joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ebe0
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x5030e5
push edi
mov edi, dword [esp + 0x14]
call fcn.004b99c5
mov eax, dword [esi]
test eax, eax
je 0x42ec4f
mov eax, dword [eax]
cmp eax, 0xffffffff
je 0x42ec4f
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42ec2a
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x42ec4f
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00448da0
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00448da0
add esp, 8
ret 4

Function at 0x432db0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0xc
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
mov ebp, ecx
mov dword [esp + 0xc], eax
push edi
mov edi, dword [esp + 0x20]
mov ecx, 0x5030e5
call fcn.004b99c5
mov esi, dword [esp + 0x24]
xor ebx, ebx
cmp dword [ebp + 0x10], 0xffffffff
je 0x432e32
mov ecx, 0x100000
nop dword [eax + eax]
cmp esi, 0x100000
mov dword [esp + 0x14], 0
push 0
mov eax, esi
cmova eax, ecx
lea ecx, [esp + 0x18]
push ecx
push eax
push edi
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov ecx, dword [esp + 0x14]
add ebx, ecx
test eax, eax
je 0x432e32
test ecx, ecx
je 0x432e2e
add edi, ecx
sub esi, ecx
mov ecx, 0x100000
jne 0x432df0
xor eax, eax
jmp 0x432e37
mov eax, 1
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x432e41
mov dword [ecx], ebx
mov ecx, dword [esp + 0x18]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00448da0
add esp, 0xc
ret 0xc
Function at 0x434c20
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6818
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x5030e5
call fcn.004b99c5
cmp dword [edi + 0x14], 8
mov eax, edi
jb 0x434c60
mov eax, dword [edi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x434cf7
lea eax, [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov dword [ebp - 4], 4
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.004351b0
test al, al
je 0x434cd4
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
mov dword [ebp - 4], 5
lea ecx, [ebp - 0x28]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448da0
mov esp, ebp
pop ebp
ret
Function at 0x434d20
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c68d0
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov ecx, 0x5030e5
call fcn.004b99c5
cmp dword [edi + 0x14], 8
mov ecx, edi
jb 0x434d63
mov ecx, dword [edi]
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x434d6d
mov eax, dword [esi]
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
push 0
push ecx
push eax
call ebx
test eax, eax
je 0x434d84
mov al, 1
jmp 0x434e8e
lea eax, [ebp - 0x40]
mov byte [ebp - 0x41], 0
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 4], 3
xor eax, eax
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x2c], 7
mov word [ebp - 0x40], ax
mov dword [ebp - 4], 4
lea edx, [ebp - 0x40]
mov ecx, esi
call fcn.004351b0
movzx ecx, byte [ebp - 0x41]
test al, al
mov edx, 1
lea eax, [ebp - 0x28]
cmovne ecx, edx
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x4c], eax
mov byte [ebp - 4], 5
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 8
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 9
lea edx, [ebp - 0x28]
mov ecx, edi
call fcn.004351b0
test al, al
jne 0x434e2d
cmp byte [ebp - 0x48], al
je 0x434e51
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call ebx
test eax, eax
je 0x434e51
mov bl, 1
jmp 0x434e53
xor bl, bl
mov byte [ebp - 4], 0x12
lea ecx, [ebp - 0x28]
call fcn.004048c0
mov byte [ebp - 4], 4
lea eax, [ebp - 0x28]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0x16
lea ecx, [ebp - 0x40]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 4], 0xffffffff
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448da0
mov esp, ebp
pop ebp
ret
Function at 0x4356e0
Capabilities:
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c6bee
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push esi
mov eax, dword [0x4fe280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov ecx, 0x5030d3
call fcn.004b99c5
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [ebp - 4], 3
xor eax, eax
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], 4
lea eax, [esi + 0x18]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 5
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
mov byte [ebp - 4], 8
xor ecx, ecx
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 9
lea eax, [esi + 0x30]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0xa
