joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405780
Capabilities:
Create directory
Query environment variable

Disassembly:
mov eax, 0x4004
call fcn.00409620
mov eax, dword [0x430014]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push edi
push 0
push eax
push 0
call fcn.004068a0
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x4057d8
push str.LOADER:_Failed_to_convert_runtime_tmpdir_to_a_wide_string._n
call fcn.004023e0
add esp, 4
xor eax, eax
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040960a
add esp, 0x4004
ret
push esi
push 0x1000
lea eax, [esp + 0x200c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov esi, eax
call fcn.0040c4b4
add esp, 4
test esi, esi
jne 0x405822
push str.LOADER:_Failed_to_expand_environment_variables_in_the_runtime_tmpdir._n
call fcn.004023e0
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040960a
add esp, 0x4004
ret
push 0x1000
lea eax, [esp + 0x200c]
push eax
push 0
call fcn.0040f8ce
mov esi, eax
add esp, 0xc
test esi, esi
jne 0x405865
push str.LOADER:_Failed_to_obtain_the_absolute_path_of_the_runtime_tmpdir._n
call fcn.004023e0
add esp, 4
xor eax, eax
pop esi
pop edi
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040960a
add esp, 0x4004
ret
push ebx
push 0x2000
lea eax, [esp + 0x10]
push 0
push eax
call fcn.0040a800
push 0x5c
push esi
call fcn.0040abc7
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov edi, eax
add esp, 0x14
test edi, edi
je 0x4058c3
nop
mov ecx, edi
lea eax, [esp + 0xc]
sub ecx, esi
sar ecx, 1
inc ecx
push ecx
push esi
push eax
call fcn.00410244
add esp, 0xc
lea eax, [esp + 0xc]
push 0
push eax
call ebx
lea eax, [edi + 2]
push 0x5c
push eax
call fcn.0040abc7
mov edi, eax
add esp, 8
test edi, edi
jne 0x405890
push 0
push esi
call ebx
mov ecx, dword [esp + 0x400c]
mov eax, esi
pop ebx
pop esi
pop edi
xor ecx, esp
call fcn.0040960a
add esp, 0x4004
ret
Function at 0x4058f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov eax, 0x1004
call fcn.00409620
mov eax, dword [0x430014]
xor eax, esp
mov dword [esp + 0x1000], eax
mov eax, dword [esp + 0x1008]
push ebx
push esi
mov esi, dword [esp + 0x1018]
push edi
mov edi, dword [esp + 0x1018]
push 0x423280
push eax
call fcn.00403600
push esi
push edi
mov ebx, eax
call fcn.00405cf0
add esp, 0x10
xor edi, edi
mov esi, eax
test ebx, ebx
je 0x4059ef
push ebx
test esi, esi
je 0x4059f4
call fcn.0040b5f0
add esp, 4
test eax, eax
jne 0x4059c6
nop dword [eax + eax]
push ebx
push 0x1000
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040b82e
add esp, 0x10
test eax, eax
jne 0x405989
push ebx
call fcn.0040b61c
add esp, 4
test eax, eax
je 0x4059ab
push ebx
jmp 0x4059bb
push esi
push eax
lea eax, [esp + 0x14]
push 1
push eax
call fcn.0040c446
add esp, 0x10
test eax, eax
je 0x4059ba
push esi
call fcn.0040b61c
add esp, 4
test eax, eax
jne 0x4059ba
push ebx
call fcn.0040b5f0
add esp, 4
test eax, eax
je 0x405960
jmp 0x4059c6
push esi
call fcn.00411959
add esp, 4
or edi, 0xffffffff
push ebx
call fcn.0040b56c
push esi
call fcn.0040b56c
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x1000]
xor ecx, esp
call fcn.0040960a
add esp, 0x1004
ret
test esi, esi
je 0x4059fc
push esi
call fcn.0040b56c
add esp, 4
mov ecx, dword [esp + 0x100c]
or eax, 0xffffffff
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040960a
add esp, 0x1004
ret
Function at 0x405a70
Capabilities:
Get common file path
Set environment variable

Disassembly:
mov eax, 0x2028
call fcn.00409620
mov eax, dword [0x430014]
xor eax, esp
mov dword [esp + 0x2024], eax
mov eax, dword [esp + 0x202c]
push ebx
push ebp
mov ebp, dword [esp + 0x2038]
mov dword [esp + 8], eax
push esi
push edi
test ebp, ebp
je 0x405aef
push 0x425564
call fcn.00405c40
push ebp
mov ebx, eax
call fcn.00405780
mov edi, eax
add esp, 8
test edi, edi
je 0x405bab
push edi
push 0x425568
call fcn.0041082f
push edi
mov esi, eax
call fcn.0040c4b4
add esp, 0xc
test esi, esi
je 0x405af3
push str.LOADER:_Failed_to_set_the_TMP_environment_variable._n
call fcn.004023e0
add esp, 4
xor eax, eax
jmp 0x405c25
mov ebx, dword [esp + 0x10]
lea eax, [esp + 0x34]
push eax
push 0x1000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
push str._MEI_d
lea eax, [esp + 0x1c]
push 0x10
push eax
call fcn.00402250
add esp, 0x10
xor esi, esi
nop
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.0041193e
mov edi, eax
push edi
call fcn.00406740
add esp, 0xc
test eax, eax
je 0x405baf
push edi
call fcn.0040c4b4
inc esi
add esp, 4
cmp esi, 5
jl 0x405b20
test ebp, ebp
je 0x405bab
push 0
push 0x425564
push 0
call fcn.004068a0
test ebx, ebx
je 0x405b94
push 0
push ebx
push 0
mov edi, eax
call fcn.004068a0
mov esi, eax
push esi
push edi
call fcn.0041082f
push edi
call fcn.0040c4b4
push esi
call fcn.0040c4b4
push ebx
call fcn.0040c4b4
add esp, 0x2c
xor eax, eax
jmp 0x405c25
add esp, 0xc
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
call fcn.0040c4b4
add esp, 4
xor eax, eax
jmp 0x405c25
push 0x1000
push edi
push dword [esp + 0x18]
call fcn.00406940
push edi
call fcn.0040c4b4
add esp, 0x10
test ebp, ebp
je 0x405c20
push 0
push 0x425564
push 0
call fcn.004068a0
test ebx, ebx
je 0x405c09
push 0
push ebx
push 0
mov edi, eax
call fcn.004068a0
mov esi, eax
push esi
push edi
call fcn.0041082f
push edi
call fcn.0040c4b4
push esi
call fcn.0040c4b4
push ebx
call fcn.0040c4b4
add esp, 0x2c
jmp 0x405c20
add esp, 0xc
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push esi
call fcn.0040c4b4
add esp, 4
mov eax, 1
mov ecx, dword [esp + 0x2034]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0040960a
add esp, 0x2028
ret
Function at 0x405c40
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x4004
call fcn.00409620
mov eax, dword [0x430014]
xor eax, esp
mov dword [esp + 0x4000], eax
mov eax, dword [esp + 0x4008]
push 0
push eax
push 0
call fcn.004068a0
add esp, 0xc
lea ecx, [esp]
push 0x2000
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x405cd0
push 0x2000
lea eax, [esp + 0x2004]
push eax
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push 0
lea eax, [esp + 4]
push eax
push 0
call fcn.00406940
add esp, 0xc
test eax, eax
je 0x405cd0
cmp byte [eax], 0
je 0x405cd0
push eax
call fcn.00412ded
add esp, 4
mov ecx, dword [esp + 0x4000]
xor ecx, esp
call fcn.0040960a
add esp, 0x4004
ret
mov ecx, dword [esp + 0x4000]
xor eax, eax
xor ecx, esp
call fcn.0040960a
add esp, 0x4004
ret

Function at 0x4060a0
Capabilities:
Set environment variable

Disassembly:
push esi
push edi
push 0
push dword [esp + 0x10]
push 0
call fcn.004068a0
add esp, 0xc
mov edi, eax
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push edi
mov esi, eax
call fcn.0040c4b4
add esp, 4
mov eax, esi
pop edi
pop esi
ret

Function at 0x4060d0
Capabilities:
Accept command line arguments
Create process on windows
Create process suspended

