joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41215d
Capabilities:
Set environment variable

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x120
push esi
push edi
push 0x2c
push 2
push dword [ebp + 0x7c]
lea eax, [ebp - 0xac]
push eax
call fcn.0040ad20
add esp, 0x10
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp + 0x34]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp + 0x34]
xor eax, eax
cmp ecx, eax
je 0x412198
cmp word [ecx], ax
jne 0x4121ac
mov edx, dword [ebp + 0x38]
cmp edx, eax
je 0x41223f
cmp word [edx], ax
je 0x41223f
cmp ecx, eax
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
je 0x4121fc
cmp word [ecx], ax
je 0x4121fc
push 0x9e
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0
call edi
push eax
lea eax, [ebp - 0x6c]
push 0x4025ac
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x34]
call ebx
xor eax, eax
mov ecx, dword [ebp + 0x38]
cmp ecx, eax
je 0x41223a
cmp word [ecx], ax
je 0x41223a
push 0x9e
push eax
mov word [ebp - 0x6c], ax
lea eax, [ebp - 0x6a]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 1
call edi
push eax
lea eax, [ebp - 0x6c]
push 0x4025ac
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x6c]
push eax
push dword [ebp + 0x38]
call ebx
xor eax, eax
pop ebx
jmp 0x412242
xor eax, eax
inc eax
pop edi
pop esi
add ebp, 0x74
leave
ret

Function at 0x4122c5
Capabilities:
Acquire debug privileges
Terminate process

Disassembly:
push ebp
mov ebp, dword [esp + 8]
cmp word [ebp], 0x5c
push edi
jne 0x41231f
add ebp, 2
push ebp
call fcn.0040ac04
xor edi, edi
cmp eax, edi
pop ecx
je 0x412305
cmp word [eax], di
je 0x412305
push eax
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x41231a
push edi
push edi
push 0x10
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
xor eax, eax
jmp 0x41238a
mov eax, dword [0x4228a4]
cmp eax, edi
je 0x41231a
push edi
push edi
push 0x10
push dword [eax + 0x4d0]
jmp 0x4122f8
xor eax, eax
inc eax
jmp 0x41238a
push ebx
mov dword [esp + 0x10], 1
xor edi, edi
push esi
push ebp
call fcn.0040b210
mov ebx, eax
cmp ebx, edi
pop ecx
je 0x412384
push ebx
push edi
push 0x1f0fff
call dword [sym.imp.KERNEL32.DLL_OpenProcess]
mov esi, eax
cmp esi, edi
je 0x41237a
push 0x4029a4
call fcn.0040e37e
test eax, eax
pop ecx
push edi
push esi
je 0x412365
call fcn.00405b8f
pop ecx
pop ecx
jmp 0x41236b
call dword [sym.imp.KERNEL32.DLL_TerminateProcess]
test eax, eax
je 0x412373
mov dword [esp + 0x14], edi
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
cmp ebx, edi
jbe 0x412384
cmp word [ebp], di
jne 0x41232b
mov eax, dword [esp + 0x14]
pop esi
pop ebx
pop edi
pop ebp
ret
Function at 0x412575
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x210
push edi
xor edi, edi
cmp eax, edi
je 0x412757
cmp word [eax], di
je 0x412757
push esi
push eax
mov dword [ebp - 4], edi
call fcn.0040ac04
pop ecx
mov esi, eax
push esi
call dword [sym.imp.USER32.dll_CharUpperW]
push 0x2c
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
cmp eax, edi
je 0x4125c7
mov word [eax], di
add eax, 2
push eax
call fcn.00403b00
pop ecx
mov dword [ebp - 4], eax
push ebx
push 0x3a
xor ebx, ebx
and dword [ebp - 8], ebx
push esi
call dword [sym.imp.SHLWAPI.dll_StrChrW]
test eax, eax
mov dword [ebp + 8], eax
