joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c75d
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x466750]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov ebx, ecx
mov dword [ebp - 0x40], eax
push edi
push ebx
mov dword [ebp - 0x3c], ebx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40c7ef
xor edi, edi
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c7ef
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
je 0x40c7e8
test edi, edi
je 0x40c7e8
cmp edi, 0x400000
ja 0x40c7e8
and dword [ebp - 0x44], 0
push edi
call fcn.0042e597
pop ecx
push 0
mov ebx, eax
lea eax, [ebp - 0x44]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40c804
push ebx
call fcn.0042f61c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ee4e
mov esp, ebp
pop ebp
ret 4
push edi
mov edi, dword [ebp - 0x40]
mov ecx, edi
push ebx
call fcn.004098ca
push str.AattchedFile:_n
call fcn.00401214
pop ecx
push eax
push str.AattchedFile:_n
mov ecx, edi
call fcn.004098ca
push dword [ebp - 0x3c]
lea ecx, [ebp - 0x20]
call fcn.0040276c
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x38]
call fcn.0041f340
push 0xffffffffffffffff
push 0
push eax
mov ecx, edi
call fcn.0040996c
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.00402927
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.00402c5d
push ebx
call fcn.0042f61c
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x40c7f1

Function at 0x40c9b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x466750]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
push 0x206
mov word [ebp - 0x214], ax
xor ebx, ebx
lea eax, [ebp - 0x212]
push ebx
push eax
call fcn.00435540
add esp, 0xc
lea eax, [ebp - 0x214]
push eax
push ebx
push ebx
push 0x1a
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.TencentWeChatQQBrowser_Pluginlog_
lea eax, [ebp - 0x214]
push 0x104
push eax
call fcn.0042f857
xor eax, eax
lea edi, [ebp - 0x23c]
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x236]
push eax
movzx eax, word [ebp - 0x23a]
push eax
movzx eax, word [ebp - 0x23c]
push eax
lea eax, [ebp - 0x22c]
push str.MM__d_.2d_.2d.xlog
push eax
call fcn.0041e1c0
add esp, 0x14
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x214]
mov ecx, esi
push eax
call fcn.0040ed8e
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x22c]
call fcn.00402c5d
mov ecx, dword [ebp - 8]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ee4e
mov esp, ebp
pop ebp
ret 4
Function at 0x40ca91
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x24], 8
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x10]
cmovae eax, dword [ebp + 0x10]
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40cae8
mov edi, 0x454a34
push edi
call fcn.004011a9
pop ecx
push eax
push edi
mov ecx, 0x469c6c
call fcn.00402f69
jmp 0x40cb65
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40cb11
mov edi, 0x454a34
push edi
call fcn.004011a9
pop ecx
push eax
push edi
mov ecx, 0x469c6c
call fcn.00402f69
jmp 0x40cb61
and dword [ebp - 8], 0
push ebx
mov dword [edi], ebx
call fcn.0042e597
pop ecx
push 0
mov edi, eax
lea eax, [ebp - 8]
push eax
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x40cb4b
mov ebx, 0x4600e2
push ebx
call fcn.00401214
pop ecx
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.00402d0e
jmp 0x40cb5a
test edi, edi
je 0x40cb5a
push dword [ebp - 4]
mov ecx, edi
push ebx
call fcn.00410282
push edi
call fcn.0042f61c
pop ecx
test esi, esi
je 0x40cb6c
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 1
lea ecx, [ebp + 0x10]
call fcn.00402c5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x20
Function at 0x40e32c
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov eax, dword [0x466750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x44]
xor edi, edi
push eax
push ecx
push 0x7c
pop edx
mov ecx, 0x469d24
mov dword [ebp - 0x38], edi
mov dword [ebp - 0x44], edi
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], edi
call fcn.00423c30
mov eax, dword [ebp - 0x40]
mov esi, dword [ebp - 0x44]
sub eax, esi
pop ecx
pop ecx
push 0x18
cdq
pop ecx
idiv ecx
mov dword [ebp - 0x38], eax
test eax, eax
je 0x40e49d
push 0x460338
lea ecx, [ebp - 0x1c]
call fcn.0040276c
push ecx
lea edx, [ebp - 0x1c]
mov ecx, esi
call fcn.0041f760
pop ecx
push edi
push 1
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00402c5d
test bl, bl
je 0x40e3ab
mov edi, SysReAllocString
jmp 0x40e3de
push str.HKEY_LOCAL_MACHINE
lea ecx, [ebp - 0x1c]
call fcn.0040276c
push ecx
lea edx, [ebp - 0x1c]
mov ecx, esi
call fcn.0041f760
pop ecx
push edi
push 1
lea ecx, [ebp - 0x1c]
mov bl, al
call fcn.00402c5d
test bl, bl
je 0x40e49d
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push 0x4549fc
call fcn.004011a9
pop ecx
push eax
push ecx
push ecx
mov ecx, esi
call fcn.0040ec67
push 7
xor ebx, ebx
xor edx, edx
mov dword [ebp - 0x24], ebx
mov word [ebp - 0x34], dx
pop ecx
mov dword [ebp - 0x20], ecx
cmp eax, 0xffffffff
je 0x40e42f
push 0xffffffffffffffff
inc eax
mov ecx, esi
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00402820
push eax
lea ecx, [ebp - 0x34]
call fcn.004027c2
push ebx
push 1
lea ecx, [ebp - 0x1c]
call fcn.00402c5d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], 0x46117c
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
cmp eax, 1
jne 0x40e45c
cmp ecx, 8
lea eax, [ebp - 0x34]
lea ecx, [ebp - 0x14]
cmovae eax, dword [ebp - 0x34]
push eax
call fcn.0041e8c0
jmp 0x40e48a
cmp eax, 2
jb 0x40e48a
cmp ecx, 8
lea eax, [ebp - 0x34]
push ecx
cmovae eax, dword [ebp - 0x34]
lea ecx, [ebp - 0x14]
push eax
call fcn.0041e830
lea eax, [esi + 0x18]
cmp dword [eax + 0x14], 8
jb 0x40e480
mov eax, dword [eax]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea ecx, [ebp - 0x14]
call fcn.0041e640
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.00402c5d
lea ecx, [ebp - 0x44]
call fcn.004073df
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ee4e
mov esp, ebp
pop ebp
ret
Function at 0x40fc27
Capabilities:
Check if file exists
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
mov eax, dword [0x466750]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0xd4], 0
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0xd8], edx
xor bh, bh
push edi
cmp dword [esi + 0x10], 0
je 0x40fdc6
cmp dword [esi + 0x14], 8
jb 0x40fc62
mov eax, dword [esi]
jmp 0x40fc64
mov eax, esi
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40fdc6
mov edx, esi
lea ecx, [ebp - 0xe4]
call fcn.0040f9c4
and dword [ebp - 0xd4], 0
lea ecx, [ebp - 0x1c]
push str.CloudCfg_DisableZipTraceFile
call fcn.0040276c
lea edx, [ebp - 0xd4]
lea ecx, [ebp - 0x1c]
call fcn.0040229b
test eax, eax
je 0x40fcb3
cmp dword [ebp - 0xd4], 0
je 0x40fcb3
xor bl, bl
jmp 0x40fcb5
mov bl, 1
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00402c5d
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
test bl, bl
je 0x40fd55
push esi
lea ecx, [ebp - 0x1c]
call fcn.004070f9
push str..zip
call fcn.004011a9
pop ecx
push eax
push str..zip
lea ecx, [ebp - 0x1c]
call fcn.00402a6a
push ecx
push ecx
lea eax, [ebp - 0xe4]
mov edx, esi
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040ff2e
add esp, 0xc
test al, al
je 0x40fd3b
cmp dword [esi + 0x14], 8
jb 0x40fd15
mov eax, dword [esi]
jmp 0x40fd17
mov eax, esi
push eax
call edi
cmp dword [esi + 0x14], 8
jb 0x40fd24
mov ecx, dword [esi]
jmp 0x40fd26
mov ecx, esi
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
push ecx
cmovae eax, dword [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
jmp 0x40fd49
cmp dword [ebp - 8], 8
lea eax, [ebp - 0x1c]
cmovae eax, dword [ebp - 0x1c]
push eax
call edi
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.00402c5d
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.0040f49d
cmp dword [ebp - 0x24], 0
je 0x40fda0
push 2
lea eax, [ebp - 0x34]
push eax
push esi
lea ecx, [ebp - 0xd0]
call fcn.0040a6ae
push dword [ebp - 0xd8]
lea ecx, [ebp - 0xd0]
call fcn.0040a787
lea ecx, [ebp - 0xd0]
call fcn.0040b0a1
lea ecx, [ebp - 0xd0]
mov bh, al
call fcn.0040a71a
cmp dword [esi + 0x14], 8
jb 0x40fda8
mov esi, dword [esi]
push esi
call edi
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.00402c5d
lea ecx, [ebp - 0xe4]
call fcn.004073df
mov al, bh
jmp 0x40fdc8
xor al, al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ee4e
mov esp, ebp
pop ebp
ret
Function at 0x4119d3
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, edx
push esi
push edi
mov esi, ecx
lea eax, [ebx - 1]
cmp eax, 7
jbe 0x4119ef
mov dword [esi + 0x6afa4], str.bad_pack_level
xor edi, edi
mov dword [esi + 0x6af78], edi
cmp dword [esi + 0x6af70], edi
jne 0x411a13
mov dword [esi + 0x6af78], 1
mov dword [esi + 0x6af70], 0x10000
push 0x1fffc
lea eax, [esi + 0x4af70]
mov dword [esi + 0x6af6c], edi
push edi
push eax
call fcn.00435540
movzx eax, word [ebx*8 + 0x459e0a]
add esp, 0xc
mov dword [esi + 0x6af98], eax
movzx eax, word [ebx*8 + 0x459e08]
mov dword [esi + 0x6af9c], eax
movzx eax, word [ebx*8 + 0x459e0c]
push 2
mov dword [esi + 0x6afa0], eax
movzx eax, word [ebx*8 + 0x459e0e]
pop ecx
mov dword [esi + 0x6af94], eax
cmp ebx, ecx
jg 0x411a76
mov eax, dword [ebp + 8]
or word [eax], 4
jmp 0x411a81
cmp ebx, 8
jl 0x411a81
mov eax, dword [ebp + 8]
or word [eax], cx
push 0x10000
lea ebx, [esi + 0x1af70]
mov dword [esi + 0x6af84], edi
push ebx
push esi
mov dword [esi + 0x6af74], edi
call dword [esi + 0xc]
add esp, 0xc
mov dword [esi + 0x6af90], eax
test eax, eax
je 0x411ae8
cmp eax, 0xffffffff
je 0x411ae8
mov dword [esi + 0x6af8c], edi
cmp eax, 0x106
jae 0x411ac3
mov ecx, esi
call fcn.00411ca3
mov dword [esi + 0x6af7c], edi
mov ecx, edi
movzx eax, byte [ebx + edi]
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
inc edi
mov dword [esi + 0x6af7c], ecx
cmp edi, 2
jb 0x411acb
jmp 0x411af8
mov dword [esi + 0x6af8c], 1
mov dword [esi + 0x6af90], edi
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x411de6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
xor edi, edi
mov ecx, edi
mov ebx, edi
mov dword [ebp - 4], ecx
mov dword [esi + 0x6af80], 2
jmp 0x411fe4
cmp dword [esi + 0x6af90], 3
jb 0x411e63
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [edx + esi + 0x1af72]
xor ecx, eax
and ecx, 0x7fff
and edx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
mov ecx, dword [ebp - 4]
test ecx, ecx
je 0x411ea0
mov eax, dword [esi + 0x6af84]
sub eax, ecx
cmp eax, 0x7efa
ja 0x411ea0
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x411e8a
mov dword [esi + 0x6afa0], eax
mov edx, ecx
mov ecx, esi
call fcn.00411afd
mov ecx, dword [esi + 0x6af90]
mov ebx, eax
cmp ebx, ecx
cmova ebx, ecx
mov ecx, esi
cmp ebx, 3
jb 0x411f72
mov edx, dword [esi + 0x6af84]
lea eax, [ebx - 3]
sub edx, dword [esi + 0x6af88]
push eax
call fcn.0041142e
sub dword [esi + 0x6af90], ebx
pop ecx
mov dword [ebp - 8], eax
cmp ebx, dword [esi + 0x6af98]
ja 0x411f39
cmp dword [esi + 0x6af90], 3
jb 0x411f39
dec ebx
inc dword [esi + 0x6af84]
mov edx, dword [esi + 0x6af84]
mov eax, dword [esi + 0x6af7c]
shl eax, 5
movzx ecx, byte [esi + edx + 0x1af72]
and edx, 0x7fff
xor ecx, eax
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov eax, dword [esi + ecx*4 + 0x4af70]
mov dword [esi + edx*4 + 0x2af70], eax
mov ecx, dword [esi + 0x6af7c]
mov dword [ebp - 4], eax
mov eax, dword [esi + 0x6af84]
mov dword [esi + ecx*4 + 0x4af70], eax
dec ebx
jne 0x411edc
mov eax, dword [ebp - 8]
jmp 0x411f8f
add dword [esi + 0x6af84], ebx
mov ebx, edi
mov eax, dword [esi + 0x6af84]
movzx ecx, byte [eax + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [eax + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov eax, dword [ebp - 8]
jmp 0x411f95
mov eax, dword [esi + 0x6af84]
xor edx, edx
movzx eax, byte [eax + esi + 0x1af70]
push eax
call fcn.0041142e
dec dword [esi + 0x6af90]
pop ecx
inc dword [esi + 0x6af84]
test eax, eax
je 0x411fce
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x411fad
lea edx, [esi + 0x1af70]
add edx, ecx
jmp 0x411faf
mov edx, edi
mov eax, dword [esi + 0x6af84]
sub eax, ecx
mov ecx, esi
push edi
push eax
call fcn.00411236
mov eax, dword [esi + 0x6af84]
pop ecx
pop ecx
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x411fe1
mov ecx, esi
call fcn.00411ca3
mov ecx, dword [ebp - 4]
cmp dword [esi + 0x6af90], edi
jne 0x411e08
mov ecx, dword [esi + 0x6af74]
test ecx, ecx
js 0x412002
lea edi, [esi + 0x1af70]
add edi, ecx
mov eax, dword [esi + 0x6af84]
mov edx, edi
sub eax, ecx
mov ecx, esi
push 1
push eax
call fcn.00411236
pop ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x412c1e
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x412c29
xor eax, eax
pop ebp
ret
push ebx
push esi
mov esi, dword [ebp + 8]
not ecx
mov ebx, 0xff
cmp esi, 8
jb 0x412ce1
push edi
mov edi, esi
shr edi, 3
movzx eax, byte [edx]
sub esi, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
movzx eax, byte [edx + 1]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
movzx eax, byte [edx + 2]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
movzx eax, byte [edx + 3]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
movzx eax, byte [edx + 4]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
movzx eax, byte [edx + 5]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
movzx eax, byte [edx + 6]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
movzx eax, byte [edx + 7]
add edx, 8
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
dec edi
jne 0x412c44
pop edi
test esi, esi
je 0x412cfa
movzx eax, byte [edx]
xor eax, ecx
shr ecx, 8
and eax, ebx
xor ecx, dword [eax*4 + 0x459f20]
inc edx
dec esi
jne 0x412ce5
not ecx
pop esi
mov eax, ecx
pop ebx
pop ebp
ret

Function at 0x412d02
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push esi
push edi
mov edi, ecx
movsx eax, dl
mov edx, 0xff
mov esi, dword [edi]
xor eax, esi
and eax, edx
shr esi, 8
mov eax, dword [eax*4 + 0x459f20]
xor eax, esi
mov dword [edi], eax
movzx eax, al
add eax, dword [edi + 4]
imul ecx, eax, 0x8088405
mov eax, dword [edi + 8]
inc ecx
mov dword [edi + 4], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, edx
xor eax, dword [ecx*4 + 0x459f20]
mov dword [edi + 8], eax
pop edi
pop esi
ret
Function at 0x412ecf
Capabilities:
Get file size
Parse pe header
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
mov eax, dword [0x466750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x4c], eax
mov ebx, ecx
mov eax, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x38]
push eax
push ebx
mov dword [ebp - 0x54], edx
call dword [sym.imp.KERNEL32.dll_GetFileInformationByHandle]
test eax, eax
jne 0x412f0f
mov eax, 0x200
jmp 0x413087
mov eax, dword [ebp - 0x38]
xor ecx, ecx
inc ecx
mov edx, eax
and edx, ecx
push 0
pop esi
cmovne esi, ecx
test al, 2
je 0x412f26
or esi, 2
test al, 4
je 0x412f2d
or esi, 4
mov ecx, eax
and ecx, 0x10
je 0x412f37
or esi, 0x10
test al, 0x20
je 0x412f3e
or esi, 0x20
test ecx, ecx
je 0x412f4a
or esi, 0x40000000
jmp 0x412f50
or esi, 0x80000000
or esi, 0x1000000
test edx, edx
jne 0x412f60
or esi, 0x800000
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x3c], eax
cmp eax, 0x28
jbe 0x413011
xor eax, eax
push eax
push eax
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 2
lea eax, [ebp - 0x40]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push 0
push 0
push 0x24
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x58]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, 0x54ad
cmp word [ebp - 0x40], ax
jne 0x41300e
mov ecx, dword [ebp - 0x58]
lea eax, [ecx + 0x34]
cmp dword [ebp - 0x3c], eax
jbe 0x41300e
push 0
push 0
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x44]
push eax
push 4
lea eax, [ebp - 0x48]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp - 0x48]
cmp eax, 0x5a4d
je 0x413008
cmp eax, 0x454e
je 0x413008
cmp eax, 0x454c
je 0x413008
cmp eax, 0x4550
jne 0x41300e
or esi, 0x400000
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x54]
test ecx, ecx
je 0x41301a
mov dword [ecx], esi
mov ecx, dword [ebp - 0x4c]
test ecx, ecx
je 0x413023
mov dword [ecx], eax
test edi, edi
je 0x41305c
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.00412e3a
push dword [ebp - 0x20]
mov dword [edi], eax
push dword [ebp - 0x24]
mov dword [edi + 4], edx
call fcn.00412e3a
push dword [ebp - 0x30]
mov dword [edi + 8], eax
push dword [ebp - 0x34]
mov dword [edi + 0xc], edx
call fcn.00412e3a
add esp, 0x18
mov dword [edi + 0x10], eax
mov dword [edi + 0x14], edx
mov esi, dword [ebp - 0x50]
test esi, esi
je 0x413085
push dword [ebp - 0x20]
lea edx, [ebp - 0x3c]
push dword [ebp - 0x24]
lea ecx, [ebp - 0x40]
call fcn.00412e5e
movzx eax, word [ebp - 0x3c]
pop ecx
pop ecx
movzx ecx, word [ebp - 0x40]
shl ecx, 0x10
or ecx, eax
mov dword [esi], ecx
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ee4e
mov esp, ebp
pop ebp
ret
Function at 0x4130bf
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
push edi
mov edi, dword [ebp + 0xc]
cmp byte [esi + 0x2d], 0
je 0x413133
cmp dword [esi + 0x3c], 0
je 0x4130f1
cmp dword [esi + 0x40], edi
jae 0x4130eb
push dword [esi + 0x3c]
call fcn.0042ee49
and dword [esi + 0x3c], 0
pop ecx
cmp dword [esi + 0x3c], 0
jne 0x413101
lea eax, [edi + edi]
push eax
call fcn.0042f91f
pop ecx
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
push edi
push ebx
push dword [esi + 0x3c]
call fcn.00433c00
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x413130
lea ecx, [esi + 0x30]
mov eax, dword [esi + 0x3c]
mov dl, byte [ebx + eax]
call fcn.00412d4c
mov ecx, dword [esi + 0x3c]
mov byte [ebx + ecx], al
inc ebx
lea ecx, [esi + 0x30]
cmp ebx, edi
jb 0x413117
mov ebx, dword [esi + 0x3c]
mov ecx, dword [esi + 0x20]
test ecx, ecx
je 0x413162
mov edx, dword [esi + 0x24]
lea eax, [edx + edi]
cmp eax, dword [esi + 0x28]
jb 0x41314e
mov dword [esi + 0x14], 0x30000
jmp 0x413184
push edi
add ecx, edx
push ebx
push ecx
call fcn.00433c00
add esp, 0xc
mov eax, edi
add dword [esi + 0x24], edi
jmp 0x413186
mov eax, dword [esi + 4]
test eax, eax
je 0x41317d
push 0
lea ecx, [ebp + 8]
push ecx
push edi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov eax, dword [ebp + 8]
jmp 0x413186
mov dword [esi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x41349a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov ecx, dword [edi + 0x84]
test ecx, ecx
je 0x4134f0
mov eax, dword [edi + 0x8c]
mov esi, dword [edi + 0x88]
cmp eax, esi
jae 0x41352b
sub esi, eax
cmp esi, dword [ebp + 0xc]
cmova esi, dword [ebp + 0xc]
add eax, ecx
push esi
push eax
push dword [ebp + 8]
call fcn.00433c00
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x8c], esi
add dword [edi + 0x74], esi
push esi
call fcn.00412c1e
add esp, 0x10
mov dword [edi + 0x78], eax
mov eax, esi
jmp 0x41352d
cmp dword [edi + 0x7c], 0
je 0x413524
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x41352b
mov esi, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov ecx, dword [edi + 0x78]
add dword [edi + 0x74], esi
push esi
call fcn.00412c1e
pop ecx
jmp 0x4134e9
mov dword [edi + 0x14], 0x1000000
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x4147e1
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x466750]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
xor eax, eax
push 3
pop esi
inc eax
mov dword [ebp - 0x118], 0x104
mov dword [ebp - 0x114], eax
mov ebx, ecx
lea eax, [ebp - 0x11c]
xor ecx, ecx
push eax
push 0x20019
push ecx
push str.SystemCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x11c], ecx
mov dword [ebp - 0x110], ecx
mov dword [ebp - 0x10c], ecx
call edi
test eax, eax
jne 0x41498f
push ebx
push str._sConnection
lea eax, [ebp - 0x108]
push 0x103
push eax
call fcn.00416b16
add esp, 0x10
lea eax, [ebp - 0x110]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push dword [ebp - 0x11c]
call edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x414987
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 4
pop eax
mov dword [ebp - 0x114], eax
mov dword [ebp - 0x118], eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.MediaSubType
push dword [ebp - 0x110]
call ebx
test eax, eax
jne 0x41497f
push 0x104
push eax
lea eax, [ebp - 0x108]
mov dword [ebp - 0x114], 1
push eax
mov dword [ebp - 0x118], 0x103
call fcn.00435540
add esp, 0xc
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x114]
push eax
push 0
push str.PnpInstanceID
push dword [ebp - 0x110]
call ebx
test eax, eax
jne 0x41497f
mov eax, dword [ebp - 0x10c]
xor ebx, ebx
inc ebx
cmp eax, ebx
jne 0x414979
push esi
lea eax, [ebp - 0x108]
push 0x460c00
push eax
call fcn.00431560
add esp, 0xc
test eax, eax
jne 0x41494b
xor esi, esi
jmp 0x41497f
mov eax, dword [ebp - 0x10c]
cmp eax, ebx
jne 0x414979
push esi
lea eax, [ebp - 0x108]
push 0x460c00
push eax
call fcn.00431560
add esp, 0xc
test eax, eax
je 0x414973
push 2
pop esi
jmp 0x41497f
mov eax, dword [ebp - 0x10c]
cmp eax, 2
cmove esi, ebx
push dword [ebp - 0x110]
call edi
push dword [ebp - 0x11c]
call edi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042ee4e
mov esp, ebp
pop ebp
ret