joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40f2b3
Capabilities:
Delete file

Disassembly:
jmp 0x577d90
jmp 0x474100
push esi
push edi
push 0x64061c
push str.._image_InterfaceScript_AdvancedSetDlg.bin
mov edi, ecx
call fcn.00408148
mov ecx, dword [edi + 0x18]
mov esi, eax
push esi
call fcn.005ffe40
mov ecx, esi
call fcn.004014c9
pop edi
mov dword [0x7a04ac], esi
mov ecx, esi
pop esi
jmp 0x40620d
sub esp, 0x2cc
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x2c8], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
push esi
push edi
push 0xff
lea eax, [esp + 0x1dc]
push eax
push 0
mov ebp, ecx
call ebx
lea ecx, [esp + 0x1d8]
push 0x5c
push ecx
call fcn.006093d0
lea edi, [esp + 0x1e0]
add esp, 8
mov byte [eax + 1], 0
dec edi
nop
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x577de0
mov ecx, 6
mov esi, str.._Ini_AdvancedSet_Cfg.ini
rep movsd dword es:[edi], dword [esi]
push 0xff
lea edx, [esp + 0xdc]
push edx
push 0
movsw word es:[edi], word [esi]
call ebx
lea eax, [esp + 0xd8]
push 0x5c
push eax
call fcn.006093d0
lea edi, [esp + 0xe0]
add esp, 8
mov byte [eax + 1], 0
dec edi
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x577e25
mov ecx, 7
mov esi, str.._Ini_AdvancedSet_Config.ini
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0xd8]
push ecx
lea edx, [esp + 0x1dc]
push str.admin
push edx
movsb byte es:[edi], byte [esi]
call fcn.0040f00b
push 0xc8
lea eax, [esp + 0x20]
push 0
push eax
call fcn.006061b0
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x2c]
push ecx
push str.Power
push str.AddPoint
call fcn.00406b13
lea edx, [esp + 0x38]
push edx
call fcn.00606e86
push 0xc8
mov dword [ebp + 0x24c], eax
lea eax, [esp + 0x40]
push 0
push eax
call fcn.006061b0
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x4c]
push ecx
push 0x653fcc
push str.AddPoint
call fcn.00406b13
lea edx, [esp + 0x58]
add esp, 0x48
push edx
call fcn.00606e86
push 0xc8
mov dword [ebp + 0x250], eax
lea eax, [esp + 0x18]
push 0
push eax
call fcn.006061b0
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x24]
push ecx
push 0x653fc8
push str.AddPoint
call fcn.00406b13
lea edx, [esp + 0x30]
push edx
call fcn.00606e86
push 0xc8
mov dword [ebp + 0x254], eax
lea eax, [esp + 0x38]
push 0
push eax
call fcn.006061b0
push str.._Ini_AdvancedSet_Config.ini
lea ecx, [esp + 0x44]
push ecx
push 0x653fc4
push str.AddPoint
call fcn.00406b13
lea edx, [esp + 0x50]
add esp, 0x40
push edx
call fcn.00606e86
mov dword [ebp + 0x258], eax
add esp, 4
lea eax, [esp + 0xd8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [esp + 0x2d8]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00606374
add esp, 0x2cc
ret
Function at 0x40ff29
Capabilities:
Get mac address on windows

Disassembly:
jmp 0x447060
sub esp, 8
push ebp
push edi
lea eax, [esp + 8]
xor edi, edi
push eax
push edi
mov ebp, ecx
mov dword [esp + 0x10], edi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
je 0x4470a2
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp + 0x14]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push ecx
call fcn.00401faa
add esp, 0x10
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
mov edx, dword [esp + 8]
push esi
push edx
call fcn.006086e6
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
cmp esi, edi
jne 0x4470d5
mov eax, dword [esp + 0x18]
push str.GetMAC_Failed__Because_malloc_failed_
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
lea ecx, [esp + 0xc]
push ecx
push esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x447110
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, dword [esp + 0x18]
push eax
push str.GetMAC_Failed__ErrorCode:__d
push 0x12
push edx
call fcn.00401faa
push esi
call fcn.0060866d
add esp, 0x14
pop esi
pop edi
xor eax, eax
pop ebp
add esp, 8
ret 4
push ebx
mov ebx, dword [esp + 0x1c]
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x44714b
cmp eax, 8
ja 0x44714b
push eax
lea eax, [esi + 0x194]
push eax
push ebx
call fcn.00607fd0
mov edi, dword [esi + 0x190]
add esp, 0xc
lea ecx, [esi + 8]
push ecx
mov ecx, ebp
call fcn.0040b1db
test al, 4
jne 0x447151
mov esi, dword [esi]
test esi, esi
jne 0x447115
mov edx, dword [esp + 0x14]
push edx
call fcn.0060866d
add esp, 4
pop ebx
pop esi
mov eax, edi
pop edi
pop ebp
add esp, 8
ret 4

Function at 0x41001e
Capabilities:
Set current directory

Disassembly:
jmp 0x5e5c80
push esi
mov esi, dword [esp + 8]
push edi
mov edi, ecx
cmp esi, 0x12
jb 0x5e5c9e
push 0
push 0x72
push str.DirectoryManager.cpp
call fcn.00409a25
add esp, 0xc
cmp esi, dword [edi + 0x50]
je 0x5e5cb6
cmp esi, 0x11
je 0x5e5cb6
mov eax, dword [edi + esi*4 + 8]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov dword [edi + 0x50], esi
pop edi
pop esi
ret 4

Function at 0x4105c3
Capabilities:
Hash data with md5

Disassembly:
jmp 0x57b3d0
xor eax, eax
mov byte [ecx + 0x68], al
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x41082a
Capabilities:
Check for time delay via gettickcount

Disassembly:
jmp 0x517c00
cmp byte [0x7983b6], 0
push esi
mov esi, ecx
je 0x517c23
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [esi + 0xc], eax
mov dword [0x7b1f68], eax
mov byte [0x7983b6], 0
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [esi + 0xc]
mov edx, eax
sub edx, ecx
mov dword [0x7b1f68], eax
cmp eax, ecx
jae 0x517c3a
dec edx
mov dword [0x7b1f4c], edx
mov dword [esi + 0xc], eax
mov eax, dword [0x7b1f4c]
add dword [0x7b1f50], eax
add dword [esi + 8], eax
cmp dword [esi + 8], 0x5265c00
jb 0x517c64
inc dword [esi + 4]
add dword [esi + 8], 0xfad9a400
pop esi
ret
Function at 0x422480
Capabilities:
Create directory
Write file on windows

Disassembly:
jmp 0x422480
sub esp, 0x48
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x44], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push edi
push 0
push str.data
mov edi, ecx
call esi
push 0
push str.data_aiconfig
call esi
mov eax, dword [0x7b0d24]
movzx ecx, word [eax + 0x129]
push ecx
lea edx, [esp + 0x10]
push str.._data_aiconfig__d.dat
push edx
call fcn.00606889
push 0x640624
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x1c]
push ecx
call fcn.00606842
mov eax, dword [esp + 0x20]
add esp, 0x18
test eax, eax
je 0x422506
push eax
push 1
push 0x1c64
add edi, 0xec
push edi
call fcn.006066f5
mov edx, dword [esp + 0x18]
push edx
call fcn.0060652a
add esp, 0x14
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
xor ecx, esp
call fcn.00606374
add esp, 0x48
ret

Function at 0x422520
Capabilities:
Read file on windows

Disassembly:
jmp 0x422520
sub esp, 0x4c
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x7b0d24]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00606889
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.006061b0
push 0x64065c
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00606842
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x4225f8
push eax
push 1
push 0x1c64
push edi
call fcn.00606ca9
mov edx, dword [esp + 0x18]
push edx
call fcn.0060652a
add esp, 0x14
call fcn.00402243
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x4225bb
fadd dword [0x6405a4]
fstp dword [esi + 0xe0]
call fcn.00402243
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x4225e1
fadd dword [0x6405a4]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00606374
add esp, 0x4c
ret
mov ecx, esi
call fcn.0040289c
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00606374
add esp, 0x4c
ret
Function at 0x422533
Capabilities:
Read file on windows

Disassembly:
jmp 0x422520
sub esp, 0x4c
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x48], eax
mov eax, dword [0x7b0d24]
push esi
mov esi, ecx
movzx ecx, word [eax + 0x129]
push edi
push ecx
lea edx, [esp + 0x14]
push str.._data_aiconfig__d.dat
push edx
call fcn.00606889
push 0x1c64
lea edi, [esi + 0xec]
push 0
push edi
call fcn.006061b0
push 0x64065c
lea eax, [esp + 0x2c]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.00606842
mov eax, dword [esp + 0x2c]
add esp, 0x24
test eax, eax
je 0x4225f8
push eax
push 1
push 0x1c64
push edi
call fcn.00606ca9
mov edx, dword [esp + 0x18]
push edx
call fcn.0060652a
add esp, 0x14
call fcn.00402243
mov eax, dword [eax + 0x228]
imul eax, eax, 0x64
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
test eax, eax
jns 0x4225bb
fadd dword [0x6405a4]
fstp dword [esi + 0xe0]
call fcn.00402243
mov ecx, dword [eax + 0x22c]
imul ecx, ecx, 0x64
mov dword [esp + 0xc], ecx
fild dword [esp + 0xc]
test ecx, ecx
jns 0x4225e1
fadd dword [0x6405a4]
pop edi
fstp dword [esi + 0xe8]
pop esi
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00606374
add esp, 0x4c
ret
mov ecx, esi
call fcn.0040289c
mov ecx, dword [esp + 0x50]
pop edi
pop esi
xor ecx, esp
call fcn.00606374
add esp, 0x4c
ret
Function at 0x428440
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x428440
sub esp, 0x4c
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x48], eax
movzx eax, word [esp + 0x54]
push ebp
push edi
mov edi, ecx
push eax
mov ecx, 0x7b0c90
mov dword [esp + 0x10], eax
call fcn.00401d89
mov ebp, eax
mov dword [esp + 8], ebp
test ebp, ebp
je 0x42862c
push ebx
xor ebx, ebx
push esi
jmp 0x428480
mov ecx, dword [edi + 0x218]
movzx esi, bx
push esi
call fcn.00409d5e
test eax, eax
je 0x4284cc
mov edx, dword [eax]
mov ecx, eax
mov eax, dword [edx + 0x78]
call eax
cmp word [esp + 0x14], ax
jne 0x4284cc
mov ecx, dword [edi + 0x218]
push esi
call fcn.00409d5e
mov esi, eax
test esi, esi
je 0x4284cc
mov ecx, dword [edi + 0x218]
push esi
call fcn.0040e74b
push esi
mov ecx, 0x7b0258
call fcn.0040c801
inc ebx
cmp ebx, 5
jl 0x428480
mov ebx, dword [ebp + 0x538]
test ebx, ebx
je 0x4285f8
mov ebp, dword [esp + 0x60]
mov ecx, dword [edi + 0x218]
push ebp
call fcn.00409d5e
mov esi, eax
test esi, esi
je 0x42850d
mov ecx, dword [edi + 0x218]
push esi
call fcn.0040e74b
push esi
mov ecx, 0x7b0258
call fcn.0040c801
push 0x53c
call fcn.00606266
add esp, 4
test eax, eax
je 0x428529
mov ecx, eax
call fcn.00408530
mov esi, eax
jmp 0x42852b
xor esi, esi
lea ecx, [esp + 0x38]
call fcn.0040a0e7
lea ecx, [esp + 0x18]
call fcn.0040a0e7
mov edx, dword [ebx + 0x33]
push 2
lea ecx, [esp + 0x3c]
push ecx
push edx
mov ecx, 0x7b00a0
call fcn.0040489a
mov ecx, dword [ebx + 0x37]
push 2
lea eax, [esp + 0x1c]
push eax
push ecx
mov ecx, 0x7b00a0
call fcn.0040489a
mov edx, dword [esi]
mov edx, dword [edx + 0xb4]
lea eax, [ebp + 0x109a0]
push eax
lea ecx, [esp + 0x1c]
push ecx
lea eax, [esp + 0x40]
push eax
push 0x28
push 0x28
push 0
push 0
mov ecx, esi
call edx
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x220]
add eax, 0x4b8
mov dword [esi + 0x220], ecx
push eax
mov ecx, esi
call fcn.00409520
mov edx, 0x8e
mov dword [esi + 0x538], ebx
mov word [esi + 0xc], dx
mov ecx, dword [0x7b0270]
push esi
call fcn.005ffe40
mov ecx, dword [edi + 0x218]
push esi
push ebp
call fcn.0040ab73
lea ecx, [esp + 0x18]
call fcn.004087bf
lea ecx, [esp + 0x38]
call fcn.004087bf
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00606374
add esp, 0x4c
ret 8
push 0x9ac
mov ecx, 0x7b3388
call fcn.004107c6
push eax
push 0x1d
push 0x7b3388
call fcn.004018f2
add esp, 0xc
pop esi
pop ebx
pop edi
pop ebp
mov ecx, dword [esp + 0x48]
xor ecx, esp
call fcn.00606374
add esp, 0x4c
ret 8
push 0x9ac
mov ecx, 0x7b3388
call fcn.004107c6
push eax
push 0x1d
push 0x7b3388
call fcn.004018f2
mov ecx, dword [esp + 0x5c]
add esp, 0xc
pop edi
pop ebp
xor ecx, esp
call fcn.00606374
add esp, 0x4c
ret 8
Function at 0x42c9f0
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
jmp 0x42c9f0
sub esp, 0x24c
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x248], eax
push esi
mov esi, dword [esp + 0x254]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
push esi
lea eax, [esp + 0x150]
push str._s
push eax
call edi
add esp, 0xc
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x150]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [esp + 8], eax
cmp eax, 0xffffffff
je 0x42cb41
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [esp + 0x14], 0x10
jne 0x42cafa
mov ecx, 0x640a38
lea eax, [esp + 0x40]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42ca88
test dl, dl
je 0x42ca84
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42ca88
add eax, 2
add ecx, 2
test dl, dl
jne 0x42ca68
xor eax, eax
jmp 0x42ca8d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42cb1c
mov ecx, 0x640a34
lea eax, [esp + 0x40]
mov edi, edi
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x42cac0
test dl, dl
je 0x42cabc
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x42cac0
add eax, 2
add ecx, 2
test dl, dl
jne 0x42caa0
xor eax, eax
jmp 0x42cac5
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x42cb1c
lea eax, [esp + 0x40]
push eax
push esi
lea ecx, [esp + 0x15c]
push 0x640a2c
push ecx
call edi
lea edx, [esp + 0x164]
push edx
call fcn.0040d23d
add esp, 0x14
lea eax, [esp + 0x154]
push eax
call ebx
jmp 0x42cb1c
lea ecx, [esp + 0x40]
push ecx
push esi
lea edx, [esp + 0x15c]
push 0x640a2c
push edx
call edi
add esp, 0x10
lea eax, [esp + 0x154]
push eax
call ebp
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42ca54
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop ebx
mov ecx, dword [esp + 0x250]
pop edi
pop esi
xor ecx, esp
call fcn.00606374
add esp, 0x24c
ret
Function at 0x42cdb0
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
jmp 0x42cdb0
sub esp, 0x35c
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x358], eax
push ebx
push ebp
push 0x104
lea eax, [esp + 0x260]
push eax
mov ebp, 1
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea eax, [esp + 0x25c]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42cde6
mov ecx, dword [str.mfl.dat]
mov edx, dword [0x640ac8]
mov dword [eax], ecx
mov cl, byte [0x640acc]
mov dword [eax + 4], edx
lea edx, [esp + 0x25c]
push 0x640a60
push edx
mov byte [eax + 8], cl
call fcn.0060682b
mov ebx, eax
add esp, 8
test ebx, ebx
jne 0x42ce45
push eax
call fcn.0060652a
add esp, 4
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x358]
xor ecx, esp
call fcn.00606374
add esp, 0x35c
ret
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [esp + 0x160]
push eax
push 0x104
call edi
lea eax, [esp + 0x160]
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x42ce64
mov ecx, dword [str.Resource.bin]
mov edx, dword [0x640ab4]
mov dword [eax], ecx
mov ecx, dword [0x640ab8]
mov dword [eax + 4], edx
mov edx, dword [0x640abc]
mov dword [eax + 8], ecx
mov dword [eax + 0xc], edx
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.00607991
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.00607991
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42cea4
lea edx, [esp + 0x160]
push edx
push 0x104
call edi
lea edi, [esp + 0x160]
dec edi
lea esp, [esp]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x42cf20
mov ecx, 6
mov esi, str.ResourceSkillArea.bsad
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x164]
push ecx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea esp, [esp]
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x38]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea ecx, [esp + 0x4c]
push ecx
push ebp
push str._d__s_t
push ebx
call fcn.00607991
movzx edx, word [esp + 0x2a]
movzx eax, word [esp + 0x28]
movzx ecx, word [esp + 0x26]
push edx
movzx edx, word [esp + 0x26]
push eax
movzx eax, word [esp + 0x28]
push ecx
push edx
push eax
push str._4d__02d__02d__02d__02d_n
push ebx
call fcn.00607991
add esp, 0x2c
lea ecx, [esp + 0x20]
push ecx
push esi
inc ebp
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x42cf50
push ebx
call fcn.0060652a
mov ecx, dword [esp + 0x36c]
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00606374
add esp, 0x35c
ret
Function at 0x446e90
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
jmp 0x446e90
sub esp, 0x130
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x12c], eax
push ebx
push esi
mov esi, dword [esp + 0x13c]
xor ebx, ebx
mov dword [esp + 0x24], esi
cmp esi, ebx
je 0x447042
cmp byte [esi], bl
je 0x447042
lea eax, [esp + 0x10]
push eax
push 0x20019
push ebx
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x447042
mov edx, dword [esp + 0x10]
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea ecx, [esp + 0x28]
push ecx
push ebx
push ebx
push ebx
push edx
mov dword [esp + 0x3c], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
test eax, eax
je 0x446f14
mov dword [esp + 0xc], 0x64
push edi
xor edi, edi
mov dword [esp + 0x24], ebx
cmp dword [esp + 0x10], ebx
jbe 0x447030
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea esp, [esp]
xor eax, eax
push edi
push str._04u
mov dword [esp + 0x38], eax
mov byte [esp + 0x3c], al
lea eax, [esp + 0x38]
push 5
push eax
call fcn.00401faa
mov eax, dword [esp + 0x28]
add esp, 0x10
lea ecx, [esp + 0x10]
push ecx
push 0x20019
push ebx
lea edx, [esp + 0x3c]
push edx
push eax
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x447009
lea ecx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x3c]
push edx
lea eax, [esp + 0x28]
push eax
push ebx
push str.NetCfgInstanceId
push ecx
mov dword [esp + 0x38], ebx
mov dword [esp + 0x34], 0x104
call ebp
test eax, eax
je 0x446faf
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x447009
push esi
lea eax, [esp + 0x3c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x446fcc
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x447009
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x28]
push eax
lea ecx, [esp + 0x28]
push ecx
push ebx
push str.Characteristics
push edx
mov dword [esp + 0x3c], ebx
mov dword [esp + 0x34], 4
call ebp
mov esi, eax
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x447027
mov esi, dword [esp + 0x2c]
inc edi
cmp edi, dword [esp + 0x14]
jb 0x446f30
mov edx, dword [esp + 0x18]
pop ebp
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x447044
mov ecx, dword [esp + 0x24]
mov dword [esp + 0x28], ecx
pop ebp
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x24]
pop edi
jmp 0x447044
xor eax, eax
mov ecx, dword [esp + 0x134]
pop esi
pop ebx
xor ecx, esp
call fcn.00606374
add esp, 0x130
ret 4
Function at 0x44d185
Capabilities:
Write file on windows

Disassembly:
jmp 0x44d180
mov eax, dword [0x79fb2c]
push esi
mov esi, ecx
mov ecx, dword [eax + 8]
mov dword [ecx + 0xc], 1
cmp dword [esi + 0x10], 0
push 0
mov ecx, 0x79fb24
push 0
je 0x44d1bb
push 3
mov dword [0x79fdb8], 1
call fcn.0040aa2e
mov dword [esi + 0x10], 0
jmp 0x44d1c2
push 2
call fcn.0040aa2e
cmp dword [0x7b3268], 0
pop esi
jne 0x44d1e0
mov dword [0x7b3268], 1
mov ecx, 0x7b31d0
jmp fcn.00409dbd
ret
Function at 0x4cf505
Capabilities:
Delete file

Disassembly:
jmp 0x4cf500
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
lea ecx, [esi + 0x284]
cmp ebx, 1
jne 0x4cf547
mov eax, dword [0x7b1f50]
add eax, 0x1d4c0
push edi
mov dword [esi + 0x238], eax
call fcn.004102ad
push str.ANRaster.tga
lea ecx, [esi + 0x284]
call fcn.00402d38
pop edi
push ebx
mov ecx, esi
call fcn.0040f187
pop esi
pop ebx
ret 4
call fcn.004102ad
push str.ANRaster.tga
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
mov ecx, esi
call fcn.0040f187
pop esi
pop ebx
ret 4
Function at 0x4fb4a0
Capabilities:
Enumerate processes

Disassembly:
jmp 0x4fb4a0
sub esp, 0x1ac
mov eax, dword [0x79d4f0]
xor eax, esp
mov dword [esp + 0x1a8], eax
push ebx
mov ebx, dword [sym.imp.WINMM.dll_timeGetTime]
push esi
mov esi, ecx
call ebx
cmp dword [esi + 0xf4], 0
jne 0x4fb4cf
mov dword [esi + 0xf4], eax
sub eax, dword [esi + 0xf4]
cmp eax, 0x1388
jbe 0x4fb5ab
mov ecx, dword [esi + 0xd0]
mov eax, dword [esi + 0xdc]
mov dword [esi + 0xe4], eax
test ecx, ecx
jle 0x4fb505
test eax, eax
je 0x4fb502
mov eax, dword [eax]
mov dword [esi + 0xe4], eax
dec ecx
jne 0x4fb4f6
push edi
push 0
push 2
mov dword [esp + 0x14], 0x128
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
je 0x4fb5aa
lea ecx, [esp + 0xc]
push ecx
push edi
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x4fb59b
lea edx, [esp + 0x30]
push edx
lea eax, [esp + 0x138]
push 0x640a64
push eax
call fcn.00606889
add esp, 0xc
lea ecx, [esp + 0x134]
push ecx
mov ecx, esi
call fcn.00404d18
test eax, eax
je 0x4fb58c
mov ecx, 0x7c45f8
call fcn.0040db16
push 0x230
mov ecx, 0x7b3388
call fcn.004107c6
push eax
push 1
push 0x179e
push 0x7b0258
call fcn.00408a53
add esp, 0x10
lea edx, [esp + 0xc]
push edx
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x4fb531
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov dword [esi + 0xf4], eax
pop edi
mov ecx, dword [esp + 0x1b0]
pop esi
pop ebx
xor ecx, esp
call fcn.00606374
add esp, 0x1ac
ret