joyce8/EMBER2024-capa huggingface dataset:
Function at 0xdfa000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xdfa131
push esi
call fcn.00dfd145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00dec080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xdfa131
push 0
push ebp
call fcn.00dec3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00dec260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xdfa08b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00dec2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xdfa121
push 0xe12918
push edi
call fcn.00dfb3f0
push eax
push ebx
push esi
call fcn.00df9f60
push 0xe128f8
push edi
call fcn.00dfb3f0
push eax
push ebx
push esi
call fcn.00df9f60
push 0xe128d8
push edi
call fcn.00dfb3f0
push eax
push ebx
push esi
call fcn.00df9f60
push 0xe128c0
push edi
call fcn.00dfb3f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00df9f60
push 0xe128a0
push edi
call fcn.00dfb3f0
push eax
push ebx
push esi
call fcn.00df9f60
push 0xe12888
push edi
call fcn.00dfb3f0
push eax
push ebx
push esi
call fcn.00df9f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xdfb1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00dfb140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00dfb140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00dfb140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00dfb140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xdfbbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xdfbc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xe0d87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xdfbc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xdfbc52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4018a4
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 3
call fcn.00402fb2
add esp, 0xc
cmp eax, 2
jge 0x4018d6
push 3
pop eax
jmp 0x401a88
push str.REALUSER
call fcn.00409015
pop ecx
cmp eax, 1
jne 0x4018ed
push eax
call fcn.00408090
pop ecx
push ebx
push esi
push edi
mov ebx, 0x431fc0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, 0x208
cmp eax, 0xffffffff
je 0x401921
test al, 0x10
je 0x401921
push ebx
call fcn.00407232
mov dword [esp], 0x431db8
push esi
push ebx
call fcn.004112fd
add esp, 0xc
push ebx
push str.Copying_file:__s
push esi
mov esi, 0x4327e0
push esi
call fcn.00403cbc
mov eax, dword [0x432c00]
add esp, 0x10
test eax, eax
je 0x40194e
push esi
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.TRYTIME
call fcn.00409015
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
pop ecx
push 0x431fc0
push 0x431db8
call fcn.00405dd7
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x401a6b
test esi, esi
jle 0x40198b
push 0x64
call ebx
sub esi, 0x64
test esi, esi
jg 0x401961
cmp edi, 0x1f
jne 0x401a40
push str.REBOOTIFLOCKED
push 0x4321c8
call fcn.00411399
pop ecx
pop ecx
test eax, eax
jne 0x401a37
mov esi, 0x431fc0
lea eax, [ebp - 0x108]
push esi
push str._s.bak
push 0x104
push eax
call fcn.00403cbc
add esp, 0x10
lea eax, [ebp - 0x108]
push 1
push eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
call esi
xor ecx, ecx
test eax, eax
push 4
push 0
lea eax, [ebp - 0x108]
cmove ecx, edi
push eax
mov edi, ecx
call esi
mov byte [0x433a62], 1
test edi, edi
jne 0x401a32
push str.TRYTIME
call fcn.00409015
pop ecx
mov esi, eax
push 0x431fc0
push 0x431db8
call fcn.00405dd7
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x401a32
test esi, esi
jle 0x401a32
push 0x64
call ebx
sub esi, 0x64
test esi, esi
jg 0x401a0c
cmp edi, 0x1f
jne 0x401a3c
push 8
pop edi
jmp 0x401a40
test edi, edi
je 0x401a6b
push str.SILENT
push 0x4321c8
call fcn.00411399
pop ecx
pop ecx
test eax, eax
jne 0x401a6b
push 0x431fc0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
push 8
pop edi
cmovne edi, ecx
push str.REALUSER
call fcn.00409015
pop ecx
cmp eax, 1
jne 0x401a83
push 0
call fcn.00408090
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d5ca
leave
Function at 0x401bf1
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
push 5
call fcn.00402fb2
add esp, 0xc
cmp eax, 4
jge 0x401c11
push 3
pop eax
leave
ret
push ebx
push esi
push edi
mov ebx, 0x4323d0
mov edi, 0x4327e0
push ebx
push 0x4321c8
push str.Creating_Registry_value:__s_s
push 0x208
push edi
call fcn.00403cbc
mov eax, dword [0x432c00]
add esp, 0x14
xor esi, esi
test eax, eax
je 0x401c50
push edi
push esi
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.REALUSER
call fcn.00409015
pop ecx
cmp eax, 1
jne 0x401c67
push eax
call fcn.00408090
pop ecx
push 0xa
push esi
push ebx
call fcn.004151e1
push 0x431db8
mov dword [ebp - 8], eax
mov edi, esi
call fcn.00403004
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x401cef
cmp byte [0x433a60], 0
mov esi, 0xf003f
je 0x401cb1
push 0x4264f0
push 0x4325d8
call fcn.00411399
pop ecx
pop ecx
test eax, eax
mov ecx, 0xf013f
cmove esi, ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
xor esi, esi
push esi
push esi
push esi
push 0x431fc0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x4321c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401cf2
push 0xc
pop edi
push str.REALUSER
call fcn.00409015
pop ecx
cmp eax, 1
jne 0x401d09
push esi
call fcn.00408090
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
leave

Function at 0x401d10
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push 5
call fcn.00402fb2
add esp, 0xc
cmp eax, 4
jge 0x401d2f
push 3
pop eax
leave
ret
push esi
push edi
push 0x4323d0
push 0x4321c8
push str.Creating_Registry_value:__s_s
push 0x208
mov esi, 0x4327e0
push esi
call fcn.00403cbc
mov eax, dword [0x432c00]
add esp, 0x14
xor edi, edi
test eax, eax
je 0x401d6c
push esi
push edi
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.REALUSER
call fcn.00409015
pop ecx
cmp eax, 1
jne 0x401d83
push eax
call fcn.00408090
pop ecx
push ebx
push 0x431db8
mov esi, edi
call fcn.00403004
mov ebx, eax
pop ecx
test ebx, ebx
je 0x401e07
cmp byte [0x433a60], 0
mov edi, 0xf003f
je 0x401dc0
push 0x4264f0
push 0x4325d8
call fcn.00411399
pop ecx
pop ecx
test eax, eax
mov ecx, 0xf013f
cmove edi, ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push edi
xor edi, edi
push edi
push edi
push edi
push 0x431fc0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ebx, 0x4323d0
push ebx
call fcn.00411480
pop ecx
inc eax
push eax
push ebx
push 1
push edi
push 0x4321c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x401e0a
push 0xb
pop esi
push str.REALUSER
call fcn.00409015
pop ecx
pop ebx
cmp eax, 1
jne 0x401e22
push edi
call fcn.00408090
pop ecx
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x401e28
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
and dword [ebp - 0x848], 0
push ebx
push eax
push ecx
push 2
mov bl, 1
call fcn.00402fb2
add esp, 0xc
cmp eax, 2
jge 0x401e64
push 3
pop eax
jmp 0x402115
push esi
push edi
push 0x431fc0
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.004110f3
lea eax, [ebp - 0x20c]
push 0x2e
push eax
call fcn.0040eae0
add esp, 0x14
test eax, eax
je 0x401e95
mov byte [eax], 0
mov edi, 0x431db8
push edi
call fcn.00411480
push eax
push edi
call fcn.00407597
push str.___41:YY
push 0x4313d6
push 0x4313cc
push 0x4264f4
mov edi, eax
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.00403cbc
lea eax, [ebp - 0x20c]
push eax
push edi
push str._08X_s
lea eax, [ebp - 0x310]
push esi
push eax
call fcn.00403cbc
add esp, 0x38
lea eax, [ebp - 0x844]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x108]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x401f7a
lea eax, [ebp - 0x84c]
mov dword [ebp - 0x84c], 4
push eax
lea eax, [ebp - 0x848]
push eax
push 0
push 0
lea eax, [ebp - 0x310]
push eax
push dword [ebp - 0x844]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401f6e
push eax
call fcn.00418b68
pop ecx
push 0
push 0x15180
push edx
push eax
call fcn.0040d6e0
mov ecx, dword [ebp - 0x848]
xor ecx, 0x5a72bc91
sub eax, ecx
cmp eax, 0x5d
sbb bl, bl
invalid
Function at 0x402e76
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1464
call fcn.0040d790
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov bl, byte [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test bl, bl
je 0x402f9b
push str.RegDeleteKeyEx
push str.Advapi32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1464], eax
test eax, eax
je 0x402f9b
lea eax, [ebp - 0x1458]
push eax
push 0xf013f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp dword [ebp - 0x1458], 0
je 0x402fa3
xor ecx, ecx
mov dword [ebp - 0x145c], 0xa28
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x145c]
mov dword [ebp - 0x1460], ecx
push eax
lea eax, [ebp - 0xa2c]
push eax
push ecx
push dword [ebp - 0x1458]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x402f7e
mov byte [ebp + 0x10], bl
mov ebx, dword [ebp - 0x1460]
lea eax, [ebp - 0xa2c]
inc ebx
push eax
push edi
push str._s_s
lea eax, [ebp - 0x1454]
push 0xa28
push eax
call fcn.00403cbc
push dword [ebp + 0x10]
lea eax, [ebp - 0x1454]
push eax
push esi
call fcn.00402e76
add esp, 0x20
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x145c]
push eax
lea eax, [ebp - 0xa2c]
push eax
push ebx
push dword [ebp - 0x1458]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x402f27
push dword [ebp - 0x1458]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x100
push edi
push esi
call dword [ebp - 0x1464]
jmp 0x402fa3
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5ca
leave
Function at 0x405e2b
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x405e63
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405e63
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, esi
inc esi
cmp eax, 0xa
jl 0x405e31
push 7
pop eax
jmp 0x405e65
xor eax, eax
pop esi
pop ebp
ret

Function at 0x405e68
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x405ee5
cmp byte [edi], 0
je 0x405ee5
push edi
call fcn.00411480
pop ecx
push edi
lea ebx, [edi + eax]
mov esi, ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x405edc
test esi, esi
je 0x405ed8
push 0x5c
push edi
call fcn.0040ec10
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x405ea9
mov byte [esi], 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x405e92
jmp 0x405ed8
test esi, esi
je 0x405ec0
mov byte [esi], 0x5c
jmp 0x405ec7
cmp byte [edi], 0
mov esi, edi
je 0x405ecd
inc esi
cmp byte [esi], 0
jne 0x405ec7
push edi
call fcn.00405e2b
pop ecx
test eax, eax
jne 0x405ee0
cmp esi, ebx
jb 0x405eb7
xor eax, eax
jmp 0x405ee8
xor eax, eax
inc eax
jmp 0x405ee8
push 2
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40603f
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x370
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push eax
mov ebx, 0x104
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.004110f3
lea eax, [ebp - 0x108]
push eax
call fcn.00407232
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push ebx
push eax
call fcn.004110f3
push 0x426a04
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.004112fd
add esp, 0x28
lea eax, [ebp - 0x370]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, dword [ebp + 0xc]
mov edi, eax
cmp edi, 0xffffffff
je 0x406165
lea eax, [ebp - 0x344]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x426598
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00403cbc
add esp, 0x14
lea eax, [ebp - 0x230]
push eax
push 0
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
test eax, eax
je 0x40614f
test byte [ebp - 0x230], 0x10
je 0x406149
lea eax, [ebp - 0x344]
push 0x426a08
push eax
call fcn.00418bf0
pop ecx
pop ecx
test eax, eax
je 0x40614f
lea eax, [ebp - 0x344]
push 0x426a0c
push eax
call fcn.00418bf0
pop ecx
pop ecx
test eax, eax
je 0x40614f
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.0040603f
pop ecx
pop ecx
add esi, eax
jmp 0x40614f
add esi, dword [ebp - 0x210]
lea eax, [ebp - 0x370]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4060c2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5ca
leave
Function at 0x40617d
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
push eax
push str._s.
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00403cbc
add esp, 0x10
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
lea eax, [ebp - 0x21c]
push 0x426a08
push eax
call fcn.00411399
pop ecx
pop ecx
test eax, eax
je 0x40620a
lea eax, [ebp - 0x21c]
push 0x426a0c
push eax
call fcn.00411399
pop ecx
pop ecx
test eax, eax
je 0x40620a
lea eax, [ebp - 0x21c]
push edi
push eax
call fcn.00411399
pop ecx
pop ecx
test eax, eax
jne 0x406236
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4061c9
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5ca
leave
ret
xor bl, bl
jmp 0x40621e

Function at 0x40623a
Capabilities:
Check if file exists
Get file attributes
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4062ca
push ebx
push 0x80
push 3
push ebx
push 3
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x4062ca
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp + 0x10]
mov ebx, eax
add ecx, ebx
push ecx
push 1
call fcn.00418c7c
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4062b3
push 0
lea eax, [ebp - 8]
push eax
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp ebx, dword [ebp - 8]
je 0x4062b5
push esi
call fcn.00418bd0
pop ecx
xor esi, esi
jmp 0x4062b5
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x4062c5
mov dword [eax], ebx
mov eax, esi
pop esi
jmp 0x4062e4
push dword [ebp + 0x10]
lea eax, [ebp - 4]
push dword [ebp + 0xc]
push eax
push ebx
push ebx
push dword [ebp + 8]
call fcn.00405eed
mov eax, dword [ebp - 4]
add esp, 0x18
pop edi
pop ebx
leave
ret
Function at 0x4062e8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.00405dd7
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4063b6
push ebx
push edi
xor edi, edi
push edi
push 0x80
push 3
push edi
push edi
push 0x40000000
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4063b1
push edi
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
call fcn.0040623a
mov edi, eax
add esp, 0xc
mov dword [ebp - 0x10], edi
test edi, edi
je 0x4063b1
mov eax, dword [ebp - 8]
mov dword [ebp - 8], eax
test eax, eax
jle 0x40639d
mov eax, dword [edi]
mov ecx, dword [edi + 4]
add edi, 8
push 0
push 0
push eax
push ebx
mov dword [ebp - 4], ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x40639a
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
cmp dword [ebp - 0xc], ecx
jne 0x40639a
push 0xfffffffffffffff8
add edi, ecx
pop eax
sub eax, ecx
mov ecx, dword [ebp - 8]
add ecx, eax
mov dword [ebp - 8], ecx
test ecx, ecx
jg 0x406350
jmp 0x40639d
push 0x18
pop esi
push dword [ebp - 0x10]
call fcn.00418bd0
pop ecx
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
jmp 0x4063b4
push 0x18
pop eax
pop edi
pop ebx
pop esi
leave

Function at 0x4063b9
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
push 0
push 0x80
push 2
mov dword [ebp - 0x110], eax
pop eax
push eax
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40645e
push edi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004110f3
lea eax, [ebp - 0x108]
push 0x5c
push eax
call fcn.0040ec10
add esp, 0x14
test eax, eax
je 0x40642a
mov byte [eax], 0
lea eax, [ebp - 0x108]
push eax
call fcn.00405e68
pop ecx
push 0
push 0x80
push 2
pop eax
push eax
push 0
push 3
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x40645e
xor eax, eax
inc eax
jmp 0x406491
and dword [ebp - 0x10c], 0
lea eax, [ebp - 0x10c]
push 0
push eax
push ebx
push dword [ebp - 0x110]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp ebx, dword [ebp - 0x10c]
push 2
pop ecx
cmovne eax, ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d5ca
leave
ret
Function at 0x4079e3
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
push 0x426c30
push 0x104
push eax
call fcn.00403cbc
add esp, 0x10
lea eax, [ebp - 0x108]
mov ebx, SysReAllocString
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push edi
push str._sfile
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00403cbc
add esp, 0x10
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0
push 0
push 0x3000
push 0x8000000
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop ebx
call fcn.0040d5ca
leave
ret

Function at 0x407bd5
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x63c
mov eax, dword [0x431440]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x638]
push edi
mov edi, dword [ebp + 8]
push 0x530
push 0
push eax
call fcn.0040e980
lea eax, [ebp - 0x638]
push eax
push edi
call fcn.00407e9b
add esp, 0x14
test al, al
je 0x407cd3
xor eax, eax
inc eax
push ebx
push eax
call fcn.00408090
mov ax, word [ebp - 0x628]
mov ebx, 0x104
pop ecx
test ax, ax
jne 0x407c6a
push esi
push 0x1a
call fcn.00407f54
push edi
push str.DeskSoft_s
lea eax, [ebp - 0x108]
push ebx
push eax
call fcn.00403cbc
lea eax, [ebp - 0x108]
push eax
push ebx
push esi
call fcn.004112fd
mov ax, word [ebp - 0x628]
add esp, 0x24
xor ecx, ecx
inc ecx
cmp ax, cx
jne 0x407cc7
lea eax, [ebp - 0x520]
push eax
push ebx
push esi
call fcn.004110f3
add esp, 0xc
cmp word [ebp - 0x626], 0
je 0x407cc7
push 0x426af0
push ebx
push esi
call fcn.004112fd
add esp, 0xc
mov dword [ebp - 0x63c], ebx
lea eax, [ebp - 0x63c]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea eax, [ebp - 0x108]
push eax
push ebx
push esi
call fcn.004112fd
add esp, 0xc
push 0
call fcn.00408090
pop ecx
xor eax, eax
inc eax
pop ebx
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040d5ca
leave
ret