je 0x4125f0
cmp word [esi], 0x3a
je 0x412755
sub dword [ebp + 8], 2
mov eax, dword [ebp - 8]
jmp 0x41262a
test esi, esi
je 0x412755
cmp word [esi], bx
je 0x412755
push 0x4030cc
push esi
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov ebx, eax
neg ebx
push 0x4030c4
sbb ebx, ebx
push esi
neg ebx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
neg eax
sbb eax, eax
neg eax
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 8]
test ecx, ecx
jne 0x4126b6
test ebx, ebx
jne 0x412641
test eax, eax
je 0x412755
and word [ebp - 0x210], di
push 0x206
lea eax, [ebp - 0x20e]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x210]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
cmp word [ebp - 0x210], di
lea esi, [ebp - 0x210]
je 0x412755
movzx eax, word [esi]
push eax
call fcn.004041fb
test eax, eax
pop ecx
jne 0x41269f
movzx eax, word [esi]
push eax
call fcn.004041d9
test eax, eax
pop ecx
je 0x412710
cmp dword [ebp - 8], 0
je 0x412710
movzx eax, word [esi]
push 0
push eax
call fcn.00412455
pop ecx
jmp 0x412738
movzx eax, word [ecx]
push eax
call fcn.0040462d
test eax, eax
pop ecx
je 0x4126db
cmp dword [ebp - 4], edi
mov eax, dword [ebp + 8]
movzx eax, word [eax]
jne 0x4126d3
push 1
jmp 0x4126ff
push eax
call fcn.00405470
jmp 0x412706
mov esi, dword [ebp + 8]
movzx eax, word [esi]
push eax
call fcn.004041fb
test eax, eax
pop ecx
jne 0x4126fa
movzx eax, word [esi]
push eax
call fcn.004041d9
test eax, eax
pop ecx
je 0x412755
movzx eax, word [esi]
push 0
push eax
call fcn.00412455
pop ecx
mov edi, eax
neg edi
sbb edi, edi
pop ecx
inc edi
jmp 0x412755
test ebx, ebx
je 0x412740
movzx eax, word [esi]
push eax
call fcn.0040462d
test eax, eax
pop ecx
je 0x412740
cmp dword [ebp - 4], 0
movzx eax, word [esi]
jne 0x412732
push 1
jmp 0x4126aa
push eax
call fcn.00405470
neg eax
sbb eax, eax
inc eax
pop ecx
or edi, eax
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], 0
jne 0x412683
pop ebx
pop esi
mov eax, edi
pop edi
leave
ret
Function at 0x41275c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa0
push ebx
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
push edi
je 0x4127a3
cmp byte [ebp + 8], 0
jne 0x4127a3
push 0x4030cc
lea eax, [ebp - 0xa0]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea eax, [ebp - 0xa0]
push eax
call fcn.00412575
test eax, eax
pop ecx
jne 0x4127a3
push 0x2710
call fcn.0040e3e6
pop ecx
lea eax, [ebp + 0xc]
push eax
mov ebx, 0x7d0
push ebx
push esi
push esi
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageTimeoutW]
push 0x11
mov edi, 0xffff
push edi
call esi
lea eax, [ebp + 0xc]
push eax
push ebx
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x16
push edi
call esi
push 0x1f4
call fcn.0040e3e6
mov dword [esp], 0x4030d4
call fcn.0040e37e
test eax, eax
pop ecx
je 0x412832
movzx eax, byte [ebp + 8]
sub eax, ebx
je 0x41281c
dec eax
je 0x412818
dec eax
je 0x41280e
dec eax
je 0x412803
dec eax
jne 0x412824
push 1
push ebx
jmp 0x412807
push 1
push 1
call fcn.00420044
jmp 0x412824
push ebx
push ebx
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp 0x412824
push 1
jmp 0x41281e
push 2
call fcn.00405b5b
pop ecx
call dword [sym.imp.KERNEL32.DLL_GetLastError]
neg eax
sbb eax, eax
neg eax
jmp 0x412835
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x412beb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
push esi
push edi
call fcn.0040aebd
push 0x3ff
lea eax, [ebp - 0x3ff]
push 0
push eax
mov byte [ebp - 0x400], 0
call sub.MSVCRT.dll_memset
add esp, 0xc
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x400]
push eax
call fcn.00403ae1
add esp, 0xc
lea eax, [ebp - 0x400]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenA]
mov ecx, dword [0x424040]
mov edi, eax
xor edx, edx
test edi, edi
mov esi, ecx
jbe 0x412c71
movzx eax, byte [ebp + edx - 0x400]
xor eax, esi
and eax, 0xff
shr esi, 8
xor esi, dword [eax*4 + 0x423c40]
inc edx
cmp edx, edi
jb 0x412c53
xor esi, ecx
push esi
call fcn.0040aef7
pop ecx
pop edi
pop esi
leave
ret

Function at 0x412c7e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x40000
call fcn.00420160
push ebx
push edi
call fcn.0040aebd
mov edi, dword [0x424040]
push SysReAllocString
push dword [ebp + 8]
call fcn.00403b1c
mov ebx, eax
xor eax, eax
cmp ebx, eax
pop ecx
pop ecx
je 0x412d03
push esi
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_SetFilePointer]
mov esi, 0x40000
jmp 0x412ce6
xor ecx, ecx
test eax, eax
jbe 0x412ce6
movzx edx, byte [ebp + ecx - 0x40000]
xor edx, edi
and edx, 0xff
shr edi, 8
xor edi, dword [edx*4 + 0x423c40]
inc ecx
cmp ecx, eax
jb 0x412cc7
push esi
lea eax, [ebp - 0x40000]
push eax
push ebx
call fcn.00403b5e
add esp, 0xc
test eax, eax
jne 0x412cc1
push ebx
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
pop esi
xor edi, dword [0x424040]
push edi
call fcn.0040aef7
pop ecx
pop edi
pop ebx
leave
ret
Function at 0x4130e7
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2b4
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x413153
cmp word [esi], 0
je 0x413153
push dword [ebp + 0xc]
push esi
push dword [0x423438]
call dword [sym.imp.SHELL32.dll_ExtractIconW]
test eax, eax
jne 0x413155
and dword [ebp - 0x2b4], eax
push 0x2b0
push eax
lea eax, [ebp - 0x2b0]
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push 0x100
push 0x2b4
lea eax, [ebp - 0x2b4]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x413153
mov eax, dword [ebp - 0x2b4]
jmp 0x413155
xor eax, eax
pop esi
leave
ret

Function at 0x413195
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
cmp dword [ebp + 0xc], 0x111
mov dword [ebp - 0xc], esi
jne 0x4131dd
mov eax, dword [ebp + 0x10]
mov ecx, dword [0x4228a8]
imul eax, eax, 0x368
lea eax, [eax + ecx + 0x150]
cmp eax, esi
je 0x4132e2
cmp word [eax], si
je 0x4132e2
push eax
call fcn.0041f8dc
pop ecx
jmp 0x4132e2
cmp dword [0x42271c], esi
mov dword [ebp - 8], esi
jl 0x4132e2
push ebx
push edi
xor edi, edi
mov eax, dword [0x4228a8]
mov ebx, dword [ebp + 8]
add eax, edi
cmp dword [eax + 0x360], ebx
jne 0x4132c8
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
push dword [eax + 0x364]
call dword [sym.imp.USER32.dll_CallWindowProcW]
cmp dword [ebp + 0xc], 0xf
mov dword [ebp - 0xc], eax
jne 0x41329d
mov eax, dword [0x4228a8]
add eax, edi
cmp dword [eax + 0x358], esi
je 0x4132c8
mov esi, dword [eax + 0xc]
push ebx
sub esi, 6
call fcn.00413158
test eax, eax
pop ecx
je 0x41325a
push 1
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
mov byte [ebp - 1], 1
jl 0x41325e
mov byte [ebp - 1], 0
push ebx
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [0x4228a8]
push 3
push 0
push 0
push esi
mov ebx, eax
movzx eax, byte [ebp - 1]
push esi
push dword [edi + ecx + 0x358]
lea ecx, [eax + 3]
push ecx
add eax, 6
push eax
push ebx
call dword [sym.imp.USER32.dll_DrawIconEx]
push ebx
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ReleaseDC]
xor esi, esi
jmp 0x4132c8
cmp dword [ebp + 0xc], 0x100
jne 0x4132c8
cmp dword [ebp + 0x10], 0xd
jne 0x4132c8
mov eax, dword [0x4228a8]
lea eax, [edi + eax + 0x150]
cmp eax, esi
je 0x4132c8
cmp word [eax], si
je 0x4132c8
push eax
call fcn.0041f8dc
pop ecx
inc dword [ebp - 8]
mov eax, dword [ebp - 8]
add edi, 0x368
cmp eax, dword [0x42271c]
jle 0x4131f0
pop edi
pop ebx
mov eax, dword [ebp - 0xc]
pop esi
leave
ret 0x10
Function at 0x4132ea
Capabilities:
Get graphical window text

Disassembly:
mov eax, dword [0x4228b8]
push esi
mov esi, dword [esp + 0xc]
imul esi, esi, 0x364
push edi
push 0x50
lea eax, [esi + eax + 0xb0]
push eax
push dword [esp + 0x14]
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor edi, edi
push edi
push edi
push 0xf0
push dword [esp + 0x18]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [0x4228b8]
push edi
push edi
push dword [esp + 0x18]
mov dword [esi + ecx + 0x35c], eax
push 4
call fcn.0040c2ad
mov eax, dword [0x4228b8]
lea eax, [esi + eax + 0x150]
add esp, 0x10
cmp eax, edi
je 0x41335b
cmp word [eax], di
je 0x41335b
push eax
call fcn.0041f8dc
pop ecx
pop edi
xor eax, eax
pop esi
ret 8

Function at 0x414763
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, word [ebp + 0xc]
push esi
xor esi, esi
push edi
xor edi, edi
inc esi
cmp word [ebp + 8], di
mov dword [ebp - 8], eax
mov dword [ebp - 4], edi
jbe 0x41488a
push ebx
push edi
call fcn.00404194
test eax, eax
pop ecx
je 0x414874
push edi
call fcn.00404b08
test eax, eax
pop ecx
je 0x414874
push edi
call fcn.004049f6
movzx eax, ax
xor ebx, ebx
inc ebx
cmp ax, bx
pop ecx
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
jb 0x414874
push ebx
push dword [ebp - 4]
call fcn.00404e0f
test eax, eax
pop ecx
pop ecx
je 0x414863
push ebx
push dword [ebp - 4]
call fcn.00404a65
cmp word [ebp + 0xc], 0
pop ecx
pop ecx
movzx edi, ax
je 0x41483b
push dword [ebp - 8]
movzx ebx, word [ebp - 8]
call fcn.00403d96
test eax, eax
pop ecx
je 0x414800
call fcn.00404828
movzx ebx, ax
test di, di
je 0x414819
push edi
push ebx
call fcn.00403a65
test eax, eax
pop ecx
pop ecx
jne 0x414819
push edi
call fcn.00404c0e
pop ecx
movzx esi, bx
test esi, esi
je 0x414889
push ebx
push dword [ebp - 0xc]
push dword [ebp - 4]
call fcn.00404b51
movzx esi, ax
add esp, 0xc
test esi, esi
je 0x414889
inc dword [ebp - 8]
jmp 0x41485f
test di, di
jne 0x41485f
call fcn.00404828
movzx eax, ax
movzx esi, ax
test esi, esi
je 0x414889
push eax
push ebx
push dword [ebp - 4]
call fcn.00404b51
add esp, 0xc
movzx esi, ax
test esi, esi
je 0x414889
mov ebx, dword [ebp - 0xc]
inc ebx
cmp bx, word [ebp - 0x10]
mov dword [ebp - 0xc], ebx
jbe 0x4147bf
test esi, esi
je 0x414889
mov edi, dword [ebp - 4]
inc edi
cmp di, word [ebp + 8]
mov dword [ebp - 4], edi
jb 0x414785
pop ebx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x4152f9
Capabilities:
Find taskbar

Disassembly:
push esi
push edi
xor edi, edi
push edi
push 0x4031f0
call dword [sym.imp.USER32.dll_FindWindowW]
cmp eax, edi
je 0x41533b
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push edi
push 0x4031d4
push edi
push eax
call esi
cmp eax, edi
je 0x41533b
push edi
push 0x4031c0
push edi
push eax
call esi
cmp eax, edi
je 0x41533b
push edi
push 0x4031a0
push edi
push eax
call esi
jmp 0x41533d
xor eax, eax
pop edi
pop esi
ret
Function at 0x415cb9
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb04
push ebx
push esi
push edi
push 0x2c
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x94]
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.0040ad20
push 0x10
pop ecx
mov esi, eax
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
push dword [ebp - 0x4c]
call fcn.00403b00
mov esi, 0x206
push esi
mov dword [ebp - 8], eax
lea eax, [ebp - 0x4a2]
push ebx
push eax
mov word [ebp - 0x4a4], bx
call sub.MSVCRT.dll_memset
push esi
lea eax, [ebp - 0x29a]
push ebx
push eax
mov word [ebp - 0x29c], bx
call sub.MSVCRT.dll_memset
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcpyW]
add esp, 0x2c
push dword [ebp - 0x54]
lea eax, [ebp - 0x4a4]
push eax
call esi
mov edi, dword [ebp - 0x50]
push edi
lea eax, [ebp - 0x29c]
push eax
call esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrRChrW]
push 0x2a
push ebx
push edi
call esi
test eax, eax
jne 0x415db5
push 0x3f
push ebx
push edi
call esi
test eax, eax
jne 0x415db5
lea eax, [ebp - 0x29c]
push eax
call fcn.00403cd5
test eax, eax
pop ecx
je 0x415d8a
cmp dword [ebp - 8], ebx
push ebx
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4a4]
push eax
jne 0x415da2
call dword [sym.imp.KERNEL32.DLL_CreateHardLinkW]
jmp 0x415daa
cmp dword [ebp - 8], ebx
je 0x415ea7
push ebx
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.00415c78
add esp, 0xc
movzx eax, al
mov dword [ebp - 4], eax
jmp 0x415ea7
lea eax, [ebp - 0x29c]
push eax
call fcn.0040aca0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x4a4]
push eax
call fcn.0040aca0
pop ecx
pop ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x6f4]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
cmp eax, ebx
mov dword [ebp - 0xc], eax
je 0x415ea7
cmp eax, 0xffffffff
je 0x415ea7
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
mov edi, 0x4025f8
lea eax, [ebp - 0x6c8]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0xb04]
push edi
push eax
call esi
lea eax, [ebp - 0x6c8]
push eax
push dword [ebp - 0x14]
lea eax, [ebp - 0x8fc]
push edi
push eax
call esi
add esp, 0x20
test byte [ebp - 0x6f4], 0x10
je 0x415e66
cmp dword [ebp - 8], ebx
je 0x415e86
lea eax, [ebp - 0x6c8]
push eax
call fcn.00409b9a
test eax, eax
pop ecx
jne 0x415e86
push 1
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x8fc]
push eax
call fcn.00415c78
add esp, 0xc
jmp 0x415e80
cmp dword [ebp - 8], ebx
push ebx
lea eax, [ebp - 0xb04]
push eax
lea eax, [ebp - 0x8fc]
push eax
jne 0x415e5c
call dword [sym.imp.KERNEL32.DLL_CreateHardLinkW]
movzx eax, al
add dword [ebp - 4], eax
lea eax, [ebp - 0x6f4]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x415e02
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.DLL_FindClose]
xor eax, eax
cmp dword [ebp - 4], ebx
pop edi
pop esi
sete al
pop ebx
leave
ret
Function at 0x415eb4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x49c
push ebx
push esi
push edi
push 0x2c
push 3
push dword [ebp + 8]
lea eax, [ebp - 0x8c]
push eax
call fcn.0040ad20
add esp, 0x10
push 0x10
mov esi, eax
pop ecx
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x48]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
je 0x415f04
cmp word [eax], bx
je 0x415f04
push eax
call fcn.00403b00
neg eax
sbb eax, eax
neg eax
pop ecx
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x44]
cmp eax, ebx
je 0x415f20
cmp word [eax], bx
je 0x415f20
push eax
call fcn.00403b00
neg eax
sbb eax, eax
neg eax
pop ecx
mov dword [ebp - 0xc], eax
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0x4033a0
push 0x403328
mov edi, SysReAllocString
push edi
call esi
mov word [ebp - 0x49c], bx
mov ebx, 0x206
push ebx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x49a]
push 0
push eax
call sub.MSVCRT.dll_memset
push 0x403304
push 0x402828
lea eax, [ebp - 0x49c]
push 0x4028b8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x1c
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push 0x4032d8
lea eax, [ebp - 0x49c]
push eax
push edi
call esi
or dword [ebp - 4], eax
and word [ebp - 0x294], 0
push ebx
lea eax, [ebp - 0x292]
push 0
push eax
call sub.MSVCRT.dll_memset
mov ebx, dword [ebp - 0x4c]
add esp, 0xc
test ebx, ebx
je 0x415fe1
cmp word [ebx], 0
je 0x415fe1
push ebx
call fcn.00403cd5
pop ecx
test eax, eax
push ebx
lea eax, [ebp - 0x294]
je 0x415fec
push 0x4032c4
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
jmp 0x415ff3
push 0x4032ac
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
lea eax, [ebp - 0x294]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
add eax, eax
push eax
lea eax, [ebp - 0x294]
push eax
push 1
push 0x403294
push 0x403240
push edi
call esi
or dword [ebp - 4], eax
push 0x1388
push 0x402704
call fcn.0040b999
pop ecx
pop ecx
xor eax, eax
cmp dword [ebp - 4], eax
pop edi
pop esi
setne al
pop ebx
leave
ret
Function at 0x4170a1
Capabilities:
Enumerate files on windows
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1260
call fcn.00420160
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrChrW]
push 0x2c
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 8], 1
mov dword [eax], ebx
call esi
cmp eax, ebx
je 0x417213
mov word [eax], bx
push edi
inc eax
inc eax
push 0x2c
push eax
mov dword [ebp - 0x10], eax
call esi
mov edi, eax
cmp edi, ebx
je 0x417212
mov word [edi], bx
inc edi
push 0x2c
inc edi
push edi
call esi
mov ebx, eax
xor esi, esi
cmp ebx, esi
je 0x417212
mov word [ebx], 1
inc ebx
push edi
inc ebx
call fcn.00403b00
mov edi, eax
mov dword [esp], 0xffe
lea eax, [ebp - 0x125e]
push esi
push eax
mov word [ebp - 0x1260], si
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_FindFirstFileW]
push dword [ebp + 8]
mov dword [ebp - 4], eax
call fcn.00403cb6
cmp dword [ebp - 4], esi
pop ecx
je 0x417212
cmp dword [ebp - 4], 0xffffffff
je 0x417212
mov dword [ebp - 8], esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0xc], 1
xor eax, eax
test byte [ebp - 0x260], 0x10
je 0x41718e
cmp dword [ebp + 0x14], eax
je 0x417195
lea eax, [ebp - 0x234]
push eax
call fcn.00409b9a
neg eax
sbb eax, eax
pop ecx
inc eax
jmp 0x417195
cmp dword [ebp + 0x14], 0
sete al
test eax, eax
je 0x4171e6
lea eax, [ebp - 0x234]
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x1260]
push 0x4025f8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1260]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableW]
push ebx
call fcn.0041f8dc
or dword [ebp - 8], eax
inc dword [ebp - 0xc]
inc dword [esi]
test edi, edi
mov eax, dword [esi]
pop ecx
jle 0x4171e6
cmp dword [ebp - 0xc], edi
jg 0x417200
cmp eax, edi
jge 0x417200
lea eax, [ebp - 0x260]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindNextFileW]
test eax, eax
jne 0x41716a
jmp 0x417209
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindClose]
pop edi
mov eax, dword [ebp - 8]
pop esi
pop ebx
leave
ret
Function at 0x41721a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1420
call fcn.00420160
push ebx
push esi
xor ebx, ebx
push edi
xor ecx, ecx
xor edi, edi
xor esi, esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
inc ecx
mov eax, dword [ebp + 8]
movzx eax, word [eax]
cmp ax, 0x21
jne 0x417249
mov edi, ecx
jmp 0x41725c
cmp ax, 0x5c
jne 0x417253
mov esi, ecx
jmp 0x41725c
cmp ax, 0x40
jne 0x417262
mov dword [ebp - 0xc], ecx
add dword [ebp + 8], 2
jmp 0x417239
push 0xffe
lea eax, [ebp - 0x141e]
push ebx
push eax
mov word [ebp - 0x1420], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
je 0x4173e9
mov esi, 0x206
push esi
lea eax, [ebp - 0x216]
push ebx
push eax
mov word [ebp - 0x218], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.DLL_GetLogicalDriveStringsW]
cmp edi, ebx
je 0x417390
push esi
lea eax, [ebp - 0x41e]
push ebx
push eax
mov word [ebp - 0x420], bx
call sub.MSVCRT.dll_memset
add esp, 0xc
cmp word [ebp - 0x218], bx
mov ebx, dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea edi, [ebp - 0x420]
lea esi, [ebp - 0x218]
je 0x417311
movzx eax, word [ebp - 0x218]
mov word [edi], ax
inc edi
push esi
inc edi
call ebx
lea esi, [esi + eax*2 + 2]
movzx eax, word [esi]
test ax, ax
jne 0x4172fd
lea eax, [ebp - 0x420]
push eax
call ebx
mov ebx, eax
test ebx, ebx
jle 0x417416
mov esi, dword [sym.imp.KERNEL32.DLL_lstrcatW]
lea edi, [ebp + ebx*2 - 0x422]
mov ax, word [edi]
and word [ebp - 0x141e], 0
mov word [ebp - 0x1420], ax
push 0x4033cc
lea eax, [ebp - 0x1420]
push eax
call esi
push dword [ebp + 8]
lea eax, [ebp - 0x1420]
push eax
call esi
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.004170a1
or dword [ebp - 4], eax
add esp, 0x10
cmp dword [ebp - 8], 0
jne 0x417416
dec ebx
dec edi
dec edi
test ebx, ebx
jg 0x417331
jmp 0x417416
cmp word [ebp - 0x218], bx
lea esi, [ebp - 0x218]
je 0x417416
push dword [ebp + 8]
lea eax, [ebp - 0x1420]
push esi
push 0x4028b8
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.004170a1
or dword [ebp - 4], eax
add esp, 0x20
cmp dword [ebp - 8], ebx
jne 0x417416
push esi
call dword [sym.imp.KERNEL32.DLL_lstrlenW]
lea esi, [esi + eax*2 + 2]
cmp word [esi], bx
jne 0x41739f
jmp 0x417416
push dword [ebp + 8]
lea eax, [ebp - 0x1420]
push eax
call dword [sym.imp.KERNEL32.DLL_lstrcpyW]
push dword [ebp - 0xc]
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1420]
push eax
call fcn.004170a1
add esp, 0x10
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret