joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4062be
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.DeviceAccess
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x40638a
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
push 0x51e8d4
push dword [0x51e8d8]
jmp 0x40635d
mov eax, dword [0x51e8d4]
add eax, 0x1000
push eax
push dword [0x51e8d8]
mov dword [0x51e8d4], eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x406378
push 0x51e8d4
mov dword [0x51e8d8], eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push str.HWBlockList
push esi
call ebx
mov edi, eax
cmp edi, 0xea
je 0x406329
xor ebx, ebx
test edi, edi
push esi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0049d307
leave
ret

Function at 0x406397
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.DeviceAccess
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x406463
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push edi
push 0x51e8cc
push dword [0x51e8d0]
jmp 0x406436
mov eax, dword [0x51e8cc]
add eax, 0x1000
push eax
push dword [0x51e8d0]
mov dword [0x51e8cc], eax
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
test eax, eax
je 0x406451
push 0x51e8cc
mov dword [0x51e8d0], eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 0
push str.HWAllowList
push esi
call ebx
mov edi, eax
cmp edi, 0xea
je 0x406402
xor ebx, ebx
test edi, edi
push esi
sete bl
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0049d307
leave
ret
Function at 0x406470
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push 0x5073ec
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], esi
mov dword [0x51e89c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4064f2
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 1
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push str.K7DSAvailable
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 0xc], esi
je 0x4064f2
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x51e89c
lea eax, [ebp - 0x10]
push eax
push esi
push str.K7DSEnabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
inc esi
cmp dword [ebp - 4], 0
je 0x406501
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x406506
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x51e89c]
push esi
mov dword [ebp - 0x10], eax
xor esi, esi
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push 0xf003f
push esi
push 0x5073ec
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406583
push edi
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 8], 1
push eax
lea eax, [ebp - 8]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x14]
push eax
push esi
push str.K7DSAvailable
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp dword [ebp - 8], esi
je 0x406582
push edi
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push str.K7DSEnabled
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
pop edi
cmp dword [ebp - 4], 0
je 0x406592
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x40662d
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.DataShieldBlockList
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
mov esi, edx
push str._s_s_s_s
push eax
mov ebx, ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00499480
mov edi, eax
test edi, edi
jne 0x4066a1
push eax
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991f0
mov edi, eax
test edi, edi
je 0x4066cb
push esi
call fcn.004c96f6
pop ecx
lea eax, [eax*2 + 2]
push eax
push esi
push 1
push 0
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
push edi
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x4066da
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.DataShield
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
mov ebx, edx
push str._s_s_s_s
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov edi, eax
test edi, edi
je 0x406758
push ebx
push esi
lea eax, [ebp - 0x10c]
push eax
push 0
push str.ProtectedDirs
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret

Function at 0x406767
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.DataShield
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
mov ebx, edx
push str._s_s_s_s
push eax
mov esi, ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov edi, eax
test edi, edi
je 0x4067e5
push ebx
push esi
lea eax, [ebp - 0x10c]
push eax
push 0
push str.TrustedApps
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret

Function at 0x4067f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.DataShield
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
mov ebx, ecx
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
xor esi, esi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov edi, eax
test edi, edi
je 0x40688e
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 4
push eax
push ebx
lea eax, [ebp - 0x110]
push eax
push esi
push str.SmartAppTrust
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406885
cmp dword [ebp - 0x110], 4
jne 0x406885
xor esi, esi
inc esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x4069fc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [0x51e898]
lea eax, [ebp - 0x108]
push esi
push edi
push str.AMSI
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
push str._s_s_s_s
xor esi, esi
push eax
mov dword [ebp - 0x10c], esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00499480
mov edi, eax
test edi, edi
je 0x406a98
lea eax, [ebp - 0x10c]
push eax
push esi
push esi
push esi
push str.ProviderId
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406a91
cmp dword [ebp - 0x10c], esi
je 0x406a91
push ebx
push str.FeatureEnabled
push edi
call fcn.004998f0
mov esi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret

Function at 0x406aa9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.AMSI
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
xor esi, esi
push str._s_s_s_s
push eax
mov dword [ebp - 0x10c], esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00499480
mov edi, eax
test edi, edi
je 0x406b42
lea eax, [ebp - 0x10c]
push eax
push esi
push esi
push esi
push str.ProviderId
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406b3b
cmp dword [ebp - 0x10c], esi
je 0x406b3b
push 0x51e898
push str.FeatureEnabled
push edi
call fcn.00499660
mov esi, eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0049d307
leave
ret
Function at 0x406b52
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x188
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x406c30
push esi
call fcn.004c96f6
pop ecx
cmp eax, 4
jb 0x406c30
push str.AMSIBlockList
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x188]
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x188]
xor ebx, ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00499480
mov edi, eax
test edi, edi
jne 0x406bdd
push ebx
lea eax, [ebp - 0x188]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991f0
mov edi, eax
test edi, edi
je 0x406c30
push ebx
call fcn.004c8af7
push eax
push 0x507560
lea eax, [ebp - 0x84]
push 0x40
push eax
call fcn.00407156
lea eax, [ebp - 0x84]
push eax
call fcn.004c96f6
add esp, 0x18
lea eax, [eax*2 + 2]
push eax
lea eax, [ebp - 0x84]
push eax
push 1
push ebx
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
neg eax
push edi
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
jmp 0x406c32
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret

Function at 0x406cc2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.AMSI
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
mov ebx, ecx
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
xor esi, esi
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov edi, eax
test edi, edi
je 0x406d5c
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 4
push eax
push ebx
lea eax, [ebp - 0x110]
push eax
push esi
push str.ThreatActionId
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x406d53
cmp dword [ebp - 0x110], 4
jne 0x406d53
xor esi, esi
inc esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret

Function at 0x406e6a
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push str.AMSI
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
xor esi, esi
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
push esi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00499480
mov edi, eax
test edi, edi
je 0x406eda
push str.DisableTempAmsi
push edi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
neg eax
push edi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0049d307
leave
ret
Function at 0x406eea
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push str.Carnivore
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x108]
mov esi, ecx
push str._s_s_s_s
push eax
mov edi, edx
mov dword [ebp - 0x110], esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x108]
xor ebx, ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov dword [ebp - 0x114], eax
test eax, eax
je 0x406fa0
push edi
push esi
lea ecx, [ebp - 0x10c]
push ecx
push ebx
push str.DecoyFileExtraTarget
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x406f90
cmp dword [ebp - 0x10c], 3
jne 0x406f90
xor esi, esi
inc esi
cmp dword [edi], ebx
jbe 0x406f92
mov edx, dword [ebp - 0x110]
lea ecx, [edx + ebx]
lea eax, [ebx + 0x77]
xor byte [ecx], al
inc ebx
cmp ebx, dword [edi]
jb 0x406f81
jmp 0x406f92
mov esi, ebx
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret

Function at 0x406faf
Capabilities:
Encode data using xor
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push str.Carnivore
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x148]
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x148]
push 0
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00499480
mov edi, eax
test edi, edi
je 0x40704a
lea eax, [ebp - 0x44]
push 0x52aa00
push eax
call fcn.004c99d0
pop ecx
pop ecx
xor ecx, ecx
lea eax, [ecx + 0x77]
xor byte [ebp + ecx - 0x44], al
inc ecx
cmp ecx, 0x40
jb 0x407017
push esi
push 0x40
lea eax, [ebp - 0x44]
push eax
push 3
push 0
push str.DecoyFilePattern
push edi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
push edi
sbb esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0049d307
leave
ret
Function at 0x407057
Capabilities:
Encode data using xor
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push str.Carnivore
push str.AntiVirus
push str.Products
push str.SoftwareK7_ComputingK7TotalSecurity
lea eax, [ebp - 0x148]
push str._s_s_s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x18
lea eax, [ebp - 0x148]
xor ebx, ebx
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004991c0
mov esi, eax
test esi, esi
je 0x40711f
push edi
lea eax, [ebp - 0x14c]
mov dword [ebp - 0x14c], 0x40
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x150]
push eax
push ebx
push str.DecoyFilePattern
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407113
cmp dword [ebp - 0x150], 3
jne 0x407113
xor edi, edi
inc edi
cmp dword [ebp - 0x14c], ebx
jbe 0x407101
lea eax, [ebx + 0x77]
xor byte [ebp + ebx - 0x44], al
inc ebx
cmp ebx, dword [ebp - 0x14c]
jb 0x4070f1
lea eax, [ebp - 0x44]
push eax
push 0x52aa00
call fcn.004c99d0
pop ecx
pop ecx
jmp 0x407115
mov edi, ebx
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x4076f3
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [ebp - 0x120], eax
mov ebx, ecx
lea eax, [ebp - 0x110]
mov dword [ebp - 0x11c], edx
push eax
push ebx
mov dword [ebp - 0x110], esi
mov dword [ebp - 0x118], esi
mov dword [ebp - 0x114], esi
mov dword [ebp - 0x10c], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
test eax, eax
je 0x4077fd
cmp eax, 0x2000
ja 0x4077fd
test edi, edi
je 0x4077fd
push edi
push eax
push dword [ebp - 0x110]
push ebx
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x4077fd
mov ebx, dword [sym.imp.VERSION.dll_VerQueryValueA]
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10c]
push eax
push str.VarFileInfoTranslation
push edi
call ebx
test eax, eax
je 0x4077fd
mov edx, dword [ebp - 0x10c]
push dword [ebp - 0x11c]
movzx ecx, word [edx]
movzx eax, word [edx + 2]
shl ecx, 0x10
or ecx, eax
mov dword [edx], ecx
mov eax, dword [ebp - 0x10c]
push dword [eax]
lea eax, [ebp - 0x108]
push str.StringFileInfo_08lx_s
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x108]
push eax
push edi
call ebx
test eax, eax
je 0x4077fd
push dword [ebp - 0x118]
push dword [ebp - 0x120]
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0049d307
leave
ret
Function at 0x40780e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xorps xmm0, xmm0
movlpd qword [ebp - 8], xmm0
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp - 8]
test edx, edx
je 0x407948
mov ebx, dword [ebp + 0xc]
lea esi, [edx - 1]
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 4]
shr esi, 3
inc esi
xor dword [edi + 4], eax
add eax, ebx
xor dword [edi], ebx
add ebx, eax
mov dword [ebp - 4], eax
movzx eax, byte [edi]
lea edi, [edi + 8]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor edx, dword [eax*8 + 0x4ff4e4]
xor ecx, dword [eax*8 + 0x4ff4e0]
movzx eax, byte [edi - 7]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor edx, dword [eax*8 + 0x4ff4e4]
xor ecx, dword [eax*8 + 0x4ff4e0]
movzx eax, byte [edi - 6]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor edx, dword [eax*8 + 0x4ff4e4]
xor ecx, dword [eax*8 + 0x4ff4e0]
movzx eax, byte [edi - 5]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor edx, dword [eax*8 + 0x4ff4e4]
xor ecx, dword [eax*8 + 0x4ff4e0]
movzx eax, byte [edi - 4]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor edx, dword [eax*8 + 0x4ff4e4]
xor ecx, dword [eax*8 + 0x4ff4e0]
movzx eax, byte [edi - 3]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor edx, dword [eax*8 + 0x4ff4e4]
xor ecx, dword [eax*8 + 0x4ff4e0]
movzx eax, byte [edi - 2]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor edx, dword [eax*8 + 0x4ff4e4]
xor ecx, dword [eax*8 + 0x4ff4e0]
movzx eax, byte [edi - 1]
xor eax, ecx
shrd ecx, edx, 8
movzx eax, al
shr edx, 8
xor ecx, dword [eax*8 + 0x4ff4e0]
xor edx, dword [eax*8 + 0x4ff4e4]
mov eax, dword [ebp - 4]
sub esi, 1
jne 0x40783c
jmp 0x40794b
mov edx, dword [ebp - 4]
pop edi
pop esi
mov eax, ecx
pop ebx
leave
ret
Function at 0x408111
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x550
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x507690
mov edi, ecx
lea eax, [ebp - 0x408]
push edi
push 0x506968
push eax
xor esi, esi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x548]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x54c], eax
cmp eax, 0xffffffff
je 0x408239
cmp byte [ebp - 0x51c], 0x2e
jne 0x408188
mov al, byte [ebp - 0x51b]
test al, al
je 0x4081ee
cmp al, 0x2e
jne 0x408188
cmp byte [ebp - 0x51a], 0
je 0x4081ee
lea eax, [ebp - 0x51c]
push eax
push edi
lea eax, [ebp - 0x408]
push 0x506968
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
test byte [ebp - 0x548], 0x10
je 0x4081bb
lea ecx, [ebp - 0x408]
call fcn.00408111
jmp 0x4081ee
push 0x80
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x4081ee
push 4
push esi
lea eax, [ebp - 0x408]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x548]
push eax
push dword [ebp - 0x54c]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408168
push dword [ebp - 0x54c]
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x80
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x408236
push 4
push esi
push edi
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0049d307
leave
ret

Function at 0x408249
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x51a448]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x507690
mov edi, ecx
lea eax, [ebp - 0x110]
push edi
push 0x506968
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x250]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4082f5
test byte [ebp - 0x250], 0x10
je 0x4082dc
lea eax, [ebp - 0x224]
push eax
push edi
lea eax, [ebp - 0x110]
push 0x506968
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x110]
push 0x52aa00
push eax
call fcn.0049f330
add esp, 0x18
test eax, eax
je 0x4082dc
lea ecx, [ebp - 0x110]
call fcn.00408111
lea eax, [ebp - 0x250]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x408296
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0049d307
leave
ret