joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ec17
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x18], ecx
xor edi, edi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
mov eax, edx
mov dword [ebp - 0x10], eax
test ecx, ecx
jne 0x41ec49
mov ecx, 0x80070057
mov ebx, ecx
call fcn.00427566
jmp 0x41edfc
test eax, eax
je 0x41ec38
lea edx, [ebp - 0xc]
mov ecx, eax
call fcn.00426bf6
mov ebx, eax
test ebx, ebx
jns 0x41ec61
mov ecx, ebx
jmp 0x41ec3f
cmp dword [ebp - 0xc], esi
jne 0x41ec9b
mov eax, dword [0x479b84]
test eax, eax
je 0x41ec74
cmp eax, 0xffffffff
jne 0x41ec76
xor eax, eax
mov ebx, dword [ebp - 0x10]
push ebx
push 0x409c38
push dword [0x47c110]
push eax
call fcn.0041704b
add esp, 0x10
mov ecx, ebx
call fcn.004269bd
mov ebx, eax
test ebx, ebx
js 0x41ec5d
xor eax, eax
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 8]
push 0x40a8b0
push eax
call fcn.00416afb
mov ebx, eax
add esp, 0xc
test ebx, ebx
js 0x41edf2
mov edi, dword [ebp - 8]
lea eax, [ebp - 4]
mov ecx, dword [ebp - 0x10]
mov edx, edi
push eax
push 0
call fcn.004268f1
mov ebx, eax
test ebx, ebx
js 0x41ede6
mov esi, dword [ebp - 4]
lea edx, [ebp - 0xc]
mov ecx, esi
call fcn.00426bf6
mov ebx, eax
test ebx, ebx
js 0x41ec5d
cmp dword [ebp - 0xc], 0
mov eax, dword [0x479b84]
je 0x41ed4f
test eax, eax
je 0x41ed04
cmp eax, 0xffffffff
jne 0x41ed06
xor eax, eax
push esi
push 0x409ca0
push dword [0x47c110]
push eax
call fcn.0041704b
add esp, 0x10
test esi, esi
je 0x41ed2b
mov ecx, esi
call fcn.00427347
xor esi, esi
mov dword [ebp - 4], esi
test edi, edi
je 0x41ed3b
mov ecx, edi
call fcn.00427347
xor edi, edi
mov dword [ebp - 8], edi
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x2710
jb 0x41eca0
jmp 0x41ed6f
test eax, eax
je 0x41ed58
cmp eax, 0xffffffff
jne 0x41ed5a
xor eax, eax
push esi
push 0x409cf0
push dword [0x47c110]
push eax
call fcn.0041704b
add esp, 0x10
mov eax, dword [0x479b84]
test esi, esi
jne 0x41eda1
test eax, eax
je 0x41ed81
cmp eax, 0xffffffff
jne 0x41ed83
xor eax, eax
push 0x409d40
push dword [0x47c110]
push eax
call fcn.0041704b
add esp, 0xc
mov ebx, 0x80070003
jmp 0x41ec5d
test eax, eax
je 0x41edaa
cmp eax, 0xffffffff
jne 0x41edac
xor eax, eax
push esi
push dword [ebp - 0x18]
push 0x409d88
push dword [0x47c110]
push eax
call fcn.0041704b
add esp, 0x14
push esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x41edfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov ebx, eax
jmp 0x41ec5d
mov ecx, ebx
call fcn.00427566
mov esi, dword [ebp - 4]
jmp 0x41edfc
mov ecx, ebx
call fcn.00427566
mov edi, dword [ebp - 8]
mov ecx, ebx
call fcn.0042757e
test edi, edi
je 0x41ee0e
mov ecx, edi
call fcn.00427347
test esi, esi
je 0x41ee19
mov ecx, esi
call fcn.00427347
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8
Function at 0x423f69
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x58
push esi
push edi
xor edi, edi
push edi
push 0x40cdec
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], edi
mov dword [esp + 0x1c], edi
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, 0x47c0f4
call fcn.00416b2b
mov eax, dword [0x479b84]
test eax, eax
je 0x423fbc
cmp eax, 0xffffffff
jne 0x423fbe
mov eax, edi
push 0x40ce0c
push dword [0x47c110]
push eax
call fcn.0041704b
add esp, 0xc
mov edx, 0x47c110
mov ecx, 0x479b84
call fcn.004178d7
call fcn.00422e3c
mov esi, eax
test esi, esi
js 0x42402a
push 0x54
lea eax, [esp + 0xc]
push edi
push eax
call sub.msvcrt.dll_memset
