joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4329e0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a558
mov eax, dword fs:[0]
push eax
sub esp, 0x12c
mov eax, dword [0x44eca0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x11c
push 0
lea eax, [ebp - 0x134]
push eax
call fcn.00414840
add esp, 0xc
mov dword [ebp - 0x134], 0x11c
lea ecx, [ebp - 0x134]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x432a5b
mov dword [ebp - 0x134], 0x114
lea edx, [ebp - 0x134]
push edx
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x432ab6
cmp dword [ebp - 0x130], 6
jne 0x432ab6
cmp dword [ebp - 0x12c], 2
jne 0x432ab6
push str.IsWin8WinServer2012_returns_1
lea ecx, [ebp - 0x138]
call fcn.004026b0
mov dword [ebp - 4], 0
push 0
lea eax, [ebp - 0x138]
push eax
push 2
call fcn.004381d0
add esp, 0xc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x138]
call fcn.00407a90
mov eax, 1
jmp 0x432ab8
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00414831
mov esp, ebp
pop ebp
ret
Function at 0x4340a0
Capabilities:
Delete directory
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x43a8df
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x44eca0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 4], 0
lea ecx, [ebp + 8]
call fcn.00403220
movzx eax, al
test eax, eax
jne 0x4340e8
lea ecx, [ebp + 8]
call fcn.004031f0
cmp eax, 4
jae 0x4340fc
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407a90
jmp 0x43427c
lea ecx, [ebp + 8]
push ecx
lea ecx, [ebp - 0x34]
call fcn.00408060
mov byte [ebp - 4], 1
push 0x5c
lea ecx, [ebp - 0x34]
call fcn.00402bf0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x434164
lea ecx, [ebp - 0x34]
call fcn.004031f0
sub eax, 1
cmp dword [ebp - 0x30], eax
jne 0x434164
mov edx, dword [ebp - 0x30]
push edx
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x34]
call fcn.00402df0
mov dword [ebp - 0x44], eax
mov ecx, dword [ebp - 0x44]
mov dword [ebp - 0x48], ecx
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x48]
push edx
lea ecx, [ebp - 0x34]
call fcn.004027b0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x3c]
call fcn.00407a90
push 0x442658
lea ecx, [ebp - 0x34]
call fcn.00402810
lea ecx, [ebp - 0x24]
call fcn.004088f5
mov byte [ebp - 4], 3
push 0
lea ecx, [ebp - 0x34]
call fcn.00403210
push eax
lea ecx, [ebp - 0x24]
call fcn.004089bc
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x434210
lea ecx, [ebp - 0x24]
call fcn.004085d7
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x24]
call fcn.004088b6
test eax, eax
je 0x4341b2
jmp 0x434193
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0x24]
call fcn.00408be9
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x24]
call fcn.004016a0
test eax, eax
je 0x4341f6
push ecx
mov ecx, esp
mov dword [ebp - 0x40], esp
lea edx, [ebp - 0x38]
push edx
call fcn.00408060
mov dword [ebp - 0x4c], eax
call fcn.004340a0
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x38]
call fcn.00407a90
jmp 0x434193
lea eax, [ebp - 0x38]
push eax
call fcn.00432740
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x38]
call fcn.00407a90
jmp 0x434193
lea ecx, [ebp - 0x24]
call fcn.004084f1
push 0x80
lea ecx, [ebp + 8]
call fcn.00403210
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov dword [ebp - 0x28], eax
lea ecx, [ebp + 8]
call fcn.00403210
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x434255
push 0x186a0
lea ecx, [ebp + 8]
push ecx
push 2
call fcn.004381d0
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
call fcn.0040891e
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00407a90
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00407a90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x437280
Capabilities:
Check if file exists
Get file attributes
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp - 0x14]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4372a4
mov eax, 3
jmp 0x4373bc
mov ecx, dword [ebp - 0x14]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4372c0
mov eax, 2
jmp 0x4373bc
mov dword [ebp - 4], 0x82
mov edx, dword [ebp - 4]
shl edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
add eax, 1
cmp dword [ebp - 4], eax
ja 0x43739b
mov ecx, dword [ebp - 4]
shl ecx, 1
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x821
jb 0x4372f9
mov eax, 0xd
jmp 0x4373bc
xor ecx, ecx
mov eax, dword [ebp - 4]
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00408443
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov edx, dword [ebp - 4]
shl edx, 1
push edx
push 0
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
push ecx
call fcn.00414840
add esp, 0xc
mov edx, dword [ebp - 0x14]
add edx, 4
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
push 0x446d4c
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x43736c
mov ecx, dword [ebp - 4]
sub ecx, 1
cmp dword [ebp - 8], ecx
jne 0x437396
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
call fcn.0040844e
add esp, 4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [ebp - 8], 0
jne 0x437396
mov eax, pe_nt_image_headers32
jmp 0x4373bc
jmp 0x4372cf
mov eax, dword [ebp + 0xc]
cmp dword [eax], 0
je 0x4373b3
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jne 0x4373ba
mov eax, 0xd
jmp 0x4373bc
xor eax, eax
mov esp, ebp
pop ebp
ret 8

Function at 0x4373d0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, 0xfeff
mov word [ebp - 8], ax
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x437412
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x437473
push 0
lea edx, [ebp - 4]
push edx
push 2
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x437434
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x437473
push 0
lea edx, [ebp - 4]
push edx
push 0x446cbc
call fcn.004148ba
add esp, 4
lea eax, [eax + eax + 2]
push eax
push str._SESSION_
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x437467
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x437473
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x437760
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], vtable.CArmReport.0
push 0x104
push 0
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call fcn.00414840
add esp, 0xc
mov edx, dword [ebp - 8]
add edx, 4
push edx
push 0
push 0
push 0x8023
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jge 0x4377ab
jmp 0x4377d7
push str.AdobeARM_
push 0x104
mov eax, dword [ebp - 8]
add eax, 4
push eax
call fcn.00401080
push str.ArmReport.ini
push 0x104
mov ecx, dword [ebp - 8]
add ecx, 4
push ecx
call fcn.00401080
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret

Function at 0x437910
Capabilities:
Check if file exists
Delete file
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x43793c
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x437943
mov eax, 2
jmp 0x4379b3
mov edx, dword [ebp - 0x10]
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x4379b1
mov byte [ebp - 9], 0
lea eax, [ebp - 9]
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Delete_Report
mov ecx, dword [ebp - 0x10]
call fcn.004377e0
push 4
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x4379b1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
mov byte [ebp - 0xa], 0
lea edx, [ebp - 0xa]
push edx
mov eax, dword [ebp - 8]
push eax
push str.MoveEx_Report
mov ecx, dword [ebp - 0x10]
call fcn.004377e0
mov eax, dword [ebp - 8]
jmp 0x4379b3
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x4379c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0xc], 0
mov byte [0x452cc5], 1
mov dword [0x452cbc], 1
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
mov ecx, 0x452d20
call fcn.00403210
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x437a46
mov dword [ebp - 0x10], 4
mov dword [ebp - 0x14], 4
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10]
push eax
push 0
mov ecx, 0x452d2c
call fcn.00403210
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 4], 0
jne 0x437a5c
cmp dword [ebp - 0xc], 1
jne 0x437a5c
mov dword [0x452cbc], 2
mov esp, ebp
pop ebp
ret
Function at 0x401146
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
sub esp, 0x34
mov eax, dword [0x4705d0]
xor eax, esp
mov dword [esp + 0x30], eax
push esi
push edi
push 5
pop ecx
mov al, byte [esp + 0x40]
mov esi, str._1234567890_____._
lea edi, [esp + 8]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 5
pop ecx
mov esi, str._______:____
lea edi, [esp + 0x20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
test al, al
je 0x401230
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push ebx
mov ebx, 0x8000
cmp al, 0x41
jb 0x4011c0
cmp al, 0x5a
ja 0x4011c0
push 0x10
call esi
test ebx, eax
jne 0x4011a6
push 0x14
call esi
test al, 1
je 0x4011b6
push 0x10
call esi
test ebx, eax
je 0x4011c0
push 0x14
call esi
test al, 1
je 0x4011c0
movsx eax, byte [esp + 0x44]
add eax, 0x20
jmp 0x40122f
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyA]
push ebp
movzx ebp, byte [esp + 0x48]
push 2
push ebp
call edi
movsx eax, al
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00445cc0
pop ecx
pop ecx
test eax, eax
je 0x401211
push 0x10
call esi
test ebx, eax
je 0x401211
push 2
push ebp
call edi
movsx eax, al
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00445cc0
pop ecx
pop ecx
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
sub ecx, edx
mov al, byte [eax + ecx]
jmp 0x40122e
mov al, byte [esp + 0x48]
mov cl, al
sub cl, 0x41
cmp cl, 0x19
jbe 0x40122e
mov cl, al
sub cl, 0x30
cmp cl, 9
jbe 0x40122e
push 2
push ebp
call edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
pop edi
pop esi
xor ecx, esp
call fcn.004464bf
add esp, 0x34
ret

Function at 0x401241
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 4], 0
and dword [ebp - 8], 0
push 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
test eax, eax
jne 0x401264
mov eax, reloc.ODBC32.dll_SQLAllocConnect
lea ecx, [ebp - 4]
push ecx
push 1
push 0
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4012a2
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 8]
leave
ret
xor eax, eax
leave
ret
Function at 0x4012a6
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
xor esi, esi
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
mov eax, edi
cmp edi, esi
jne 0x4012c3
mov eax, reloc.ODBC32.dll_SQLAllocConnect
lea ecx, [ebp - 8]
push ecx
push 0xf003f
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x401312
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
mov dword [ebp - 4], eax
mov eax, edi
cmp edi, esi
jne 0x4012f3
mov eax, reloc.ODBC32.dll_SQLAllocConnect
lea ecx, [ebp - 4]
push ecx
lea ecx, [ebp - 8]
push ecx
push esi
push 0x2001f
push esi
push 0x4597fe
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov eax, dword [ebp + 0x14]
push 4
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push 4
push esi
push dword [ebp + 0x10]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret
Function at 0x4076a4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4076de
cmp edi, 0xffffffff
je 0x4076de
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
xor eax, eax
inc eax
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
leave
ret 8

Function at 0x4076e3
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp + 8], edi
je 0x407752
cmp dword [ebp + 8], 0xffffffff
je 0x407752
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push edi
push edi
push dword [ebp + 8]
mov byte [ebp + 0xf], bl
call esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
inc eax
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xf]
push eax
push dword [ebp + 8]
call edi
sar ebx, 8
push 2
mov byte [ebp + 0xf], bl
xor ebx, ebx
push ebx
push ebx
push dword [ebp + 8]
call esi
push ebx
xor eax, eax
inc eax
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xf]
push eax
push dword [ebp + 8]
call edi
pop esi
pop ebx
pop edi
leave
ret 8

Function at 0x40778d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4077c7
cmp edi, 0xffffffff
je 0x4077c7
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 8
pop eax
push 0
lea ecx, [ebp - 4]
push ecx
push eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
leave
ret 0xc

Function at 0x4077cc
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x40780b
cmp edi, 0xffffffff
je 0x40780b
push 2
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push 0
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop edi
leave
ret 8
Function at 0x40bf89
Capabilities:
Check if file exists
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x103
push esi
lea eax, [ebp - 0x107]
push 0
push eax
mov byte [ebp - 0x108], 0
call fcn.004464f0
add esp, 0xc
test edi, edi
je 0x40c11d
cmp byte [edi], 0
je 0x40c11d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
inc eax
cmp eax, esi
jle 0x40bfe3
mov eax, esi
jmp 0x40bfe7
push edi
call ebx
inc eax
push eax
push edi
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push 1
mov esi, str.__r_n
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0043fbb2
push 2
push esi
lea eax, [ebp - 0x108]
push eax
call fcn.0043fbb2
cmp byte [ebp - 0x108], 0x22
jne 0x40c03c
push 0
push 0
push 0x4597fe
push 0x45aca0
lea eax, [ebp - 0x108]
push eax
call fcn.0043fa75
push 0x140
lea eax, [ebp - 0x248]
push 0
push eax
call fcn.004464f0
add esp, 0xc
lea eax, [ebp - 0x248]
push eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40c0fb
mov edi, dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x108]
push 0x45befc
push eax
call fcn.00445d80
pop ecx
pop ecx
test eax, eax
jne 0x40c0a5
lea eax, [ebp - 0x108]
push 0x45af3c
push eax
call fcn.00445d80
pop ecx
pop ecx
test eax, eax
je 0x40c0ee
push 0x45b780
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x40c0d1
push 0x45bef8
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
jne 0x40c0ee
lea eax, [ebp - 0x248]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c0e9
push esi
call edi
or esi, 0xffffffff
cmp esi, 0xffffffff
jne 0x40c077
cmp esi, 0xffffffff
je 0x40c0fb
push esi
call edi
xor eax, eax
inc eax
jmp 0x40c11f
lea eax, [ebp - 0x108]
push eax
call ebx
cmp eax, 0x104
jge 0x40c11d
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40c0f6
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
leave
ret 4
Function at 0x40cc0a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x210], eax
cmp esi, ebx
je 0x40cc81
cmp edi, ebx
je 0x40cc81
cmp byte [edi], bl
je 0x40cc81
push str.MAIL
push edi
mov byte [esi], bl
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x40cc94
push str.HKEY_LOCAL_MACHINESOFTWAREClientsMail_
mov edi, 0x102
push edi
push esi
push ebx
push 3
call fcn.0044129f
add esp, 0x14
cmp byte [esi], bl
je 0x40cc81
push esi
push str.HKEY_LOCAL_MACHINESOFTWAREClientsMail_s_shellopencommand_
push edi
push esi
push ebx
push 3
call fcn.0044129f
add esp, 0x18
cmp byte [esi], bl
jne 0x40cce3
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
leave
ret 0xc
push edi
push str.HKEY_CLASSES_ROOT_s_
mov edi, 0x103
push edi
push esi
push ebx
push 3
call fcn.0044129f
add esp, 0x18
cmp byte [esi], bl
je 0x40cc81
push esi
push str.HKEY_CLASSES_ROOT_s_shellopencommand_
push edi
push esi
push ebx
push 3
call fcn.0044129f
add esp, 0x18
cmp byte [esi], bl
jne 0x40cce3
cmp dword [ebp - 0x210], ebx
je 0x40cc7d
push esi
push 0x45c2bc
push dword [ebp - 0x210]
call dword [sym.imp.SHELL32.dll_FindExecutableA]
jmp 0x40cc7d
push 0x207
lea eax, [ebp - 0x20b]
push ebx
push eax
mov byte [ebp - 0x20c], bl
call fcn.004464f0
add esp, 0xc
push 0x1f8
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
push ebx
push 0x4597fe
push 0x45aca0
push esi
call fcn.0043fa75
mov edi, 0x459858
push edi
push esi
call fcn.004010ff
pop ecx
pop ecx
test eax, eax
je 0x40cd4e
push edi
push esi
call fcn.004010ff
pop ecx
pop ecx
mov byte [eax], bl
push 2
push str.__r_n
push esi
call fcn.0043fbb2
xor eax, eax
inc eax
jmp 0x40cc83
Function at 0x40cd63
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4705d0]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
mov ebx, dword [ebp + 0x19c]
push esi
push edi
mov edi, dword [ebp + 0x1a0]
push 0x207
lea eax, [ebp - 0x77]
push 0
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], edi
mov byte [ebp - 0x78], 0
call fcn.004464f0
add esp, 0xc
test ebx, ebx
je 0x40cec3
cmp byte [ebx], 0
je 0x40cec3
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebx
call esi
mov ecx, eax
inc ecx
mov eax, 0x103
cmp ecx, eax
jg 0x40cdd4
push ebx
call esi
inc eax
push eax
push ebx
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x78]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40cdfd
test al, 0x10
je 0x40cdfd
xor eax, eax
inc eax
jmp 0x40cec5
test edi, edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
je 0x40ce71
mov eax, dword [ebp - 0x80]
cmp byte [eax], 0
je 0x40ce71
push eax
call esi
mov ecx, eax
inc ecx
mov eax, 0x102
cmp ecx, eax
jg 0x40ce24
push dword [ebp - 0x80]
call esi
inc eax
push eax
push dword [ebp - 0x80]
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [ebp - 0x78]
push eax
call esi
cmp byte [ebp + eax - 0x79], 0x5c
je 0x40ce52
mov eax, dword [ebp - 0x7c]
cmp byte [eax], 0x5c
je 0x40ce52
push 0x45a954
lea eax, [ebp - 0x78]
push eax
call edi
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call edi
lea eax, [ebp - 0x78]
push eax
mov byte [ebp + 0x8b], 0
call ebx
cmp eax, 0xffffffff
je 0x40ce71
test al, 0x10
jne 0x40cdf5
lea eax, [ebp - 0x78]
push eax
push 0x102
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea eax, [ebp - 0x78]
push eax
call esi
cmp byte [ebp + eax - 0x79], 0x5c
je 0x40cea0
mov eax, dword [ebp - 0x7c]
cmp byte [eax], 0x5c
je 0x40cea0
push 0x45a954
lea eax, [ebp - 0x78]
push eax
call edi
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push eax
call edi
lea eax, [ebp - 0x78]
push eax
mov byte [ebp + 0x8b], 0
call ebx
cmp eax, 0xffffffff
je 0x40cec3
test al, 0x10
jne 0x40cdf5
xor eax, eax
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004464bf
add ebp, 0x194
leave
ret 8