joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4021e8
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453013
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 4], 0
cmp dword [0x471200], 0
je 0x402393
cmp dword [0x46b0f0], 1
jne 0x40224e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x471208], eax
je 0x402243
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [0x471208]
push eax
call fcn.0040246b
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [0x471208], eax
mov eax, dword [0x471200]
push eax
push 1
lea ecx, [ebp + 8]
call fcn.004026f0
push eax
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
call fcn.0041d7dc
add esp, 0x10
cmp dword [0x471210], 1
jne 0x402393
mov ecx, dword [0x471200]
push ecx
call fcn.0041d659
add esp, 4
cmp eax, 0x600000
jl 0x402393
mov edx, dword [0x471200]
push edx
call fcn.0041d5dc
add esp, 4
cmp dword [0x46b0f4], 0
jne 0x402322
push 0x46b1a8
push str.S5USB_A.LOG
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x471248
call fcn.00405477
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x1c]
call fcn.004013f0
push eax
call fcn.0041d5c9
add esp, 8
mov dword [0x471200], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0043b962
cmp dword [0x471200], 0
jne 0x402316
push 0x46b1b8
push str.C:S5USB_A.LOG
call fcn.0041d5c9
add esp, 8
mov dword [0x471200], eax
mov dword [0x46b0f4], 1
jmp 0x402393
push 0x46b1cc
push str.S5USB_B.LOG
lea edx, [ebp - 0x14]
push edx
mov ecx, 0x471248
call fcn.00405477
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x24]
call fcn.004013f0
push eax
call fcn.0041d5c9
add esp, 8
mov dword [0x471200], eax
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.0043b962
cmp dword [0x471200], 0
jne 0x402389
push 0x46b1dc
push str.C:S5USB_B.LOG
call fcn.0041d5c9
add esp, 8
mov dword [0x471200], eax
mov dword [0x46b0f4], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043b962
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x402aa3
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45306f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x10], 0
push 0x46b23c
lea ecx, [ebp - 0x18]
call fcn.0043b9d0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x402b25
mov eax, dword [ebp - 0x14]
and eax, 1
test eax, eax
je 0x402b12
mov ecx, dword [ebp - 0x10]
add ecx, 0x41
push ecx
push 0
lea ecx, [ebp - 0x18]
call fcn.0043bf14
lea edx, [ebp - 0x18]
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.00402b7b
mov eax, dword [ebp - 0x14]
shr eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
add ecx, 1
mov dword [ebp - 0x10], ecx
jmp 0x402ae5
mov ecx, dword [ebp - 0x1c]
add ecx, 0x3c
call fcn.00404850
test eax, eax
jne 0x402b5e
push 0xff00ff
push 0
push 0x10
push 0x89
mov ecx, dword [ebp - 0x1c]
add ecx, 0x3c
call fcn.00435606
push 0
mov edx, dword [ebp - 0x1c]
add edx, 0x3c
push edx
mov ecx, dword [ebp - 0x1c]
call fcn.004046c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x18]
call fcn.0043b962
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x402e87
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4530c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x168
mov dword [ebp - 0x16c], ecx
mov dword [ebp - 0x15c], 0
lea ecx, [ebp - 0x158]
call fcn.004013d0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043b6d7
mov byte [ebp - 4], 1
push 0x46b248
push 1
lea ecx, [ebp - 0x164]
push ecx
lea ecx, [ebp - 0x10]
call fcn.0043258b
mov dword [ebp - 0x170], eax
mov edx, dword [ebp - 0x170]
mov dword [ebp - 0x174], edx
mov byte [ebp - 4], 2
mov eax, dword [ebp - 0x174]
push eax
call fcn.00404590
mov byte [ebp - 0x160], al
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x164]
call fcn.0043b962
mov ecx, dword [ebp - 0x160]
and ecx, 0xff
test ecx, ecx
je 0x402f41
push 0x46b24c
lea ecx, [ebp - 0x10]
call fcn.0043bd3e
push 0x46b250
lea ecx, [ebp - 0x10]
call fcn.0043bd3e
lea edx, [ebp - 0x150]
push edx
lea ecx, [ebp - 0x10]
call fcn.004013f0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x154], eax
cmp dword [ebp - 0x154], 0xffffffff
je 0x403002
mov eax, dword [ebp - 0x150]
and eax, 0x10
test eax, eax
je 0x402fd4
lea ecx, [ebp - 0x124]
push ecx
lea ecx, [ebp - 0x158]
call fcn.0043baeb
push 0x46b254
lea edx, [ebp - 0x158]
push edx
call fcn.00404590
and eax, 0xff
test eax, eax
je 0x402fd4
push 0x46b258
lea eax, [ebp - 0x158]
push eax
call fcn.00404590
and eax, 0xff
test eax, eax
je 0x402fd4
mov dword [ebp - 0x15c], 1
lea ecx, [ebp - 0x150]
push ecx
mov edx, dword [ebp - 0x154]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x402ff5
cmp dword [ebp - 0x15c], 0
je 0x402f77
mov eax, dword [ebp - 0x154]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 0x15c]
mov dword [ebp - 0x168], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0043b962
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x158]
call fcn.0043b962
mov eax, dword [ebp - 0x168]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x403ca8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov ecx, dword [ebp + 8]
call fcn.004013f0
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 2
je 0x403cd6
cmp dword [ebp - 4], 5
je 0x403cd6
mov eax, 1
jmp 0x403cdb
mov eax, 1
mov esp, ebp
pop ebp
ret 4
Function at 0x408c18
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453a9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x408c8b
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x44f
mov ecx, dword [ebp - 0x20]
call fcn.00408e2c
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043b962
mov eax, dword [ebp - 0x14]
jmp 0x408d12
mov eax, dword [ebp - 0x10]
and eax, 1
test eax, eax
je 0x408cf9
mov ecx, dword [ebp - 0x10]
and ecx, 0xfffffffe
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
and edx, 0xfffffffd
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
and al, 0xfb
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x408cf9
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x450
mov ecx, dword [ebp - 0x20]
call fcn.00408e2c
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043b962
mov eax, dword [ebp - 0x18]
jmp 0x408d12
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043b962
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4

Function at 0x408d22
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453aae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
jne 0x408d95
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x44f
mov ecx, dword [ebp - 0x20]
call fcn.00408e2c
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043b962
mov eax, dword [ebp - 0x14]
jmp 0x408e1c
mov eax, dword [ebp - 0x10]
and eax, 1
test eax, eax
jne 0x408e03
mov ecx, dword [ebp - 0x10]
or ecx, 1
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
or edx, 2
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
or al, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x408e03
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x450
mov ecx, dword [ebp - 0x20]
call fcn.00408e2c
mov dword [ebp - 0x18], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043b962
mov eax, dword [ebp - 0x18]
jmp 0x408e1c
mov dword [ebp - 0x1c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.0043b962
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40b1e6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x453e31
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov dword [ebp - 0x50], ecx
push 0xa
lea ecx, [ebp - 0x2c]
call fcn.004358eb
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004013d0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.0043592a
lea eax, [ebp - 0x3c]
push eax
push 0x20019
push 0
push 0x46d0b0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b2c0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x44], 0x200
mov dword [ebp - 0x34], 0
lea ecx, [ebp - 0x34]
push ecx
push 0
push 0
push 0
lea edx, [ebp - 0x44]
push edx
mov eax, dword [ebp - 0x44]
push eax
lea ecx, [ebp - 0x10]
call fcn.0043bd92
push eax
mov ecx, dword [ebp - 0x38]
push ecx
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x30], eax
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0043bde1
cmp dword [ebp - 0x30], 0
jne 0x40b2a5
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00435ad7
mov ecx, dword [ebp - 0x38]
add ecx, 1
mov dword [ebp - 0x38], ecx
cmp dword [ebp - 0x30], 0
je 0x40b24f
mov edx, dword [ebp - 0x3c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40b2ce
push 0
push 0
push 0x46d0d0
call fcn.00444a94
lea ecx, [ebp - 0x2c]
call fcn.004101e0
test eax, eax
jle 0x40b350
lea ecx, [ebp - 0x2c]
call fcn.00410200
mov dword [ebp - 0x40], eax
cmp dword [ebp - 0x40], 0
je 0x40b350
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x2c]
call fcn.00410220
push eax
lea ecx, [ebp - 0x10]
call fcn.0043ba9b
push 0x46d0ec
lea ecx, [ebp - 0x10]
call fcn.004326f7
cmp eax, 0xffffffff
je 0x40b34e
