joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469e90
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x45c1e5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
push 0x14
mov ebp, ecx
call 0x49ab9f
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
test esi, esi
mov dword [esp + 0x1c], 0
je 0x469ef9
mov dword [esi], 0x45fcf8
call 0x49abcf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 4], eax
mov byte [esp + 0x1c], 1
call 0x49abcf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esi + 8], eax
jmp 0x469efb
xor esi, esi
mov edi, dword [esp + 0x24]
test edi, edi
mov dword [esp + 0x1c], 0xffffffff
lea ebx, [esi + 4]
jne 0x469f12
xor eax, eax
jmp 0x469f1b
push edi
call fcn.00486858
add esp, 4
push eax
push edi
mov ecx, ebx
call fcn.00466e00
mov edi, dword [esp + 0x28]
test edi, edi
lea ebx, [esi + 8]
jne 0x469f33
xor eax, eax
jmp 0x469f3c
push edi
call fcn.00486858
add esp, 4
push eax
push edi
mov ecx, ebx
call fcn.00466e00
mov ecx, dword [esp + 0x2c]
mov eax, dword [esp + 0x30]
mov dword [esi + 0x10], ecx
push esi
mov ecx, ebp
mov dword [esi + 0xc], eax
call fcn.004993f0
mov ecx, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 0x10
Function at 0x46f0f0
Capabilities:
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x45c568
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push esi
mov esi, dword [esp + 0x38]
mov eax, dword [esi]
lea ecx, [esp + 0xc]
push ecx
push 0
push 0x70
push 0
push esi
mov dword [esp + 0x20], 0
call dword [eax + 0x1c]
test eax, eax
je 0x46f131
push 0
call fcn.004878f2
lea edx, [esp + 0x18]
push edx
call dword [0x45f460]
push 0x460da8
lea ecx, [esp + 0x14]
mov dword [esp + 0x34], 0
call fcn.0046ed80
mov edx, dword [esp + 0x10]
mov eax, dword [esi]
push 0
push 0
lea ecx, [esp + 0x20]
push ecx
push 0
push edx
push esi
mov byte [esp + 0x48], 1
call dword [eax + 0x10]
test eax, eax
je 0x46f178
push 0
call fcn.004878f2
cmp word [esp + 0x18], 8
je 0x46f187
push 0
call fcn.004878f2
push ebx
push edi
mov dword [esp + 0x40], 0
call 0x49abcf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0xc], eax
mov byte [esp + 0x38], 2
call 0x49abcf
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0xc]
add eax, 0x10
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x28]
mov bl, 3
push eax
lea ecx, [esp + 0x10]
mov byte [esp + 0x3c], bl
call fcn.00466ec0
push 8
lea ecx, [esp + 0x20]
push ecx
lea ecx, [esp + 0x14]
call fcn.0046d230
push eax
lea ecx, [esp + 0x14]
mov byte [esp + 0x3c], 4
call fcn.00467ea0
mov eax, dword [esp + 0x1c]
add eax, 0xfffffff0
mov byte [esp + 0x38], bl
lea edx, [eax + 0xc]
or ecx, 0xffffffff
lock xadd dword [edx], ecx
dec ecx
test ecx, ecx
jg 0x46f211
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x40]
push eax
push 0x460da0
push edi
call fcn.00486ffe
mov eax, dword [esp + 0x4c]
cdq
mov ecx, 0xf4240
idiv ecx
mov esi, 0x2710
add esp, 0xc
mov ecx, edx
mov eax, ecx
cdq
idiv esi
mov dword [esp + 0x40], ecx
lea ebx, [eax + eax*8]
mov esi, edx
mov eax, ecx
cdq
mov ecx, 0x64
idiv ecx
lea eax, [edx + ebx*4]
lea ecx, [eax + eax*8]
mov eax, 0x51eb851f
imul esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, dword [esp + 0x14]
test eax, eax
lea esi, [edx + ecx*4]
je 0x46f27c
push eax
call dword [0x45f468]
lea eax, [edi - 0x10]
mov byte [esp + 0x38], 2
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
pop edi
pop ebx
jg 0x46f29d
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 4]
add eax, 0xfffffff0
mov byte [esp + 0x30], 1
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x46f2c0
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
call dword [edx + 4]
mov eax, dword [esp + 0x10]
push eax
call dword [0x45f45c]
lea ecx, [esp + 0x18]
push ecx
call dword [0x45f464]
mov ecx, dword [esp + 0x28]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x30
ret
Function at 0x472080
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x154
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [esp + 0x54], ecx
mov ecx, ebx
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x30], edi
mov dword [esp + 0x34], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
call fcn.00479380
mov esi, eax
test esi, esi
je 0x472236
lea eax, [esp + 0x60]
push eax
mov ecx, ebx
call fcn.00479670
cmp esi, 0x3231
jg 0x472138
je 0x472132
sub esi, 0x3130
je 0x472121
dec esi
je 0x472110
sub esi, 0xff
jne 0x472180
lea ecx, [esp + 0x38]
jmp 0x47216c
lea eax, [esp + 0x10]
push eax
push 0x461340
lea ecx, [esp + 0x68]
push ecx
jmp 0x472177
lea edx, [esp + 0x30]
push edx
push 0x461340
lea eax, [esp + 0x68]
push eax
jmp 0x472177
lea ecx, [esp + 0x18]
jmp 0x47216c
sub esi, 0x3430
je 0x472168
dec esi
je 0x472157
dec esi
jne 0x472180
lea eax, [esp + 0x20]
push eax
push 0x461340
lea ecx, [esp + 0x68]
push ecx
jmp 0x472177
lea edx, [esp + 0x28]
push edx
push 0x461340
lea eax, [esp + 0x68]
push eax
jmp 0x472177
lea ecx, [esp + 0x40]
push ecx
lea edx, [esp + 0x64]
push 0x461340
push edx
call fcn.00487c82
add esp, 0xc
inc edi
mov ecx, ebx
call fcn.00479380
mov esi, eax
test esi, esi
jne 0x4720e1
cmp edi, 7
jne 0x472236
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
push edx
push eax
call fcn.00467060
fstp qword [esp + 0x68]
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
call fcn.00497859
fstp qword [esp + 0x68]
mov edx, dword [esp + 0x7c]
fld qword [esp + 0x68]
mov eax, dword [esp + 0x78]
fmul qword [esp + 0x60]
mov ecx, dword [esp + 0x5c]
add esp, 0x20
push 0x3ff00000
push esi
push edx
mov edx, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push ecx
mov ecx, dword [esp + 0x44]
push edx
mov edx, dword [esp + 0x3c]
push eax
mov eax, dword [esp + 0x3c]
push ecx
mov ecx, dword [esp + 0x4c]
push edx
mov edx, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x74]
push ecx
mov ecx, dword [esp + 0x74]
push edx
sub esp, 8
fstp qword [esp]
push eax
push ecx
mov ecx, dword [esp + 0x94]
add ecx, 0x64
call fcn.00476ca0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x42f605
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x42f66f
push 6
call fcn.0043fb89
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x42f6e2
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x42f6d8
push 6
call fcn.0043fb89
add esp, 4
jmp 0x42f6ea
mov eax, dword [ebp - 4]
jmp 0x42f6ea
mov esp, ebp
pop ebp
ret 8

Function at 0x432b92
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x432bfc
push 6
call fcn.0043fb89
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x432c6f
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x432c65
push 6
call fcn.0043fb89
add esp, 4
jmp 0x432c77
mov eax, dword [ebp - 4]
jmp 0x432c77
mov esp, ebp
pop ebp
ret 8

Function at 0x435f65
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0x40
push dword [ebp - 4]
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x435fca
push 6
call fcn.0043fb89
add esp, 4
jmp 0x435fcf
mov esp, ebp
pop ebp
ret 4
Function at 0x43943f
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x4394a9
push 6
call fcn.0043fb89
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43951c
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x439512
push 6
call fcn.0043fb89
add esp, 4
jmp 0x439524
mov eax, dword [ebp - 4]
jmp 0x439524
mov esp, ebp
pop ebp
ret 8

Function at 0x43c9cc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x43ca36
push 6
call fcn.0043fb89
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x43caa9
push 0x80000301
push 0
push 0x2000
push 0x80000301
push 0
push 0x1000
push 2
mov ebx, 0xc8
call fcn.00441860
add esp, 0x1c
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
push 0x40
push dword [ebp - 8]
push dword [ebp + 0xc]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x43ca9f
push 6
call fcn.0043fb89
add esp, 4
jmp 0x43cab1
mov eax, dword [ebp - 4]
jmp 0x43cab1
mov esp, ebp
pop ebp
ret 8
Function at 0x4403f0
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x14
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov edi, eax
mov al, 0x20
mov cl, byte [edi]
inc edi
cmp cl, 0x22
jne 0x44040a
mov al, cl
mov dl, byte [edi]
inc edi
cmp dl, al
je 0x440418
mov cl, byte [edi]
inc edi
cmp cl, al
jne 0x440411
cmp al, 0x20
je 0x440422
cmp byte [edi], 0x20
jne 0x440422
inc edi
lea ecx, [esp + 0xc]
call fcn.00445c50
mov dword [esp + 0xc], 0x452344
mov al, byte [edi]
test al, al
je 0x4404e6
mov esi, dword [esp + 0x28]
cmp al, 0x22
jne 0x44048e
mov al, byte [edi + 1]
inc edi
test al, al
mov esi, edi
je 0x440469
mov al, byte [esi]
cmp al, 0x22
je 0x440469
test al, al
jge 0x440461
mov al, byte [esi + 1]
test al, al
je 0x440469
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x44044f
mov edx, esi
sub edx, edi
push edx
push edi
call fcn.004460e0
add esp, 8
lea ecx, [esp + 0xc]
push eax
call fcn.00445ee0
mov al, byte [esi]
mov edi, esi
test al, al
je 0x4404dc
lea edi, [esi + 1]
jmp 0x4404dc
cmp al, 0x20
jg 0x44049a
cmp byte [esi], 0
jl 0x44049a
inc edi
jmp 0x4404dc
test al, al
mov esi, edi
je 0x4404c2
mov al, byte [esi]
cmp al, 0x22
je 0x4404c2
cmp al, 0x20
jg 0x4404ae
test al, al
jge 0x4404c2
test al, al
jge 0x4404ba
mov al, byte [esi + 1]
test al, al
je 0x4404c2
inc esi
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x4404a0
mov eax, esi
sub eax, edi
push eax
push edi
call fcn.004460e0
add esp, 8
lea ecx, [esp + 0xc]
push eax
call fcn.00445ee0
mov edi, esi
mov al, byte [edi]
test al, al
jne 0x440441
mov ebx, dword [esp + 0x28]
mov eax, dword [ebx]
test eax, eax
je 0x4404f9
push eax
call fcn.00446080
add esp, 4
mov edi, dword [esp + 0x1c]
shr edi, 2
shl edi, 2
lea ecx, [edi + 8]
push ecx
call fcn.0043fee0
mov dword [eax], 1
mov edx, dword [esp + 0x20]
shr edx, 2
mov dword [eax + 4], edx
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x18]
add esp, 4
neg esi
sbb esi, esi
and esi, ecx
mov ecx, edi
mov edx, ecx
lea edi, [eax + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
mov dword [ebx], eax
mov dword [esp + 0xc], 0x452340
call fcn.00445e50
pop edi
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x440750
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00446120
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x4408a0
test ecx, ecx
je 0x4408a0
inc ecx
push ecx
call fcn.004489d7
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004489b0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x4407c9
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x44088d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.004489d7
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x440851
cmp eax, 0xea
jne 0x440879
push esi
call fcn.00448768
mov ecx, dword [esp + 0x18]
push ecx
call fcn.004489d7
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x44081c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x44085f
cmp eax, 2
jne 0x440879
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.004460e0
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.00448768
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.00448768
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x4408ce
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x4408da
mov edx, dword [esp + 0x40]
test edx, edx
je 0x4408da
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.004460e0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x4408f0
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.00446120
mov esi, dword [esp + 0x28]
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ebp, ebp
je 0x4409c1
test ecx, ecx
je 0x4409c1
inc ecx
push ebx
push ecx
call fcn.004489d7
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.004489b0
mov esi, eax
add esp, 0xc
test esi, esi
je 0x440963
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x44099d
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4409b0
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call fcn.00448768
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, edx
pop ebp
pop ecx
ret
Function at 0x4409f0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
mov ebp, dword [esp + 0x15c]
push esi
push edi
mov esi, dword [ebp]
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x440a7b
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x440a7b
test esi, esi
je 0x440a35
cmp esi, 0xffffffff
je 0x440a35
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp], esi
je 0x440ac1
mov eax, dword [esp + 0x160]
test eax, eax
je 0x440a64
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
je 0x440a7b
jmp 0x440a73
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x14]
test edx, eax
je 0x440a7b
mov dword [esp + 0x10], 1
test esi, esi
je 0x440ac1
cmp esi, 0xffffffff
je 0x440ac1
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x440af8
mov eax, dword [esp + 0x160]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x14]
push eax
push esi
je 0x440ace
call edi
test eax, eax
je 0x440ac1
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
jne 0x440af8
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x440aa9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
call edi
test eax, eax
je 0x440ac1
mov ebx, dword [esp + 0x15c]
test dword [esp + 0x14], ebx
jne 0x440af8
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x440adb
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.0043fee0
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
Function at 0x440dc0
Capabilities:
Delete directory

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x440dcd
xor eax, eax
pop esi
ret
push edi
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
jne 0x440ddf
pop esi
ret
cmp ecx, 1
jne 0x440ded
cmp byte [esi], 0x5c
jne 0x440ded
xor eax, eax
pop esi
ret
push esi
call fcn.00440b70
add esp, 4
test eax, eax
je 0x440e01
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop esi
ret

Function at 0x4410c0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x441129
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0043fee0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x441130
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x4411c2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x4411b4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x4411ac
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x441175
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x4413d0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x441820
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x44183e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x441833
pop esi
ret
Function at 0x441ab0
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.004489d7
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x441b1a
push esi
lea edi, [eax + 0x400]
call fcn.00448768
push edi
call fcn.004489d7
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x441aea
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x441b36
push ecx
push esi
call fcn.004460e0
add esp, 8
mov ebx, eax
push esi
call fcn.00448768
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret