joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012e4
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
jmp 0x4079b0
sub esp, 0x86c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x868], eax
push ebx
push ebp
mov ebp, dword [esp + 0x87c]
push esi
push edi
mov edi, dword [esp + 0x880]
push 0x208
xor esi, esi
lea eax, [esp + 0x674]
push esi
push eax
call fcn.0041be10
push 0x208
lea ecx, [esp + 0x270]
push esi
push ecx
call fcn.0041be10
push 0x208
lea edx, [esp + 0x484]
push esi
push edx
call fcn.0041be10
push 0x250
lea eax, [esp + 0x38]
push esi
push eax
call fcn.0041be10
push edi
lea ecx, [esp + 0x49c]
push 0x104
push ecx
call fcn.0041c22f
push 0x435bf0
lea edx, [esp + 0x4a8]
push 0x104
push edx
call fcn.0041c1b5
add esp, 0x48
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407af2
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
test byte [esp + 0x10], 0x10
jne 0x407ad4
lea edx, [esp + 0x3c]
push edx
push edi
lea eax, [esp + 0x678]
push str._s_s
push eax
call esi
lea ecx, [esp + 0x4c]
push ecx
push ebp
lea edx, [esp + 0x278]
push str._s_s
push edx
call esi
add esp, 0x20
push 0
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0x678]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x407af6
lea edx, [esp + 0x260]
push 0
push edx
call fcn.0040114a
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407a72
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x407af8
mov eax, esi
jmp 0x407af8
xor eax, eax
mov ecx, dword [esp + 0x878]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x86c
ret

Function at 0x4012e9
Capabilities:
Write file on windows

Disassembly:
jmp 0x403540
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
mov ebx, dword [esp + 0x428]
push esi
mov esi, dword [esp + 0x424]
test esi, esi
push edi
mov edi, dword [esp + 0x42c]
jne 0x40358a
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
test edi, edi
je 0x403570
test ebx, ebx
je 0x403570
push 0x410
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.0041be10
push 0xa
push 0xd
push ebx
push edi
push esi
lea ecx, [esp + 0x30]
push str.REGI_s___s____s__1c_1c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x486308]
add eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x420]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
add eax, 1
call fcn.0041bdf4
add esp, 0x418
ret
Function at 0x401325
Capabilities:
Get common file path
Set current directory

Disassembly:
jmp 0x412d90
sub esp, 0xc38
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0xc34], eax
cmp dword [0x46b138], 1
push edi
mov edi, dword [esp + 0xc40]
jne 0x412dd0
mov eax, 1
pop edi
mov ecx, dword [esp + 0xc34]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc38
ret
test edi, edi
jne 0x412dec
xor eax, eax
pop edi
mov ecx, dword [esp + 0xc34]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc38
ret
push esi
push 0x208
lea eax, [esp + 0x218]
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.0041be10
push 0x208
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.0041be10
push 0x410
lea edx, [esp + 0x438]
push 0
push edx
call fcn.0041be10
push 0x410
lea eax, [esp + 0x854]
push 0
push eax
call fcn.0041be10
add esp, 0x30
push 0x44f400
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push 0x45e730
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0x45e730
lea ecx, [esp + 0x10]
push 0x104
push ecx
call fcn.0041c22f
push 0x4781b0
lea edx, [esp + 0x1c]
push 0x104
push edx
call fcn.0041c1b5
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x28]
push ecx
call fcn.004010e1
mov esi, eax
add esp, 0x20
test esi, esi
jne 0x412eff
push 0x100
lea edx, [esp + 0x420]
push edx
push 0x452
push edi
call dword [sym.imp.USER32.dll_LoadStringW]
push str.setup.ini
lea eax, [esp + 0x420]
push eax
lea ecx, [esp + 0x834]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push esi
lea edx, [esp + 0x83c]
push edx
push esi
call fcn.004010be
add esp, 0x18
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0xc34]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc38
ret
push ebx
mov ebx, dword [esp + 0xc]
push 0x434ed4
push ebx
push esi
call fcn.0040120d
add esp, 0xc
test eax, eax
je 0x412f66
jmp 0x412f20
push 0x208
lea ecx, [esp + 0x21c]
push ecx
push eax
call fcn.004011fe
lea edx, [esp + 0x224]
push edx
mov edi, eax
call fcn.00401280
add esp, 0x10
test eax, eax
je 0x412fbc
mov eax, edi
sub eax, esi
sar eax, 1
mov ecx, ebx
push 0x434ed4
sub ecx, eax
push ecx
push edi
call fcn.0040120d
add esp, 0xc
test eax, eax
jne 0x412f20
mov edx, dword [esp + 0xc]
push edx
push 0
push esi
call fcn.00401357
add esp, 0xc
test eax, eax
jne 0x412fe6
push 0x454
push eax
push eax
call fcn.004010be
push 0x455
push 0
push 0
call fcn.004010be
push esi
call fcn.004012bc
add esp, 0x1c
call fcn.00401253
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0xc34]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc38
ret
or dword [0x44fe2c], 1
push esi
call fcn.004012bc
add esp, 4
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [esp + 0xc34]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc38
ret
push esi
call fcn.004012bc
mov ecx, dword [esp + 0xc44]
add esp, 4
pop ebx
pop esi
pop edi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0xc38
ret
Function at 0x401361
Capabilities:
Copy file
Create directory
Delete directory
Delete file
Get common file path

Disassembly:
jmp 0x412a50
mov eax, 0x1274
call fcn.0041be90
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x1270], eax
push ebx
mov ebx, dword [esp + 0x1280]
push ebp
push esi
mov esi, dword [esp + 0x1284]
push 0x208
xor ebp, ebp
lea eax, [esp + 0x468]
push ebp
push eax
call fcn.0041be10
push 0x410
lea ecx, [esp + 0x67c]
push ebp
push ecx
call fcn.0041be10
push 0x200
lea edx, [esp + 0xe98]
push ebp
push edx
call fcn.0041be10
push 0x200
lea eax, [esp + 0x10a4]
push ebp
push eax
call fcn.0041be10
push 0x200
lea ecx, [esp + 0xab0]
push ebp
push ecx
call fcn.0041be10
push 0x208
lea edx, [esp + 0x29c]
push ebp
push edx
call fcn.0041be10
add esp, 0x48
push 0x200
lea eax, [esp + 0xc80]
push ebp
push eax
call fcn.0041be10
push 0x250
lea ecx, [esp + 0x1c]
push ebp
push ecx
call fcn.0041be10
add esp, 0x18
lea edx, [esp + 0x464]
push edx
push ebp
push ebp
push 0x23
push ebp
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push 0x100
lea eax, [esp + 0xc80]
push eax
lea ecx, [esp + 0x46c]
push ecx
call fcn.004010b4
add esp, 0xc
test eax, eax
je 0x412caa
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [esp + 0xc80]
push edx
lea eax, [esp + 0x46c]
push eax
lea ecx, [esp + 0x678]
push str._s_s
push ecx
call edi
add esp, 0x10
push ebp
lea edx, [esp + 0x674]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x412ca9
push 0x100
lea eax, [esp + 0x1084]
push eax
push 0x100
lea ecx, [esp + 0xe8c]
push ecx
push ebp
push ebp
push ebp
push ebp
push esi
call fcn.0041c92d
lea edx, [esp + 0x10a4]
push edx
lea eax, [esp + 0xea8]
push eax
lea ecx, [esp + 0xaac]
push 0x435d60
push ecx
call edi
lea edx, [esp + 0xab4]
push edx
lea eax, [esp + 0x6a8]
push eax
lea ecx, [esp + 0x29c]
push str._s_s
push ecx
call edi
add esp, 0x44
push ebp
lea edx, [esp + 0x264]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x412ca9
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
and eax, 0xfffffffe
push eax
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea edx, [esp + 0x670]
push edx
push 0x401177
push ebp
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.SETUPAPI.dll_SetupIterateCabinetW]
test eax, eax
je 0x412ca9
lea ecx, [esp + 0x260]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x250
lea edx, [esp + 0x14]
push ebp
push edx
call fcn.0041be10
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x412c8c
push ebx
call fcn.004012df
add esp, 4
test eax, eax
je 0x412ca9
jmp 0x412c93
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [esp + 0x670]
push ebx
push ecx
call fcn.004012e4
add esp, 8
mov ebp, 1
pop edi
lea edx, [esp + 0x66c]
push edx
call fcn.004010b9
add esp, 4
lea eax, [esp + 0x66c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [esp + 0x127c]
pop esi
mov eax, ebp
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x1274
ret
Function at 0x405a00
Capabilities:
Set registry value

Disassembly:
jmp 0x405a00
sub esp, 0x10
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0xc], eax
lea eax, [esp + 8]
push eax
lea ecx, [esp + 4]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWARECanonIJAppInstaller
push 0x80000002
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
mov eax, dword [esp]
jne 0x405b08
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [esp + 0xc]
push edx
push 4
push 0
push str.APPLICATION_COMPLETED
push eax
call esi
mov edx, dword [esp + 4]
push 4
lea ecx, [esp + 0xc]
push ecx
push 4
push 0
push str.REBOOT
push edx
call esi
mov eax, 0x46b154
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405a90
mov ecx, dword [esp + 4]
sub eax, edx
sar eax, 1
add eax, eax
push eax
push 0x46b154
push 1
push 0
push str.RESIDENCE
push ecx
call esi
mov eax, 0x46b17c
lea edx, [eax + 2]
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x405ac0
sub eax, edx
sar eax, 1
lea edx, [eax + eax]
mov eax, dword [esp + 4]
push edx
push 0x46b17c
push 1
push 0
push str.REGION
push eax
call esi
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x10
ret
test eax, eax
je 0x405b13
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0xc]
xor ecx, esp
xor eax, eax
call fcn.0041bdf4
add esp, 0x10
ret
Function at 0x4060c0
Capabilities:
Get common file path

Disassembly:
jmp 0x4060c0
sub esp, 0x690
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x68c], eax
mov eax, dword [esp + 0x694]
push esi
push 0x208
xor esi, esi
lea ecx, [esp + 0x284]
push esi
push ecx
mov dword [esp + 0x10], eax
call fcn.0041be10
push 0x208
lea edx, [esp + 0x498]
push esi
push edx
call fcn.0041be10
push 0x250
lea eax, [esp + 0x24]
push esi
push eax
call fcn.0041be10
xor eax, eax
add esp, 0x24
lea ecx, [esp + 0x280]
push ecx
push 0x104
mov dword [esp + 0x260], eax
mov dword [esp + 0x264], eax
mov dword [esp + 0x268], eax
mov dword [esp + 0x26c], eax
mov dword [esp + 0x270], eax
mov dword [esp + 0x274], eax
mov dword [esp + 0x278], eax
mov dword [esp + 0x27c], eax
mov dword [esp + 0x280], eax
mov dword [esp + 0x284], eax
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
jne 0x406190
pop esi
mov ecx, dword [esp + 0x68c]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x690
ret
lea eax, [esp + 0x280]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4061a0
sub eax, edx
sar eax, 1
lea edx, [esp + eax*2 + 0x27e]
push edx
lea eax, [esp + 0x284]
push eax
call fcn.00401113
add esp, 8
test eax, eax
jne 0x4061e5
push 0x435bfc
lea ecx, [esp + 0x284]
push 0x104
push ecx
call fcn.0041c22f
add esp, 0xc
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindClose]
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea ebx, [ebx]
push esi
lea edx, [esp + 0x268]
push str.IJINS_03d.ini
push edx
call edi
lea eax, [esp + 0x270]
push eax
lea ecx, [esp + 0x29c]
push ecx
lea edx, [esp + 0x4a8]
push 0x435d60
push edx
call edi
add esp, 0x1c
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x498]
push ecx
call ebx
cmp eax, 0xffffffff
je 0x406256
push eax
add esi, 1
call ebp
cmp esi, 0x3e7
jle 0x406200
jmp 0x406269
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x264]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [esp + 0x69c]
pop edi
pop ebp
xor eax, eax
cmp esi, 0x3e8
pop ebx
setne al
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0x690
ret
Function at 0x4064e0
Capabilities:
Write file on windows

Disassembly:
jmp 0x4064e0
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
jne 0x406518
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
push 0x410
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
add esp, 0xc
cmp dword [esp + 0x424], 1
push 0xa
push 0xd
push esi
jne 0x406565
cmp dword [esp + 0x434], 0
je 0x406559
push str.FILEREGI64__s__1c_1c
lea ecx, [esp + 0x18]
push ecx
jmp 0x40656f
push str.FILEREGI__s__1c_1c
lea edx, [esp + 0x18]
push edx
jmp 0x40656f
push str.FILE__s__1c_1c
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [0x486308]
add eax, eax
push eax
lea eax, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x418]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x418
ret
Function at 0x406f70
Capabilities:
Get geographical location

Disassembly:
jmp 0x406f70
sub esp, 0x18
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
xor eax, eax
push edi
push 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edi, edi
mov esi, 0x447dc0
mov eax, dword [esi]
lea ecx, [esi - 0x14]
lea eax, [esp + eax*2 + 8]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406fe6
test dx, dx
je 0x406fe2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406fe6
add eax, 4
add ecx, 4
test dx, dx
jne 0x406fc0
xor eax, eax
jmp 0x406feb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407013
add esi, 0x21c
add edi, 1
cmp esi, 0x44b060
jl 0x406fb1
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x18
ret
mov ecx, dword [0x46b144]
imul edi, edi, 0x21c
imul ecx, ecx, 0xb0
mov eax, dword [ecx + 0x4478bc]
and eax, dword [edi + 0x447da8]
mov ecx, dword [esp + 0x1c]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x18
ret
Function at 0x407130
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
jmp 0x407130
sub esp, 0x830
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x82c], eax
mov eax, dword [esp + 0x840]
mov ecx, dword [esp + 0x844]
mov edx, dword [esp + 0x848]
push ebx
mov ebx, dword [esp + 0x840]
push ebp
mov ebp, dword [esp + 0x83c]
push esi
push edi
mov edi, dword [esp + 0x848]
push 0x1fe
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x240]
push 0
push eax
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], edx
mov esi, 0x20019
mov dword [esp + 0x24], 0
call fcn.0041be10
push 0x400
lea ecx, [esp + 0x44c]
push 0
push ecx
call fcn.0041be10
push 0x200
lea edx, [esp + 0x58]
push 0
push edx
call fcn.0041be10
add esp, 0x24
cmp dword [0x44fe28], 1
jne 0x4071ea
mov esi, dword [esp + 0x85c]
sub esi, 1
neg esi
sbb esi, esi
and esi, 0xffffff00
add esi, 0x20219
lea eax, [esp + 0x14]
push eax
push esi
push 0
push edi
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
call ebp
test eax, eax
je 0x407207
xor eax, eax
jmp 0x40732a
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x18]
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x250]
push eax
push 0
push ecx
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x407304
lea esp, [esp]
lea edx, [esp + 0x23c]
push edx
push edi
lea eax, [esp + 0x444]
push str._s_s
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 0x20]
push ecx
push esi
push 0
lea edx, [esp + 0x448]
push edx
push 0x80000002
call ebp
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x2c]
push edx
push 0
push ebx
push eax
mov dword [esp + 0x34], 0x200
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4072e0
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x34]
push ecx
push 0
push 0
push 0
lea edx, [esp + 0x20]
push edx
mov edx, dword [esp + 0x28]
lea ecx, [esp + 0x250]
add eax, 1
push ecx
push eax
push edx
mov dword [esp + 0x38], eax
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x407240
jmp 0x407304
mov ecx, dword [esp + 0x2c]
lea eax, [esp + 0x3c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x28]
mov ecx, dword [esp + 0x1c]
mov dword [eax], edx
mov edx, dword [esp + 0x30]
mov dword [edx], ecx
mov eax, dword [esp + 0x14]
test eax, eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x407315
push eax
call esi
mov eax, dword [esp + 0x20]
test eax, eax
je 0x407320
push eax
call esi
xor eax, eax
cmp word [esp + 0x3c], ax
setne al
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x830
ret
Function at 0x407590
Capabilities:
Get geographical location

Disassembly:
jmp 0x407590
sub esp, 0xc
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
test esi, esi
je 0x407626
push ebx
push edi
push 6
mov dword [esp + 0x10], eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x10]
push eax
push 0x5a
push 0x800
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, dword [esp + 0x20]
test ebx, ebx
jle 0x407622
add esi, 0x202
jmp 0x4075e0
mov ecx, esi
lea eax, [esp + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40760c
test dx, dx
je 0x407608
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40760c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4075e6
xor eax, eax
jmp 0x407611
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407636
add edi, 1
add esi, 0x216
cmp edi, ebx
jl 0x4075e0
pop edi
xor eax, eax
pop ebx
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc
ret
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc
ret

Function at 0x4079b0
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
jmp 0x4079b0
sub esp, 0x86c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x868], eax
push ebx
push ebp
mov ebp, dword [esp + 0x87c]
push esi
push edi
mov edi, dword [esp + 0x880]
push 0x208
xor esi, esi
lea eax, [esp + 0x674]
push esi
push eax
call fcn.0041be10
push 0x208
lea ecx, [esp + 0x270]
push esi
push ecx
call fcn.0041be10
push 0x208
lea edx, [esp + 0x484]
push esi
push edx
call fcn.0041be10
push 0x250
lea eax, [esp + 0x38]
push esi
push eax
call fcn.0041be10
push edi
lea ecx, [esp + 0x49c]
push 0x104
push ecx
call fcn.0041c22f
push 0x435bf0
lea edx, [esp + 0x4a8]
push 0x104
push edx
call fcn.0041c1b5
add esp, 0x48
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x46c]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407af2
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
test byte [esp + 0x10], 0x10
jne 0x407ad4
lea edx, [esp + 0x3c]
push edx
push edi
lea eax, [esp + 0x678]
push str._s_s
push eax
call esi
lea ecx, [esp + 0x4c]
push ecx
push ebp
lea edx, [esp + 0x278]
push str._s_s
push edx
call esi
add esp, 0x20
push 0
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0x678]
push ecx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
je 0x407af6
lea edx, [esp + 0x260]
push 0
push edx
call fcn.0040114a
add esp, 8
lea eax, [esp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407a72
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x407af8
mov eax, esi
jmp 0x407af8
xor eax, eax
mov ecx, dword [esp + 0x878]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x86c
ret
Function at 0x407b70
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x407b70
sub esp, 0x664
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x660], eax
push ebx
push esi
mov esi, dword [esp + 0x670]
push edi
push 0x208
xor ebx, ebx
lea eax, [esp + 0x468]
push ebx
push eax
call fcn.0041be10
push 0x208
lea ecx, [esp + 0x26c]
push ebx
push ecx
call fcn.0041be10
push 0x250
lea edx, [esp + 0x28]
push ebx
push edx
call fcn.0041be10
push esi
lea eax, [esp + 0x284]
push 0x104
push eax
call fcn.0041c22f
push 0x435bf0
lea ecx, [esp + 0x290]
push 0x104
push ecx
call fcn.0041c1b5
add esp, 0x3c
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x407c7e
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
lea ebx, [ebx]
test byte [esp + 0x10], 0x10
jne 0x407c49
lea ecx, [esp + 0x3c]
push ecx
push esi
lea edx, [esp + 0x470]
push str._s_s
push edx
call ebp
add esp, 0x10
lea eax, [esp + 0x468]
push eax
call ebx
lea ecx, [esp + 0x10]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x407c20
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebp
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x664
ret
mov ecx, dword [esp + 0x66c]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x664
ret
Function at 0x408330
Capabilities:
Delete registry key

Disassembly:
jmp 0x408330
sub esp, 0x40c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x408], eax
push 0x200
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
call fcn.0041be10
push 0x200
lea ecx, [esp + 0x218]
push 0
push ecx
call fcn.0041be10
add esp, 0x18
lea edx, [esp + 4]
push edx
lea eax, [esp + 4]
push eax
push 0
push 0xf003f
push 1
push 0x435de4
push 0
push str.SYSTEMAPP_Installer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x408409
mov edx, dword [0x486304]
push 0x100
lea ecx, [esp + 0xc]
push ecx
push 0x458
push edx
call dword [sym.imp.USER32.dll_LoadStringW]
push 0x44f200
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x210]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0
lea edx, [esp + 0x218]
push edx
push 0
call fcn.004010be
add esp, 0x18
xor eax, eax
mov ecx, dword [esp + 0x408]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x40c
ret
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push str.SYSTEMAPP_Installer
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [esp + 0x408]
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x40c
ret