lea ecx, [ebp - 0x2c]
call fcn.0043592a
push str._nSearchVCP:VCP_gefunden__TRUE
call fcn.0040202c
add esp, 4
mov dword [ebp - 0x48], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0043b962
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0043595f
mov eax, dword [ebp - 0x48]
jmp 0x40b38a
jmp 0x40b2e5
lea ecx, [ebp - 0x2c]
call fcn.0043592a
push str._nSearchVCP:VCP_NICHT_gefunden__FALSE
call fcn.0040202c
add esp, 4
mov dword [ebp - 0x4c], 0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.0043b962
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x2c]
call fcn.0043595f
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40f975
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45449a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x14]
push eax
push 1
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40fa1c
mov dword [ebp - 0x18], 4
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x10]
push edx
push 0
push 0
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40fa10
cmp dword [ebp + 0x10], 1
jne 0x40fa10
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x45b
mov ecx, dword [ebp - 0x20]
call fcn.00408e2c
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40fa3a
cmp dword [ebp + 0x10], 1
jne 0x40fa3a
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x45a
mov ecx, dword [ebp - 0x20]
call fcn.00408e2c
mov edx, dword [ebp - 0x10]
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043b962
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043b962
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40fa6e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4544d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x14
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0
mov dword [ebp - 4], 2
push 0x4713c8
lea ecx, [ebp - 0x10]
call fcn.0043b9d0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x14]
push eax
push 1
push 0
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40fb3a
mov dword [ebp - 0x18], 0x200
lea ecx, [ebp - 0x18]
push ecx
push 0x200
lea ecx, [ebp - 0x10]
call fcn.0043bd92
push eax
push 0
push 0
lea ecx, [ebp + 0x10]
call fcn.004013f0
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40fb24
cmp dword [ebp + 0x14], 1
jne 0x40fb24
lea ecx, [ebp + 0x10]
call fcn.004013f0
push eax
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
push 0x45b
mov ecx, dword [ebp - 0x20]
call fcn.00408e2c
push 0xffffffffffffffff
lea ecx, [ebp - 0x10]
call fcn.0043bde1
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40fb58
cmp dword [ebp + 0x14], 1
jne 0x40fb58
push 0
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
push 0x45a
mov ecx, dword [ebp - 0x20]
call fcn.00408e2c
lea ecx, [ebp - 0x10]
push ecx
mov ecx, dword [ebp + 8]
call fcn.0043b6d7
mov edx, dword [ebp - 0x1c]
or edx, 1
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x10]
call fcn.0043b962
mov byte [ebp - 4], 1
lea ecx, [ebp + 0xc]
call fcn.0043b962
mov byte [ebp - 4], 0
lea ecx, [ebp + 0x10]
call fcn.0043b962
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40fba4
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4544f2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0x4713cc
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x40fc64
push 4
lea ecx, [ebp + 0x10]
push ecx
push 4
push 0
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
jne 0x40fc62
cmp dword [ebp + 0x14], 1
jne 0x40fc62
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x451
mov ecx, dword [ebp - 0x1c]
call fcn.00408e2c
jmp 0x40fc88
cmp dword [ebp - 0x10], 0
jne 0x40fc88
cmp dword [ebp + 0x14], 1
jne 0x40fc88
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x452
mov ecx, dword [ebp - 0x1c]
call fcn.00408e2c
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ecx
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043b962
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043b962
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40fd3c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454518
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x28], ecx
lea ecx, [ebp - 0x10]
call fcn.004013d0
mov dword [ebp - 4], 0
mov eax, dword [0x471308]
add eax, 0x47a
push eax
lea ecx, [ebp - 0x10]
call fcn.0043c013
push 0
push 4
lea ecx, [ebp - 0x10]
call fcn.004013f0
push eax
call fcn.00444a94
cmp eax, 6
je 0x40fda7
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0043b962
jmp 0x40fe7b
push str._norestart
mov ecx, dword [0x4712b8]
push ecx
call fcn.0041dec0
add esp, 8
test eax, eax
je 0x40fdd3
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0043b962
jmp 0x40fe7b
lea edx, [ebp - 0x24]
push edx
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40fdfb
push 0
push 0
push 0x465
mov ecx, dword [ebp - 0x28]
call fcn.00408e2c
lea eax, [ebp - 0x1c]
push eax
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x14], 2
push 0
push 0
push 0
lea ecx, [ebp - 0x20]
push ecx
push 0
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x40fe4b
push 0
push 0
push 0x465
mov ecx, dword [ebp - 0x28]
call fcn.00408e2c
push 0
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
test eax, eax
jne 0x40fe6c
push 0
push 0
push 0x466
mov ecx, dword [ebp - 0x28]
call fcn.00408e2c
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0043b962
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 4
Function at 0x40fe8b
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x45453d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 2
mov dword [ebp - 0x10], 0
push 0
lea eax, [ebp - 0x14]
push eax
push 0
push 0xf003f
push 0
push 0x4713d0
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 1
jne 0x40ff6a
lea ecx, [ebp + 0x10]
call fcn.004026f0
push eax
lea ecx, [ebp + 0x10]
call fcn.004026f0
push eax
lea ecx, [ebp + 0x10]
call fcn.0043bd92
push eax
push 1
push 0
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
push 0xffffffffffffffff
lea ecx, [ebp + 0x10]
call fcn.0043bde1
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x10], 0
jne 0x40ff68
cmp dword [ebp + 0x14], 1
jne 0x40ff68
lea ecx, [ebp + 0xc]
call fcn.004013f0
push eax
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x451
mov ecx, dword [ebp - 0x1c]
call fcn.00408e2c
jmp 0x40ff8e
cmp dword [ebp - 0x10], 0
jne 0x40ff8e
cmp dword [ebp + 0x14], 1
jne 0x40ff8e
push 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push 0x452
mov ecx, dword [ebp - 0x1c]
call fcn.00408e2c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 1
lea ecx, [ebp + 8]
call fcn.0043b962
mov byte [ebp - 4], 0
lea ecx, [ebp + 0xc]
call fcn.0043b962
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0x10]
call fcn.0043b962
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40ffce
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454559
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 1
mov dword [ebp - 0x10], 0
lea ecx, [ebp + 8]
call fcn.004013f0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x410029
push str._nIDS_MSG_REGISTRYDELETE
call fcn.0040202c
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.0043b962
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.0043b962
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret 8

Function at 0x41de6d
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x41de8d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0041eda9
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x41deb0
test byte [esp + 8], 2
je 0x41deb0
call fcn.0041ee1c
mov dword [eax], 0xd
call fcn.0041ee25
mov dword [eax], 5
jmp 0x41de89
xor eax, eax
ret
Function at 0x425b5d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x470038
cmp edx, dword [eax]
je 0x425b7f
add eax, 8
inc ecx
cmp eax, 0x4700c8
jl 0x425b70
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x470038]
jne 0x425cad
mov eax, dword [0x47347c]
cmp eax, 1
je 0x425c87
test eax, eax
jne 0x425bb0
cmp dword [0x46f8c4], 1
je 0x425c87
cmp edx, 0xfc
je 0x425cad
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x425be7
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004268e0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0041d920
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x425c2a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0041d920
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x45dcd8
push edi
call fcn.00429750
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004268e0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004268f0
lea eax, [ebp - 0xa0]
push 0x45dcb8
push eax
call fcn.004268f0
push dword [esi + 0x47003c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004268f0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00429a1e
add esp, 0x2c
pop edi
jmp 0x425cad
lea eax, [ebp + 8]
lea esi, [esi + 0x47003c]
push 0
push eax
push dword [esi]
call fcn.0041d920
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret