joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cbc34
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4cbc3c
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cbddd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027c4
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004049e0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x4cbdf4
call fcn.00404af4
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43b7ac]
call fcn.0043b85c
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x4181d0]
call fcn.00403984
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cbdb3
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x4cbe08
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cbd95
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov edx, dword [0x4bd920]
mov eax, 8
call fcn.004056ec
mov esi, eax
mov eax, esi
mov edx, 0x4cbe08
call fcn.0040483c
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 4]
call fcn.0040483c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov edx, esi
call fcn.0041a4d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x22c]
call fcn.0044fc3c
mov esi, eax
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.0044f6dc
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4cbe08
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 8]
mov edx, 0x4cbe18
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x14]
jne 0x4cbcde
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbdba
mov eax, dword [ebp - 0xc]
call fcn.004039b4
mov eax, dword [ebp - 0x10]
call fcn.004039b4
ret
Function at 0x4cbe20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4cbe28
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cbfc9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, 0xff
call fcn.004027c4
mov ebx, eax
push 0xff
push ebx
call sub.kernel32.dll_GetWindowsDirectoryA
lea eax, [ebp - 0x18]
mov edx, ebx
call fcn.004049e0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
mov ecx, 0x4cbfe0
call fcn.00404af4
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x43b7ac]
call fcn.0043b85c
mov dword [ebp - 0xc], eax
mov dl, 1
mov eax, dword [0x4181d0]
call fcn.00403984
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x4cbf9f
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, 0x4cbff4
mov eax, dword [ebp - 0xc]
mov ebx, dword [eax]
call dword [ebx + 0x40]
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4cbf81
inc eax
mov dword [ebp - 0x14], eax
xor ebx, ebx
mov edx, dword [0x4bd920]
mov eax, 8
call fcn.004056ec
mov esi, eax
mov eax, esi
mov edx, 0x4cbff4
call fcn.0040483c
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
lea eax, [esi + 4]
call fcn.0040483c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov edx, esi
call fcn.0041a4d8
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x2fc]
mov eax, dword [eax + 0x22c]
call fcn.0044fc3c
mov esi, eax
lea ecx, [ebp - 0x20]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x20]
mov eax, esi
call fcn.0044f6dc
push 0
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov ecx, dword [ebp - 0x28]
mov edx, 0x4cbff4
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi]
mov edx, dword [ebp - 0x24]
mov eax, dword [esi + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
mov eax, dword [esi + 8]
mov edx, 0x4cc000
mov ecx, dword [eax]
call dword [ecx + 0x38]
inc ebx
dec dword [ebp - 0x14]
jne 0x4cbeca
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4cbfa6
mov eax, dword [ebp - 0xc]
call fcn.004039b4
mov eax, dword [ebp - 0x10]
call fcn.004039b4
ret
Function at 0x4ceb50
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
xor edx, edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4cee20
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43c6f8]
call fcn.0043c7f8
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x4ced53
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 8]
call fcn.0043c898
xor ecx, ecx
mov edx, 0x4cee34
mov eax, dword [ebp - 8]
call fcn.0043c900
test al, al
je 0x4cec42
lea edx, [ebp - 0x158]
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.0048a2a0
mov eax, dword [ebp - 0x158]
lea edx, [ebp - 0x154]
call fcn.0040991c
mov edx, dword [ebp - 0x154]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.0043ce7c
lea edx, [ebp - 0x15c]
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.0048a2a0
mov edx, dword [ebp - 0x15c]
mov eax, dword [ebp - 0xc]
call fcn.00404bf4
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x31c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
mov eax, dword [ebp - 8]
call fcn.0043c868
mov edx, 0x80000001
mov eax, dword [ebp - 8]
call fcn.0043c898
xor ecx, ecx
mov edx, 0x4cee6c
mov eax, dword [ebp - 8]
call fcn.0043c900
test al, al
je 0x4ced35
lea ecx, [ebp - 0xc]
mov edx, 0x4cee8c
mov eax, dword [ebp - 8]
call fcn.0043ce7c
mov eax, dword [ebp - 0xc]
mov edx, 0x4ceea4
call fcn.00404bf4
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x328]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0xc]
mov edx, 0x4ceeb0
mov eax, dword [ebp - 8]
call fcn.0043ce7c
mov eax, dword [ebp - 0xc]
mov edx, 0x4ceea4
call fcn.00404bf4
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x32c]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0xc]
mov edx, 0x4ceec4
mov eax, dword [ebp - 8]
call fcn.0043ce7c
mov eax, dword [ebp - 0xc]
mov edx, 0x4ceea4
call fcn.00404bf4
sete dl
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x340]
mov ecx, dword [eax]
call dword [ecx + 0xcc]
lea ecx, [ebp - 0x10]
mov edx, 0x4ceed8
mov eax, dword [ebp - 8]
call fcn.0043ce7c
lea edx, [ebp - 0x160]
mov eax, dword [ebp - 0x10]
call fcn.00408d68
cmp dword [ebp - 0x160], 0
jne 0x4ced35
lea eax, [ebp - 0x10]
mov edx, 0x4ceee8
call fcn.00404880
mov eax, dword [ebp - 8]
call fcn.0043c868
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4ced5a
mov eax, dword [ebp - 8]
call fcn.004039b4
ret
Function at 0x4d3258
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
mov esi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
push ebp
push 0x4d32eb
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x300
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
mov eax, dword [ebp - 4]
call fcn.00404ca8
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [ebx + 0x2f8]
call fcn.00476fe0
mov edx, dword [ebp - 0x164]
call fcn.0042f1c8
mov eax, dword [ebp - 0x164]
push eax
call sub.user32.dll_DestroyIcon
mov eax, esi
lea edx, [ebp - 0x158]
mov ecx, 0x104
call fcn.00404a58
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d32f2
lea eax, [ebp - 4]
call fcn.004047e8
ret
Function at 0x4d5128
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
xor edx, edx
mov dword [ebp - 0x104], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d5198
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x100]
push eax
push 0xff
call sub.kernel32.dll_GetTempPathA
push ebx
lea edx, [ebp - 0x104]
lea eax, [ebp - 0x100]
call fcn.00409cec
mov eax, dword [ebp - 0x104]
mov ecx, 3
xor edx, edx
call fcn.00404d08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d519f
lea eax, [ebp - 0x104]
call fcn.004047e8
ret

Function at 0x4d51a4
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d5328
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x4181d0]
call fcn.00403984
mov dword [ebp - 0x10], eax
mov dl, 1
mov eax, dword [0x43c6f8]
call fcn.0043c7f8
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4d52f9
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043c898
xor ecx, ecx
mov edx, 0x4d5340
mov eax, dword [ebp - 4]
call fcn.0043c900
test al, al
je 0x4d5225
lea ecx, [ebp - 8]
mov edx, 0x4d5374
mov eax, dword [ebp - 4]
call fcn.0043ce7c
mov eax, dword [ebp - 4]
call fcn.0043c868
xor ecx, ecx
mov edx, 0x4d5388
mov eax, dword [ebp - 4]
call fcn.0043c900
test al, al
je 0x4d52db
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043d08c
test al, al
je 0x4d525b
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043cb9c
jmp 0x4d52db
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0043ccec
mov eax, dword [ebp - 0x10]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4d52db
inc esi
xor ebx, ebx
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0043ce2c
dec eax
sub al, 2
jae 0x4d52d7
lea ecx, [ebp - 0x18]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x18]
lea ecx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.0043ce7c
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00404dec
test eax, eax
jle 0x4d52d7
lea ecx, [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x10]
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0043cb9c
inc ebx
dec esi
jne 0x4d5278
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5300
mov eax, dword [ebp - 4]
call fcn.004039b4
mov eax, dword [ebp - 0x10]
call fcn.004039b4
ret
Function at 0x4d53b8
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4d53c0
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x4d5534
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x43c6f8]
call fcn.0043c7f8
mov dword [ebp - 4], eax
mov dl, 1
mov eax, dword [0x4181d0]
call fcn.00403984
mov esi, eax
xor eax, eax
push ebp
push 0x4d550a
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x80000002
mov eax, dword [ebp - 4]
call fcn.0043c898
mov cl, 1
mov edx, 0x4d554c
mov eax, dword [ebp - 4]
call fcn.0043c900
test al, al
je 0x4d54f4
mov edx, esi
mov eax, dword [ebp - 4]
call fcn.0043ccec
mov eax, esi
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x4d54f4
inc eax
mov dword [ebp - 0xc], eax
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0043ce2c
dec eax
sub al, 2
jae 0x4d54ea
lea ecx, [ebp - 0x14]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.0043ce7c
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.00408c58
mov eax, dword [ebp - 0x18]
push eax
lea edx, [ebp - 0x1c]
mov eax, 0x4d5584
call fcn.00408c58
mov eax, dword [ebp - 0x1c]
pop edx
call fcn.00404dec
test eax, eax
jg 0x4d54d3
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00408c58
mov eax, dword [ebp - 0x20]
push eax
lea edx, [ebp - 0x24]
mov eax, 0x4d5598
call fcn.00408c58
mov eax, dword [ebp - 0x24]
pop edx
call fcn.00404dec
test eax, eax
jle 0x4d54ea
lea ecx, [ebp - 0x28]
mov edx, ebx
mov eax, esi
mov edi, dword [eax]
call dword [edi + 0xc]
mov edx, dword [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.0043cb9c
inc ebx
dec dword [ebp - 0xc]
jne 0x4d5447
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d5511
mov eax, dword [ebp - 4]
call fcn.004039b4
ret
Function at 0x4d9a08
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x4d9a10
push ebx
mov ebx, edx
xor eax, eax
push ebp
push 0x4d9aed
push dword fs:[eax]
mov dword fs:[eax], esp
call fcn.0040af28
add esp, 0xfffffff8
fstp qword [esp]
wait
lea edx, [ebp - 4]
mov eax, 0x4d9b04
call fcn.0040bc2c
lea edx, [ebp - 0x14]
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.0048a2a0
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 0x10]
call fcn.00409800
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0x4d9b1c
call fcn.00404af4
mov eax, dword [ebp - 8]
call fcn.00409650
test al, al
jne 0x4d9a7f
mov eax, dword [ebp - 8]
call fcn.00409ae4
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
mov eax, dword [ebp - 4]
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x1c], 0xb
lea edx, [ebp - 0x28]
mov ecx, 1
mov eax, 0x4d9b30
call fcn.0040a1dc
mov edx, dword [ebp - 0x18]
mov eax, ebx
call fcn.0040483c
mov ecx, dword [ebx]
lea eax, [ebp - 0xc]
mov edx, 0x4d9b4c
call fcn.00404af4
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404ca8
push eax
call sub.kernel32.dll_WinExec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9af4
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.0040480c
ret
Function at 0x4d9b58
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4d9cc4
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x300]
mov eax, dword [eax + 0x22c]
call fcn.0044fd8c
lea edx, [ebp - 0x14c]
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.0048a2a0
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00409800
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 4]
mov ecx, 0x4d9cdc
call fcn.00404af4
mov eax, dword [ebp - 4]
call fcn.00404ca8
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
lea eax, [ebp - 0x144]
push eax
push 0x4d9ce8
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4d9c98
mov eax, dword [edi + 0x300]
mov eax, dword [eax + 0x22c]
call fcn.0044fc3c
mov ebx, eax
lea eax, [ebp - 0x140]
call fcn.004be2b4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x150]
call fcn.0040bc18
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.0044f6dc
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404a58
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00404af4
mov edx, dword [ebp - 0x154]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4d9c08
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d9ccb
lea eax, [ebp - 0x158]
mov edx, 5
call fcn.0040480c
lea eax, [ebp - 4]
call fcn.004047e8
ret
Function at 0x4da3d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
call fcn.00404c98
xor eax, eax
push ebp
push 0x4da5b0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
mov eax, dword [ebp + 0xc]
call fcn.00404ca8
push eax
mov eax, dword [ebp + 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4da57e
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x18]
push eax
push 0
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x130]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
mov dword [ebp - 0x10], 0x3e8
cmp dword [ebp - 0x18], 0
jne 0x4da47f
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp - 4]
call fcn.004da0e0
mov ebx, dword [ebp - 0x18]
dec ebx
test ebx, ebx
jl 0x4da57e
inc ebx
xor esi, esi
mov eax, dword [0x4fc898]
cmp byte [eax], 1
je 0x4da57e
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x230]
push eax
push esi
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegEnumKeyExA
cmp dword [ebp + 0xc], 0
jne 0x4da4ea
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 6
lea edx, [ebp - 0x238]
xor ecx, ecx
mov eax, 0x4da5c8
call fcn.0040a1dc
jmp 0x4da531
push dword [ebp + 0xc]
push 0x4da5d4
lea eax, [ebp - 0x23c]
push eax
lea eax, [ebp - 0x230]
mov dword [ebp - 0x238], eax
mov byte [ebp - 0x234], 6
lea edx, [ebp - 0x238]
xor ecx, ecx
mov eax, 0x4da5c8
call fcn.0040a1dc
push dword [ebp - 0x23c]
lea eax, [ebp - 0x30]
mov edx, 3
call fcn.00404b68
mov edx, dword [ebp - 0x30]
mov eax, edi
call fcn.00469d04
mov eax, dword [ebp - 0x30]
mov edx, 0x4da5e0
call fcn.00404bf4
je 0x4da563
mov eax, dword [ebp + 0x10]
push eax
mov eax, dword [ebp - 0x30]
push eax
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
mov edx, edi
mov eax, dword [ebp - 4]
call fcn.004da3d0
mov dword [ebp - 0x10], 0x3e8
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.00489ae4
inc esi
dec ebx
jne 0x4da48e
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4da5b7
lea eax, [ebp - 0x23c]
call fcn.004047e8
lea eax, [ebp - 0x30]
call fcn.004047e8
lea eax, [ebp + 0xc]
call fcn.004047e8
ret
Function at 0x4dc01c
Capabilities:
Enumerate files on windows
Set current directory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffea8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x148], edx
mov dword [ebp - 0x14c], edx
mov dword [ebp - 4], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4dc188
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [edi + 0x32c]
mov eax, dword [eax + 0x22c]
call fcn.0044fd8c
lea edx, [ebp - 0x14c]
mov eax, dword [0x4fcbc4]
mov eax, dword [eax]
call fcn.0048a2a0
mov eax, dword [ebp - 0x14c]
lea edx, [ebp - 0x148]
call fcn.00409800
mov edx, dword [ebp - 0x148]
lea eax, [ebp - 4]
mov ecx, 0x4dc1a0
call fcn.00404af4
mov eax, dword [ebp - 4]
call fcn.00404ca8
push eax
call sub.kernel32.dll_SetCurrentDirectoryA_1
lea eax, [ebp - 0x144]
push eax
push 0x4dc1ac
call sub.kernel32.dll_FindFirstFileA_1
mov esi, eax
cmp esi, 0xffffffff
je 0x4dc15c
mov eax, dword [edi + 0x32c]
mov eax, dword [eax + 0x22c]
call fcn.0044fc3c
mov ebx, eax
lea eax, [ebp - 0x140]
call fcn.004be2b4
add esp, 0xfffffff8
fstp qword [esp]
wait
lea eax, [ebp - 0x150]
call fcn.0040bc18
mov edx, dword [ebp - 0x150]
mov eax, ebx
call fcn.0044f6dc
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x118]
mov ecx, 0x104
call fcn.00404a58
mov ecx, dword [ebp - 0x158]
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 4]
call fcn.00404af4
mov edx, dword [ebp - 0x154]
mov eax, dword [ebx + 8]
mov ecx, dword [eax]
call dword [ecx + 0x38]
lea eax, [ebp - 0x144]
push eax
push esi
call sub.kernel32.dll_FindNextFileA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
jne 0x4dc0cc
push esi
call sub.kernel32.dll_FindClose_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc18f
lea eax, [ebp - 0x158]
mov edx, 5
call fcn.0040480c
lea eax, [ebp - 4]
call fcn.004047e8
ret

Function at 0x4dc6b8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4dc739
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x104
lea eax, [ebp - 0x109]
push eax
call sub.kernel32.dll_GetSystemDirectoryA
lea edx, [ebp - 4]
lea eax, [ebp - 0x109]
call fcn.00409cec
lea eax, [ebp - 4]
push eax
mov ecx, 3
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404d08
lea eax, [ebp - 4]
mov edx, 0x4dc750
call fcn.00404ab0
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.0040483c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4dc740
lea eax, [ebp - 4]
call fcn.004047e8
ret