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], ecx
mov byte [ebp - 4], 0xd
mov dword [eax + 0x10], ecx
mov dword [eax + 0x14], 7
mov word [eax], cx
mov byte [ebp - 4], 0xe
mov dword [esi + 0x48], ecx
mov dword [esi + 0x4c], ecx
mov dword [esi + 0x50], ecx
mov dword [esi + 0x54], ecx
mov dword [esi + 0x58], ecx
mov dword [esi + 0x5c], ecx
mov dword [esi + 0x60], ecx
mov byte [esi + 0x64], cl
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x4372d0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c7288
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ecx, 0x5030e5
mov edi, dword [ebp + 0xc]
call fcn.004b99c5
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.00437a10
mov dword [ebp - 4], 0
xorps xmm0, xmm0
movlpd qword [ebp - 0x18], xmm0
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov byte [ebp - 4], 2
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x18]
call fcn.00420d10
xorps xmm0, xmm0
movlpd qword [ebp - 0x3c], xmm0
mov byte [ebp - 4], 3
lea eax, [ebp - 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x18]
mov byte [ebp - 0x38], 0
test eax, eax
jne 0x437366
xor bl, bl
jmp 0x437384
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x43737e
cmp eax, 0x80
je 0x43737e
xor bl, bl
jmp 0x437384
mov byte [ebp - 0x14], 1
mov bl, 1
mov byte [ebp - 0x38], bl
mov byte [ebp - 4], 4
lea eax, [ebp - 0x31]
push eax
push edi
push esi
mov byte [ebp - 0x31], 0
call fcn.00437440
test al, al
jne 0x4373b2
cmp byte [ebp - 0x31], al
je 0x4373b2
cmp dword [esi + 0x14], 8
jb 0x4373ab
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 5
test bl, bl
je 0x4373cc
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4373c8
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov byte [ebp - 0x14], 0
mov dword [ebp - 0x3c], 0
mov byte [ebp - 4], 6
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4373ec
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x18], 0
mov word [ebp - 0x14], 0
mov dword [ebp - 4], 7
lea ecx, [ebp - 0x30]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448da0
mov esp, ebp
pop ebp
ret 8
Function at 0x43b9d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x118
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 0x114], eax
push esi
mov esi, ecx
mov ecx, 0x5030e5
call fcn.004b99c5
push 0x110
lea eax, [esp + 0xc]
mov dword [esi + 4], 0
push 0
push eax
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov byte [esi], 0
mov dword [esp + 0x10], 0x114
call fcn.0044ba00
add esp, 0xc
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
mov eax, esi
je 0x43ba71
cmp dword [esp + 8], 6
jb 0x43ba71
mov byte [esi], 1
mov ecx, dword [esp + 0x118]
pop esi
xor ecx, esp
call fcn.00448da0
add esp, 0x118
ret

Function at 0x43bad0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c81d0
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
push ebx
push esi
push edi
mov eax, dword [0x4fe280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, 0x5030e5
call fcn.004b99c5
push str.wintrust.dll
lea ecx, [ebp - 0x2c]
call fcn.00404530
mov dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
call fcn.004305e0
mov ecx, eax
call fcn.004306d0
mov ebx, eax
mov dword [ebp - 4], 1
lea ecx, [ebp - 0x2c]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
push str.crypt32.dll
call fcn.00404530
mov dword [ebp - 4], 5
lea eax, [ebp - 0x44]
push eax
call fcn.004305e0
mov ecx, eax
call fcn.004306d0
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 6
lea ecx, [ebp - 0x44]
call fcn.004048c0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], 0xffffffff
test ebx, ebx
je 0x43bc17
test esi, esi
je 0x43bc17
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CryptCATAdminCalcHashFromFileHandle
push ebx
call esi
push str.CryptCATAdminAcquireContext
push ebx
mov dword [edi + 4], eax
call esi
push str.CryptCATAdminEnumCatalogFromHash
push ebx
mov dword [edi + 8], eax
call esi
push str.CryptCATCatalogInfoFromContext
push ebx
mov dword [edi + 0xc], eax
call esi
push str.CryptCATAdminReleaseCatalogContext
push ebx
mov dword [edi + 0x10], eax
call esi
push str.CryptCATAdminReleaseContext
push ebx
mov dword [edi + 0x14], eax
call esi
push str.WTHelperProvDataFromStateData
push ebx
mov dword [edi + 0x18], eax
call esi
push str.WTHelperGetProvSignerFromChain
push ebx
mov dword [edi + 0x1c], eax
call esi
push str.WinVerifyTrust
push ebx
mov dword [edi + 0x20], eax
call esi
push str.CertNameToStrW
push dword [ebp - 0x10]
mov dword [edi + 0x24], eax
call esi
mov dword [edi + 0x28], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43d350
Capabilities:
Get file size

Disassembly:
sub esp, 8
mov eax, dword [0x4fe280]
xor eax, esp
mov dword [esp + 4], eax
push esi
mov esi, ecx
mov ecx, 0x5030e5
push edi
mov edi, dword [esp + 0x14]
call fcn.004b99c5
mov eax, dword [esi]
cmp eax, 0xffffffff
je 0x43d3c1
lea ecx, [esp + 8]
mov dword [esp + 8], 0
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43d39c
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43d3c1
mov eax, dword [esp + 8]
xor ecx, ecx
add ecx, esi
mov dword [edi], ecx
adc eax, 0
mov dword [edi + 4], eax
mov al, 1
pop edi
pop esi
mov ecx, dword [esp + 4]
xor ecx, esp
call fcn.00448da0
add esp, 8
ret 4
mov ecx, dword [esp + 0xc]
xor al, al
pop edi
pop esi
xor ecx, esp
call fcn.00448da0
add esp, 8
ret 4
Function at 0x43db20
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4c8498
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4fe280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov ecx, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x24], ecx
mov ecx, 0x5030e5
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], ebx
call fcn.004b99c5
mov eax, dword [ebp - 0x24]
test eax, eax
je 0x43db76
mov dword [eax], 0
mov dword [ebx], 0
cmp dword [edi], 0xffffffff
je 0x43dccb
mov eax, dword [ebp + 0xc]
mov ecx, 0x100000
nop dword [eax]
push 0
mov ebx, eax
mov dword [ebp - 0x1c], 0
cmp eax, 0x100000
lea eax, [ebp - 0x1c]
push eax
cmova ebx, ecx
push ebx
push esi
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
cmp dword [edi + 0x1c], 0
je 0x43dc96
test eax, eax
je 0x43dc96
mov edx, dword [ebp - 0x1c]
cmp edx, ebx
jae 0x43dc99
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [edi]
mov dword [ebp - 0x28], eax
cmp ecx, 0xffffffff
je 0x43dc1b
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x43dc0f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x43dc1b
mov eax, dword [ebp - 0x14]
xor ecx, ecx
add ecx, esi
adc eax, 0
jmp 0x43dc29
xorps xmm0, xmm0
movlpd qword [ebp - 0x38], xmm0
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
push 0
push dword [ebp - 0x28]
push eax
push ecx
sub esp, 0x18
lea eax, [edi + 4]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.00408570
mov dword [ebp - 4], 0
mov ecx, dword [edi + 0x1c]
mov eax, dword [ecx]
mov dword [ebp - 4], 0xffffffff
call dword [eax + 0x18]
mov esi, dword [ebp - 0x20]
test eax, eax
jne 0x43dc96
push eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x1c]
push ebx
add eax, esi
push eax
push dword [edi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, eax
xor edx, edx
test ecx, ecx
mov eax, 0x80004005
cmovne eax, edx
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
test ecx, ecx
je 0x43dbd4
jmp 0x43dc99
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x2c]
add dword [ecx], edx
test eax, eax
jne 0x43dcc2
test edx, edx
je 0x43dcbe
mov eax, dword [ebp + 0xc]
add esi, edx
sub eax, edx
mov dword [ebp - 0x20], esi
mov dword [ebp + 0xc], eax
mov ecx, 0x100000
jne 0x43db90
mov al, 1
jmp 0x43dccd
mov ecx, dword [ebp - 0x24]
test ecx, ecx
je 0x43dccb
mov dword [ecx], eax
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00448da0
mov esp, ebp
pop ebp
ret 0x10
Function at 0x401000
Capabilities:
Copy file

Disassembly:
sub esp, 0x410
mov eax, dword [esp + 0x414]
push ebx
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x10d]
mov byte [esp + 0x10c], bl
push 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x110]
push ecx
push ebx
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push ebx
lea edx, [esp + 0x10]
push ebx
lea eax, [esp + 0x10]
push edx
lea ecx, [esp + 0x118]
push eax
push ecx
mov byte [esp + 0x1c], bl
mov word [esp + 0x1d], bx
call fcn.00401241
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x225]
mov byte [esp + 0x224], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x406038
lea edx, [esp + 0x24]
push str.GdiPlus
lea eax, [esp + 0x24]
push edx
lea ecx, [esp + 0x230]
push eax
push ecx
call fcn.004011b0
lea edx, [esp + 0x34]
push 0x5c
push edx
call fcn.00401150
add esp, 0x30
cmp eax, ebx
je 0x4010ce
mov byte [eax], bl
lea eax, [esp + 0xc]
push 0x5c
push eax
call fcn.00401150
add esp, 8
cmp eax, ebx
je 0x4010e3
mov byte [eax], bl
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x315]
mov byte [esp + 0x314], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0x406038
lea ecx, [esp + 0x10]
stosb byte es:[edi], al
push str.GdiPlus
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x320]
push edx
push eax
call fcn.004011b0
add esp, 0x14
lea ecx, [esp + 0x210]
lea edx, [esp + 0x314]
push ebx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
pop edi
xor eax, eax
pop ebx
add esp, 0x410
ret 0x10
Function at 0x41c520
Capabilities:
Write file on windows

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x418
cmp dword [0x428b04], edx
push ebx
push esi
push edi
push ebp
jbe 0x41c727
mov eax, edx
and eax, 0xffffffe7
sar eax, 3
add eax, 0x428b10
mov dword [esp + 0x18], eax
mov eax, edx
and eax, 0x1f
mov ecx, dword [esp + 0x18]
shl eax, 3
mov ebx, dword [ecx]
mov ebp, eax
mov dword [esp + 0x1c], eax
mov al, byte [ebx + ebp + 4]
test al, 1
je 0x41c727
xor esi, esi
mov ebp, dword [esp + 0x434]
mov dword [esp + 0x20], esi
cmp ebp, esi
jne 0x41c589
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
test al, 0x20
je 0x41c59a
push 2
push 0
push edx
call fcn.0041c9c0
add esp, 0xc
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
add ecx, dword [eax]
test byte [ecx + 4], 0x80
je 0x41c636
mov dword [esp + 0x10], 0
mov edi, dword [esp + 0x430]
mov eax, edi
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x41c66f
lea ebx, [esp + 0x24]
mov eax, edi
sub eax, dword [esp + 0x430]
cmp eax, ebp
jae 0x41c5fd
mov al, byte [edi]
inc edi
cmp al, 0xa
jne 0x41c5eb
mov byte [ebx], 0xd
inc esi
inc ebx
mov byte [ebx], al
inc ebx
mov eax, ebx
lea ecx, [esp + 0x24]
sub eax, ecx
cmp eax, 0x400
jl 0x41c5d2
lea eax, [esp + 0x24]
push 0
sub ebx, eax
lea ecx, [esp + 0x28]
lea eax, [esp + 0x18]
mov edx, dword [esp + 0x1c]
push eax
push ebx
push ecx
mov eax, dword [edx]
mov ecx, dword [esp + 0x2c]
mov edx, dword [eax + ecx]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41c665
mov eax, dword [esp + 0x14]
add dword [esp + 0x20], eax
cmp eax, ebx
jge 0x41c5bd
jmp 0x41c66f
lea eax, [esp + 0x14]
push 0
mov edx, dword [esp + 0x434]
push eax
push ebp
mov ecx, dword [ecx]
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x41c665
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0x14]
mov dword [esp + 0x20], eax
jmp 0x41c66f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x10], eax
cmp dword [esp + 0x20], 0
jne 0x41c716
cmp dword [esp + 0x10], 0
je 0x41c6c8
cmp dword [esp + 0x10], 5
jne 0x41c6ab
mov dword [0x426c80], 9
mov eax, dword [esp + 0x10]
pop ebp
pop edi
mov dword [0x426c84], eax
mov eax, 0xffffffff
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x10]
push eax
call fcn.0041c950
add esp, 4
mov eax, 0xffffffff
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x1c]
mov edx, dword [eax]
test byte [edx + ecx + 4], 0x40
je 0x41c6f2
mov eax, dword [esp + 0x430]
cmp byte [eax], 0x1a
jne 0x41c6f2
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x426c80], 0x1c
mov dword [0x426c84], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, dword [esp + 0x20]
pop ebp
sub eax, esi
pop edi
pop esi
pop ebx
add esp, 0x418
ret
mov eax, 0xffffffff
pop ebp
mov dword [0x426c80], 9
mov dword [0x426c84], 0
pop edi
pop esi
pop ebx
add esp, 0x418
ret
Function at 0x41d550
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4be5cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.004b04e7
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x41d5d2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.004ad5fc
mov eax, dword [eax]
push 0x60a264
push eax
call fcn.0048d334
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.004b0772
test bl, bl
je 0x41d5d2
push 0x60a264
lea ecx, [esp + 0xc]
call fcn.004b0b4e
push 0x60dddc
lea ecx, [esp + 0xc]
call fcn.004b0b4e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x41d60e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.004b0772
jmp 0x41d6d9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x41d692
lea edx, [esp + 0x7c]
push 0x60ddd8
push edx
call fcn.0048d334
add esp, 8
test eax, eax
je 0x41d692
lea eax, [esp + 0x7c]
push 0x60ddd4
push eax
call fcn.0048d334
add esp, 8
test eax, eax
je 0x41d692
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41d622
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.004b0772
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x41ded0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x41df32
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc