joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ef2c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40efe8
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040ed94
lea eax, [ebp - 0x1c]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x14]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40efd2
xor eax, eax
push ebp
push 0x40efcb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40efd2
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40efef
lea eax, [ebp - 0x14]
call fcn.00403498
ret

Function at 0x40f424
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffbdc
xor ecx, ecx
mov dword [ebp - 0x424], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40f564
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.0040ed94
mov eax, dword [ebp - 8]
call fcn.0040a35c
xor eax, eax
push ebp
push 0x40f53c
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x40]
lea eax, [ebp - 0x14]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0xc]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40f526
xor eax, eax
push ebp
push 0x40f51f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x20], 0x400
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x420]
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegEnumKeyExA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x40f502
lea eax, [ebp - 0x424]
lea edx, [ebp - 0x420]
call fcn.0040364c
mov edx, dword [ebp - 0x424]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
call dword [ecx + 0x34]
inc dword [ebp - 0x18]
cmp dword [ebp - 0x1c], 0
je 0x40f4b0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f526
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f543
mov eax, dword [ebp - 8]
call fcn.0040a418
ret
Function at 0x40f570
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40f627
push dword fs:[eax]
mov dword fs:[eax], esp
lea ecx, [ebp - 0x14]
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.0040ed94
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCreateKeyA
test eax, eax
jne 0x40f60d
xor eax, eax
push ebp
push 0x40f606
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
sete byte [ebp - 0xd]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f611
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov byte [ebp - 0xd], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40f62e
lea eax, [ebp - 0x14]
call fcn.00403498
ret

Function at 0x40fa24
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40faad
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 0
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040ed94
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0x10]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40fa97
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteValueA
test eax, eax
sete byte [ebp - 9]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fab4
lea eax, [ebp - 0x10]
call fcn.00403498
ret
Function at 0x40fabc
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
xor ecx, ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x10], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40fc33
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 6], 0
mov dl, 1
mov eax, dword [0x409aa4]
call fcn.00402b48
mov dword [ebp - 0x1c], eax
xor eax, eax
push ebp
push 0x40fc04
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [ebp - 5], 0
je 0x40fb67
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.0040f424
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
test eax, eax
jl 0x40fb67
inc eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], 0
lea edx, [ebp - 0x28]
mov eax, dword [ebp - 4]
call fcn.00412fbc
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov edx, dword [ebp - 0x2c]
pop eax
call fcn.004036f8
mov eax, dword [ebp - 0x28]
mov dl, 1
call fcn.0040fabc
inc dword [ebp - 0x20]
dec dword [ebp - 0x24]
jne 0x40fb2f
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00413118
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.00406b38
lea edx, [ebp - 0x2c]
mov eax, dword [ebp - 0xc]
call fcn.00406b04
mov eax, dword [ebp - 0x2c]
lea edx, [ebp - 0x28]
call fcn.00413118
mov edx, dword [ebp - 0x28]
lea eax, [ebp - 0xc]
call fcn.00403530
lea ecx, [ebp - 0xc]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 0xc]
call fcn.0040ed94
lea eax, [ebp - 0x18]
push eax
push 0x20006
push 0
mov eax, dword [ebp - 0xc]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40fbee
mov eax, dword [ebp - 0x10]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete byte [ebp - 6]
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fc0b
mov eax, dword [ebp - 0x1c]
call fcn.00402b70
ret
Function at 0x40fc44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40fcff
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040ed94
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40fce9
xor eax, eax
push ebp
push 0x40fce2
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40fccb
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fce9
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fd06
lea eax, [ebp - 0x10]
call fcn.00403498
ret

Function at 0x40fd10
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x40fdcb
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea ecx, [ebp - 0x10]
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 4]
call fcn.0040ed94
lea eax, [ebp - 0x18]
push eax
push 0x20019
push 0
mov eax, dword [ebp - 0x10]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x40fdb5
xor eax, eax
push ebp
push 0x40fdae
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1c]
push eax
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x40fd97
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fdb5
mov eax, dword [ebp - 0x18]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40fdd2
lea eax, [ebp - 0x10]
call fcn.00403498
ret
Function at 0x4116b4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x41191e
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0xd], 0
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp + 0x14]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
call fcn.004102f8
call fcn.00405310
mov byte [eax + 0x5d], 0
call fcn.00405310
mov dl, byte [ebp + 8]
mov byte [eax + 0x5c], dl
call fcn.00405310
add eax, 0xc
mov edx, dword [ebp - 8]
call fcn.004034ec
xor eax, eax
push ebp
push 0x4118ba
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
mov edx, 0x104
call fcn.004039c4
mov eax, dword [ebp - 4]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
call fcn.004038b4
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0xc]
call fcn.004038b4
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], 0x411574
xor eax, eax
mov dword [ebp - 0x24], eax
xor eax, eax
mov dword [ebp - 0x20], eax
call fcn.00405310
add eax, 0x54
mov edx, dword [ebp + 0xc]
mov edx, dword [edx]
call fcn.004034ec
cmp dword [0x41a348], 0
je 0x41179c
call fcn.00405310
mov edx, dword [0x41a348]
mov dword [eax + 0x60], edx
jmp 0x4117d4
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_IsWindow
test eax, eax
je 0x4117c7
push 0
push 0
push 0x31
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_SendMessageA
mov ebx, eax
call fcn.00405310
mov dword [eax + 0x60], ebx
jmp 0x4117d4
call fcn.00405310
xor edx, edx
mov dword [eax + 0x60], edx
lea eax, [ebp - 0x3c]
push eax
call sub.shell32.dll_SHBrowseForFolderA
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41185f
xor eax, eax
push ebp
push 0x411858
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp + 0x11], 0x10
jne 0x411820
lea eax, [ebp - 0x18]
mov edx, 0x104
call fcn.004039c4
mov eax, dword [ebp - 0x18]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0x1c]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
call fcn.00408930
jmp 0x41182b
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x34]
call fcn.0040364c
mov eax, dword [ebp - 0x18]
call fcn.004038b4
mov edx, eax
mov eax, dword [ebp + 0xc]
call fcn.0040364c
mov byte [ebp - 0xd], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x41185f
mov eax, dword [ebp - 0x1c]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4118c1
call fcn.00405310
cmp dword [eax + 0x58], 0
je 0x41188b
call fcn.00405310
mov eax, dword [eax + 0x58]
push eax
call sub.user32.dll_UnhookWindowsHookEx
call fcn.00405310
cmp dword [eax + 0x1c], 0
je 0x4118aa
call fcn.00405310
mov eax, dword [eax + 0x1c]
push eax
call sub.user32.dll_DestroyWindow
cmp dword [ebp - 0x38], 0
je 0x4118b9
mov eax, dword [ebp - 0x38]
push eax
call sub.ole32.dll_CoTaskMemFree
ret
Function at 0x411d2c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403498
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, eax
jne 0x411d9d
mov eax, dword [ebp - 8]
mov edx, 0x104
call fcn.004039c4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004038b4
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
test eax, eax
je 0x411d93
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004038b4
call fcn.00406c28
mov edx, eax
mov eax, dword [ebp - 8]
call fcn.004039c4
jmp 0x411d9d
mov eax, dword [ebp - 8]
xor edx, edx
call fcn.004039c4
mov esp, ebp
pop ebp
ret

Function at 0x411ef8
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov eax, dword [0x41a5bc]
cmp dword [eax], 2
jne 0x411f65
test byte [ebp - 4], 0xb
je 0x411f65
lea eax, [ebp - 0xc]
push eax
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x411f65
lea eax, [ebp - 0x18]
push eax
push 0x411f80
push 0
call sub.advapi32.dll_LookupPrivilegeValueA
test eax, eax
je 0x411f65
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x10], 2
push 0
push 0
push 0
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_AdjustTokenPrivileges
test eax, eax
je 0x411f79
push 0
mov eax, dword [ebp - 4]
push eax
call sub.user32.dll_ExitWindowsEx
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
mov esp, ebp
pop ebp
ret

Function at 0x411fb8
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov byte [ebp - 9], 0
mov eax, dword [ebp - 8]
mov byte [eax], 0
mov edx, 0x20
mov eax, dword [ebp - 4]
call fcn.00406760
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4120a1
xor eax, eax
push ebp
push 0x41209a
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 9], 1
lea edx, [ebp - 0x54]
mov ecx, 0x40
mov eax, dword [ebp - 0x10]
call fcn.004067c4
cmp eax, 0x40
je 0x412019
call fcn.00403050
jmp 0x4120a1
cmp word [ebp - 0x54], 0x5a4d
jne 0x412027
cmp dword [ebp - 0x18], 0
jne 0x41202e
call fcn.00403050
jmp 0x4120a1
mov eax, dword [ebp - 4]
call fcn.00413068
cmp eax, dword [ebp - 0x18]
jg 0x412042
call fcn.00403050
jmp 0x4120a1
xor ecx, ecx
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
call fcn.0040681c
inc eax
jne 0x412059
call fcn.00403050
jmp 0x4120a1
lea edx, [ebp - 0x14]
mov ecx, 4
mov eax, dword [ebp - 0x10]
call fcn.004067c4
cmp eax, 4
je 0x412075
call fcn.00403050
jmp 0x4120a1
cmp dword [ebp - 0x14], 0x4550
jne 0x412084
mov eax, dword [ebp - 8]
mov byte [eax], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4120a1
mov eax, dword [ebp - 0x10]
call fcn.00406828
ret
mov al, byte [ebp - 9]
mov esp, ebp
pop ebp
ret
Function at 0x412578
Capabilities:
Create process on windows
Self delete

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
xor edx, edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x1d4], edx
mov dword [ebp - 0x1d8], edx
mov dword [ebp - 0x1dc], edx
mov dword [ebp - 0x1e0], edx
mov byte [ebp - 0x1cd], al
xor eax, eax
push ebp
push 0x4127e8
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1e0]
call fcn.00414cb0
lea edx, [ebp - 0x238]
mov eax, dword [ebp - 0x1e0]
call fcn.00406b04
mov eax, dword [ebp - 0x238]
lea edx, [ebp - 0x1d8]
call fcn.00413118
lea edx, [ebp - 0x1dc]
mov eax, dword [ebp - 0x1d8]
call fcn.00406b04
push 1
lea eax, [ebp - 0x238]
push eax
mov ecx, 0x4127fc
xor edx, edx
mov eax, dword [ebp - 0x1dc]
call fcn.00412ab4
mov ecx, dword [ebp - 0x238]
lea eax, [ebp - 0x1d4]
mov edx, dword [ebp - 0x1dc]
call fcn.0040373c
mov edx, dword [ebp - 0x1d4]
lea eax, [ebp - 0x1cc]
call fcn.00404a9a
lea eax, [ebp - 0x1cc]
call fcn.00404d22
call fcn.00402628
push ebp
mov eax, 0x41280c
call fcn.00412508
pop ecx
push ebp
push 0x41281c
push dword [ebp - 0x1e0]
push 0x41282c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004037b0
mov eax, dword [ebp - 0x238]
call fcn.00412508
pop ecx
push ebp
push 0x412838
push dword [ebp - 0x1e0]
push 0x41282c
push 0x41284c
lea eax, [ebp - 0x238]
mov edx, 4
call fcn.004037b0
mov eax, dword [ebp - 0x238]
call fcn.00412508
pop ecx
cmp byte [ebp - 0x1cd], 0
je 0x4126e7
push ebp
push 0x412860
push dword [ebp - 0x1d8]
push 0x41282c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004037b0
mov eax, dword [ebp - 0x238]
call fcn.00412508
pop ecx
push ebp
push 0x41281c
push dword [ebp - 0x1d4]
push 0x41282c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004037b0
mov eax, dword [ebp - 0x238]
call fcn.00412508
pop ecx
lea eax, [ebp - 0x1cc]
call fcn.00404b3c
call fcn.00402628
lea eax, [ebp - 0x234]
xor ecx, ecx
mov edx, 0x44
call fcn.004028fc
mov dword [ebp - 0x208], 1
mov word [ebp - 0x204], 0
lea eax, [ebp - 0x1f0]
push eax
lea eax, [ebp - 0x234]
push eax
mov eax, dword [ebp - 0x1dc]
call fcn.004038b4
push eax
push 0
push 0x8000040
push 0
push 0
push 0
push 0x41282c
push dword [ebp - 0x1d4]
push 0x41282c
lea eax, [ebp - 0x238]
mov edx, 3
call fcn.004037b0
mov eax, dword [ebp - 0x238]
call fcn.004038b4
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
je 0x4127bf
mov eax, dword [ebp - 0x1ec]
push eax
call sub.kernel32.dll_CloseHandle_1
mov eax, dword [ebp - 0x1f0]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4127ef
lea eax, [ebp - 0x238]
call fcn.00403498
lea eax, [ebp - 0x1e0]
mov edx, 4
call fcn.004034bc
ret

Function at 0x412920
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004128fc
mov ebx, eax
push 0
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_GetFileSize_1
cmp ebx, eax
jge 0x412949
mov byte [ebp - 5], 0
jmp 0x41294d
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x412cd4
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004038a4
xor eax, eax
push ebp
push 0x412d2f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.kernel32.dll_GetFileAttributesA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
je 0x412d10
test byte [ebp - 0xc], 0x10
jne 0x412d14
xor eax, eax
jmp 0x412d16
mov al, 1
mov byte [ebp - 5], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412d36
lea eax, [ebp - 4]
call fcn.00403498
ret

Function at 0x4132cc
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
push 0x80
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.kernel32.dll_SetFileAttributesA
mov eax, dword [ebp - 4]
call fcn.004069b4
mov byte [ebp - 5], al
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x4140b8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 8]
call fcn.00403498
cmp dword [ebp - 4], 0
je 0x414116
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 1
jle 0x414116
mov edx, dword [ebp - 0xc]
dec edx
mov eax, dword [ebp - 8]
call fcn.004039c4
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.004038b4
push eax
mov eax, dword [ebp - 4]
call fcn.004038b4
push eax
call sub.kernel32.dll_GetEnvironmentVariableA
mov esp, ebp
pop ebp
ret
Function at 0x4170c0
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x417271
push dword fs:[eax]
mov dword fs:[eax], esp
cmp byte [0x41b709], 0
je 0x417162
mov eax, 0x417288
call fcn.0041621c
mov eax, dword [0x41b6e4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x417162
inc esi
xor ebx, ebx
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x41b6e4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.00416278
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0xc]
mov eax, 0xf
call fcn.00415820
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea edx, [ebp - 0x14]
xor ecx, ecx
pop eax
call fcn.004071e4
mov eax, dword [ebp - 8]
call fcn.004161f0
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.00412d90
call fcn.004161ac
inc ebx
dec esi
jne 0x417103
mov eax, 0x41729c
call fcn.0041621c
mov eax, dword [0x41b6e4]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
je 0x41724e
mov eax, dword [0x41b6d0]
call fcn.004132cc
mov eax, dword [0x41b6e4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov esi, eax
dec esi
test esi, esi
jl 0x4171c9
inc esi
xor ebx, ebx
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, dword [0x41b6e4]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00416278
mov ecx, dword [ebp - 8]
mov edx, ebx
mov eax, dword [0x41b6e4]
mov edi, dword [eax]
call dword [edi + 0x20]
inc ebx
dec esi
jne 0x41719c
mov eax, dword [0x41b6e4]
mov edx, dword [eax]
call dword [edx + 0x7c]
mov eax, dword [0x41b6e4]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
cmp ebx, 0
jl 0x41724e
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0xc]
mov edx, ebx
mov eax, dword [0x41b6e4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0xb
lea eax, [ebp - 0x14]
push eax
lea edx, [ebp - 0x18]
mov eax, 0xf
call fcn.00415820
mov eax, dword [ebp - 0x18]
xor ecx, ecx
pop edx
call fcn.004071e4
mov eax, dword [ebp - 8]
call fcn.004161f0
lea ecx, [ebp - 8]
mov edx, ebx
mov eax, dword [0x41b6e4]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 8]
call fcn.004038b4
push eax
call sub.kernel32.dll_RemoveDirectoryA_1
call fcn.004161ac
dec ebx
cmp ebx, 0xffffffff
jne 0x4171e5
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x417278
lea eax, [ebp - 0x18]
call fcn.00403498
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.004034bc
ret