mov ecx, dword [ebp + 0x10]
lea edx, [esp + 0x14]
add esp, 0xc
call fcn.00422ee0
mov esi, eax
test esi, esi
js 0x42402a
cmp dword [esp + 0x40], edi
je 0x42401b
mov esi, 0xc190010a
jmp 0x42402a
lea ecx, [esp + 8]
call fcn.00420e28
mov esi, eax
test esi, esi
jns 0x42405b
mov ecx, esi
call fcn.00427566
mov eax, dword [0x479b84]
test eax, eax
je 0x42403f
cmp eax, 0xffffffff
jne 0x424041
mov eax, edi
push esi
push 0x40ce28
push 0x406d68
push dword [0x47c110]
push eax
call fcn.0041704b
add esp, 0x14
mov ecx, esi
call fcn.0042757e
lea ecx, [esp + 8]
call fcn.00424075
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x425436
Capabilities:
Check os version

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x13c
mov eax, dword [0x479b74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x130], edx
push 0x118
lea eax, [ebp - 0x124]
mov dword [ebp - 0x134], ecx
push edi
push eax
or ebx, 0xffffffff
mov dword [ebp - 0x12c], edi
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x128], 0x11c
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.ntdll.dll_RtlGetVersion]
test eax, eax
je 0x4254bb
lea edx, [ebp - 0x12c]
mov ecx, eax
call fcn.00427484
mov edi, dword [ebp - 0x12c]
test eax, eax
jne 0x4254bb
mov ecx, edi
call fcn.00427566
mov esi, dword [ebp - 0x138]
jmp 0x4254d6
cmp dword [ebp - 0x124], 6
ja 0x4254d3
jne 0x4254cf
cmp dword [ebp - 0x120], 2
jae 0x4254d3
xor esi, esi
jmp 0x4254d6
xor esi, esi
inc esi
mov ecx, edi
call fcn.0042757e
test edi, edi
jns 0x4254ea
mov ecx, edi
call fcn.00427566
jmp 0x42555e
test esi, esi
je 0x4254f3
push dword [ebp + 0xc]
jmp 0x425546
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x425545
cmp esi, ebx
je 0x425545
test esi, esi
je 0x42555e
mov edx, 0x927c0
mov ecx, edx
cmp esi, edx
jae 0x42550f
mov ecx, esi
push ecx
push 0
push dword [ebp - 0x130]
lea eax, [esi - 0x927c0]
sbb esi, esi
push dword [ebp - 0x134]
not esi
and esi, eax
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
cmp ebx, 0x102
jne 0x42555c
mov edx, 0x927c0
test esi, esi
jne 0x425507
jmp 0x42555e
push esi
push 0
push dword [ebp - 0x130]
push dword [ebp - 0x134]
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov ebx, eax
xor edi, edi
mov ecx, edi
call fcn.0042757e
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004729c0
leave
ret 8
Function at 0x425ac4
Capabilities:
Get disk information

Disassembly:
push 0x240
mov eax, 0x47609c
call fcn.00472eab
mov ecx, edx
mov dword [ebp - 0x248], ecx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x24c], eax
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x23c], ebx
mov dword [ebp - 0x238], ebx
mov dword [ebp - 0x234], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x230], ebx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x228], ebx
mov edi, ebx
mov dword [ebp - 0x220], edi
mov byte [ebp - 4], 2
mov esi, ebx
test ecx, ecx
jne 0x425b36
mov ecx, 0x80070057
mov esi, ecx
call fcn.00427566
jmp 0x425cbf
test eax, eax
je 0x425b25
push 0x208
lea eax, [ebp - 0x21c]
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x21c]
push eax
push 0x103
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
test eax, eax
jne 0x425b78
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov esi, eax
mov ecx, esi
jmp 0x425b2c
cmp word [ebp - 0x21c], si
lea ebx, [ebp - 0x21c]
jmp 0x425c8d
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 3
je 0x425b9f
cmp eax, 2
jne 0x425c6a
test edi, edi