Disassembly:
mov eax, 0x2068
call fcn.00409620
mov eax, dword [0x430014]
xor eax, esp
mov dword [esp + 0x2064], eax
mov eax, dword [esp + 0x206c]
push 0x1000
push eax
lea eax, [esp + 0x6c]
mov dword [esp + 8], 0
push eax
call fcn.004068a0
push 1
push 0x16
call fcn.004113c3
push 1
push 2
call fcn.004113c3
push 1
push 0xf
call fcn.004113c3
push 1
push 0x15
call fcn.004113c3
add esp, 0x2c
mov dword [esp + 4], 0xc
lea eax, [esp + 0x20]
mov dword [esp + 8], 0
mov dword [esp + 0xc], 1
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov eax, 1
mov dword [esp + 0x24], 0
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x50], 0x101
mov word [esp + 0x54], ax
call fcn.0040e9d2
push eax
call fcn.00412e41
push eax
call fcn.00410f59
push 1
mov dword [esp + 0x68], eax
call fcn.0040e9d2
push eax
call fcn.00412e41
push eax
call fcn.00410f59
push 2
mov dword [esp + 0x78], eax
call fcn.0040e9d2
push eax
call fcn.00412e41
push eax
call fcn.00410f59
add esp, 0x24
mov dword [esp + 0x60], eax
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x24]
push eax
push 0
push 0
push 0
push 1
push 0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
lea eax, [esp + 0x88]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x406227
push 0xffffffffffffffff
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea eax, [esp]
push eax
push dword [esp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [esp]
mov ecx, dword [esp + 0x2064]
xor ecx, esp
call fcn.0040960a
add esp, 0x2068
ret
push str.Error_creating_child_process__n
push 0x42566c
call fcn.00402330
mov ecx, dword [esp + 0x206c]
add esp, 8
xor ecx, esp
or eax, 0xffffffff
call fcn.0040960a
add esp, 0x2068
ret
Function at 0x406740
Capabilities:
Create directory

Disassembly:
mov eax, 0x201c
call fcn.00409620
mov eax, dword [0x430014]
xor eax, esp
mov dword [esp + 0x2018], eax
push ebx
mov ebx, dword [esp + 0x2024]
lea eax, [esp + 8]
push esi
push eax
xor esi, esi
mov dword [esp + 0x10], 0xffffffff
push 8
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x4067eb
lea eax, [esp + 8]
push eax
push esi
push esi
push 1
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x4067b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x4067eb
push dword [esp + 8]
push 1
call fcn.0040c4a9
mov esi, eax
add esp, 8
test esi, esi
je 0x4067eb
lea eax, [esp + 8]
push eax
push dword [esp + 0xc]
push esi
push 1
push dword [esp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x4067eb
lea eax, [esp + 0x10]
push eax
push dword [esi]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
push esi
call fcn.0040c4b4
mov eax, dword [esp + 0x10]
add esp, 4
cmp eax, 0xffffffff
je 0x406804
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [esp + 0x10]
mov eax, str.S_1_3_4
test esi, esi
cmovne eax, esi
push eax
push str.D:_A__FA____s_
lea eax, [esp + 0x28]
push 0x1000
push eax
call fcn.004065e0
add esp, 0x10
push esi
call dword [sym.imp.KERNEL32.dll_LocalFree]
push 0
lea eax, [esp + 0x1c]
mov dword [esp + 0x18], 0xc
push eax
push 1
lea eax, [esp + 0x2c]
mov dword [esp + 0x28], 0
push eax
call sub.ADVAPI32.dll_ConvertStringSecurityDescriptorToSecurityDescriptorW
test eax, eax
je 0x406881
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x406881
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x2018]
xor ecx, esp
call fcn.0040960a
add esp, 0x201c
ret
mov ecx, dword [esp + 0x2020]
or eax, 0xffffffff
pop esi
pop ebx
xor ecx, esp
call fcn.0040960a
add esp, 0x201c
ret
Function at 0x4148ef
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00414765

Function at 0x418f20
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00418a73
Function at 0x401497
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov eax, dword [0x42a5f0]
or eax, 8
push eax
xor ebx, ebx
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x40152c
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x4014e9
cmp dword [ebp + 0x10], ebx
jne 0x401520
push ebx
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 4]
call fcn.00401497
test eax, eax
jne 0x4014fb
push edi
lea eax, [ebp - 0x210]
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x4014d0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 2
call fcn.00405d19
cmp eax, ebx
je 0x401533
push ebx
push dword [0x42a5f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x40152c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a5f0], ebx
jne 0x401529
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x401529
jmp 0x40152c
Function at 0x402f63
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
mov esi, dword [0x41c99c]
sub esi, dword [0x4209a8]
push edi
add esi, dword [esp + 0x18]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1f4
xor ebx, ebx
mov dword [0x42a560], eax
cmp esi, ebx
jle 0x4030c1
push dword [0x4209a4]
call fcn.00402f4c
push ebx
push ebx
push dword [0x4209a8]
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [0x41c998], esi
mov dword [0x40c90c], ebx
mov ebp, 0x414998
mov eax, dword [0x4209a0]
sub eax, dword [0x4209a4]
mov edi, 0x4000
cmp eax, edi
jg 0x402fd8
mov edi, eax
push edi
mov esi, 0x41c9a0
push esi
call fcn.00402f1a
test eax, eax
je 0x4030d3
add dword [0x4209a4], edi
mov dword [0x414928], esi
mov dword [0x41492c], edi
cmp dword [0x42a50c], ebx
je 0x40302f
cmp dword [0x42a5e0], ebx
jne 0x40302f
mov eax, dword [0x41c998]
sub eax, dword [0x41c99c]
push ebx
sub eax, dword [esp + 0x1c]
add eax, dword [0x4209a8]
mov dword [0x40c90c], eax
call fcn.00402e78
pop ecx
mov ecx, 0x414910
mov dword [0x414930], ebp
mov dword [0x414934], 0x8000
call fcn.00406d4f
test eax, eax
js 0x4030d8
mov esi, dword [0x414930]
sub esi, ebp
je 0x40308d
push ebx
lea eax, [esp + 0x14]
push eax
push esi
push ebp
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4030dd
cmp esi, dword [esp + 0x10]
jne 0x4030dd
add dword [0x4209a8], esi
cmp dword [0x41492c], ebx
jne 0x402ffe
jmp 0x403099
cmp dword [0x41492c], ebx
jne 0x4030d8
cmp edi, ebx
je 0x4030d8
mov eax, dword [0x41c99c]
mov ecx, eax
sub ecx, dword [0x4209a8]
add ecx, dword [esp + 0x18]
test ecx, ecx
jg 0x402fc2
push ebx
push ebx
push eax
push dword [0x40a014]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 1
call fcn.00402e78
pop ecx
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4
or eax, 0xffffffff
jmp 0x4030cb
push 0xfffffffffffffffd
pop eax
jmp 0x4030cb
push 0xfffffffffffffffe
jmp 0x4030da
Function at 0x4030e1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp eax, edi
jl 0x40310b
add eax, dword [0x42a558]
push edi
push edi
push eax
push dword [0x40a014]
mov dword [0x41c99c], eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 4
pop esi
push esi
call fcn.00402f63
cmp eax, edi
jl 0x403204
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 8]
push eax
push dword [0x40a014]
call ebx
test eax, eax
je 0x403200
cmp dword [ebp - 4], esi
jne 0x403200
push dword [ebp + 8]
add dword [0x41c99c], esi
call fcn.00402f63
mov dword [ebp - 8], eax
cmp eax, edi
jl 0x403203
cmp dword [ebp + 0x10], edi
jne 0x4031cf
cmp dword [ebp + 8], edi
jle 0x4031fb
mov esi, 0x41c9a0
mov edi, 0x4000
cmp dword [ebp + 8], edi
jge 0x40317f
mov edi, dword [ebp + 8]
push 0
lea eax, [ebp - 4]
push eax
push edi
push esi
push dword [0x40a014]
call ebx
test eax, eax
je 0x403200
cmp edi, dword [ebp - 4]
jne 0x403200
push 0
lea eax, [ebp + 0x14]
push eax
push dword [ebp - 4]
push esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4031cb
cmp dword [ebp + 0x14], edi
jne 0x4031cb
mov eax, dword [ebp - 4]
add dword [ebp - 8], eax
sub dword [ebp + 8], eax
add dword [0x41c99c], eax
cmp dword [ebp + 8], 0
jg 0x403172
jmp 0x4031fb
push 0xfffffffffffffffe
jmp 0x403202
mov eax, dword [ebp + 8]
cmp eax, dword [ebp + 0x14]
jl 0x4031da
mov eax, dword [ebp + 0x14]
push edi
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0x10]
push dword [0x40a014]
call ebx
test eax, eax
je 0x403200
mov eax, dword [ebp - 4]
add dword [0x41c99c], eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x403203
push 0xfffffffffffffffd
pop eax
pop ebx
pop edi
pop esi
leave
ret 0x10
Function at 0x40584a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x4251f8
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x4251f8], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405885
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405a3b
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x405a58
and eax, 0xfffffffe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
ret 4

Function at 0x405a5b
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
lea ecx, [eax + 1]
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x405a8a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x4088f4]
mov dword [ebp - 8], eax
mov eax, dword [0x4088f8]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x405ada
test edi, edi
jne 0x405a97
mov word [esi], ax
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x405ad4

Function at 0x405ade
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
xor eax, eax
mov word [esi], ax
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x405b57
lea eax, [ebp + 0xc]
push eax
push esi
lea eax, [ebp + 0x14]
push eax
push 0
push dword [ebp + 0x10]
mov dword [ebp + 0xc], 0x800
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x405b40
cmp dword [ebp + 0x14], 1
je 0x405b45
cmp dword [ebp + 0x14], 2
je 0x405b45
xor eax, eax
mov word [esi], ax
push dword [ebp + 0x18]
xor eax, eax
mov word [esi + 0x7fe], ax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
ret 0x14
Function at 0x40622c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425240
push esi
call fcn.00405c14
push esi
call fcn.00405964
mov edi, eax
test edi, edi
jne 0x40624d
xor eax, eax
jmp 0x4062aa
push edi
call fcn.00405c43
test byte [0x42a568], 0x80
je 0x406269
movzx eax, word [edi]
test ax, ax
je 0x406249
cmp eax, 0x5c
je 0x406249
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x40628b
push esi
call fcn.00405cf2
test eax, eax
je 0x406285
test byte [eax], 0x10
je 0x4062af
push esi
call fcn.004061ff
push esi
call ebx
cmp eax, edi
jg 0x406276
push esi
call fcn.004061d0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x4062a9
Function at 0x406544
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
push 0x4089dc
mov ebx, 0x425a40
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edi, dword [esp + 0x1c]
xor ebp, ebp
mov esi, 0x400
cmp edi, ebp
je 0x406592
push 1
push ebp
push edi
call fcn.00405a5b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x40670d
cmp eax, esi
jg 0x40670d
push esi
mov edi, 0x427890
push edi
push dword [esp + 0x20]
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
cmp eax, ebp
je 0x40670d
cmp eax, esi
jg 0x40670d
push ebp
push ebp
push esi
push 0x426240
push 0xffffffffffffffff
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebp
push ebp
call ebx
test eax, eax
je 0x40670d
push ebp
push ebp
push esi
mov esi, 0x426890
push esi
push 0xffffffffffffffff
push edi
push ebp
push ebp
call ebx
test eax, eax
je 0x40670d
push esi
push 0x426240
push str._s_s_r_n
push 0x426c90
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42a50c]
push dword [eax + 0x128]
push edi
call fcn.004062b3
push 4
push 0xc0000000
push edi
call fcn.00405a5b
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
je 0x40670d
push ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
cmp esi, ebp
je 0x406703
push ebp
lea eax, [esp + 0x14]
push eax
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x406703
cmp edi, dword [esp + 0x10]
jne 0x406703
push str._Rename__r_n
push esi
call fcn.004059c1
cmp eax, ebp
jne 0x406696
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x4066cb
push 0x4089d0
add eax, 0xa
push eax
call fcn.004059c1
mov ebp, eax
test ebp, ebp
je 0x4066c9
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
cmp ecx, ebp
jbe 0x4066c0
sub eax, ecx
mov dl, byte [ecx]
mov byte [eax + ecx], dl
dec ecx
cmp ecx, ebp
ja 0x4066b6
sub ebp, esi
lea eax, [ebp + 1]
xor ebp, ebp
jmp 0x4066cd
xor ebp, ebp
mov eax, edi
push ebx
push 0x426c90
add eax, esi
push eax
call fcn.00405a17
push ebp
push ebp
push ebp
push dword [esp + 0x28]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebp
lea eax, [esp + 0x14]
push eax
add edi, ebx
push edi
push esi
push dword [esp + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret