joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401285
Capabilities:
Shutdown system

Disassembly:
jmp 0x40f000
sub esp, 0x24
xor eax, eax
cmp dword [0x450c54], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
je 0x40f09c
cmp dword [esp + 0x28], eax
jne 0x40f119
lea eax, [esp]
push eax
push 0xf003f
push 0
push 0x450648
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f119
mov edx, dword [esp]
lea ecx, [esp + 8]
push ecx
push 4
push str.REBOOT
push edx
call fcn.0040132f
mov eax, dword [esp + 0x10]
add esp, 0x10
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
add esp, 0x24
ret
cmp dword [0x44fe24], 3
jl 0x40f10f
lea ecx, [esp + 4]
push ecx
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea edx, [esp + 0xc]
push edx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x10]
push 0
push 0
push 0
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x14]
push 0
mov edx, 2
push ecx
mov dword [esp + 0x2c], 1
mov dword [esp + 0x38], edx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
add esp, 0x24
ret

Function at 0x40128f
Capabilities:
Hide graphical window

Disassembly:
jmp 0x403890
sub esp, 0x20
push esi
mov esi, dword [esp + 0x28]
test esi, esi
je 0x403931
xor eax, eax
push 0x10
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
lea eax, [esp + 0x18]
push eax
push 0
push 0x30
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
lea ecx, [esp + 4]
push ecx
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
mov edx, dword [esp + 0x10]
sub edx, dword [esp + 8]
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0xc]
sub ecx, dword [esp + 4]
sub eax, edx
add eax, dword [esp + 0x18]
push 1
push edx
cdq
sub eax, edx
sar eax, 1
push ecx
push eax
mov eax, dword [esp + 0x2c]
sub eax, ecx
add eax, dword [esp + 0x24]
cdq
sub eax, edx
sar eax, 1
push eax
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 5
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetActiveWindow]
pop esi
add esp, 0x20
ret
Function at 0x401294
Capabilities:
Get geographical location

Disassembly:
jmp 0x407590
sub esp, 0xc
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 8], eax
push esi
mov esi, dword [esp + 0x14]
xor eax, eax
test esi, esi
je 0x407626
push ebx
push edi
push 6
mov dword [esp + 0x10], eax
mov word [esp + 0x14], ax
lea eax, [esp + 0x10]
push eax
push 0x5a
push 0x800
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ebx, dword [esp + 0x20]
test ebx, ebx
jle 0x407622
add esi, 0x202
jmp 0x4075e0
mov ecx, esi
lea eax, [esp + 0xc]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x40760c
test dx, dx
je 0x407608
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x40760c
add eax, 4
add ecx, 4
test dx, dx
jne 0x4075e6
xor eax, eax
jmp 0x407611
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407636
add edi, 1
add esi, 0x216
cmp edi, ebx
jl 0x4075e0
pop edi
xor eax, eax
pop ebx
pop esi
mov ecx, dword [esp + 8]
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc
ret
mov ecx, dword [esp + 0x14]
mov eax, edi
pop edi
pop ebx
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0xc
ret

Function at 0x4012c1
Capabilities:
Write file on windows

Disassembly:
jmp 0x403450
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
jne 0x403488
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
push 0x410
lea eax, [esp + 0xc]
push 0
push eax
mov dword [esp + 0x10], 0
call fcn.0041be10
mov eax, dword [0x478bf8]
push 0xa
push 0xd
add eax, 1
push esi
push eax
lea ecx, [esp + 0x24]
push str.FOLDER_d___s__1c_1c
push ecx
mov dword [0x478bf8], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
push 0
lea edx, [esp + 8]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x486308]
add eax, eax
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x418]
neg eax
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x418
ret
Function at 0x4012df
Capabilities:
Create directory

Disassembly:
jmp 0x409a10
sub esp, 0x664
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x660], eax
push edi
mov edi, dword [esp + 0x66c]
test edi, edi
jne 0x409a48
xor eax, eax
pop edi
mov ecx, dword [esp + 0x660]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x664
ret
push 0x208
lea eax, [esp + 0x258]
push 0
push eax
call fcn.0041be10
push 0x250
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.0041be10
add esp, 0x18
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x409afb
push ebx
push ebp
lea ebx, [esp + 0x25c]
push esi
mov esi, edi
sub ebx, edi
mov ebp, eax
nop
cmp word [esi], 0x5c
jne 0x409ae9
push esi
push edi
call fcn.00401113
add esp, 8
test eax, eax
je 0x409ae9
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x264]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x409ae2
push 0
lea ecx, [esp + 0x264]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x409ae9
lea edx, [esp + 0x260]
push edx
call fcn.004012c1
add esp, 4
jmp 0x409ae9
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ax, word [esi]
mov word [ebx + esi], ax
add esi, 2
sub ebp, 1
jne 0x409a90
pop esi
pop ebp
pop ebx
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x258]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x409b39
push 0
lea eax, [esp + 0x258]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x409b40
lea ecx, [esp + 0x254]
push ecx
call fcn.004012c1
add esp, 4
jmp 0x409b40
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x664]
pop edi
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x664
ret

Function at 0x4012e9
Capabilities:
Write file on windows

Disassembly:
jmp 0x403540
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
mov ebx, dword [esp + 0x428]
push esi
mov esi, dword [esp + 0x424]
test esi, esi
push edi
mov edi, dword [esp + 0x42c]
jne 0x40358a
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
test edi, edi
je 0x403570
test ebx, ebx
je 0x403570
push 0x410
lea eax, [esp + 0x14]
push 0
push eax
mov dword [esp + 0x18], 0
call fcn.0041be10
push 0xa
push 0xd
push ebx
push edi
push esi
lea ecx, [esp + 0x30]
push str.REGI_s___s____s__1c_1c
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x486308]
add eax, eax
push eax
lea ecx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x420]
pop edi
neg eax
pop esi
sbb eax, eax
pop ebx
xor ecx, esp
add eax, 1
call fcn.0041bdf4
add esp, 0x418
ret
Function at 0x401302
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x409f50
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
test esi, esi
je 0x409fca
mov eax, dword [esp + 0x14]
push eax
lea ecx, [esp + 0x14]
push ecx
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push 0x80000002
mov dword [esp + 0x24], 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0xc8
mov word [esi], 0
call fcn.00401276
add esp, 0x14
test eax, eax
jne 0x409fca
mov ecx, dword [esp + 0x10]
lea edx, [esp + 4]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.ProgramFilesDir
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x409fd1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
add esp, 8
ret
cmp word [esi], 0
je 0x40a03d
mov eax, dword [esp + 4]
cmp eax, 0x104
jae 0x40a03d
mov ecx, dword [esp + 8]
push edi
mov edi, 1
cmp ecx, edi
je 0x409ffa
cmp ecx, 7
je 0x409ffa
cmp ecx, 2
jne 0x409fff
mov edi, 2
sub eax, edi
cmp word [esi + eax*2], 0x5c
lea eax, [esi + eax*2]
jne 0x40a025
push eax
push esi
call fcn.00401113
add esp, 8
test eax, eax
je 0x40a025
mov eax, dword [esp + 8]
sub eax, edi
mov word [esi + eax*2], 0
mov ecx, dword [esp + 0x14]
pop edi
push ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x10]
push ecx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x40132a
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
jmp 0x4101c0
sub esp, 0x514
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x510], eax
push ebx
mov ebx, dword [esp + 0x520]
push esi
mov esi, dword [esp + 0x520]
test esi, esi
jne 0x410201
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x514
ret
test ebx, ebx
je 0x4101e8
push 0x200
lea eax, [esp + 0x31c]
push 0
push eax
call fcn.0041be10
push 0xfe
lea ecx, [esp + 0x228]
push 0
push ecx
call fcn.0041be10
push 0xfe
lea edx, [esp + 0x134]
push 0
push edx
call fcn.0041be10
push 0x88
lea eax, [esp + 0x30]
push 0
push eax
call fcn.0041be10
push 0x88
lea ecx, [esp + 0xc4]
push 0
push ecx
call fcn.0041be10
push 0x5c
push ebx
call fcn.004010eb
add esp, 0x44
add eax, 2
push eax
lea edx, [esp + 0x31c]
push 0x100
push edx
call fcn.0041c1b5
add esp, 0xc
lea eax, [esp + 0x218]
push eax
push 0x7f
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x4101e8
push edi
push 0x104
lea ecx, [esp + 0x120]
push ecx
lea edx, [esp + 0x224]
push edx
call dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
lea eax, [esp + 0x31c]
push eax
lea ecx, [esp + 0x120]
push 0x7f
push ecx
call fcn.0041c1b5
add esp, 0xc
push 0
lea edx, [esp + 0x10]
push edx
push esi
call sub.LZ32.dll_LZOpenFileW
mov esi, eax
push 0x1000
lea eax, [esp + 0x98]
push eax
lea ecx, [esp + 0x124]
push ecx
call sub.LZ32.dll_LZOpenFileW
mov edi, eax
push edi
push esi
call sub.LZ32.dll_LZCopy
test eax, eax
jge 0x410328
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x510]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x514
ret
push ebp
push esi
mov ebp, 1
call sub.LZ32.dll_LZClose
push edi
call sub.LZ32.dll_LZClose
mov ecx, ebx
lea eax, [esp + 0x120]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x410369
test dx, dx
je 0x410365
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x410369
add eax, 4
add ecx, 4
test dx, dx
jne 0x410343
xor eax, eax
jmp 0x41036e
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x4103a2
push 0
push ebx
lea edx, [esp + 0x128]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x410389
xor ebp, ebp
lea eax, [esp + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4103a2
or dword [0x44fe2c], 2
mov ecx, dword [esp + 0x520]
mov eax, ebp
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x514
ret
Function at 0x40132f
Capabilities:
Set registry value

Disassembly:
jmp 0x409d70
sub esp, 0x608
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x604], eax
push ebx
mov ebx, dword [esp + 0x614]
push ebp
mov ebp, dword [esp + 0x614]
test ebp, ebp
push esi
mov esi, dword [esp + 0x624]
mov dword [esp + 0xc], ebx
jne 0x409dbe
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x604]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x608
ret
test ebx, ebx
je 0x409da4
push edi
mov edi, dword [esp + 0x624]
test edi, edi
je 0x409e43
test esi, esi
je 0x409e43
push 0x200
lea eax, [esp + 0x18]
push 0
push eax
call fcn.0041be10
add esp, 0xc
cmp edi, 1
jne 0x409dfc
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push esi
push edi
jmp 0x409ebf
cmp edi, 3
jne 0x409ebb
push 0x400
xor edi, edi
lea ecx, [esp + 0x218]
push edi
push ecx
call fcn.0041be10
push esi
lea edx, [esp + 0x224]
push 0x200
push edx
call fcn.0041c22f
lea eax, [esp + 0x22c]
push eax
call fcn.004012a3
mov ebx, eax
add esp, 0x1c
test ebx, ebx
jne 0x409e4a
xor eax, eax
jmp 0x409ed2
push ebx
lea ecx, [esp + 0x18]
push 0x200
push ecx
call fcn.0041cd94
add esp, 0xc
cmp byte [esp + 0x14], 0
je 0x409e98
mov al, byte [esp + edi + 0x14]
cmp al, 0x40
jle 0x409e74
cmp al, 0x47
jge 0x409e74
sub al, 0x37
jmp 0x409e8a
cmp al, 0x60
jle 0x409e88
cmp al, 0x67
jge 0x409e88
add word [esp + edi*2 + 0x214], 0xffa9
jmp 0x409e8e
sub al, 0x30
mov byte [esp + edi + 0x14], al
add edi, 1
cmp byte [esp + edi + 0x14], 0
jne 0x409e64
mov eax, dword [esp + 0x10]
push edi
lea edx, [esp + 0x18]
push edx
push 3
push 0
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push ebx
mov esi, eax
call fcn.0041cb40
add esp, 4
jmp 0x409ecb
push 4
push esi
push edi
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
xor eax, eax
test esi, esi
sete al
mov ecx, dword [esp + 0x614]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0041bdf4
add esp, 0x608
ret
Function at 0x401339
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
jmp 0x40b980
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x40b993
xor eax, eax
pop esi
add esp, 8
ret
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40ba06
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0xc8
mov word [esi], 0
call fcn.00401276
add esp, 0x14
test eax, eax
jne 0x40ba06
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push esi
lea eax, [esp + 0x14]
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40ba0e
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 8
ret
cmp word [esi], 0
je 0x40ba79
mov eax, dword [esp + 8]
cmp eax, 0x104
jae 0x40ba79
mov ecx, dword [esp + 0xc]
mov edi, 1
cmp ecx, edi
je 0x40ba36
cmp ecx, 7
je 0x40ba36
cmp ecx, 2
jne 0x40ba3b
mov edi, 2
sub eax, edi
cmp word [esi + eax*2], 0x5c
lea eax, [esi + eax*2]
jne 0x40ba61
push eax
push esi
call fcn.00401113
add esp, 8
test eax, eax
je 0x40ba61
mov eax, dword [esp + 8]
sub eax, edi
mov word [esi + eax*2], 0
mov ecx, dword [esp + 0x14]
push ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x14]
push ecx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x401343
Capabilities:
Get geographical location

Disassembly:
jmp 0x406f70
sub esp, 0x18
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
xor eax, eax
push edi
push 0x14
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
lea eax, [esp + 0xc]
push eax
push 1
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edi, edi
mov esi, 0x447dc0
mov eax, dword [esi]
lea ecx, [esi - 0x14]
lea eax, [esp + eax*2 + 8]
lea ebx, [ebx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x406fe6
test dx, dx
je 0x406fe2
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x406fe6
add eax, 4
add ecx, 4
test dx, dx
jne 0x406fc0
xor eax, eax
jmp 0x406feb
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x407013
add esi, 0x21c
add edi, 1
cmp esi, 0x44b060
jl 0x406fb1
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x18
ret
mov ecx, dword [0x46b144]
imul edi, edi, 0x21c
imul ecx, ecx, 0xb0
mov eax, dword [ecx + 0x4478bc]
and eax, dword [edi + 0x447da8]
mov ecx, dword [esp + 0x1c]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
neg eax
call fcn.0041bdf4
add esp, 0x18
ret
Function at 0x401352
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
jmp 0x40a2f0
sub esp, 8
push esi
mov esi, dword [esp + 0x10]
test esi, esi
jne 0x40a303
xor eax, eax
pop esi
add esp, 8
ret
push edi
mov edi, dword [esp + 0x18]
test edi, edi
je 0x40a376
mov eax, dword [esp + 0x1c]
push eax
lea ecx, [esp + 0x18]
push ecx
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
mov dword [esp + 0x28], 0
mov dword [esp + 0x20], 0
mov dword [esp + 0x1c], 0xc8
mov word [esi], 0
call fcn.00401276
add esp, 0x14
test eax, eax
jne 0x40a376
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push esi
lea eax, [esp + 0x14]
push eax
push 0
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x40a37e
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 8
ret
cmp word [esi], 0
je 0x40a3e9
mov eax, dword [esp + 8]
cmp eax, 0x104
jae 0x40a3e9
mov ecx, dword [esp + 0xc]
mov edi, 1
cmp ecx, edi
je 0x40a3a6
cmp ecx, 7
je 0x40a3a6
cmp ecx, 2
jne 0x40a3ab
mov edi, 2
sub eax, edi
cmp word [esi + eax*2], 0x5c
lea eax, [esi + eax*2]
jne 0x40a3d1
push eax
push esi
call fcn.00401113
add esp, 8
test eax, eax
je 0x40a3d1
mov eax, dword [esp + 8]
sub eax, edi
mov word [esi + eax*2], 0
mov ecx, dword [esp + 0x14]
push ecx
mov esi, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 8
ret
mov ecx, dword [esp + 0x14]
push ecx
xor esi, esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 8
ret
Function at 0x401366
Capabilities:
Write file on windows

Disassembly:
jmp 0x403640
sub esp, 0x418
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x414], eax
push esi
mov esi, dword [esp + 0x420]
test esi, esi
push edi
mov edi, dword [esp + 0x428]
jne 0x403681
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x418
ret
test edi, edi
je 0x403668
push 0x410
lea eax, [esp + 0x10]
push 0
push eax
mov dword [esp + 0x14], 0
call fcn.0041be10
mov eax, dword [0x478e28]
push 0xa
push 0xd
push edi
add eax, 1
push esi
push eax
lea ecx, [esp + 0x2c]
push str.REGIFLDR_d__s___s__1c_1c
push ecx
mov dword [0x478e28], eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x28
push 0
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [0x486308]
add eax, eax
push eax
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [esp + 0x41c]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, esp
add eax, 1
call fcn.0041bdf4
add esp, 0x418
ret

Function at 0x401700
Capabilities:
Check os version

Disassembly:
jmp 0x401700
sub esp, 0x118
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x114], eax
push 0x114
lea eax, [esp + 4]
push 0
push eax
call fcn.0041be10
add esp, 0xc
lea ecx, [esp]
push ecx
mov dword [esp + 4], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [esp + 4]
cmp eax, 4
jae 0x40175a
xor eax, eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x118
ret
jne 0x401816
mov eax, dword [esp + 8]
test eax, eax
jne 0x4017c3
mov eax, 1
cmp dword [esp + 0x10], eax
jne 0x40179b
cmp dword [0x46b13c], 0
je 0x401743
mov dword [0x44fe24], 0
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x118
ret
cmp dword [0x478e14], 0
je 0x401743
mov dword [0x44fe24], 3
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x118
ret
cmp eax, 0xa
jne 0x4017f4
cmp dword [0x45043c], 0
je 0x401743
mov eax, 1
mov dword [0x44fe24], eax
mov ecx, dword [esp + 0x114]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x118
ret
cmp eax, 0x5a
jne 0x401889
cmp dword [0x479044], 0
je 0x401743
mov dword [0x44fe24], 2
jmp 0x401889
cmp eax, 5
jne 0x401854
cmp dword [esp + 8], 0
jne 0x40183b
cmp dword [0x450c50], 0
je 0x401743
mov dword [0x44fe24], 4
jmp 0x401889
cmp dword [0x451058], 0
je 0x401743
mov dword [0x44fe24], 5
jmp 0x401889
cmp eax, 6
jne 0x40186d
cmp dword [0x478e24], 0
je 0x401743
mov dword [0x44fe24], eax
jmp 0x401889
cmp eax, 7
jb 0x401889
cmp dword [0x478e1c], 0
je 0x401743
mov dword [0x44fe24], 0x1c
mov ecx, dword [esp + 0x114]
xor ecx, esp
mov eax, 1
call fcn.0041bdf4
add esp, 0x118
ret
Function at 0x401910
Capabilities:
Enumerate files on windows

Disassembly:
jmp 0x401910
sub esp, 0x69c
mov eax, dword [0x44e1b4]
xor eax, esp
mov dword [esp + 0x698], eax
mov eax, dword [esp + 0x6a4]
push esi
mov esi, dword [esp + 0x6a4]
test esi, esi
push edi
mov edi, dword [esp + 0x6b0]
mov dword [esp + 8], eax
jne 0x40195c
pop edi
xor eax, eax
pop esi
mov ecx, dword [esp + 0x698]
xor ecx, esp
call fcn.0041bdf4
add esp, 0x69c
ret
test eax, eax
je 0x401943
test edi, edi
je 0x401943
push ebx
push ebp
push 0x410
lea eax, [esp + 0x29c]
push 0
push eax
call fcn.0041be10
push 0x250
lea ecx, [esp + 0x58]
push 0
push ecx
call fcn.0041be10
push 0x34
lea edx, [esp + 0x30]
push 0
push edx
call fcn.0041be10
add esp, 0x24
push 0x3f5
push esi
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebp, eax
push edi
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x435bf0
lea ecx, [esp + 0x29c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [esp + 0x48]
push edx
lea eax, [esp + 0x29c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x401a31
mov edi, dword [sym.imp.KERNEL32.dll_lstrcmpW]
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov al, byte [esp + 0x48]
test al, 0x10
je 0x401a1e
test al, 2
jne 0x401a1e
push 0x435bec
lea ecx, [esp + 0x78]
push ecx
call edi
test eax, eax
je 0x401a1e
push 0x435be4
lea edx, [esp + 0x78]
push edx
call edi
test eax, eax
jne 0x401a4c
lea eax, [esp + 0x48]
push eax
push esi
call ebx
test eax, eax
jne 0x4019f2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
mov ecx, dword [esp + 0x6a8]
pop ebp
pop ebx
pop edi
pop esi
xor ecx, esp
call fcn.0041bdf4
add esp, 0x69c
ret
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0x14]
push edx
push 0
push 0x1132
push ebp
mov dword [esp + 0x24], ecx
mov dword [esp + 0x2c], 0x11
mov dword [esp + 0x3c], str.Dummy
call dword [sym.imp.USER32.dll_SendMessageW]
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, 1
jmp 0x401a33