joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415fcc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x4160da
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x24]
mov dl, 0x22
mov eax, dword [ebp - 4]
call fcn.0040fac4
mov edx, dword [ebp - 0x24]
lea eax, [ebp - 4]
call fcn.0040364c
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4160bc
mov eax, dword [ebp - 0x14]
inc eax
call fcn.004025b0
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x4160b5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.version.dll_GetFileVersionInfoA
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
push 0x4160ec
mov eax, dword [ebp - 0x1c]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
jne 0x416085
call fcn.0040316c
jmp 0x4160bc
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 0xc]
mov dword [edx], eax
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4160bc
mov eax, dword [ebp - 0x1c]
call fcn.004025c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4160e1
lea eax, [ebp - 0x24]
call fcn.004035b4
lea eax, [ebp - 4]
call fcn.004035b4
ret
Function at 0x4166e4
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x416954
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e0]
call fcn.004192d8
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x1e0]
call fcn.00406e5c
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x1d8]
call fcn.004172bc
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.00406e5c
push 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x416968
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.00416c58
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.0040387c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404c2e
lea eax, [ebp - 0x1cc]
call fcn.00404eb6
call fcn.00402674
push ebp
mov eax, 0x416978
call fcn.00416674
pop ecx
push ebp
push 0x416988
push dword [ebp - 0x1e0]
push 0x416998
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00416674
pop ecx
push ebp
push 0x4169a4
push dword [ebp - 0x1e0]
push 0x416998
push 0x4169b8
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00416674
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x416853
push ebp
push 0x4169cc
push dword [ebp - 0x1d8]
push 0x416998
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00416674
pop ecx
push ebp
push 0x416988
push dword [ebp - 0x1d4]
push 0x416998
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.00416674
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404cd0
call fcn.00402674
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x44
call fcn.004029a4
mov dword [ebp - 0x208], 1
mov word [ebp - 0x204], 0
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.004039f4
push eax
push 0
push 0x8000040
push 0
push 0
push 0
push 0x416998
push dword [ebp - 0x1d4]
push 0x416998
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004038f0
mov eax, dword [ebp - 0x238]
call fcn.004039f4
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x41692b
mov eax, dword [ebp - 0x1ec]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x1f0]
push eax
call sub.KERNEL32.DLL_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41695b
lea eax, [ebp - 0x238]
call fcn.004035b4
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.004035d8
ret

Function at 0x416a8c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.00416a68
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.KERNEL32.DLL_GetFileSize
cmp ebx, eax
jge 0x416ab5
mov byte [ebp - 5], 0
jmp 0x416ab9
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x416e78
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x416ed3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x416eb4
test byte [ebp - 0xc], 0x10
jne 0x416eb8
xor eax, eax
jmp 0x416eba
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x416eda
lea eax, [ebp - 4]
call fcn.004035b4
ret

Function at 0x417470
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc0
xor edx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004039e4
xor eax, eax
push ebp
push 0x4175d9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.00416ee4
test al, al
je 0x4175b6
mov eax, dword [0x43daec]
cmp dword [eax], 1
jne 0x4174d7
lea edx, [ebp - 0x40]
mov eax, dword [ebp - 4]
call fcn.00406e90
mov eax, dword [ebp - 0x40]
lea edx, [ebp - 0x3c]
call fcn.00417160
mov edx, dword [ebp - 0x3c]
lea eax, [ebp - 4]
call fcn.0040364c
mov eax, dword [0x43da98]
mov al, byte [eax]
sub al, 2
jae 0x417533
mov eax, dword [0x43da98]
cmp dword [eax + 0xd], 0x457
jge 0x417533
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x2c]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetDiskFreeSpaceA
test eax, eax
je 0x4175b6
mov eax, dword [ebp - 0x30]
imul dword [ebp - 0x2c]
imul dword [ebp - 0x34]
test eax, eax
jns 0x417528
add eax, 0x3ff
sar eax, 0xa
mov dword [ebp - 8], eax
jmp 0x4175b6
push 0x4175e8
call sub.KERNEL32.DLL_LoadLibraryA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4175b6
xor eax, eax
push ebp
push 0x4175af
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x4175f8
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetProcAddress
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x417598
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call dword [ebp - 0x10]
test eax, eax
je 0x417598
mov eax, dword [ebp - 0x14]
shl eax, 0x16
mov edx, dword [ebp - 0x18]
shr edx, 0xa
or eax, edx
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4175b6
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_FreeLibrary
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4175e0
lea eax, [ebp - 0x40]
mov edx, 2
call fcn.004035d8
lea eax, [ebp - 4]
call fcn.004035b4
ret
Function at 0x41760c
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.00406d0c
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x417f88
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b4
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406aa4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x418011
xor eax, eax
push ebp
push 0x41800a
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jle 0x417ff4
mov eax, dword [ebp - 8]
mov edx, dword [ebp - 0x10]
call fcn.00403b60
mov eax, dword [ebp - 8]
call fcn.00403a00
mov edx, eax
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00406b08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418011
mov eax, dword [ebp - 0xc]
call fcn.00406b6c
ret
mov esp, ebp
pop ebp
ret

Function at 0x418730
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.004035b4
cmp dword [ebp - 4], 0
je 0x41878e
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jle 0x41878e
mov edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 8]
call fcn.00403b60
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004039f4
push eax
mov eax, dword [ebp - 4]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetEnvironmentVariableA
mov esp, ebp
pop ebp
ret

Function at 0x418d9c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x418e4c
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.KERNEL32.DLL_GetEnvironmentStringsA
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
call fcn.0040d608
xor eax, eax
push ebp
push 0x418e2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x40]
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
jmp 0x418e08
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 0xc]
call fcn.00403768
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 0x34]
mov eax, dword [ebp - 0x10]
call fcn.00403830
inc eax
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
cmp byte [eax], 0
jne 0x418de6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x418e36
mov eax, dword [ebp - 4]
call fcn.0040d6c4
mov eax, dword [ebp - 8]
push eax
call sub.KERNEL32.DLL_FreeEnvironmentStringsA
ret
Function at 0x41902c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41910b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x104
call fcn.00403b60
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004039f4
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00403830
push eax
call sub.KERNEL32.DLL_GetTempPathA
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.00403b60
lea edx, [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00417160
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0040364c
lea eax, [ebp - 0xc]
call fcn.004070dc
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00417160
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.004067a8
test eax, eax
jne 0x4190f0
mov eax, dword [0x43daec]
cmp dword [eax], 1
jne 0x4190e3
lea eax, [ebp - 0xc]
call fcn.0041913c
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00417160
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, 0x419120
call fcn.0040387c
jmp 0x4190f0
mov eax, dword [ebp - 4]
mov edx, 0x419130
call fcn.0040364c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419112
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.004035d8
ret

Function at 0x41949c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
mov edx, dword [0x4193c4]
call fcn.00403e24
xor eax, eax
push ebp
push 0x419501
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, dword [ebp - 4]
call fcn.0040364c
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x10]
push eax
push 0x4193e8
call sub.user32.dll_EnumWindows
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x419508
lea eax, [ebp - 0x10]
mov edx, dword [0x4193c4]
call fcn.00403eec
ret

Function at 0x42687c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov ecx, dword [ebp + 8]
dec ecx
test ecx, ecx
jl 0x4268a1
inc ecx
xor esi, esi
mov bl, byte [eax + esi]
xor bl, byte [edx + esi]
mov edi, dword [ebp - 4]
mov byte [edi + esi], bl
inc esi
dec ecx
jne 0x426891
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret 4
Function at 0x42b198
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 3], cl
mov word [ebp - 2], dx
mov esi, eax
xor eax, eax
push ebp
push 0x42b2e7
push dword fs:[eax]
mov dword fs:[eax], esp
mov bl, 1
mov ax, word [ebp - 2]
mov word [esi + 0x1b], ax
test byte [esi + 0x1b], 1
setne al
xor al, 1
mov byte [esi + 0x18], al
mov eax, dword [esi + 0x20]
call fcn.00406bdc
test al, al
je 0x42b2d1
mov byte [esi + 0x19], 1
push 1
lea eax, [ebp - 8]
push eax
mov eax, dword [0x43dad8]
mov eax, dword [eax]
mov eax, dword [eax + 0x28]
xor ecx, ecx
xor edx, edx
call fcn.00416c58
mov ecx, dword [ebp - 8]
mov eax, dword [0x43dad8]
mov eax, dword [eax]
mov edx, dword [eax + 0x28]
lea eax, [esi + 0x24]
call fcn.0040387c
mov eax, dword [esi + 0x20]
call fcn.00412758
xor ecx, ecx
mov edx, dword [esi + 0x24]
mov eax, dword [esi + 0x20]
call fcn.00417f5c
mov ebx, eax
test byte [ebp - 3], bl
je 0x42b2d1
test byte [esi + 0x1b], 4
je 0x42b242
mov eax, dword [esi + 0x20]
call fcn.00415f08
test byte [esi + 0x1b], 8
je 0x42b266
mov eax, dword [esi + 0x20]
call fcn.004039f4
push eax
call sub.gdi32.dll_RemoveFontResourceA
push 0
push 0
push 0x1d
push 0xffff
call sub.user32.dll_SendMessageA
mov eax, dword [esi + 0x20]
call fcn.0041760c
test al, al
jne 0x42b2d1
mov byte [esi + 0x30], 1
lea eax, [esi + 0x28]
mov edx, 0x104
call fcn.00403b60
mov eax, dword [esi + 0x28]
call fcn.004039f4
push eax
push 0
push 0x42b2f8
lea edx, [ebp - 8]
mov eax, dword [esi + 0x20]
call fcn.00406e5c
mov eax, dword [ebp - 8]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetTempFileNameA
mov eax, dword [esi + 0x28]
call fcn.004039f4
mov edx, eax
lea eax, [esi + 0x28]
call fcn.00403768
mov eax, dword [0x43dad8]
mov eax, dword [eax]
mov cl, 1
mov edx, 0x42b304
call fcn.00424e58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42b2ee
lea eax, [ebp - 8]
call fcn.004035b4
ret
Function at 0x42f378
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x42f4f5
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00406bdc
test al, al
je 0x42f4c4
mov eax, ebx
call fcn.0041720c
mov edi, eax
mov eax, ebx
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_GetFileAttributesA
mov esi, eax
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x42f3c9
and esi, 0xfffffffe
mov eax, ebx
call fcn.00406b74
call fcn.00406fe0
fstp qword [ebp - 8]
wait
lea eax, [ebp - 0xc]
call fcn.004035b4
mov byte [0x43d6b8], 0
mov eax, dword [ebp + 8]
mov eax, dword [eax + 8]
push eax
push dword [ebp - 4]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.0042e7c0
pop ecx
dec eax
jne 0x42f4df
cmp dword [0x43e74c], 0
je 0x42f427
mov eax, dword [0x43e74c]
test byte [eax + 0x29], 4
je 0x42f427
mov byte [0x43d6b8], 1
cmp byte [0x43d6b8], 0
je 0x42f447
push 0
mov eax, dword [ebp + 8]
mov edx, dword [eax - 8]
mov eax, 0x43e75c
mov ecx, pe_nt_image_headers32
call fcn.004271dc
mov eax, 0x42f308
push eax
push 0
mov ecx, 0x42f2d4
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00417ce8
mov byte [ebp - 0xd], al
cmp byte [0x43d6b8], 0
je 0x42f474
mov eax, 0x43e75c
call fcn.004272dc
cmp byte [ebp - 0xd], 0
je 0x42f4a9
mov eax, dword [ebp + 8]
cmp byte [eax - 1], 0
je 0x42f492
push esi
mov eax, dword [ebp - 0xc]
call fcn.004039f4
push eax
call sub.KERNEL32.DLL_SetFileAttributesA
push dword [ebp - 4]
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push eax
mov ecx, esi
mov edx, edi
mov eax, ebx
call fcn.0042ef1c
jmp 0x42f4df
mov eax, dword [0x43d9e8]
cmp byte [eax], 0
jne 0x42f4df
mov byte [0x43e756], 1
mov eax, dword [0x43d9e8]
mov byte [eax], 1
jmp 0x42f4df
mov eax, 0x43e744
mov edx, ebx
call fcn.00403608
mov byte [0x43e756], 1
mov eax, dword [0x43d9e8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42f4fc
lea eax, [ebp - 0xc]
call fcn.004035b4
ret
Function at 0x438890
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x438c2b
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00406f24
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
call fcn.00406e5c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 0x14]
call fcn.0042c290
test al, al
jne 0x438938
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x50]
mov eax, 0x16
call fcn.0042b9a8
mov eax, dword [ebp - 0x50]
push eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x5c], eax
mov byte [ebp - 0x58], 0xb
lea edx, [ebp - 0x5c]
xor ecx, ecx
pop eax
call fcn.00407768
mov edx, dword [ebp - 0x54]
lea ecx, [ebp - 0x50]
mov eax, dword [0x43dad8]
mov eax, dword [eax]
call fcn.004246d0
mov edx, dword [ebp - 0x50]
mov eax, 0x438c44
call fcn.0042c5a0
jmp 0x438c03
lea edx, [ebp - 0x50]
mov eax, dword [ebp - 0x18]
call fcn.00417160
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 4]
add eax, 0x28
mov ecx, dword [ebp - 0x14]
call fcn.0040387c
lea ecx, [ebp - 0x50]
xor edx, edx
mov eax, dword [ebp - 0x14]
call fcn.00406dc8
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp - 4]
add eax, 0x20
call fcn.00403608
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x28]
mov edx, 0x20
call fcn.00406aa4
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x438b41
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
mov eax, dword [ebp - 0x10]
push eax
call sub.KERNEL32.DLL_GetFileSize
mov dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
cmp edi, 0x10000
jle 0x4389ae
mov edi, 0x10000
mov eax, edi
call fcn.004025b0
mov dword [ebp - 0x20], eax
xor eax, eax
push ebp
push 0x438a64
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x21], 0
xor eax, eax
mov dword [ebp - 0x28], eax
mov edx, edi
neg edx
mov ecx, 2
mov eax, dword [ebp - 0x10]
call fcn.00406b60
mov edx, dword [ebp - 0x20]
mov ecx, edi
mov eax, dword [ebp - 0x10]
call fcn.00406b08
mov esi, edi
sub esi, 6
cmp esi, 0
jl 0x438a4e
mov eax, 0x438c5c
mov al, byte [eax]
call fcn.00402884
mov edx, dword [ebp - 0x20]
cmp al, byte [edx + esi]
jne 0x438a48
mov byte [ebp - 0x21], 1
mov ebx, 1
mov eax, 0x438c5c
mov al, byte [eax + ebx]
call fcn.00402884
lea edx, [ebx + esi]
mov ecx, dword [ebp - 0x20]
cmp al, byte [ecx + edx]
je 0x438a32
mov byte [ebp - 0x21], 0
jmp 0x438a38
inc ebx
cmp ebx, 6
jne 0x438a14
cmp byte [ebp - 0x21], 0
je 0x438a48
sub edi, esi
sub edi, 6
mov dword [ebp - 0x28], edi
jmp 0x438a4e
dec esi
cmp esi, 0xffffffff
jne 0x4389f7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438a6b
mov eax, dword [ebp - 0x20]
call fcn.004025c8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x438c32
lea eax, [ebp - 0x54]
mov edx, 2
call fcn.004035d8
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.004035d8
ret
Function at 0x40e900
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x48df4b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.00482a91
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x40e982
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.00480370
mov eax, dword [eax]
push 0x4e9d04
push eax
call fcn.004724a4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.00482d1c
test bl, bl
je 0x40e982
push 0x4e9d04
lea ecx, [esp + 0xc]
call fcn.004830ac
push 0x4e9d10
lea ecx, [esp + 0xc]
call fcn.004830ac
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x40e9be
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.00482d1c
jmp 0x40ea89
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x40ea42
lea edx, [esp + 0x7c]
push 0x4e9d0c
push edx
call fcn.004724a4
add esp, 8
test eax, eax
je 0x40ea42
lea eax, [esp + 0x7c]
push 0x4e9d08
push eax
call fcn.004724a4
add esp, 8
test eax, eax
je 0x40ea42
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e9d2
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.00482d1c
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x40f290
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x40f2f2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc