joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41dbc8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffc48
xor eax, eax
mov dword [ebp - 0x3b8], eax
mov dword [ebp - 0x3b4], eax
mov dword [ebp - 0x3b0], eax
mov dword [ebp - 0x3a0], eax
mov dword [ebp - 0x3a8], eax
mov dword [ebp - 0x3ac], eax
mov dword [ebp - 0x3a4], eax
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41dd6d
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x3a4]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3a4]
lea edx, [ebp - 0x3a0]
call fcn.00408148
push dword [ebp - 0x3a0]
lea edx, [ebp - 0x3ac]
xor eax, eax
call fcn.004029a0
mov eax, dword [ebp - 0x3ac]
lea edx, [ebp - 0x3a8]
call fcn.00408210
push dword [ebp - 0x3a8]
push 0x41dd80
lea eax, [ebp - 4]
mov edx, 3
call fcn.00404b0c
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x1d0]
call fcn.00402d44
lea eax, [ebp - 0x1d0]
call fcn.00402ad4
lea eax, [ebp - 0x1d0]
call fcn.00402ee8
lea eax, [ebp - 0x3b0]
call fcn.0041ca9c
lea eax, [ebp - 0x3b0]
mov edx, 0x41dd90
call fcn.00404a54
mov edx, dword [ebp - 0x3b0]
lea eax, [ebp - 0x39c]
call fcn.00402d44
lea eax, [ebp - 0x39c]
call fcn.00402ad4
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x39c]
call fcn.00404d90
call fcn.00403558
lea eax, [ebp - 0x39c]
call fcn.00402ee8
push 0
lea eax, [ebp - 0x3b4]
call fcn.0041ca9c
lea eax, [ebp - 0x3b4]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b4]
call fcn.00404c44
push eax
call sub.kernel32.dll_WinExec
push 0x5dc
call sub.kernel32.dll_Sleep
lea eax, [ebp - 0x3b8]
call fcn.0041ca9c
lea eax, [ebp - 0x3b8]
mov edx, 0x41dd90
call fcn.00404a54
mov eax, dword [ebp - 0x3b8]
call fcn.004080e0
mov eax, dword [ebp - 4]
call fcn.004080e0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41dd74
lea eax, [ebp - 0x3b8]
mov edx, 7
call fcn.004047b8
lea eax, [ebp - 4]
call fcn.00404794
ret

Function at 0x431004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x4f941f41
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x762a7ff7
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x10001640
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x10001667
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push 0x10001350
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor eax, eax
pop ebp
ret 0xc

Function at 0x424040
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c9d0
add esp, 4
test eax, eax
je 0x42420e
mov ebx, dword [esp + 0x368]
test ebx, ebx
je 0x42420e
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040ce70
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424137
call fcn.004246e0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040ce70
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42411d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
test eax, eax
jl 0x42411d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4240c3
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040ce70
add esp, 8
lea eax, [esp + 0x18]
push 0x42b1bc
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4241fd
call fcn.004246e0
test byte [esp + 0x220], 0x10
je 0x4241e3
cmp byte [esp + 0x24c], 0x2e
je 0x4241e3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040ce70
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424040
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42417b
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov eax, dword [0x4dc063]
shl eax, 2
mov dword [0x4dc067], eax
push edi
push ecx
xor eax, eax
mov edi, 0x5eaa04
mov ecx, 0x62d71c
cmp ecx, edi
jbe 0x401024
sub ecx, edi
cld
rep stosb byte es:[edi], al
pop ecx
pop edi
push 0
call fcn.004cde2f
pop ecx
push 0x4dc02c
push 0
call sub.KERNEL32.dll_GetModuleHandleA
mov dword [0x4dc06b], eax
push 0
jmp fcn.004d94dc

Function at 0x4017b8
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
mov ebx, dword [ebp + 8]
mov eax, dword [0x4dc0d4]
dec eax
je 0x40187c
mov dword [0x4dc0d4], 1
push 0
call sub.KERNEL32.dll_GetProcessHeap
push eax
call sub.KERNEL32.dll_HeapCompact
call fcn.004d8380
push 0
call sub.USER32.dll_MessageBeep
lea edx, [ebp - 0x20]
push edx
call sub.KERNEL32.dll_GlobalMemoryStatus
test ebx, ebx
jne 0x401804
mov ebx, dword [ebp - 0x18]
jmp 0x401809
mov eax, dword [ebp - 0x14]
add ebx, eax
push 4
push 0x1000
push ebx
push 0
call sub.KERNEL32.dll_VirtualAlloc
mov esi, eax
test esi, esi
je 0x401874
xor ecx, ecx
xor eax, eax
mov edx, esi
cmp ebx, eax
jbe 0x401840
mov byte [edx], 0
add ecx, 0x800
add edx, 0x1000
add eax, 0x1000
cmp ebx, eax
ja 0x401828
mov eax, 0x800
lea edx, [esi + 0x800]
cmp ebx, eax
jbe 0x401867
mov byte [edx], 0
add ecx, 0x800
add edx, 0x1000
add eax, 0x1000
cmp ebx, eax
ja 0x40184f
push 0x8000
push 0
push esi
call sub.KERNEL32.dll_VirtualFree
xor ecx, ecx
mov dword [0x4dc0d4], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403f30
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
or ebx, 0xffffffff
mov esi, dword [ebp + 8]
push 0x15
push esi
call fcn.00403da4
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x403f5e
push 0x11
push esi
call fcn.00403da4
add esp, 8
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x403f7c
push 0
mov edx, dword [ebp - 4]
push edx
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
lea eax, [ebp - 4]
push eax
call fcn.00403e78
pop ecx
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x4040f0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test esi, esi
jne 0x404109
push ebx
call fcn.00404018
pop ecx
jmp 0x40415d
push ebx
call fcn.00404018
pop ecx
test eax, eax
jne 0x404118
xor eax, eax
jmp 0x40415d
push ebx
call fcn.00403f84
pop ecx
mov edi, eax
push 2
push esi
push ebx
call fcn.00403fe8
add esp, 0xc
push ebx
call sub.KERNEL32.dll_SetEndOfFile
test eax, eax
jne 0x404142
push ebx
call fcn.00404018
pop ecx
xor eax, eax
jmp 0x40415d
push edi
push ebx
call fcn.00403fa4
add esp, 8
mov dword [0x4dc074], 0x613
push ebx
call fcn.00404018
pop ecx
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40419c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
lea esi, [ebp + 0x10]
cmp dword [ebp + 0x10], 0
mov edi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
jne 0x4041b6
mov eax, dword [ebp + 0x10]
jmp 0x4041fd
mov edx, dword [ebp + 0x10]
push edx
push 0
push ebx
call fcn.004cd264
add esp, 0xc
push 0
push esi
mov ecx, dword [ebp + 0x10]
push ecx
push ebx
push edi
call sub.KERNEL32.dll_ReadFile
mov ebx, eax
mov eax, dword [ebp + 0x10]
test eax, eax
jne 0x4041e7
test ebx, ebx
je 0x4041e7
push edi
call fcn.00404018
pop ecx
test ebx, ebx
jne 0x4041f0
xor edx, edx
mov dword [ebp + 0x10], edx
mov dword [0x4dc074], 0x615
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4042b4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 8]
lea esi, [ebp + 0x10]
cmp dword [ebp + 0x10], 0
jne 0x4042ca
mov eax, dword [ebp + 0x10]
jmp 0x404319
push ebx
call fcn.00404058
pop ecx
test eax, eax
je 0x4042f1
mov edx, dword [ebp + 0x10]
push edx
push ebx
call fcn.004040f0
add esp, 8
mov ecx, dword [ebp + 0x10]
neg ecx
push ecx
push ebx
call fcn.004040a4
add esp, 8
push 0
push esi
mov eax, dword [ebp + 0x10]
push eax
mov edx, dword [ebp + 0xc]
push edx
push ebx
call sub.KERNEL32.dll_WriteFile
test eax, eax
jne 0x40430a
xor eax, eax
jmp 0x404319
mov dword [0x4dc074], 0x617
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x4046a0
Capabilities:
Timestomp file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
lea eax, [ebp - 0x18]
push eax
call sub.KERNEL32.dll_GetSystemTime
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 0x18]
push ecx
call sub.KERNEL32.dll_SystemTimeToFileTime
lea eax, [ebp - 8]
push eax
push 0
push 0
mov edx, dword [ebp + 8]
push edx
call sub.KERNEL32.dll_SetFileTime
mov esp, ebp
pop ebp
ret
Function at 0x404e38
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
push 0x5c9f16
call fcn.004036e4
pop ecx
mov esi, eax
push 0x5c9f2a
call fcn.004036e4
pop ecx
mov edi, eax
push 0x5c9f3d
call fcn.004036e4
pop ecx
mov dword [ebp - 4], eax
push 1
push 0x5c9f4f
call fcn.004038c8
add esp, 8
push 1
push 0x5c9f63
call fcn.004038c8
add esp, 8
push 1
push 0x5c9f76
call fcn.004038c8
add esp, 8
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x404eab
mov ebx, 0xffffff87
jmp 0x404ebe
push eax
mov eax, dword [ebp + 0xc]
push eax
call sub.KERNEL32.dll_SetFileAttributesA
test eax, eax
jne 0x404ebe
mov ebx, 0xffffff7d
push esi
push 0x5c9f88
call fcn.004038c8
add esp, 8
push edi
push 0x5c9f9c
call fcn.004038c8
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x5c9faf
call fcn.004038c8
add esp, 8
test ebx, ebx
je 0x404ef3
xor eax, eax
jmp 0x404ef5
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret

Function at 0x404efc
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push 0x5c9fc1
call fcn.004036e4
pop ecx
mov edi, eax
push 0x5c9fd5
call fcn.004036e4
pop ecx
mov dword [ebp - 4], eax
push 0x5c9fe8
call fcn.004036e4
pop ecx
mov dword [ebp - 8], eax
push 1
push 0x5c9ffa
call fcn.004038c8
add esp, 8
push 1
push 0x5ca00e
call fcn.004038c8
add esp, 8
push 1
push 0x5ca021
call fcn.004038c8
add esp, 8
push esi
call sub.KERNEL32.dll_GetFileAttributesA
cmp eax, 0xffffffff
jne 0x404f73
mov ebx, 0xffffff87
jmp 0x404fdc
test al, 0x80
je 0x404f7c
and eax, 0xffffff7f
test bh, 1
je 0x404f84
or eax, 1
test bh, 2
je 0x404f8c
and eax, 0xfffffffe
test bh, 0x10
je 0x404f94
or eax, 4
test bh, 0x20
je 0x404f9c
and eax, 0xfffffffb
test ebx, 0x10000
je 0x404fa7
or eax, 0x20
test ebx, 0x20000
je 0x404fb2
and eax, 0xffffffdf
test ebx, 0x100000
je 0x404fbd
or eax, 2
test ebx, 0x200000
je 0x404fc8
and eax, 0xfffffffd
push eax
push esi
call sub.KERNEL32.dll_SetFileAttributesA
test eax, eax
jne 0x404fda
mov ebx, 0xffffff73
jmp 0x404fdc
xor ebx, ebx
push edi
push 0x5ca033
call fcn.004038c8
add esp, 8
mov eax, dword [ebp - 4]
push eax
push 0x5ca047
call fcn.004038c8
add esp, 8
mov edx, dword [ebp - 8]
push edx
push 0x5ca05a
call fcn.004038c8
add esp, 8
test ebx, ebx
je 0x405014
xor eax, eax
jmp 0x405016
mov al, 1
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x40581c
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
test ebx, ebx
jne 0x40582f
xor eax, eax
jmp 0x40586a
test esi, esi
jne 0x405837
xor eax, eax
jmp 0x40586a
push esi
push ebx
call fcn.004cd568
add esp, 8
test eax, eax
jne 0x40584c
mov eax, 1
jmp 0x40586a
push esi
push ebx
call sub.KERNEL32.dll_MoveFileA
test eax, eax
jne 0x40585b
xor eax, eax
jmp 0x40586a
mov dword [0x4dc074], 0x630
mov eax, 1
pop esi
pop ebx
pop ebp
ret

Function at 0x4058f4
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0x200
push ebx
call fcn.00404efc
add esp, 8
push 4
push 0
push ebx
call sub.KERNEL32.dll_MoveFileExA
pop ebx
pop ebp
ret

Function at 0x405918
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdbc
mov ecx, 0x50
lea eax, [ebp - 0x244]
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x140]
push esi
mov esi, 0x4dc300
rep movsd dword es:[edi], dword [esi]
pop esi
lea edi, [ebp - 0x244]
push esi
mov esi, 0x4dc440
mov ecx, 0x41
rep movsd dword es:[edi], dword [esi]
pop esi
push 0x5ca1d2
push esi
push eax
call fcn.00405870
add esp, 0xc
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x244]
push ecx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
cmp edi, 0xffffffff
je 0x405a5d
lea ebx, [ebp - 0x10]
test ebx, ebx
jne 0x40598f
lea ebx, [ebp - 0x114]
mov al, byte [ebx]
test al, al
jne 0x40599b
lea ebx, [ebp - 0x114]
test ebx, ebx
je 0x405a57
mov al, byte [ebx]
test al, al
je 0x405a57
movsx edx, byte [ebx]
cmp edx, 0x2e
jne 0x4059c0
mov cl, byte [ebx + 1]
test cl, cl
je 0x405a42
movsx eax, byte [ebx]
cmp eax, 0x2e
jne 0x4059d8
movsx edx, byte [ebx + 1]
cmp edx, 0x2e
jne 0x4059d8
mov cl, byte [ebx + 2]
test cl, cl
je 0x405a42
lea eax, [ebp - 0x244]
push eax
call fcn.004cd3e4
pop ecx
push eax
push ebx
call fcn.004cd3e4
pop ecx
pop edx
add edx, eax
add edx, 2
cmp edx, 0x104
ja 0x405a57
test byte [ebp - 0x140], 0x10
je 0x405a24
push ebx
push esi
lea ecx, [ebp - 0x244]
push ecx
call fcn.00405870
add esp, 0xc
lea eax, [ebp - 0x244]
push eax
call fcn.00405918
pop ecx
jmp 0x405a42
push ebx
push esi
lea edx, [ebp - 0x244]
push edx
call fcn.00405870
add esp, 0xc
lea ecx, [ebp - 0x244]
push ecx
call fcn.004058f4
pop ecx
lea eax, [ebp - 0x140]
push eax
push edi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x405982
push edi
call sub.KERNEL32.dll_CloseHandle
xor eax, eax
push esi
mov edi, esi
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea esi, [ebp - 0x244]
xchg edi, esi
mov edx, ecx
mov eax, edi
shr ecx, 2
lea eax, [ebp - 0x244]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
push 0
push esi
push eax
call fcn.00405870
add esp, 0xc
lea edx, [ebp - 0x244]
push edx
call fcn.004058f4
pop ecx
mov al, 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405b9c
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
push ebx
push esi
push edi
xor ebx, ebx
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
mov byte [ebp - 1], 0
test esi, 0x200
je 0x405bc0
mov byte [ebp - 1], 1
test esi, 0x100
je 0x405bca
mov bl, 1
test esi, 0x200
jne 0x405be0
test esi, 0x100
jne 0x405be0
mov byte [ebp - 1], 1
mov bl, 1
test edi, edi
je 0x405d39
mov al, byte [edi]
test al, al
je 0x405d39
test esi, 0x1000
je 0x405c09
push edi
call fcn.00405b64
pop ecx
test al, al
jne 0x405d39
lea edx, [ebp - 0x108]
push edx
push edi
call fcn.00405ad4
add esp, 8
mov cl, byte [ebp - 0x108]
test cl, cl
je 0x405c52
lea eax, [ebp - 0x108]
push eax
call fcn.004cd3e4
pop ecx
movsx edx, byte [ebp + eax - 0x109]
cmp edx, 0x5c
jne 0x405c52
lea ecx, [ebp - 0x108]
push ecx
call fcn.004cd3e4
pop ecx
mov byte [ebp + eax - 0x109], 0
lea eax, [ebp - 0x248]
push eax
lea edx, [ebp - 0x108]
push edx
call sub.KERNEL32.dll_FindFirstFileA
mov edi, eax
cmp edi, 0xffffffff
jne 0x405ca7
call sub.KERNEL32.dll_GetLastError
cmp eax, 2
jne 0x405c9c
movsx eax, byte [ebp - 0x107]
cmp eax, 0x3a
jne 0x405c9c
mov dl, byte [ebp - 0x106]
test dl, dl
jne 0x405c9c
push edi
call sub.KERNEL32.dll_FindClose
mov eax, 1
jmp 0x405d3b
push edi
call sub.KERNEL32.dll_FindClose
jmp 0x405d39
mov dl, byte [ebp - 1]
test dl, dl
je 0x405cd6
test byte [ebp - 0x248], 0x10
je 0x405cd6
test esi, 0x2000
jne 0x405cd6
push edi
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x405d3b
mov eax, 1
jmp 0x405d3b
test bl, bl
je 0x405d1e
test byte [ebp - 0x248], 0x10
jne 0x405d1e
test esi, 0x2000
je 0x405d07
mov edx, dword [ebp - 0x22c]
test edx, edx
jne 0x405d07
mov ecx, dword [ebp - 0x228]
test ecx, ecx
jne 0x405d07
push edi
call sub.KERNEL32.dll_FindClose
jmp 0x405d33
push edi
call sub.KERNEL32.dll_FindClose
mov eax, dword [ebp - 0x228]
test eax, eax
jne 0x405d3b
mov eax, 1
jmp 0x405d3b
lea edx, [ebp - 0x248]
push edx
push edi
call sub.KERNEL32.dll_FindNextFileA
test eax, eax
jne 0x405ca7
push edi
call sub.KERNEL32.dll_FindClose
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x405d44
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x405d9d
call fcn.00401270
push eax
push 0x5ca1d4
push ebx
call fcn.004d1ac0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
push 0x104
call sub.KERNEL32.dll_GetTempPathA
test eax, eax
je 0x405d9d
push ebx
push 0
push 0x5ca1e0
lea edx, [ebp - 0x104]
push edx
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
je 0x405d9d
mov eax, 1
jmp 0x405d9f
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406678
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
xor eax, eax
push ebx
push esi
push edi
or ebx, 0xffffffff
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x18]
mov dword [ebp - 4], eax
test edi, edi
je 0x4067ca
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x4067ca
lea ecx, [ebp - 4]
push ecx
push 0x20106
push 0
mov eax, dword [ebp + 0xc]
push eax
mov edx, dword [ebp + 8]
push edx
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x4066fd
cmp esi, 0xfffffffe
jne 0x4066cd
mov ebx, 1
jmp 0x4067ca
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 4]
push edx
push 0
push 0xf013f
push 0
push 0
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_RegCreateKeyExA
test eax, eax
je 0x4066fd
mov ebx, 0xffffff9b
jmp 0x4067ca
cmp esi, 0xfffffffe
jne 0x406724
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegDeleteValueA
test eax, eax
je 0x40671a
mov ebx, 0xffffff37
jmp 0x4067ca
mov ebx, 1
jmp 0x4067ca
mov eax, dword [ebp + 0x1c]
sub eax, 4
jne 0x406766
mov edx, dword [ebp + 0x14]
cmp esi, 0xffffffff
mov dword [ebp - 0xc], edx
jne 0x406740
mov dword [ebp - 8], 4
jmp 0x406743
mov dword [ebp - 8], esi
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0xc]
push ecx
push eax
mov edx, dword [ebp + 0x1c]
push edx
push 0
push edi
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x4067ca
mov ebx, 1
jmp 0x4067ca
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4067ca
cmp esi, 0xffffffff
jne 0x4067a6
mov edx, dword [ebp + 0x1c]
sub edx, 7
je 0x406789
mov ecx, dword [ebp + 0x14]
push ecx
call fcn.004cd3e4
pop ecx
mov dword [ebp - 8], eax
jmp 0x4067a9
xor eax, eax
mov dword [ebp - 8], eax
mov edx, dword [ebp + 0x14]
mov eax, edx
mov dl, byte [eax]
test dl, dl
jne 0x4067a0
mov cl, byte [eax + 1]
test cl, cl
je 0x4067a9
inc dword [ebp - 8]
inc eax
jmp 0x406793
mov dword [ebp - 8], esi
mov eax, dword [ebp - 8]
push eax
mov edx, dword [ebp + 0x14]
push edx
mov ecx, dword [ebp + 0x1c]
push ecx
push 0
push edi
mov eax, dword [ebp - 4]
push eax
call sub.ADVAPI32.dll_RegSetValueExA
test eax, eax
jne 0x4067ca
mov ebx, 1
mov eax, dword [ebp - 4]
test eax, eax
je 0x4067da
mov edx, dword [ebp - 4]
push edx
call sub.ADVAPI32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4067e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
or ebx, 0xffffffff
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], edx
xor edx, edx
mov dword [ebp - 4], edx
test edi, edi
je 0x40685f
test eax, eax
je 0x40685f
lea ecx, [ebp - 4]
push ecx
push 0x20119
push 0
push eax
mov eax, dword [ebp + 8]
push eax
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x40682c
mov ebx, 0xffffff9b
jmp 0x40685f
lea eax, [ebp - 8]
lea edx, [ebp - 0xc]
push eax
push esi
push edx
push 0
push edi
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegQueryValueExA
test eax, eax
je 0x40684c
mov ebx, 0xffffff37
jmp 0x40685f
mov ebx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, 1
jne 0x40685f
test esi, esi
je 0x40685f
mov byte [esi + ebx], 0
mov edx, dword [ebp - 4]
test edx, edx
je 0x40686f
mov ecx, dword [ebp - 4]
push ecx
call sub.ADVAPI32.dll_RegCloseKey
test ebx, ebx
jge 0x406886
test esi, esi
je 0x406886
mov byte [esi], 0
mov byte [esi + 1], 0
mov byte [esi + 2], 0
mov byte [esi + 3], 0
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406890
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push 0x20119
push 0
push esi
push edi
call sub.ADVAPI32.dll_RegOpenKeyExA
test eax, eax
je 0x4068ce
cmp eax, 2
jne 0x4068c7
mov eax, 1
jmp 0x406996
xor eax, eax
jmp 0x406996
push esi
call sub.KERNEL32.dll_lstrlenA
mov ebx, eax
add ebx, esi
movsx eax, byte [ebx - 1]
cmp eax, 0x5c
je 0x4068e8
mov byte [ebx], 0x5c
inc ebx
mov byte [ebx], 0
mov dword [ebp - 4], 0x104
lea edx, [ebp - 0x10]
lea ecx, [ebp - 4]
push edx
push 0
push 0
push 0
push ecx
lea eax, [ebp - 0x114]
push eax
push 0
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
jne 0x406975
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x114]
or ecx, 0xffffffff
mov esi, ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
xchg edi, esi
shr ecx, 2
mov eax, edi
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
push esi
push edi
call fcn.00406890
add esp, 8
test eax, eax
je 0x406975
mov dword [ebp - 4], 0x104
lea eax, [ebp - 0x10]
lea edx, [ebp - 4]
push eax
push 0
push 0
push 0
push edx
lea ecx, [ebp - 0x114]
push ecx
push 0
mov eax, dword [ebp - 8]
push eax
call sub.ADVAPI32.dll_RegEnumKeyExA
test eax, eax
je 0x406913
dec ebx
mov byte [ebx], 0
mov edx, dword [ebp - 8]
push edx
call sub.ADVAPI32.dll_RegCloseKey
push esi
push edi
call sub.ADVAPI32.dll_RegDeleteKeyA
test eax, eax
jne 0x406994
mov eax, 1
jmp 0x406996
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret