joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45777c
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 8]
mov ecx, eax
push ebx
mov ebx, dword [ebp + 0xc]
and eax, 0x3f
push esi
sar ecx, 6
push edi
imul edi, eax, 0x38
mov dword [ebp - 8], ecx
mov eax, dword [ecx*4 + 0x485010]
push 0xa
pop edx
mov dword [ebp - 0x18], edx
mov ecx, dword [eax + edi + 0x18]
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x4577c2
cmp word [ebx], dx
jne 0x4577c2
or byte [eax + edi + 0x28], 4
jmp 0x4577c7
and byte [eax + edi + 0x28], 0xfb
lea edx, [ebx + ecx*2]
mov eax, ebx
mov dword [ebp - 0xc], edx
mov esi, ebx
mov dword [ebp - 4], eax
cmp ebx, edx
jae 0x45792a
mov dword [ebp - 0x10], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x14], edx
mov edx, dword [ebp - 0xc]
cmp ecx, 0x1a
je 0x45790a
add eax, 2
cmp cx, word [ebp - 0x10]
je 0x457808
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x45783e
cmp eax, edx
jae 0x45784c
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x18]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 0xc]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
push 2
pop ecx
add esi, ecx
cmp eax, edx
jb 0x4577e3
jmp 0x45792a
push 0
lea eax, [ebp - 0x18]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x457905
cmp dword [ebp - 0x18], 0
je 0x457905
mov edx, dword [ebp - 8]
push 0xa
mov eax, dword [edx*4 + 0x485010]
test byte [eax + edi + 0x28], 0x48
je 0x4578db
lea eax, [esi + 2]
mov dword [ebp - 0x1c], eax
mov ax, word [ebp - 4]
pop ecx
mov word [ebp - 2], ax
cmp ax, cx
jne 0x45789f
mov word [esi], cx
jmp 0x4578d6
push 0xd
pop ecx
mov word [esi], cx
movzx ecx, ax
mov eax, dword [edx*4 + 0x485010]
mov dx, word [ebp - 2]
shr ecx, 8
push 0xa
mov byte [eax + edi + 0x2a], dl
mov edx, dword [ebp - 8]
mov eax, dword [edx*4 + 0x485010]
mov byte [eax + edi + 0x2b], cl
mov eax, dword [edx*4 + 0x485010]
pop ecx
mov byte [eax + edi + 0x2c], cl
mov esi, dword [ebp - 0x1c]
jmp 0x45792a
pop eax
cmp word [ebp - 4], ax
jne 0x4578eb
cmp esi, ebx
jne 0x4578eb
mov word [esi], ax
jmp 0x457927
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.004575d1
add esp, 0x10
push 0xa
pop eax
cmp word [ebp - 4], ax
je 0x45792a
push 0xd
pop eax
jmp 0x4578e6
mov edx, dword [ebp - 8]
mov edx, dword [edx*4 + 0x485010]
mov al, byte [edx + edi + 0x28]
test al, 0x40
jne 0x457924
or al, 2
mov byte [edx + edi + 0x28], al
jmp 0x45792a
mov word [esi], cx
add esi, 2
sub esi, ebx
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x45b8e9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x45b986
push ebx
push esi
call fcn.0045b8b2
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.0045b846
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x45b933
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x45b985
push edi
push eax
call fcn.004561fc
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x45b953
call fcn.00455149
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x45b984
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.0045b846
add esp, 0x20
test eax, eax
jne 0x45b972
push edi
call fcn.00455149
jmp 0x45b97a
push ebx
call fcn.00455149
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x45e3f5
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00455f11
mov esi, dword [ebp + 8]
mov edi, eax
push 2
lea eax, [ebp - 4]
mov ecx, esi
push eax
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45e464
cmp esi, dword [ebp - 4]
je 0x45e45f
cmp dword [ebp + 0xc], 0
je 0x45e45f
mov esi, dword [edi + 0x50]
lea ecx, [esi + 2]
mov ax, word [esi]
add esi, 2
test ax, ax
jne 0x45e43c
push dword [edi + 0x50]
sub esi, ecx
sar esi, 1
call fcn.0045df47
pop ecx
xor ecx, ecx
cmp eax, esi
setne cl
mov eax, ecx
jmp 0x45e466
xor eax, eax
inc eax
jmp 0x45e466
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x45e4cb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x47d040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.00455f11
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.00455f11
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x45e542
cmp word [ecx], dx
je 0x45e542
mov eax, dword [0x46dafc]
push edi
dec eax
push eax
push 0x46d9e8
call fcn.0045e46a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x45e5b5
cmp word [eax], dx
je 0x45e5b5
mov eax, dword [edi]
test eax, eax
je 0x45e566
cmp word [eax], dx
je 0x45e566
lea eax, [ebp - 0x10]
push eax
call fcn.0045de4d
jmp 0x45e56f
lea eax, [ebp - 0x10]
push eax
call fcn.0045dee8
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x45e5df
mov eax, dword [0x46d9e4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x46d6d8
call fcn.0045e46a
add esp, 0xc
test al, al
je 0x45e5df
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x45e5aa
cmp word [eax], di
je 0x45e5aa
lea eax, [ebp - 0x10]
push eax
call fcn.0045de4d
pop ecx
jmp 0x45e5e1
lea eax, [ebp - 0x10]
push eax
call fcn.0045dee8
jmp 0x45e5a7
mov eax, dword [edi]
test eax, eax
je 0x45e5cc
cmp word [eax], dx
je 0x45e5cc
lea eax, [ebp - 0x10]
push eax
call fcn.0045de02
pop ecx
jmp 0x45e5df
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x45e6aa
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.0045e2ef
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x45e6aa
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x45e6aa
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x45e6aa
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x45e637
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.0045575d
test ebx, ebx
je 0x45e6a5
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.0045575d
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45e6aa
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x45e6aa
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004628f4
add esp, 0x10
xor eax, eax
inc eax
jmp 0x45e6ac
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0044096c
leave
ret
Function at 0x463165
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004630e1
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4632d4
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4632d4
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x463289
jg 0x4631c1
test eax, eax
je 0x46327f
push 1
push 0x1000
call fcn.004550ec
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4631e4
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x463276
push 0x8000
push ebx
call fcn.0045272f
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x46320d
jg 0x463208
cmp ecx, 0x1000
jb 0x46320d
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.00458bf0
add esp, 0x10
cmp eax, 0xffffffff
je 0x463252
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x463208
jl 0x463239
test ecx, ecx
jne 0x4631fa
push dword [ebp - 0xc]
push ebx
call fcn.0045272f
push esi
call fcn.00455149
add esp, 0xc
xor ebx, ebx
jmp 0x4632e2
cmp byte [edi + 0x24], 0
je 0x463269
cmp dword [edi + 0x20], 5
jne 0x463269
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x463274
mov ebx, dword [edi + 0x18]
jmp 0x463276
xor ebx, ebx
push esi
call fcn.00455149
pop ecx
jmp 0x4632e2
test ecx, ecx
jg 0x46324b
jl 0x463289
test eax, eax
jae 0x46324b
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.004575d1
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4632a9
cmp byte [edi + 0x1c], 0
je 0x46324b
jmp 0x4632da
push ebx
call fcn.0045c2c5
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x46324b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4632e2
cmp byte [edi + 0x1c], 0
je 0x4632df
mov ebx, dword [edi + 0x18]
jmp 0x4632e2
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.004575d1
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x464630
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x46465d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x46465d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x414ac0
Capabilities:
Encode data using xor

Disassembly:
out dx, eax
invalid
mov byte [0xf2b7fe5b], al
add cl, byte [edx + 0x30]
not ebx
jae 0x414a6d
and eax, 0x11b1b94
cmp ah, byte [ecx - 0x4c]
or dword [0x1453994b], ebp
in eax, 0x8e
dec esi
shr bl, cl
aaa
imul dword [eax + 0x1f]
xor dword [ecx - 0x68be5c2e], 0xa7991b93
sub eax, 0x891f8ee4
in al, 0x8e
or byte [edx + 0xb], ch
adc dword [esi + 0x71a0f3d2], esi
sub eax, 0xd234b8e4
xor al, 0xd2
sbb esi, dword [ecx - 9]
rcr byte [ebx], cl
jno 0x414b00
not edx
sbb esi, dword [ecx - 9]
rcr byte [ebx], cl
jno 0x414b04
rcr byte [ebx], cl
jno 0x414b19
sub eax, 0xd2f78ee4
sbb esi, dword [ecx + 8]
sub eax, 0xd2f78ee4
not edx
sbb esi, dword [ecx - 9]
rcr byte [ebx], cl
jno 0x414b1c
not edx
sbb esi, dword [ecx - 9]
rcr byte [ebx], cl
jno 0x414b20
rcr byte [eax + 0x1f15f39d], cl
push ebp
sbb esp, dword [ebp + ebx*2 + 0x71]
mov cl, 0x53
int1
cmpsd dword [esi], dword es:[edi]
add bl, dl
scasd eax, dword es:[edi]
sbb edi, esi
mov byte [0x3876715a], al
sbb dh, byte [ecx - 9]
rcr byte [eax + 0x1f15f39d], cl
push ebp
popfd
sbb eax, 0xbaafd751
sbb esp, dword [ecx - 0x49]
rol byte [eax + 0x50], cl
add eax, 0x1974f153
cmp bl, al
jo 0x414b81
mov edx, 0xd2b63a3b
inc edx
cdq
rcl dl, 1
sbb esi, dword [ecx - 0x54]
pop ecx
pop ss
push ebp
je 0x414b88
pop ds
pop eax
add dword [edx + ebx*4 + 0x224c209f], ebx
lahf
pop ds
rcr byte [ebx], 0x71
not dword [edx + ebx*4 + 0x4d0ec99f]
invalid
xchg esp, eax
lcall 0xb5c7, 0x4d0ec99f
sbb edi, dword [edx]
invalid
mov ch, 0x1b
cmp cl, byte [edi + 0x7dd920de]
not ebx
in al, 0x40
hlt
Function at 0x401000
Capabilities:
Copy file
Extract resource via kernel32 functions
Get common file path
Get file size
Move file
Read file on windows
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x338
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x337]
mov byte [ebp - 0x338], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x233]
mov byte [ebp - 0x234], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0x12f]
mov byte [ebp - 0x130], bl
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0x1c], 0xa
mov byte [ebp - 0x1b], 0xa
mov byte [ebp - 0x1a], 0xa
mov byte [ebp - 0x19], 0xa
mov byte [ebp - 0x18], 0xa
mov byte [ebp - 0x17], 0xa
mov byte [ebp - 0x16], 0xa
mov byte [ebp - 0x15], 0xa
mov dword [ebp - 8], ebx
stosb byte es:[edi], al
call fcn.004021a1
mov eax, 0x401c20
mov edi, 0x401a0b
sub eax, edi
mov dword [ebp - 0x24], eax
mov eax, 0x401f02
sub eax, int.00401ce6
mov dword [ebp - 0x20], eax
mov eax, 0x4019fa
sub eax, 0x401943
mov dword [ebp - 0x28], eax
mov eax, 0x40193a
sub eax, fcn.004015ee
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push str.RT_RCDATA
push 0x66
call fcn.00401450
add esp, 0x10
cmp dword [ebp - 0x10], ebx
jne 0x4010d7
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
mov esi, 0x40443c
push 0x104
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x1c]
push 8
push eax
push section..data
call fcn.00402350
add esp, 0xc
test eax, eax
je 0x40119f
push 8
lea eax, [ebp - 0x130]
push section..data
push eax
call fcn.00401f17
push dword [ebp - 0x24]
lea eax, [ebp - 0x130]
push edi
push eax
call fcn.00401f8f
push dword [ebp - 0x20]
lea eax, [ebp - 0x130]
push int.00401ce6
push eax
call fcn.00401f8f
push dword [ebp - 0x28]
lea eax, [ebp - 0x130]
push 0x401943
push eax
call fcn.00401f8f
push dword [ebp - 0x2c]
lea eax, [ebp - 0x130]
push fcn.004015ee
push eax
call fcn.00401f8f
push dword [ebp - 0x10]
lea eax, [ebp - 0x130]
push dword [ebp - 0x14]
push eax
call fcn.00401f8f
add esp, 0x48
lea eax, [ebp - 0x130]
push 0x100
push ebx
push eax
call fcn.004022f0
call fcn.004015ee
push str.svchost.exe
push dword [ebp - 0x14]
call int.00401ce6
add esp, 0x14
mov dword [ebp - 4], ebx
call fcn.00401499
mov ecx, dword [ebp - 4]
inc dword [ebp - 4]
cmp dword [ebp - 4], 8
mov byte [ecx + section..data], al
jl 0x4011a2
lea eax, [ebp - 0x1c]
push 8
push eax
push section..data
call fcn.00402350
add esp, 0xc
test eax, eax
je 0x40119f
push 8
lea eax, [ebp - 0x130]
push section..data
push eax
call fcn.00401f17
push dword [ebp - 0x24]
lea eax, [ebp - 0x130]
push edi
push eax
call fcn.00401f8f
push dword [ebp - 0x20]
lea eax, [ebp - 0x130]
push int.00401ce6
push eax
call fcn.00401f8f
push dword [ebp - 0x28]
lea eax, [ebp - 0x130]
push 0x401943
push eax
jmp loc.00409000
Function at 0x401088
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x40c0cc]
xor eax, dword [ebp + 0x7c]
mov dword [ebp - 0x20], 0x94
mov dword [ebp + 0x74], eax
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x4010c4
cmp dword [ebp - 0x10], 2
jne 0x4010c4
cmp dword [ebp - 0x1c], 5
jb 0x4010c4
xor eax, eax
inc eax
jmp 0x4010c6
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, dword [ebp + 0x7c]
call fcn.004025c0
add ebp, 0x78
leave
ret

Function at 0x401165
Capabilities:
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x40c0cc]
xor eax, dword [ebp + 4]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x220]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push dword [0x40c0a0]
lea eax, [ebp - 0x220]
push eax
call fcn.004026e0
push dword [ebp + 8]
call fcn.00402640
add eax, 0x21
add esp, 0xc
and eax, 0xfffffffc
call fcn.004027d0
lea eax, [ebp - 0x14]
mov ebx, esp
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
push dword [ebp + 8]
movzx eax, word [ebp - 8]
push eax
movzx eax, word [ebp - 0xa]
push eax
movzx eax, word [ebp - 0xc]
push eax
movzx eax, word [ebp - 0xe]
push eax
movzx eax, word [ebp - 0x12]
push eax
movzx eax, word [ebp - 0x14]
push eax
push str.__04d__02d__02d__02d:_02d:_02d___s_r_n
push ebx
call fcn.004025e1
add esp, 0x24
xor esi, esi
push esi
push esi
push 4
push esi
push 1
push 0x40000000
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40123a
push 2
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push esi
lea eax, [ebp - 0x18]
push eax
push ebx
call fcn.00402640
pop ecx
push eax
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea esp, [ebp - 0x22c]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
call fcn.004025c0
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401275
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov eax, dword [0x40c0cc]
xor eax, dword [ebp + 4]
push 8
pop ecx
mov esi, str.SoftwareMicrosoft.NETFramework
lea edi, [ebp - 0x40]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov dword [ebp - 4], eax
mov esi, str.ZapDisable
lea edi, [ebp - 0x1c]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0xc]
push eax
movsd dword es:[edi], dword [esi]
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x2001f
movsw word es:[edi], word [esi]
push ebx
push 0x409b7d
movsb byte es:[edi], byte [esi]
push ebx
lea eax, [ebp - 0x40]
xor edi, edi
push eax
inc edi
push 0x80000002
mov dword [ebp - 8], edi
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
mov esi, 0x40cc40
jne 0x401379
cmp dword [ebp - 0xc], edi
jne 0x4012f0
lea eax, [ebp - 0x40]
push eax
push str.Created_new_registry_key:__s
jmp 0x4012ff
cmp dword [ebp - 0xc], 2
jne 0x401308
lea eax, [ebp - 0x40]
push eax
push str.Opened_existing_registry_key:__s
push esi
call fcn.004025e1
add esp, 0xc
push esi
call fcn.00401165
cmp dword [ebp + 8], ebx
pop ecx
je 0x401353
push 4
lea eax, [ebp - 8]
push eax
push 4
push ebx
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
test eax, eax
lea eax, [ebp - 0x1c]
push eax
jne 0x40133c
push str.Set_registry_value__s__0x_08X
jmp 0x401341
push str.ERROR:_Could_not_set_registry_value__s__0x_08X
push esi
call fcn.004025e1
add esp, 0x10
push esi
call fcn.00401165
pop ecx
jmp 0x401391
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 8]
test eax, eax
lea eax, [ebp - 0x1c]
push eax
jne 0x401372
push str.Removed_registry_value__s__0x_08x
jmp 0x401341
push str.ERROR:_Could_not_remove_registry_value__s__0x_08x
jmp 0x401341
lea eax, [ebp - 0x40]
push eax
push str.ERROR:_Could_not_open_registry_key:__s
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x10
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.004025c0
leave
ret
Function at 0x4013aa
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x31c
mov eax, dword [0x40c0cc]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
xor ebx, ebx
mov esi, 0x104
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x218]
push ebx
push eax
xor edi, edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
call fcn.00402810
add esp, 0xc
push esi
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp byte [ebp - 0x113], 0x3a
jne 0x4014ac
cmp byte [ebp - 0x112], 0x5c
jne 0x4014ac
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0x31c]
push eax
lea eax, [ebp - 0x114]
push eax
mov byte [ebp - 0x111], bl
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
test eax, eax
mov esi, 0x40cc40
je 0x401463
push 3
lea eax, [ebp - 0x218]
push 0x409c28
push eax
call fcn.00402449
add esp, 0xc
mov edi, eax
neg edi
sbb edi, edi
inc edi
jmp 0x40147e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.ERROR:_Failed_to_get_volume_information.__Error_code:__d
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x10
cmp edi, ebx
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x114]
push eax
je 0x401497
push str._s_is_running_on_FAT___s_.
jmp 0x40149c
push str._s_is_not_running_on_FAT___s_.
push esi
call fcn.004025e1
add esp, 0x10
push esi
call fcn.00401165
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
mov eax, edi
pop edi
pop esi
pop ebx
call fcn.004025c0
leave
ret
Function at 0x4014be
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x354
mov eax, dword [0x40c0cc]
xor eax, dword [ebp + 4]
push ebx
push esi
push edi
push dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 0x354]
push eax
call fcn.004026d0
lea eax, [ebp - 0x354]
push eax
call fcn.00402640
xor ecx, ecx
add esp, 0xc
cmp dword [ebp + 0x10], ecx
mov dword [ebp - 8], ecx
jbe 0x4015ad
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp + eax - 0x354]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push dword [eax + ecx*4]
push dword [ebp - 0xc]
call fcn.004026d0
pop ecx
pop ecx
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x354]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40155e
lea eax, [ebp - 0x354]
push eax
push str.File_not_found:__s
mov esi, 0x40cc40
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x10
jmp 0x40159d
lea eax, [ebp - 0x120]
push eax
push dword [ebp + 8]
call dword [ebp + 0x14]
mov ebx, eax
test ebx, ebx
pop ecx
pop ecx
jne 0x4015bf
lea eax, [ebp - 0x14c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401598
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov ebx, eax
call edi
or esi, 0xffffffff
cmp ebx, 0x12
jne 0x4015c4
cmp esi, 0xffffffff
jne 0x40155e
mov ecx, dword [ebp - 8]
inc ecx
cmp ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
jb 0x401511
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.004025c0
leave
ret
push esi
call edi
jmp 0x4015de
push ebx
push str.FindNextFile_returned_error_code:__d
mov esi, 0x40cc40
push esi
call fcn.004025e1
push esi
call fcn.00401165
add esp, 0x10
mov eax, ebx
jmp 0x4015af