je 0x425bb2
mov ecx, edi
call fcn.00427347
xor eax, eax
mov dword [ebp - 0x220], eax
lea eax, [ebp - 0x220]
mov edx, 0x40a5a8
push eax
xor eax, eax
mov ecx, ebx
push eax
call fcn.004268f1
mov esi, eax
test esi, esi
js 0x425d09
mov edi, dword [ebp - 0x220]
lea edx, [ebp - 0x240]
mov ecx, edi
call fcn.00426bf6
mov esi, eax
test esi, esi
js 0x425d18
cmp dword [ebp - 0x240], 0
je 0x425c6a
xor eax, eax
xor edx, edx
push eax
push eax
mov ecx, edi
mov ebx, eax
call fcn.0042ce7c
test eax, eax
jne 0x425c20
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test ebx, ebx
jle 0x425c20
movzx ebx, bx
or ebx, 0x80070000
lea eax, [ebp - 0x220]
push eax
push dword [ebp - 0x238]
lea ecx, [ebp - 0x23c]
call fcn.00428fa1
mov esi, eax
test esi, esi
js 0x425d09
push ebx
push dword [ebp - 0x22c]
lea ecx, [ebp - 0x230]
call fcn.00429248
mov esi, eax
test esi, esi
js 0x425d09
mov edi, dword [ebp - 0x220]
mov ebx, dword [ebp - 0x224]
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x244]
jne 0x425c6f
sub ecx, edx
xor eax, eax
sar ecx, 1
lea ebx, [ebx + ecx*2]
add ebx, 2
cmp word [ebx], ax
mov dword [ebp - 0x224], ebx
jne 0x425b8a
mov ecx, dword [ebp - 0x248]
lea eax, [ebp - 0x23c]
push eax
call fcn.004272bf
mov ecx, dword [ebp - 0x24c]
lea eax, [ebp - 0x230]
push eax
call fcn.004272bf
xor ebx, ebx
mov ecx, esi
call fcn.0042757e
test edi, edi
je 0x425cd1
mov ecx, edi
call fcn.00427347
push ebx
lea ecx, [ebp - 0x230]
call fcn.004292d0
lea ecx, [ebp - 0x228]
call fcn.0041702b
push ebx
lea ecx, [ebp - 0x23c]
call fcn.00429588
lea ecx, [ebp - 0x234]
call fcn.0041702b
mov eax, esi
call fcn.00472e69
ret 4
mov ecx, esi
call fcn.00427566
mov edi, dword [ebp - 0x220]
jmp 0x425cbd
mov ecx, esi
call fcn.00427566
jmp 0x425cbd
Function at 0x4262ac
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
mov eax, edx
mov dword [ebp - 4], esi
xor edi, edi
mov dword [ebp - 8], eax
test ebx, ebx
jne 0x4262da
mov ecx, 0x80070057
mov ebx, ecx
call fcn.00427566
jmp 0x426367
test eax, eax
je 0x4262c9
xor ecx, ecx
call fcn.0042757e
xor ecx, ecx
call fcn.0042757e
push 0x820
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x42630f
mov ebx, 0x8007000e
mov ecx, ebx
jmp 0x4262d0
push 0x820
push 0
push edi
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x410
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
jne 0x426341
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov ebx, eax
jmp 0x42630b
lea edx, [ebp - 4]
mov ecx, edi
call fcn.0042743a
mov ebx, eax
test ebx, ebx
jns 0x42635d
mov ecx, ebx
call fcn.00427566
mov esi, dword [ebp - 4]
jmp 0x426367
mov ecx, dword [ebp - 8]
xor esi, esi
mov eax, dword [ebp - 4]
mov dword [ecx], eax
mov ecx, ebx
call fcn.0042757e
test edi, edi
je 0x426382
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
test esi, esi
je 0x42638d
mov ecx, esi
call fcn.00427347
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret
Function at 0x426845
Capabilities:
Get token membership

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x479b74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
mov word [ebp - 8], 0x500
mov esi, edx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
push edi
mov edi, ecx
test esi, esi
jne 0x42687e
mov ebx, 0x80070057
mov ecx, ebx
call fcn.00427566
jmp 0x4268ca
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
jne 0x4268b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov ebx, eax
jmp 0x426875
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x10]
push edi
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
je 0x4268a2
mov eax, dword [ebp - 0x14]
mov dword [esi], eax
mov ecx, ebx
call fcn.0042757e
cmp dword [ebp - 0x10], 0
je 0x4268e0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004729c0
leave
ret
Function at 0x4269bd
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x479b74]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x63c]
mov edx, 0x104
push eax
mov edi, ecx
call fcn.0041681e
mov esi, eax
test esi, esi
js 0x426b97
push edi
mov edx, 0x105
lea ecx, [ebp - 0x218]
call fcn.0041668b
mov esi, eax
test esi, esi
js 0x426b97
mov edi, dword [ebp - 0x63c]
mov ecx, 0x80070216
lea eax, [edi - 1]
cmp eax, edi
ja 0x426a25
mov edi, eax
xor esi, esi
jmp 0x426a2c
mov esi, ecx
call fcn.00427566
mov ecx, esi
call fcn.0042757e
test esi, esi
js 0x426b97
add edi, edi
push 0x5c
pop ecx
cmp word [ebp + edi - 0x218], cx
jne 0x426a60
cmp edi, 0x20a
jae 0x426bbf
xor eax, eax
mov word [ebp + edi - 0x218], ax
xor eax, eax
lea edi, [ebp - 0x218]
and dword [ebp - 0x63c], eax
mov word [ebp - 0x428], ax
cmp word [ebp - 0x218], cx
jne 0x426a84
lea edi, [ebp - 0x216]
push ecx
push edi
call dword [sym.imp.msvcrt.dll_wcschr]
pop ecx
mov ebx, eax
mov edx, 0x105
pop ecx
lea ecx, [ebp - 0x638]
test ebx, ebx
jne 0x426abb
push edi
call fcn.0041668b
mov esi, eax
test esi, esi
js 0x426b97
mov dword [ebp - 0x63c], 1
jmp 0x426afd
mov eax, ebx
sub eax, edi
sar eax, 1
push eax
push edi
mov dword [ebp - 0x640], eax
call fcn.004166c4
mov esi, eax
test esi, esi
js 0x426b97
cmp ebx, edi
jb 0x426bb6
mov eax, dword [ebp - 0x640]
add eax, eax
cmp eax, 0x20a
jae 0x426bbf
xor ecx, ecx
mov word [ebp + eax - 0x638], cx
lea eax, [ebp - 0x638]
mov edx, 0x105
push eax
lea ecx, [ebp - 0x428]
call fcn.0041670b
mov esi, eax
test esi, esi
js 0x426b97
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426b30
test al, 0x10
jne 0x426b55
push 0
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x426b88
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426b88
test ebx, ebx
je 0x426b77
push 0x406bf4
mov edx, 0x105
lea ecx, [ebp - 0x428]
lea edi, [ebx + 2]
call fcn.0041670b
mov esi, eax
test esi, esi
js 0x426b97
cmp dword [ebp - 0x63c], 0
jne 0x426b9e
push 0x5c
pop ecx
jmp 0x426a84
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov esi, eax
mov ecx, esi
call fcn.00427566
mov ecx, esi
call fcn.0042757e
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004729c0
leave
ret
mov ecx, 0x80070216
mov esi, ecx
jmp 0x426b99
call fcn.00472bce
int3

Function at 0x426bc5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426be0
shr eax, 4
not eax
and eax, 1
jmp 0x426be2
xor eax, eax
mov dword [esi], eax
xor ecx, ecx
call fcn.0042757e
xor ecx, ecx
call fcn.0042757e
xor eax, eax
pop esi
ret
Function at 0x426bf6
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push esi
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x426c0f
shr eax, 4
and eax, 1
jmp 0x426c11
xor eax, eax
mov dword [esi], eax
xor ecx, ecx
call fcn.0042757e
xor ecx, ecx
call fcn.0042757e
xor eax, eax
pop esi
ret

Function at 0x427afe
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14c
mov eax, dword [0x479b74]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x144], 0xffffffff
mov eax, edx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0x14c], eax
test ecx, ecx
jne 0x427b37
mov ecx, 0x80070057
mov edi, ecx
jmp 0x427c8d
test eax, eax
je 0x427b2b
push edi
push 0x80
push 3
push edi
xor ebx, ebx
inc ebx
push ebx
push SysReAllocString
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
lea ecx, [ebp - 0x144]
call fcn.004169d2
mov esi, dword [ebp - 0x144]
test esi, esi
je 0x427c7c
cmp esi, 0xffffffff
je 0x427c7c
push 0x40
lea eax, [ebp - 0x48]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x148]
push edi
push eax
push 0x40
lea eax, [ebp - 0x48]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x427c7c
mov eax, 0x5a4d
cmp ax, word [ebp - 0x48]
je 0x427bb8
mov edi, 0x8007000d
jmp 0x427c8b
mov eax, dword [ebp - 0xc]
push edi
push edi
cdq
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x427c7c
push 0xf8
lea eax, [ebp - 0x140]
push edi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x148]
push edi
push eax
push 0xf8
lea eax, [ebp - 0x140]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x427c7c
movzx eax, word [ebp - 0x13c]
mov ecx, 0x1f0
cmp eax, ecx
ja 0x427c40
je 0x427c3c
sub eax, 0x14c
je 0x427c38
sub eax, 0x16
je 0x427c72
sub eax, 4
je 0x427c72
sub eax, 0x1e
je 0x427c34
sub eax, 0x40
jne 0x427c5c
push 5
jmp 0x427c71
push 2
jmp 0x427c71
mov ebx, edi
jmp 0x427c72
push 3
jmp 0x427c71
cmp eax, 0x200
je 0x427c6f
cmp eax, 0x284
je 0x427c6b
cmp eax, 0x8664
je 0x427c67
cmp eax, 0xaa64
je 0x427c63
mov ebx, 0xffff
jmp 0x427c72
push 0xc
jmp 0x427c71
push 9
jmp 0x427c71
push 7
jmp 0x427c71
push 6
pop ebx
mov eax, dword [ebp - 0x14c]
mov dword [eax], ebx
jmp 0x427c92
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov edi, eax
mov ecx, edi
call fcn.00427566
mov ecx, edi
call fcn.0042757e
lea ecx, [ebp - 0x144]
call fcn.00416f58
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004729c0
leave
ret
Function at 0x427cb5
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push ebx
push esi
push eax
push ecx
xor esi, esi
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 8], esi
call fcn.00429d7c
mov ebx, eax
mov dword [ebp - 0x10], ebx
test ebx, ebx
js 0x427d7a
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x40acc0
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea edx, [ebp - 0x10]
mov ecx, eax
call fcn.00427535
test eax, eax
je 0x427d77
test esi, esi
jne 0x427d47
cmp dword [ebp - 4], ebx
jbe 0x427d40
push dword [ebp - 4]
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
push eax
lea ecx, [ebp - 8]
call fcn.0042776b
mov esi, dword [ebp - 8]
test esi, esi
jne 0x427ce9
mov ebx, 0x8007000e
jmp 0x427d7a
mov ebx, 0x8000ffff
jmp 0x427d7a
cmp dword [ebp - 0x14], 2
je 0x427d54
mov ebx, 0x8007000d
jmp 0x427d7a
mov edx, dword [ebp - 4]
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 0xc]
mov ecx, esi
call fcn.00416ee1
mov ebx, eax
test ebx, ebx
js 0x427d7a
cmp dword [ebp - 0x10], 0
je 0x427d81
and dword [ebp - 8], 0
jmp 0x427d81
mov ebx, dword [ebp - 0x10]
mov ecx, ebx
call fcn.00427566
mov ecx, ebx
call fcn.0042757e
lea ecx, [ebp - 8]
call fcn.0041702b
cmp dword [ebp - 0xc], 0
je 0x427d9f
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x427e33
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 2
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
call fcn.00429bf7
mov edi, eax
test edi, edi
js 0x427e8b
xor ecx, ecx
call fcn.0042757e
push dword [ebp + 0x10]
mov dword [ebp - 8], ebx
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00427535
mov edi, dword [ebp - 8]
test eax, eax
jne 0x427e92
mov ecx, edi
call fcn.00427566
mov ecx, edi
call fcn.0042757e
lea ecx, [ebp - 0xc]
call fcn.0041702b
cmp dword [ebp - 4], ebx
je 0x427eaf
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 0xc
Function at 0x427fa8
Capabilities:
Delete registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push edi
push eax
push 2
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
call fcn.00429bf7
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
js 0x427fea
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00427535
mov edi, dword [ebp - 8]
test eax, eax
jne 0x427ff1
mov ecx, edi
call fcn.00427566
mov ecx, edi
call fcn.0042757e
cmp dword [ebp - 4], 0
je 0x428007
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
leave
ret 4

Function at 0x4280b5
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
lea eax, [ebp - 4]
xor ebx, ebx
push eax
push 2
mov edx, 0x406d9c
mov dword [ebp - 4], ebx
mov ecx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0xc], ebx
call fcn.00429bf7
mov edi, eax
test edi, edi
js 0x428113
xor ecx, ecx
call fcn.0042757e
push dword [ebp + 0x10]
lea eax, [ebp + 0xc]
mov dword [ebp - 8], ebx
push eax
push 4
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea edx, [ebp - 8]
mov ecx, eax
call fcn.00427535
mov edi, dword [ebp - 8]
test eax, eax
jne 0x42811a
mov ecx, edi
call fcn.00427566
mov ecx, edi
call fcn.0042757e
lea ecx, [ebp - 0xc]
call fcn.0041702b
cmp dword [ebp - 4], ebx
je 0x428137
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop ebx
leave
ret 0xc
Function at 0x428e2c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
test ecx, ecx
jne 0x428e40
mov esi, 0x80070057
jmp 0x428e7e
push ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x428e69
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov esi, eax
mov ecx, esi
call fcn.00427566
mov ebx, dword [ebp - 4]
mov ecx, esi
call fcn.0042757e
test esi, esi
js 0x428e7e
test bl, 0x10
jne 0x428e85
mov esi, 0x8007007b
mov ecx, esi
call fcn.00427566
mov ecx, esi
call fcn.0042757e
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x428e92
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
xor esi, esi
mov dword [ebp - 0xc], esi
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
test edx, edx
jne 0x428ec2
mov ebx, 0x80070057
mov ecx, ebx
call fcn.00427566
mov edi, esi
jmp 0x428f6d
push edx
lea eax, [ebp - 0xc]
push 0x409538
push eax
call fcn.00416afb
mov ebx, eax
add esp, 0xc
test ebx, ebx
js 0x428eb4
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
push esi
push esi
push dword [ebp + 0xc]
mov eax, dword [eax + 0x2c]
shr eax, 8
and eax, 1
push eax
push esi
push esi
push dword [ebp - 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x428f12
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov ebx, eax
jmp 0x428eb4
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x428f3f
mov ebx, 0x80004005
cmp eax, 0x102
jne 0x428f36
mov ebx, 0x800705b4
mov ecx, ebx
call fcn.00427566
jmp 0x428f6d
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x428f61
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, eax
call fcn.0042754e
mov ebx, eax
jmp 0x428f36
mov ecx, dword [ebp + 0x18]
test ecx, ecx
je 0x428f6d
mov eax, dword [ebp - 0x10]
mov dword [ecx], eax
mov ecx, ebx
call fcn.0042757e
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x428f82
mov ecx, eax
call fcn.00427347
test edi, edi
je 0x428f8d
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x428f98
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 0x14