602
je 0x42d433
push 0
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
jmp 0x42d49f
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
mov edx, 0x1860a3c
call fcn.0045d0ba
call fcn.0045c602
je 0x42d49f
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
mov edx, 0x1862b08
call fcn.0045d0ba
call fcn.0045c602
je 0x42d49f
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
call fcn.0045c56d
mov eax, 0x80000104
call fcn.00454915
call fcn.004253b7
lea ebx, [ebp - 0x1dc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x42d380
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x42d4e3
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.0042d4e3
xor esi, esi
mov ecx, 0x9a
push esi
dec ecx
jne 0x42d4fd
lea ebx, [ebp + 8]
call fcn.0045ce8d
mov edx, 0x1862af8
call fcn.0045d0ba
call fcn.0045c56d
lea ebx, [ebp - 0x2e0]
mov ecx, 0x104
call fcn.0045ced6
lea ebx, [ebp - 0x1dc]
push ebx
lea ebx, [ebp - 0x2e0]
push ebx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
fldcw word [ebp - 0x10]
mov esi, eax
fild qword [0x186cd80]
mov dword [ebp - 0x6c], esi
mov dword [ebp - 0x68], 0
fild qword [ebp - 0x6c]
fcompp
fnstsw ax
sahf
je 0x42d5e5
nop
fild dword [0x186cd30]
fild dword [0x186cd30]
mov eax, dword [ebp - 0x1dc]
call fcn.0045c27b
call fcn.0045c106
fcompp
fnstsw ax
sahf
je 0x42d5c2
push 0
lea ebx, [ebp + 8]
call fcn.0045ce8d
lea ebx, [ebp - 0x1b0]
call fcn.0045ce8d
call fcn.0045c56d
lea ebx, [esp]
call fcn.0045c36b
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
push eax
mov ebx, esp
mov eax, dword [ebx + 4]
call fcn.00457d88
pop eax
add esp, 4
fldcw word [ebp - 0x10]
lea ebx, [ebp - 0x1dc]
push ebx
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
fldcw word [ebp - 0x10]
test eax, eax
jne 0x42d560
mov eax, esi
push eax
call dword [sym.imp.KERNEL32.DLL_FindClose]
fldcw word [ebp - 0x10]
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x104
Function at 0x430952
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x133f
sub esp, 0x70
push fcn.00430952
xor esi, esi
xor edi, edi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
mov edx, 0x18609c8
call fcn.0045d0ba
mov ebx, dword [ebp + 0x14]
call fcn.0045c2a9
mov ebx, dword [ebp + 0x18]
mov dword [ebx], 0
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0045d0a3
mov eax, 1
mov ecx, 1
xchg ecx, eax
call fcn.00454232
mov edx, 0x18609d8
call fcn.0045d0ba
call fcn.0045c602
jne 0x4309d8
mov ebx, dword [ebp + 0xc]
mov edx, dword [ebx]
call fcn.0045d0a3
mov ecx, 2
mov eax, 0x7fffffff
call fcn.00454232
mov ebx, dword [ebp + 0xc]
call fcn.0045c2a9
lea ebx, [ebp - 0xa4]
push ebx
push 0x20019
push 0
mov ebx, dword [ebp + 0xc]
call fcn.0045d1af
push ebx
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.DLL_RegOpenKeyExA]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x430b3a
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
push 0
push 0
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045d1af
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
cmp esi, 0
jne 0x430b2b
mov eax, edi
mov ebx, eax
xor eax, eax
call fcn.00456eea
mov ebx, dword [ebp + 0x14]
call fcn.0045c2a9
lea ebx, [ebp - 0xa0]
mov dword [ebx], edi
push ebx
mov ebx, dword [ebp + 0x14]
call fcn.0045d1af
push ebx
mov ebx, dword [ebp + 0x18]
push ebx
push 0
mov ebx, dword [ebp + 0x10]
call fcn.0045d1af
push ebx
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegQueryValueExA]
mov edi, dword [ebp - 0xa0]
fldcw word [ebp - 0x10]
mov esi, eax
mov ebx, dword [ebp + 0x18]
mov eax, dword [ebx]
call fcn.0045c27b
fstp xword [ebp - 0x50]
fild dword [0x186cdcc]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
je 0x430ad0
fild dword [0x186cdd0]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
je 0x430ad0
fild dword [0x186cdd8]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
jne 0x430af6
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045d0a3
mov edx, 0x186080c
call fcn.0045d0ba
call fcn.0045a86f
mov ebx, dword [ebp + 0x14]
call fcn.0045c2a9
jmp 0x430b2b
fild dword [0x186cdd4]
fld xword [ebp - 0x50]
fcompp
fnstsw ax
sahf
jne 0x430b2b
mov ebx, dword [ebp + 0x14]
mov edx, dword [ebx]
call fcn.0045d0a3
mov eax, 1
call fcn.00450156
call fcn.0045ad27
mov ebx, dword [ebp + 0x14]
call fcn.0045c2a9
push dword [ebp - 0xa4]
call dword [sym.imp.ADVAPI32.DLL_RegCloseKey]
fldcw word [ebp - 0x10]
mov dword [ebp - 0x98], esi
mov eax, dword [ebp - 0x98]
lea esp, [ebp - 0xc]
pop edi
pop esi
pop ebx
pop ebp
ret 0x14