joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403ef0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
add esp, 0xfffffff4
push 0
lea eax, [ebp - 4]
push eax
push 4
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x403f1a
cmp dword [ebp - 4], 3
ja 0x403f3d
add esp, 0xfffffffc
push dword [ebp - 4]
call sub.KERNEL32.dll_GetLastError
push eax
push 0x403eca
call fcn.00408090
add esp, 0xfffffff4
push 0x403ed7
call fcn.0040374c
mov eax, dword [ebp - 8]
leave
ret

Function at 0x403f5c
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
add esp, 0xfffffff4
push 0
lea eax, [ebp - 4]
push eax
push 2
lea eax, [ebp - 6]
push eax
push dword [ebp + 8]
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x403f86
cmp dword [ebp - 4], 1
ja 0x403fa6
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
push eax
push 0x403e54
call fcn.00408090
add esp, 0xfffffff4
push 0x403f42
call fcn.0040374c
movsx eax, word [ebp - 6]
leave
ret

Function at 0x403fc8
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
mov ebx, dword [ebp + 8]
add esp, 0xfffffff4
push ebx
call fcn.00403ef0
mov esi, eax
add esp, 0xfffffff4
lea eax, [esi + 1]
push eax
call fcn.00416eb4
mov edi, eax
mov byte [esi + edi], 0
add esp, 0x20
add esp, 0xfffffff4
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
push ebx
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x404011
cmp dword [ebp - 4], esi
jae 0x40401e
add esp, 0xfffffff4
push 0x403fac
call fcn.0040374c
mov eax, edi
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x404044
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push edi
push esi
push ebx
add esp, 0xfffffff4
mov eax, dword [ebp + 8]
push eax
call fcn.00403ef0
mov esi, eax
add esp, 0xfffffff4
shr eax, 0x1f
lea ebx, [eax + esi]
sar ebx, 1
lea eax, [ebx*2 + 2]
push eax
call fcn.00416eb4
mov edi, eax
mov word [edi + ebx*2], 0
add esp, 0x20
add esp, 0xfffffff4
push 0
lea eax, [ebp - 4]
push eax
push esi
push edi
mov eax, dword [ebp + 8]
push eax
call sub.KERNEL32.dll_ReadFile
add esp, 0xc
test eax, eax
je 0x40409e
cmp dword [ebp - 4], esi
jae 0x4040ab
add esp, 0xfffffff4
push 0x404028
call fcn.0040374c
mov eax, edi
lea esp, [ebp - 0x28]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x4046d8
Capabilities:
Create directory
Delete directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2014
call fcn.004170c4
push ebx
add esp, 0xfffffffc
push dword [ebp + 8]
push 0x4046c5
lea ebx, [ebp - 0x2000]
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__rmdir
add esp, 0x20
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__mkdir
add esp, 0x10
test eax, eax
jne 0x404741
add esp, 0xfffffff4
push ebx
call fcn.004040c4
add esp, 0x10
test al, al
je 0x404738
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__rmdir
mov al, 1
jmp 0x404743
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__rmdir
mov al, 0
mov ebx, dword [ebp - 0x2018]
leave
ret
Function at 0x4047f4
Capabilities:
Create directory
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.004170c4
push edi
push esi
push ebx
mov esi, dword [ebp + 8]
add esp, 0xfffffff8
push esi
push 0x2000
call sub.KERNEL32.dll_GetTempPathA
mov ebx, eax
add esp, 0xfffffff4
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
push eax
push ebx
push 0x404760
call fcn.00408090
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
add esp, 0x28
cmp ecx, 0xfffffffe
jne 0x40489c
add esp, 0xfffffffc
push 0x2000
push esi
push 0x404788
call sub.KERNEL32.dll_GetEnvironmentVariableA
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx + 0x1fff]
push eax
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [esi + ecx - 1]
push eax
push 0x404792
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 0xfffffffc
push esi
push 0x4047a0
call fcn.00408090
add esp, 0x10
jmp 0x4048ba
test ebx, ebx
jle 0x4048ba
add esp, 0xfffffff8
add esp, 0xfffffff4
push esi
call sub.msvcrt.dll__mkdir
push eax
push 0x4047c3
call fcn.00408090
add esp, 0x20
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x2000]
push ebx
push esi
mov eax, dword [0x422020]
call eax
add esp, 0xfffffffc
push 0x3f
push ebx
call sub.msvcrt.dll_strchr
add esp, 0x10
test eax, eax
je 0x4049dc
add esp, 0xfffffff8
push 0x2000
lea ebx, [ebp - 0x4000]
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
add esp, 0xfffffff4
push ebx
push 0x4047d8
push esi
call sub.msvcrt.dll_sprintf
add esp, 0x20
add esp, 0xfffffff4
push esi
call fcn.004046d8
add esp, 0x10
test al, al
jne 0x4049dc
mov eax, dword [0x4047e0]
mov dword [esi], eax
mov eax, dword [0x4047e4]
mov dword [esi + 4], eax
add esp, 0xfffffff4
push esi
call fcn.004046d8
add esp, 0x10
test al, al
jne 0x4049dc
mov edi, 0x4047e8
mov eax, dword [0x4047e8]
mov dword [esi], eax
movzx eax, word [edi + 4]
mov word [esi + 4], ax
mov al, byte [edi + 6]
mov byte [esi + 6], al
add esp, 0xfffffff4
push esi
call fcn.004046d8
add esp, 0x10
test al, al
jne 0x4049dc
add esp, 0xfffffff8
push ebx
push esi
call sub.msvcrt.dll_strcpy
add esp, 0xfffffff4
push esi
call fcn.004046d8
add esp, 0x20
test al, al
jne 0x4049dc
mov eax, dword [0x4047ef]
mov dword [esi], eax
add esp, 0xfffffff4
push esi
call fcn.004046d8
add esp, 0x10
test al, al
je 0x4049cd
mov eax, dword [0x4047e8]
mov dword [esi], eax
movzx eax, word [edi + 4]
mov word [esi + 4], ax
mov al, byte [edi + 6]
mov byte [esi + 6], al
add esp, 0xfffffff4
push esi
call sub.msvcrt.dll__mkdir
add esp, 0xfffffff4
push esi
call fcn.004046d8
add esp, 0x20
test al, al
jne 0x4049dc
add esp, 0xfffffff8
push 0
push 0x3f7
call fcn.004037a0
lea esp, [ebp - 0x4018]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x404a40
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.004170c4
push esi
push ebx
mov esi, dword [ebp + 8]
add esp, 0xfffffff4
lea ebx, [ebp - 0x2000]
push ebx
call fcn.004047f4
add esp, 0xfffffff8
push ebx
push 0x4049e7
call fcn.00408090
add esp, 0x20
push esi
push 0
push 0x4049f6
push ebx
call sub.KERNEL32.dll_GetTempFileNameA
test eax, eax
jne 0x404ac2
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
push eax
push 0x404a00
call fcn.00408090
add esp, 0xfffffff4
add esp, 0xfffffff4
push 0
call sub.msvcrt.dll_time
push eax
call sub.msvcrt.dll_srand
add esp, 0x30
call sub.msvcrt.dll_rand
push eax
push ebx
push 0x404a27
push esi
call sub.msvcrt.dll_sprintf
add esp, 0x10
add esp, 0xfffffff8
push esi
push 0x404a2f
call fcn.00408090
lea esp, [ebp - 0x2018]
pop ebx
pop esi
leave
ret
Function at 0x4074ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push esi
push ebx
mov esi, 0x422030
mov edi, dword [0x422030]
jmp 0x40755d
mov ebx, dword [esi]
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea edi, [ecx - 1]
add esp, 0xfffffff4
push ecx
call fcn.00416eb4
xor edx, edx
add esp, 0x10
cmp edx, edi
jge 0x40753a
lea esi, [esi]
mov cl, byte [edx + ebx]
xor cl, 0xbb
mov byte [edx + eax], cl
inc edx
cmp edx, edi
jl 0x40752c
mov byte [edi + eax], 0
add esp, 0xfffffffc
push edi
push eax
mov eax, dword [ebp + 8]
push eax
call sub.msvcrt.dll_strncmp
add esp, 0x10
test eax, eax
jne 0x407558
mov al, 1
jmp 0x40756e
add esi, 4
mov edi, dword [esi]
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
cmp ecx, 0xfffffffe
jne 0x407504
mov al, 0
lea esp, [ebp - 0x18]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x407d4c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp + 0x10]
test eax, eax
jle 0x407d79
mov ecx, eax
mov eax, dword [esi]
mov dl, al
xor dl, byte [ebx]
movzx edx, dl
shr eax, 8
xor eax, dword [edx*4 + 0x42204c]
mov dword [esi], eax
inc ebx
dec ecx
jne 0x407d60
pop ebx
pop esi
leave
ret
Function at 0x407e74
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x401c
call fcn.004170c4
push edi
push esi
push ebx
mov eax, dword [0x422854]
test eax, eax
je 0x407eac
cmp dword [0x422850], 0
jne 0x407eac
add esp, 0xfffffff8
push 0x407e1b
push eax
call sub.msvcrt.dll_fopen
mov dword [0x422850], eax
add esp, 0x10
cmp byte [0x42284c], 0
jne 0x407ffc
mov byte [0x42284c], 1
mov al, byte [0x42287e]
mov byte [ebp - 0x4005], al
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x2000]
push ebx
push 0x407e1d
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 4
test eax, eax
je 0x407f05
mov esi, ebx
mov edi, 0x407e27
mov ecx, 4
cld
test al, 0
repe cmpsb byte [esi], byte es:[edi]
jne 0x407f05
mov byte [ebp - 0x4005], 1
add esp, 0xfffffffc
push 0x2000
push ebx
push 0x407e2b
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 4
test eax, eax
je 0x407f39
mov esi, ebx
mov edi, 0x407e27
mov ecx, 4
cld
test al, 0
repe cmpsb byte [esi], byte es:[edi]
jne 0x407f39
mov byte [ebp - 0x4005], 1
cmp byte [ebp - 0x4005], 0
je 0x407ffc
add esp, 0xfffffff8
push 0x407e39
push 0x407e43
call sub.msvcrt.dll__tempnam
mov dword [0x422854], eax
add esp, 0x10
test eax, eax
je 0x407f7a
add esp, 0xfffffff8
push 0x407e47
push eax
call sub.msvcrt.dll_fopen
mov dword [0x422850], eax
add esp, 0x10
cmp dword [0x422850], 0
jne 0x407fab
mov dword [0x422854], 0x407e49
add esp, 0xfffffff8
push 0x407e47
push 0x407e49
call sub.msvcrt.dll_fopen
mov dword [0x422850], eax
add esp, 0x10
test eax, eax
je 0x407ffc
add esp, 0xfffffffc
push 0x2000
lea esi, [ebp - 0x4000]
push esi
push 0
call sub.KERNEL32.dll_GetModuleFileNameA
add esp, 0xfffffff8
lea ebx, [ebp - 0x4004]
push ebx
call sub.msvcrt.dll_time
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll_ctime
push eax
push esi
push 0x407e55
push dword [0x422850]
call sub.msvcrt.dll_fprintf
add esp, 0x30
add esp, 0xfffffff4
push dword [0x422850]
call sub.msvcrt.dll_fflush
lea esp, [ebp - 0x4028]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x40817c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.004170c4
push ebx
add esp, 0xfffffffc
add esp, 0xfffffffe
push 0
call fcn.00404278
push eax
lea ebx, [ebp - 0x2000]
push ebx
call fcn.00404664
add esp, 0xfffffff4
push 0
lea eax, [ebp - 0x2004]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push 0x408154
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0x1c
test eax, eax
jne 0x408209
call sub.KERNEL32.dll_GetCurrentProcessId
mov dword [ebp - 0x2008], eax
add esp, 0xfffffff8
push 4
lea eax, [ebp - 0x2008]
push eax
push 4
push 0
push ebx
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xfffffffc
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegCloseKey
mov ebx, dword [ebp - 0x2028]
leave
ret
Function at 0x408214
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2020
call fcn.004170c4
push esi
push ebx
add esp, 0xfffffffc
add esp, 0xfffffffe
push 0
call fcn.00404278
push eax
lea ebx, [ebp - 0x2000]
push ebx
call fcn.00404664
xor esi, esi
add esp, 0xfffffff4
lea eax, [ebp - 0x2004]
push eax
push 0x20019
push 0
push 0x408154
push 0x80000001
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0x1c
test eax, eax
jne 0x4082bb
mov dword [ebp - 0x2008], 4
add esp, 0xfffffff8
lea eax, [ebp - 0x2008]
push eax
lea eax, [ebp - 0x200c]
push eax
lea eax, [ebp - 0x2010]
push eax
push 0
push ebx
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegQueryValueExA
add esp, 8
test eax, eax
jne 0x4082ad
cmp dword [ebp - 0x2008], 4
jne 0x4082ad
mov esi, dword [ebp - 0x200c]
add esp, 0xfffffff4
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegCloseKey
mov eax, esi
lea esp, [ebp - 0x2028]
pop ebx
pop esi
leave
ret
Function at 0x408ce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.004170c4
push esi
push ebx
add esp, 0xfffffff4
push 0x278b
call fcn.004019cc
add esp, 0x10
test eax, eax
je 0x408e3a
cmp dword [ebp + 8], 0
jne 0x408d28
cmp byte [0x422864], 0
je 0x408e3a
mov eax, dword [0x42e158]
call eax
jmp 0x408e3a
cmp byte [0x422864], 0
jne 0x408e3a
add esp, 0xfffffffc
call fcn.00404eec
push eax
push 0x408ba1
lea ebx, [ebp - 0x2000]
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0xfffffff8
push ebx
push 0x408bd4
call fcn.00408090
add esp, 0x20
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_LoadLibraryA
mov ebx, eax
add esp, 0xc
test ebx, ebx
jne 0x408d84
add esp, 0xfffffff4
push 0x408c14
call fcn.00408024
jmp 0x408e3a
add esp, 0xfffffff8
push 0x408c34
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x42e158], eax
push 0x408c40
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x42e148], eax
push 0x408c4b
push ebx
call sub.KERNEL32.dll_GetProcAddress
mov dword [0x42e138], eax
add esp, 8
cmp dword [0x42e158], 0
je 0x408dd1
mov edx, dword [0x42e148]
test edx, edx
je 0x408dd1
test eax, eax
jne 0x408de0
add esp, 0xfffffff4
push 0x408c74
call fcn.00408024
jmp 0x408e3a
call edx
add esp, 0xfffffffc
push 0xa
push 0x2710
push 0
call sub.KERNEL32.dll_FindResourceA
mov ebx, eax
add esp, 0xfffffff8
add esp, 0xfffffffc
push ebx
push 0
call sub.KERNEL32.dll_LoadResource
push eax
call sub.KERNEL32.dll_LockResource
mov esi, eax
add esp, 0xfffffff8
push ebx
push 0
call sub.KERNEL32.dll_SizeofResource
add esp, 0xfffffffc
push eax
push esi
push ebx
push eax
push esi
mov eax, dword [0x42e138]
call eax
add esp, 8
push eax
push 0x408cb4
call fcn.00408090
mov byte [0x422864], 1
lea esp, [ebp - 0x2018]
pop ebx
pop esi
leave
ret

Function at 0x409ee4
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x4010
call fcn.004170c4
push esi
push ebx
cmp dword [0x422878], 1
jne 0x409f87
mov dword [0x422878], 0
add esp, 0xfffffff4
push 0x6b
call fcn.004019cc
add esp, 0x10
cmp eax, 1
je 0x409f87
add esp, 0xfffffff8
push 0x2000
lea esi, [ebp - 0x4000]
push esi
call sub.KERNEL32.dll_GetConsoleTitleA
add esp, 8
test eax, eax
je 0x409f87
call sub.KERNEL32.dll_GetCurrentProcessId
push eax
call sub.KERNEL32.dll_GetTickCount
push eax
push 0x409ede
lea ebx, [ebp - 0x2000]
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_SetConsoleTitleA
add esp, 0x1c
test eax, eax
je 0x409f87
add esp, 0xfffffff4
push 0x28
call sub.KERNEL32.dll_Sleep
add esp, 0xfffffff4
push ebx
push 0
call sub.USER32.dll_FindWindowA
mov dword [0x422878], eax
add esp, 0xfffffffc
push esi
call sub.KERNEL32.dll_SetConsoleTitleA
lea esp, [ebp - 0x4018]
pop ebx
pop esi
leave
ret

Function at 0x409f94
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov edx, dword [ebp + 8]
movzx eax, byte [ebp + 0xc]
mov dword [0x42e178], edx
add esp, 0xfffffff8
push eax
push 0x40a0a0
call sub.USER32.dll_EnumWindows
leave
ret
Function at 0x40a2fc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2010
call fcn.004170c4
push esi
push ebx
xor esi, esi
lea esi, [esi]
add esp, 0xfffffff4
lea ebx, [ebp - 0x2000]
push ebx
call fcn.00404a40
add esp, 0xfffffff8
push ebx
push 0x42e190
call sub.msvcrt.dll_strcpy
add esp, 0x20
add esp, 0xfffffff8
push 0x40a2cc
push 0x42e190
call sub.msvcrt.dll_strcat
add esp, 0xfffffff8
push 0x42e190
push 0x40a2d1
call fcn.00408090
add esp, 0x20
add esp, 0xfffffff8
push 0
push 0x42e190
call sub.KERNEL32.dll_CreateDirectoryA
add esp, 8
test eax, eax
jne 0x40a39b
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
push eax
push 0x40a2de
call fcn.00408090
add esp, 0x10
inc esi
cmp esi, 4
jle 0x40a310
add esp, 0xfffffff8
push 0x40a2f8
push 0x3f1
call fcn.004037a0
lea esp, [ebp - 0x2018]
pop ebx
pop esi
leave
ret

Function at 0x40a40c
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
add esp, 0xfffffff4
push 0x1388
call sub.KERNEL32.dll_Sleep
add esp, 0xfffffffc
call fcn.0040a9fc
add esp, 0x10
test al, al
je 0x40a491
add esp, 0xfffffffc
lea eax, [ebp - 0x14]
push eax
push 0x28
call sub.KERNEL32.dll_GetCurrentProcess
push eax
call sub.ADVAPI32.DLL_OpenProcessToken
add esp, 4
test eax, eax
je 0x40a49d
add esp, 0xfffffffc
lea ebx, [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push 0x40a3f8
push 0
call sub.ADVAPI32.DLL_LookupPrivilegeValueA
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 2
add esp, 0xfffffffc
push 0
push 0
push 0
push ebx
push 0
push dword [ebp - 0x14]
call sub.ADVAPI32.DLL_AdjustTokenPrivileges
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
add esp, 0x10
test eax, eax
jne 0x40a49d
add esp, 0xfffffff8
push 0
push 2
call sub.USER32.dll_ExitWindowsEx
mov ebx, dword [ebp - 0x38]
leave
ret
Function at 0x40a530
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x8010
call fcn.004170c4
push edi
push ebx
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x6000]
push ebx
push 0x2714
call fcn.00401aa8
add esp, 0xfffffff8
push ebx
push 0x40a4a2
call fcn.00408090
add esp, 0x20
add esp, 0xfffffff4
push ebx
call fcn.004069a0
add esp, 0xfffffff8
push ebx
lea ebx, [ebp - 0x4000]
push ebx
call fcn.00403d9c
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
add esp, 0x20
cmp ecx, 0xfffffffe
je 0x40a5ba
mov edi, ebx
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
cmp byte [ebx + ecx - 2], 0x3b
je 0x40a5ba
add esp, 0xfffffff8
push 0x40a4b7
push ebx
call sub.msvcrt.dll_strcat
add esp, 0x10
add esp, 0xfffffffc
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
mov eax, 0x4001
sub eax, ecx
push eax
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ebx + ecx - 1]
push eax
push 0x40a4b9
call sub.KERNEL32.dll_GetEnvironmentVariableA
add esp, 0xfffffffc
push ebx
push 0x40a4b9
call sub.KERNEL32.dll_SetEnvironmentVariableA
add esp, 8
test eax, eax
je 0x40a610
add esp, 0xfffffff8
push ebx
push 0x40a4be
jmp 0x40a61f
add esp, 0xfffffffc
call sub.KERNEL32.dll_GetLastError
push eax
push ebx
push 0x40a4f4
call fcn.00408090
add esp, 0x10
add esp, 0xfffffffc
push ebx
push 0x40a527
lea ebx, [ebp - 0x8000]
push ebx
call sub.msvcrt.dll_sprintf
add esp, 0xfffffff4
push ebx
call sub.msvcrt.dll__putenv
lea esp, [ebp - 0x8018]
pop ebx
pop edi
leave
ret
Function at 0x40a7b8
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x400c
call fcn.004170c4
push edi
push esi
push ebx
mov ebx, dword [ebp + 0xc]
test ebx, ebx
je 0x40a875
mov edx, dword [ebx]
mov eax, dword [ebx + 4]
sub eax, edx
sar eax, 2
cmp eax, 1
jbe 0x40a875
add esp, 0xfffffff8
push 0x40a654
push dword [edx + 4]
call sub.msvcrt.dll_wcscmp
add esp, 0x10
test eax, eax
je 0x40a848
add esp, 0xfffffff8
push 0x40a674
mov eax, dword [ebx]
push dword [eax + 4]
call sub.msvcrt.dll_wcscmp
add esp, 0x10
test eax, eax
je 0x40a848
add esp, 0xfffffff8
push 0x40a694
mov eax, dword [ebx]
push dword [eax + 4]
call sub.msvcrt.dll_wcscmp
add esp, 0x10
test eax, eax
je 0x40a848
add esp, 0xfffffff8
push 0x40a6b4
mov eax, dword [ebx]
push dword [eax + 4]
call sub.msvcrt.dll_wcscmp
add esp, 0x10
test eax, eax
jne 0x40a875
mov eax, dword [ebx]
lea ecx, [eax + 4]
add eax, 8
mov edx, dword [ebx + 4]
cmp eax, edx
je 0x40a86a
add esp, 0xfffffffc
sub edx, eax
and edx, 0xfffffffc
push edx
push eax
push ecx
call sub.msvcrt.dll_memmove
add esp, 0x10
add dword [ebx + 4], 0xfffffffc
mov byte [0x42287e], 1
call fcn.00401c1c
mov eax, dword [ebp + 8]
mov dword [0x430190], eax
call fcn.0040a3b8
cmp byte [0x42287d], 0
jne 0x40a8f8
add esp, 0xfffffffc
push 0x2000
lea ebx, [ebp - 0x2000]
push ebx
push 0x92
call fcn.00401aa8
add esp, 0x10
cmp byte [ebp - 0x2000], 0
je 0x40a8e8
add esp, 0xfffffffc
add esp, 0xfffffffe
push 1
push ebx
lea ebx, [ebp - 0x4000]
push ebx
call fcn.00404664
add esp, 0xfffffff4
push ebx
call sub.KERNEL32.dll_SetCurrentDirectoryA
add esp, 0xfffffff4
push ebx
push 0x40a6d4
call fcn.00408090
add esp, 0x30
jmp 0x40a8f8
add esp, 0xfffffff4
push 0x40a6f3
call fcn.00408090
add esp, 0x10
cmp byte [0x42287e], 0
je 0x40a9f0
add esp, 0xfffffffc
call fcn.00408008
push eax
push 0x40a714
lea edi, [ebp - 0x4000]
push edi
call sub.msvcrt.dll_sprintf
push 4
push dword [0x430194]
push edi
push 0
call sub.USER32.dll_MessageBoxA
add esp, 0x10
cmp eax, 6
jne 0x40a9f0
add esp, 0xfffffffc
push 0x104
lea esi, [ebp - 0x2000]
push esi
call fcn.00408008
push eax
call sub.KERNEL32.dll_GetShortPathNameA
add esp, 0xfffffffc
push 0x104
lea ebx, [ebp - 0x1ef0]
push ebx
call sub.KERNEL32.dll_GetWindowsDirectoryA
add esp, 0xfffffff8
push esi
push ebx
push 0x40a769
push edi
call sub.msvcrt.dll_sprintf
add esp, 0x20
add esp, 0xfffffff8
push edi
push 0x40a784
call fcn.00408090
add esp, 0xfffffffc
push 0x10
push 0
lea esi, [ebp - 0x1de0]
push esi
call sub.msvcrt.dll_memset
add esp, 0x20
add esp, 0xfffffffc
push 0x44
push 0
lea ebx, [ebp - 0x1dd0]
push ebx
call sub.msvcrt.dll_memset
mov dword [ebp - 0x1dd0], 0x44
add esp, 0xfffffff8
push esi
push ebx
push 0
push 0
push 0x20
push 1
push 0
push 0
push edi
push 0
call sub.KERNEL32.dll_CreateProcessA
add esp, 0x18
test eax, eax
jne 0x40a9f0
add esp, 0xfffffff8
call sub.KERNEL32.dll_GetLastError
push eax
push 0x40a794
call fcn.00408090
lea esp, [ebp - 0x4018]
pop ebx
pop esi
pop edi
leave
ret
Function at 0x40b730
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x201c
call fcn.004170c4
push edi
push esi
push ebx
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x2010], eax
mov dword [ebp - 0x200c], edx
mov esi, dword [ebp + 0x14]
add esp, 0xfffffffc
push 0x40b6f4
push ecx
lea ebx, [ebp - 0x2000]
push ebx
call fcn.0040b694
add esp, 0xfffffff4
push 0
lea eax, [ebp - 0x2004]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ebx
push 0x80000001
call sub.ADVAPI32.DLL_RegCreateKeyExA
add esp, 0x1c
test eax, eax
jne 0x40b7ed
add esp, 0xfffffff8
push 8
lea eax, [ebp - 0x2010]
push eax
push 3
push 0
push 0x40b719
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegSetValueExA
mov edi, esi
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
lea eax, [ecx - 1]
push eax
push esi
push 1
push 0
push 0x40b727
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegSetValueExA
add esp, 0xfffffffc
push dword [ebp - 0x2004]
call sub.ADVAPI32.DLL_RegCloseKey
lea esp, [ebp - 0x2028]
pop ebx
pop esi
pop edi
leave
ret

Function at 0x40b8e4
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x802c
call fcn.004170c4
push edi
push esi
push ebx
mov edx, dword [ebp + 8]
mov byte [ebp - 0x8019], 0
mov eax, dword [ebp + 0x10]
mov byte [eax], 0
add esp, 0xfffffff4
lea eax, [ebp - 0x8004]
push eax
push 0x20019
push 0
push 0x40b814
push edx
call sub.ADVAPI32.DLL_RegOpenKeyExA
add esp, 0xc
test eax, eax
jne 0x40ba3a
mov eax, 0x2000
mov dword [ebp - 0x8014], eax
mov dword [ebp - 0x8018], eax
xor esi, esi
jmp 0x40b9f0
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
xor eax, eax
cmp eax, ecx
jge 0x40b978
mov dl, byte [eax + ebx]
cmp dl, 0x2f
jne 0x40b96c
mov byte [eax + ebp - 0x6000], 0x5c
jmp 0x40b973
mov byte [eax + ebp - 0x6000], dl
inc eax
cmp eax, ecx
jl 0x40b958
add esp, 0xfffffff4
add esp, 0xfffffffe
push 1
mov eax, dword [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x14]
push eax
lea edi, [ebp - 0x8000]
push edi
lea ebx, [ebp - 0x6000]
push ebx
call fcn.0040c048
add esp, 0x20
test al, al
je 0x40b9db
add esp, 0xfffffff8
mov eax, dword [ebp + 0x10]
push eax
push edi
call sub.msvcrt.dll_strcmp
add esp, 0x10
test eax, eax
jle 0x40b9db
add esp, 0xfffffff8
push edi
mov eax, dword [ebp + 0x10]
push eax
call sub.msvcrt.dll_strcpy
add esp, 0xfffffff8
push ebx
mov eax, dword [ebp + 0xc]
push eax
call sub.msvcrt.dll_strcpy
mov byte [ebp - 0x8019], 1
add esp, 0x20
inc esi
mov dword [ebp - 0x8014], 0x2000
mov dword [ebp - 0x8018], 0x2000
lea eax, [ebp - 0x8010]
push eax
lea eax, [ebp - 0x8014]
push eax
lea eax, [ebp - 0x2000]
push eax
push 0
lea eax, [ebp - 0x8018]
push eax
lea ebx, [ebp - 0x4000]
push ebx
push esi
push dword [ebp - 0x8004]
call sub.ADVAPI32.DLL_RegEnumKeyExA
cmp eax, 0x103
jne 0x40b944
add esp, 0xfffffff4
push dword [ebp - 0x8004]
call sub.ADVAPI32.DLL_RegCloseKey
mov al, byte [ebp - 0x8019]
lea esp, [ebp - 0x8038]
pop ebx
pop esi
pop edi
leave
ret