joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a3380
Capabilities:
Check http status code
Check internet connectivity via wininet
Create http request
Get http content length
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x50d800
push 0x4aa6a0
mov eax, dword fs:[0]
push eax
sub esp, 0x268
mov eax, dword [0x511070]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x6c], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x60], edx
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x5c], eax
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x54], edi
xor esi, esi
mov dword [ebp - 0x58], esi
movups xmm0, xmmword [0x4fc9f8]
movups xmmword [ebp - 0x3c], xmm0
movups xmm0, xmmword [0x4fca08]
movups xmmword [ebp - 0x2c], xmm0
mov dword [ebp - 0x44], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], 4
test edx, edx
jne 0x4a3405
xor eax, eax
jmp 0x4a3554
mov eax, dword [ecx]
call dword [eax + 0xc]
mov dword [ebp - 4], ebx
push 0
lea eax, [ebp - 0x44]
push eax
call dword [sym.imp.WININET.dll_InternetGetConnectedState]
test byte [ebp - 0x44], 0x20
je 0x4a342e
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x40]
jmp 0x4a354c
mov edx, dword [ebp - 0x5c]
test edx, edx
je 0x4a3458
mov ecx, edx
lea edi, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4a3440
sub ecx, edi
sar ecx, 1
je 0x4a3458
mov eax, 3
jmp 0x4a345c
xor eax, eax
xor edx, edx
push 0
push 0
push edx
push eax
push str.Mozilla_5.0__compatible__MSIE_8.0__Windows_NT_6.1__QQPCMgr7.0_
call dword [sym.imp.WININET.dll_InternetOpenW]
mov edi, eax
mov dword [ebp - 0x54], edi
test edi, edi
je 0x4a341f
push 0
push 0x84000100
push 0xffffffffffffffff
lea eax, [ebp - 0x3c]
push eax
push dword [ebp - 0x60]
push edi
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov esi, eax
mov dword [ebp - 0x58], esi
test esi, esi
je 0x4a341f
push 0x20a
push 0
lea eax, [ebp - 0x278]
push eax
call fcn.004a83c0
add esp, 0xc
mov dword [ebp - 0x64], 0x208
push 0
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x278]
push 0x2f
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov dword [ebp - 0x48], 0
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x48]
push eax
push 0x20000013
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
test eax, eax
je 0x4a341f
cmp dword [ebp - 0x48], 0xc8
jne 0x4a341f
push 0
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x20000005
push esi
call dword [sym.imp.WININET.dll_HttpQueryInfoW]
mov ecx, dword [ebp - 0x40]
test eax, eax
je 0x4a351d
mov eax, dword [ebp - 0x50]
mov dword [ecx + 0x24], eax
mov ebx, 1
mov dword [ebp - 0x68], ebx
mov dword [ebp - 4], 0xfffffffe
jmp 0x4a354c
mov dword [ecx + 4], edi
mov dword [ecx + 8], esi
mov eax, ebx
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret 8
Function at 0x4a36f0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x511070]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x5153d0], 0
jne 0x4a376f
push 0x20a
lea eax, [ebp - 0x210]
push 0
push eax
call fcn.004a83c0
add esp, 0xc
lea eax, [ebp - 0x210]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x4fca34
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ecx, ecx
mov dword [0x5153d0], eax
test eax, eax
setne cl
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.004a578d
mov esp, ebp
pop ebp
ret

Function at 0x4c333e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c31bd

Function at 0x4c954a
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004c920a

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Create process on windows
Execute shellcode via indirect call
Read file on windows

Disassembly:
push ebx
push esi
mov ebx, 0x10003028
xor esi, esi
push edi
cmp ebx, 0x10002034
jne 0x1000116a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x10002038]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x10001172
push 1
push esi
push esi
push ebx
push esi
push esi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
mov word [0x1000302e], ax
movzx ecx, word [eax + 0x1000203c]
mov word [eax + 0x10003028], cx
add eax, 2
cmp cx, si
jne 0x1000119d
push 0x40
mov eax, 0x1000
push eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x10003018], eax
lea edi, [ebx - 2]
mov ax, word [edi + 2]
add edi, 2
cmp ax, si
jne 0x100011cb
mov esi, 0x10002044
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push 0x80
push 3
push esi
push 1
push 0x80000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000301c], eax
cmp eax, 0xffffffff
je 0x10001223
push esi
push 0x10003020
push 0x1000
push dword [0x10003018]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
call dword [0x10003018]
pop edi
pop esi
pop ebx
ret 0x10
Function at 0x99677c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x9967a3
call fcn.00938d18
mov dword [eax], esi
call fcn.00938d05
push 0x16
pop esi
mov dword [eax], esi
call fcn.0093995a
mov eax, esi
jmp 0x9967f8
test dword [ebp + 0xc], 0xfffffff9
jne 0x996789
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x9967d0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00938d2b
pop ecx
call fcn.00938d05
mov eax, dword [eax]
jmp 0x9967f8
test al, 0x10
jne 0x9967f6
test al, 1
je 0x9967f6
test byte [ebp + 0xc], 2
je 0x9967f6
call fcn.00938d18
mov dword [eax], 5
call fcn.00938d05
mov dword [eax], 0xd
jmp 0x9967c7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x501d70
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x502358
push 0x501f70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffff98
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 2
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x503454], 0xffffffff
mov dword [0x503458], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x503450]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x50344c]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x50345c], ecx
call fcn.00501f60
mov eax, dword [0x503184]
test eax, eax
jne 0x501e01
push 0x501f50
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.00501f30
push 0x50300c
push 0x503008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x503448]
mov dword [ebp - 0x6c], edx
lea eax, [ebp - 0x6c]
push eax
mov ecx, dword [0x503444]
push ecx
lea edx, [ebp - 0x64]
push edx
lea eax, [ebp - 0x70]
push eax
lea ecx, [ebp - 0x60]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x503004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x74], esi
cmp byte [esi], 0x22
jne 0x501f0f
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e75
cmp al, 0x22
jne 0x501e67
cmp byte [esi], 0x22
jne 0x501e7e
inc esi
mov dword [ebp - 0x74], esi
mov al, byte [esi]
test al, al
je 0x501e8e
cmp al, 0x20
ja 0x501e8e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501e7e
mov dword [ebp - 0x30], 0
lea edx, [ebp - 0x5c]
push edx
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x30], 1
je 0x501eaf
mov eax, dword [ebp - 0x2c]
and eax, 0xffff
jmp 0x501eb4
mov eax, 0xa
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
mov dword [ebp - 0x68], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x501ef4
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [esi], 0x20
jbe 0x501e7e
inc esi
mov dword [ebp - 0x74], esi
jmp 0x501f0f
Function at 0x503fb0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x503fee
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x503fe6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x503ff0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x503fd6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x5040d0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x5040ff
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x5040ff
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x42e002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..rdata
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x15840b95
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
mov eax, section._RDATA
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x66dc5ca7
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x10033179
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x100331b8
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100331b8
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100331b8
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x100331b8
cmp dword [ecx + 0x74], 0xe
jbe 0x100331b8
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10033f90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10033fbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10033fbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x100342e0
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003e618
push 0x1003e610
push str.FlsAlloc
push 0x1f
call fcn.100345c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10034314
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x1003431a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x1003435e
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003e628
push 0x1003e620
push str.FlsGetValue
push 0x21
call fcn.100345c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10034395
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x1003439d
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x1003e630
push 0x1003e628
push str.FlsSetValue
push 0x22
call fcn.100345c3
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100343d7
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x10037683
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10037720
push ebx
push esi
call fcn.10037723
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10037587
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x100376cd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003771f
push edi
push eax
call fcn.10037994
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x100376ed
call fcn.10035890
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1003771e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10037587
add esp, 0x20
test eax, eax
jne 0x1003770c
push edi
call fcn.10035890
jmp 0x10037714
push ebx
call fcn.10035890
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x98a68c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x98a6b3
call fcn.0092cbf8
mov dword [eax], esi
call fcn.0092cbe5
push 0x16
pop esi
mov dword [eax], esi
call fcn.0092d83a
mov eax, esi
jmp 0x98a708
test dword [ebp + 0xc], 0xfffffff9
jne 0x98a699
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x98a6e0
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0092cc0b
pop ecx
call fcn.0092cbe5
mov eax, dword [eax]
jmp 0x98a708
test al, 0x10
jne 0x98a706
test al, 1
je 0x98a706
test byte [ebp + 0xc], 2
je 0x98a706
call fcn.0092cbf8
mov dword [eax], 5
call fcn.0092cbe5
mov dword [eax], 0xd
jmp 0x98a6d7
xor eax, eax
pop esi
pop ebp
ret

Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
nop
nop
sub eax, 0x403d50
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
nop
jmp fcn.00401219
Function at 0x407d9c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004033fc
xor eax, eax
push ebp
push 0x407e75
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp byte [eax], 0x5c
jne 0x407dd4
mov eax, dword [ebp - 4]
call fcn.004071d0
jmp 0x407ddc
mov eax, dword [ebp - 4]
call fcn.00407bd4
call fcn.00404ae8
mov esi, eax
test esi, esi
jle 0x407e28
mov ebx, 1
lea edx, [ebp - 8]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 8]
cmp byte [eax], 0x5c
jne 0x407e12
lea edx, [ebp - 0xc]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0xc]
call fcn.004071d0
jmp 0x407e24
lea edx, [ebp - 0x10]
mov eax, ebx
call fcn.004049d0
mov eax, dword [ebp - 0x10]
call fcn.00407bd4
inc ebx
dec esi
jne 0x407dec
push 1
push dword [ebp - 4]
push 0x407e8c
lea edx, [ebp - 0x18]
xor eax, eax
call fcn.00406f34
push dword [ebp - 0x18]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.004032cc
mov eax, dword [ebp - 0x14]
call fcn.0040340c
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x407e7c
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.004030b8
ret

Function at 0x401ae0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40406c], eax
push str.Riched32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.mifedount
push str.Deltapo
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x401b33
xor eax, eax
jmp 0x401b4e
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x404c82
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 4
pop edi
lea eax, [ebp - 4]
mov dword [ebp - 0xc], edi
push eax
push 0x2000000
push 0
push 0x401f20
push 0x80000002
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegOpenKeyExW]
test eax, eax
jne 0x404ceb
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0x401f14
push dword [ebp - 4]
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.api_ms_win_core_registry_l1_1_0.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x404ceb
cmp dword [ebp - 8], edi
jne 0x404ceb
mov eax, dword [ebp - 0x10]
pop edi
leave
ret
xor eax, eax
jmp 0x404ce8
Function at 0x40531b
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, edx
push edi
mov edi, dword [ebp + 0xc]
mov eax, ecx
mov dword [ebp - 4], eax
mov esi, dword [esi]
neg esi
sbb esi, esi
test byte [ebx - 0x397cffd9], 3
Function at 0x407284
Capabilities:
Check if file exists
Get disk information
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x47c
mov eax, dword [0x42d0b4]
xor eax, esp
mov dword [esp + 0x478], eax
push ebx
push esi
push edi
mov edi, ecx
test edi, edi
je 0x4073f9
mov eax, 0x104
mov byte [esp + 0x224], 1
push eax
xor esi, esi
mov dword [esp + 0x22c], eax
lea eax, [esp + 0x1c]
mov dword [esp + 0x224], esi
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [esp + 0x24]
add esp, 0xc
cmp byte [esp + 0x224], al
sete al
dec eax
and eax, 0xfdc6
add eax, 0x208
push eax
call fcn.0040e330
test eax, eax
js 0x4073fd
mov eax, dword [esp + 0x220]
test eax, eax
je 0x41a701
lea ecx, [esp + 0x10]
push ecx
push eax
push dword [esp + 0x230]
mov ecx, edi
call fcn.0040ffb0
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFullPathNameW]
mov ebx, eax
test ebx, ebx
je 0x4073a2
mov esi, dword [esp + 0x220]
test esi, esi
je 0x41a70a
push 4
push 0x401ff8
push esi
call dword [sym.imp.msvcrt.dll_wcsncmp]
add esp, 0xc
test eax, eax
je 0x41a713
mov eax, dword [esp + 0x10]
test eax, eax
je 0x41a77b
xor edi, edi
cmp word [eax], di
je 0x41a77b
lea eax, [esp + 0x14]
mov edx, esi
push eax
lea eax, [esp + 0x234]
mov ecx, fcn.00415950
push eax
push edi
push 0x1037
call fcn.0041581a
mov ecx, dword [esp + 0x14]
movzx ebx, al
call fcn.00408a9a
test ebx, ebx
je 0x4073d3
xor esi, esi
mov eax, dword [esp + 0x220]
mov dword [esp + 0x220], esi
test eax, eax
je 0x4073bc
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
mov eax, ebx
mov ecx, dword [esp + 0x484]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00416ad0
mov esp, ebp
pop ebp
ret
movzx eax, word [esi + 2]
push 0x5c
pop ecx
cmp ax, cx
je 0x41a763
cmp eax, 0x3a
jne 0x4073a0
cmp word [esi + 4], cx
jne 0x4073a0
cmp word [esi + 6], di
jne 0x4073a0
jmp 0x41a763
xor eax, eax
jmp 0x4073be
mov ebx, esi
jmp 0x4073a2
lea eax, [esp + 0x18]
jmp 0x407311
lea esi, [esp + 0x18]
jmp 0x407341
add esi, 8
push esi
push edi
mov dword [esp + 0x18], esi
call dword [sym.imp.msvcrt.dll_wcsstr]
mov dword [esp + 0x18], eax
pop ecx
pop ecx
test eax, eax
je 0x41a74a
cmp eax, edi
jbe 0x41a74a
movzx esi, word [eax]
xor ecx, ecx
push edi
mov word [eax], cx
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
mov eax, dword [esp + 0x10]
mov word [eax], si
jmp 0x41a753
push edi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
mov ebx, eax
xor esi, esi
cmp ebx, 0xffffffff
jne 0x4073a2
jmp 0x4073fd
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4073a0
xor ebx, ebx
inc ebx
jmp 0x4073a0
push esi
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetFileAttributesW]
xor ebx, ebx
cmp eax, 0xffffffff
setne bl
jmp 0x4073a0
Function at 0x407e97
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x42d0b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x104
mov byte [ebp - 0x1c], 1
xor ebx, ebx
mov dword [ebp - 0x18], edi
push edi
lea eax, [ebp - 0x228]
mov dword [ebp - 0x20], ebx
push ebx
push eax
mov si, cx
call sub.msvcrt.dll_memset
xor eax, eax
lea ecx, [ebp - 0x228]
add esp, 0xc
cmp byte [ebp - 0x1c], al
sete al
dec eax
and eax, 0x7ee3
add eax, edi
push eax
call fcn.0040e330
test eax, eax
js 0x407f51
push 0x3a
pop eax
mov word [ebp - 0xe], ax
push 0x5c
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
lea eax, [ebp - 0x10]
push eax
mov word [ebp - 0x10], si
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x41aecf
cmp eax, 2
je 0x407f51
cmp eax, 5
je 0x407f51
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x407f74
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x230]
push ecx
push dword [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.api_ms_win_core_file_l1_1_0.dll_GetVolumeInformationW]
test eax, eax
je 0x41aedc
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
test eax, eax
je 0x407f63
push eax
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00416ad0
leave
ret
lea eax, [ebp - 0x228]
jmp 0x407f30
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
test eax, eax
je 0x41aefd
push eax
jmp 0x41aef6
call dword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
cmp eax, 5
jne 0x407f51
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 0x20], ebx
test ecx, ecx
je 0x41aefd
push ecx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
xor eax, eax
inc eax
jmp 0x407f65