joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401510
Capabilities:
Copy file
Delete file
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call fcn.004124f5
add esp, 8
test eax, eax
jne 0x401537
call fcn.0040fdc0
mov edi, eax
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
or eax, 0xffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x2c], 0x406850
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], 0x406880
mov dword [esp + 0x38], eax
call esi
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x401584
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x401687
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edi
call esi
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x4015b0
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x40163b
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4015d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4015e9
mov edx, dword [esp + 0xc]
push 1
push 0
push 0
push edx
call fcn.0041e120
xor ecx, ecx
add eax, esi
adc edx, ecx
jmp 0x4015f1
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
push edx
push eax
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x24]
push eax
call fcn.00401370
add esp, 0x10
test eax, eax
jne 0x40160c
lea ebx, [eax + 1]
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x401630
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x401628
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x401630
mov dword [esp + 0x1c], 0xffffffff
test ebx, ebx
jne 0x40163b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x40165f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x401657
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x40165f
mov dword [esp + 0x14], 0xffffffff
test ebx, ebx
je 0x401687
cmp edi, dword [ebp + 0xc]
je 0x401687
mov ecx, dword [ebp + 8]
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401690
Capabilities:
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
push edi
push esi
call fcn.004124f5
add esp, 8
test eax, eax
jne 0x4016b7
call fcn.0040fdc0
mov edi, eax
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 1
push SysReAllocString
or eax, 0xffffffff
push esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esp + 0x34], 0x406850
mov dword [esp + 0x38], eax
mov dword [esp + 0x2c], 0x406880
mov dword [esp + 0x30], eax
call esi
mov dword [esp + 0x1c], eax
cmp eax, 0xffffffff
jne 0x401704
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x4017b9
push 0
push 0x80
push 2
push 0
push 1
push 0x40000000
push edi
call esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 0x14], eax
cmp eax, 0xffffffff
jne 0x40172e
call esi
test eax, eax
jne 0x401771
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
call fcn.004011e0
add esp, 4
test eax, eax
jne 0x401746
lea ebx, [eax + 1]
mov eax, dword [esp + 0x14]
cmp eax, 0xffffffff
je 0x401766
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x40175e
call esi
jmp 0x401766
mov dword [esp + 0x14], 0xffffffff
test ebx, ebx
jne 0x401771
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, dword [esp + 0x1c]
cmp eax, 0xffffffff
je 0x401791
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x401789
call esi
jmp 0x401791
mov dword [esp + 0x1c], 0xffffffff
test ebx, ebx
je 0x4017b9
cmp edi, dword [ebp + 0xc]
je 0x4017b9
mov ecx, dword [ebp + 8]
push 0
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x401cf0
Capabilities:
Encode data using xor

Disassembly:
push ebx
xor eax, eax
or ecx, 0x100
push edi
lea ebx, [ebx]
mov ebx, ecx
shr ebx, 7
mov edi, ecx
shr edi, 8
movzx edi, word [esi + edi*2]
and ebx, 1
neg ebx
sar ebx, 4
shr edi, 4
and ebx, 0x7f
xor edi, ebx
add eax, dword [edx + edi*4]
add ecx, ecx
cmp ecx, 0x10000
jb 0x401d00
pop edi
pop ebx
ret

Function at 0x401d30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, eax
mov edx, 0x100
xor eax, eax
or ecx, edx
mov edi, edi
add esi, esi
mov ebx, edx
and ebx, esi
add ebx, edx
mov ebp, ecx
shr ebp, 8
add ebp, ebx
mov ebx, dword [esp + 0x10]
movzx ebx, word [ebx + ebp*2]
mov ebp, ecx
shr ebp, 7
and ebp, 1
neg ebp
shr ebx, 4
sar ebp, 4
and ebp, 0x7f
xor ebx, ebp
add eax, dword [edi + ebx*4]
add ecx, ecx
mov ebx, ecx
xor ebx, esi
not ebx
and edx, ebx
cmp ecx, 0x10000
jb 0x401d40
pop esi
pop ebp
pop ebx
ret
Function at 0x401fe0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [esp], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
push ebp
mov dword [esp + 8], edx
mov dword [esp + 0xc], ecx
xor edx, edx
push edi
cmp edx, dword [esp + 0x1c]
jae 0x402153
mov eax, edx
or eax, 8
xor edi, edi
cmp eax, 1
je 0x40206a
lea ebx, [ebx]
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 4]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x402040
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x20]
add edi, eax
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x402024
cmp edx, 0x10
jae 0x4020ed
lea eax, [edx - 8]
mov dword [esp + 8], eax
lea esp, [esp]
cmp edx, dword [esp + 0x1c]
jae 0x402153
or eax, 8
xor edi, edi
cmp eax, 1
je 0x4020d1
mov ebp, dword [esp + 0x18]
mov ecx, eax
shr ecx, 1
and eax, 1
lea ebp, [ecx + ebp*8]
movzx ebp, word [ebx + ebp*2 + 0x104]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x4020a4
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, 0x10
jb 0x402090
cmp edx, dword [esp + 0x1c]
jae 0x402153
lea eax, [edx - 0x10]
mov dword [esp + 8], eax
lea ebx, [ebx]
or eax, 0x100
xor edi, edi
cmp eax, 1
je 0x402136
lea esp, [esp]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add edi, dword [esi + ebp*4]
mov eax, ecx
cmp eax, 1
jne 0x402110
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x20]
add edi, eax
mov eax, dword [esp + 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [esp + 8], eax
cmp edx, dword [esp + 0x1c]
jb 0x402100
pop edi
pop ebp
add esp, 0xc
ret
Function at 0x403c40
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
xor esi, esi
lea eax, [edi + 0x32550]
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
jmp 0x403c60
xor edx, edx
lea ecx, [edx + 1]
mov dword [esp + 0xc], 4
lea ecx, [ecx]
movzx ebx, word [edi + ecx*2 + 0x32bf4]
mov eax, esi
and eax, 1
mov ebp, eax
neg ebp
sar ebp, 4
shr ebx, 4
and ebp, 0x7f
xor ebx, ebp
add edx, dword [edi + ebx*4 + 0x30ea0]
add ecx, ecx
shr esi, 1
or ecx, eax
sub dword [esp + 0xc], 1
jne 0x403c70
mov eax, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], eax
cmp esi, 0x10
jb 0x403c60
pop esi
pop ebp
mov dword [edi + 0x32590], 0
pop ebx
add esp, 0xc
ret
Function at 0x403cd0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
mov eax, 4
push edi
mov dword [esp + 0x18], eax
movzx ebp, byte [edx + eax + 0x306a0]
mov ecx, ebp
mov esi, ebp
and esi, 1
shr ecx, 1
dec ecx
or esi, 2
shl esi, cl
mov edi, eax
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x10], 0
sub edi, esi
mov ebx, 1
mov dword [esp + 0x14], ecx
test ecx, ecx
je 0x403d62
jmp 0x403d24
mov ebp, dword [esp + 0x1c]
mov ecx, ebx
sub ecx, ebp
mov eax, edi
and eax, 1
add ecx, esi
movzx ecx, word [edx + ecx*2 + 0x32b0e]
mov ebp, eax
neg ebp
sar ebp, 4
shr ecx, 4
and ebp, 0x7f
xor ecx, ebp
mov ecx, dword [edx + ecx*4 + 0x30ea0]
add dword [esp + 0x10], ecx
add ebx, ebx
shr edi, 1
or ebx, eax
sub dword [esp + 0x14], 1
jne 0x403d20
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x20], ecx
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x80
jb 0x403ce3
lea eax, [edx + 0x32910]
mov dword [esp + 0x10], eax
lea eax, [esp + 0x20]
sub eax, edx
lea ebp, [edx + 0x31d58]
sub eax, 0x31d50
lea edi, [edx + 0x31950]
mov dword [esp + 0x18], ebp
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], 4
jmp 0x403db0
xor ebx, ebx
cmp dword [edx + 0x32594], ebx
jbe 0x403e0b
lea ebx, [ebx]
mov eax, ebx
or eax, 0x40
xor esi, esi
cmp eax, 1
je 0x403dff
lea esp, [esp]
mov ebp, dword [esp + 0x10]
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebp, word [ebp + ecx*2]
neg eax
sar eax, 4
and eax, 0x7f
shr ebp, 4
xor ebp, eax
add esi, dword [edx + ebp*4 + 0x30ea0]
mov eax, ecx
cmp eax, 1
jne 0x403dd0
mov ebp, dword [esp + 0x18]
mov dword [edi + ebx*4], esi
inc ebx
cmp ebx, dword [edx + 0x32594]
jb 0x403dc0
mov eax, 0xe
cmp dword [edx + 0x32594], eax
jbe 0x403e2e
mov ecx, eax
shr ecx, 1
sub ecx, 5
shl ecx, 4
add dword [edi + eax*4], ecx
inc eax
cmp eax, dword [edx + 0x32594]
jb 0x403e18
mov eax, dword [edi]
mov dword [ebp - 8], eax
mov ecx, dword [edi + 4]
mov dword [ebp - 4], ecx
mov eax, dword [edi + 8]
mov dword [ebp], eax
mov ecx, dword [edi + 0xc]
mov dword [ebp + 4], ecx
mov eax, 4
lea ecx, [ebp + 8]
lea ecx, [ecx]
movzx esi, byte [edx + eax + 0x306a0]
mov esi, dword [edi + esi*4]
mov ebx, dword [esp + 0x14]
add esi, dword [ebx + ecx]
inc eax
mov dword [ecx], esi
add ecx, 4
cmp eax, 0x80
jb 0x403e50
sub dword [esp + 0x10], 0xffffff80
sub dword [esp + 0x14], 0x200
add ebp, 0x200
add edi, 0x100
sub dword [esp + 0x1c], 1
mov dword [esp + 0x18], ebp
jne 0x403db0
pop edi
pop esi
pop ebp
mov dword [edx + 0x3bcf8], 0
pop ebx
add esp, 0x210
ret
Function at 0x406750
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x406761
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x40677f
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x4067b6
test ecx, ecx
je 0x4067af
test esi, esi
ja 0x406770
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x4067d0
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push esi
mov esi, dword [edi]
mov ebx, eax
test esi, esi
jne 0x4067e1
pop esi
xor eax, eax
pop ebx
pop ecx
ret
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [edi], 0
mov edi, edi
mov eax, 0x400000
cmp esi, 0x400000
ja 0x4067ff
mov eax, esi
mov edx, dword [esp + 0x14]
push 0
lea ecx, [esp + 0x10]
push ecx
push eax
mov eax, dword [edx]
push ebx
push eax
mov dword [esp + 0x20], 0
call ebp
mov ecx, dword [esp + 0xc]
add dword [edi], ecx
add ebx, ecx
sub esi, ecx
test eax, eax
je 0x406836
test ecx, ecx
je 0x40682f
test esi, esi
ja 0x4067f0
pop ebp
pop esi
xor eax, eax
pop ebx
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop ebp
pop esi
pop ebx
pop ecx
ret

Function at 0x406a60
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
push esi
mov dword [eax + 0x30], edx
mov dword [eax + 0x4c], edx
mov dword [eax + 0x20], edx
mov dword [eax + 0x2c], 0x20
mov dword [eax + 0x54], 1
mov dword [eax + 0x48], 4
mov dword [eax + 0x58], edx
lea esi, [eax + 0x70]
mov eax, edx
and eax, 1
dec eax
not eax
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x406a87
pop esi
ret

Function at 0x408b60
Capabilities:
Create thread

Disassembly:
push ecx
lea eax, [esp]
push eax
push 0
push ecx
push edx
push 0
push 0
call fcn.00411f0b
mov ecx, dword [esp + 0x20]
add esp, 0x18
mov dword [ecx], eax
test eax, eax
je 0x408b83
xor eax, eax
pop ecx
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x408b92
mov eax, 1
pop ecx
ret
Function at 0x408d50
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
mov ecx, dword [ebx + 0x1e8]
push ebp
mov ebp, dword [ebx + 0x1e4]
test ebp, ebp
jle 0x408d9f
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
shl edi, cl
add esi, 8
xor dword [esi - 8], edi
xor dword [esi - 4], edi
xor dword [esi], edi
xor dword [esi + 4], edi
lea eax, [esi - 8]
push eax
push eax
mov eax, dword [ebx]
push eax
lea eax, [ebx + 4]
push eax
call fcn.0040e7e0
add esp, 0x10
add esi, 0x10
inc edi
sub ebp, 1
jne 0x408d75
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x408db0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, dword [esp + 0xc]
mov eax, dword [ebp + 0x1e4]
mov ecx, dword [ebp + 0x1e8]
test eax, eax
jle 0x408e10
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
mov edi, dword [esp + 0x1c]
shl edi, cl
add esi, 8
mov dword [esp + 0x18], eax
lea esp, [esp]
mov eax, dword [ebp]
lea ebx, [esi - 8]
push ebx
push ebx
push eax
lea eax, [ebp + 0xf4]
push eax
call fcn.0040edb0
xor dword [esi - 4], edi
xor dword [esi], edi
xor dword [esi + 4], edi
xor dword [ebx], edi
add esp, 0x10
add esi, 0x10
inc edi
sub dword [esp + 0x18], 1
jne 0x408de0
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x409080
Capabilities:
Set registry value

Disassembly:
sub esp, 0x214
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x210], eax
push str.SoftwareContentGuard
lea eax, [esp + 0xc]
push 0x104
push eax
call fcn.004105bc
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 4]
push edx
push 0
push 0xf003f
push 0
push 0x429358
push 0
lea eax, [esp + 0x24]
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4090ff
mov edx, dword [esp]
push 4
lea ecx, [esp + 0x21c]
push ecx
push 4
push eax
push str.AutoUpdate
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040ff55
add esp, 0x214
ret

Function at 0x4092f0
Capabilities:
Read file on windows
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0xc]
push ebx
push 0x4293a0
push eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov dword [esp + 0x10], ebx
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x4093a8
mov edx, dword [esp + 4]
push esi
push edi
push edx
call fcn.0040a800
mov esi, eax
push esi
call fcn.00411613
mov edi, eax
add esp, 8
cmp edi, ebx
je 0x409399
mov eax, dword [esp + 0xc]
push eax
push 1
push esi
push edi
call fcn.004115a7
add esp, 0x10
cmp eax, 1
jne 0x409390
mov ecx, dword [esp + 0x1c]
push 0x429398
push ecx
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], ebx
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x409390
mov eax, dword [esp + 0x10]
push eax
push 1
push esi
push edi
call fcn.00411285
add esp, 0x10
cmp eax, 1
jne 0x409383
mov ebx, eax
mov ecx, dword [esp + 0x10]
push ecx
call fcn.004110a7
add esp, 4
push edi
call fcn.00410fa2
add esp, 4
mov edx, dword [esp + 0xc]
push edx
call fcn.004110a7
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x4093b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 8]
push eax
push 0x20019
xor esi, esi
push esi
push str.SoftwareContentGuard
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x409488
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x20]
lea ecx, [esp + 0xc]
push ecx
push eax
lea edx, [esp + 0x1c]
push edx
push eax
mov eax, dword [esp + 0x20]
push edi
push eax
mov dword [esp + 0x24], esi
call ebx
test eax, eax
jne 0x409471
mov ecx, dword [esp + 0xc]
push ecx
call fcn.00411613
mov esi, eax
add esp, 4
test esi, esi
je 0x409471
mov ecx, dword [esp + 0x10]
lea edx, [esp + 0xc]
push edx
push esi
lea eax, [esp + 0x1c]
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x409468
mov edx, dword [esp + 0xc]
mov edi, dword [esp + 0x1c]
push edx
push esi
push edi
call fcn.0040a510
add esp, 0xc
test eax, eax
je 0x409468
push edi
call fcn.0040a7f0
add esp, 4
test eax, eax
je 0x409468
push edi
push edi
call fcn.00401690
add esp, 8
test eax, eax
je 0x409468
push edi
call fcn.0040a6b0
add esp, 4
push esi
call fcn.00410fa2
add esp, 4
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, 1
pop esi
add esp, 0xc
ret
mov eax, esi
pop esi
add esp, 0xc
ret

Function at 0x409740
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x210
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x20c], eax
push ebx
push esi
mov esi, dword [esp + 0x220]
push edi
mov edi, dword [esp + 0x220]
lea eax, [esp + 0x10]
push eax
xor ebx, ebx
call fcn.0040fe40
add esp, 4
test eax, eax
je 0x4097ba
lea ecx, [esp + 0x10]
push str.INFO5
push ecx
call fcn.004093b0
add esp, 8
test eax, eax
je 0x4097af
lea edx, [esp + 0x10]
push edx
push edi
call fcn.004092f0
add esp, 8
test eax, eax
je 0x4097af
push ebx
push edi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ebx, eax
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x429398
lea edx, [esp + 0x10]
push edi
push edx
mov dword [esp + 0x18], 0
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x409812
movzx eax, word [esi + 0xc]
movzx ecx, word [esi + 0xa]
movzx edx, word [esi + 8]
push eax
movzx eax, word [esi + 6]
push ecx
movzx ecx, word [esi + 2]
push edx
movzx edx, word [esi]
push eax
mov eax, dword [esp + 0x1c]
push ecx
push edx
push str.___r_n_d__02d__02d__02d:_02d:_02d_r_n
push eax
call fcn.004117f6
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.004110a7
add esp, 0x24
mov ecx, dword [esp + 0x218]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0040ff55
add esp, 0x210
ret
Function at 0x409830
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x418
mov eax, dword [0x431034]
xor eax, esp
mov dword [esp + 0x414], eax
push ebx
mov ebx, dword [esp + 0x424]
push esi
mov esi, dword [esp + 0x424]
push edi
lea eax, [esp + 0x10]
push eax
xor edi, edi
call fcn.0040fe40
add esp, 4
test eax, eax
je 0x40998a
lea ecx, [esp + 0x10]
push str.INFO5
push ecx
call fcn.004093b0
add esp, 8
test eax, eax
je 0x4098a3
lea edx, [esp + 0x10]
push edx
push esi
call fcn.004092f0
add esp, 8
test eax, eax
je 0x4098a3
push edi
push esi
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [esp + 0x14]
push ecx
call ebp
test edi, edi
je 0x4099a4
lea edx, [esp + 0x21c]
push edx
xor edi, edi
call fcn.0040fe40
add esp, 4
test eax, eax
je 0x4099a4
lea eax, [esp + 0x21c]
push str.INFO6
push eax
call fcn.004093b0
add esp, 8
test eax, eax
je 0x4098ff
lea ecx, [esp + 0x21c]
push esi
push ecx
call fcn.004092f0
add esp, 8
mov edi, eax
lea edx, [esp + 0x21c]
push edx
call ebp
test edi, edi
je 0x4099a4
push 0x429398
lea eax, [esp + 0x14]
push esi
xor edi, edi
push eax
mov dword [esp + 0x1c], edi
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x4099a4
movzx ecx, word [ebx + 0xc]
movzx edx, word [ebx + 0xa]
movzx eax, word [ebx + 8]
push ecx
movzx ecx, word [ebx + 6]
push edx
movzx edx, word [ebx + 2]
push eax
movzx eax, word [ebx]
push ecx
mov ecx, dword [esp + 0x20]
push edx
push eax
push str.___r_n_d__02d__02d__02d:_02d:_02d_r_n
push ecx
call fcn.004117f6
mov edx, dword [esp + 0x30]
push edx
call fcn.004110a7
push esi
call fcn.0040a600
add esp, 0x28
test eax, eax
je 0x4099a4
push esi
push esi
call fcn.00401510
add esp, 8
test eax, eax
je 0x4099a4
push esi
call fcn.0040a750
add esp, 4
jmp 0x4099a6
mov eax, edi
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x414]
xor ecx, esp
call fcn.0040ff55
add esp, 0x418
ret
mov eax, edi
mov ecx, dword [esp + 0x424]
pop ebp
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040ff55
add esp, 0x418
ret

Function at 0x4099c0
Capabilities:
Read file on windows

Disassembly:
push ecx
push ebx
push 0x4293a0
push eax
lea ecx, [esp + 0xc]
xor ebx, ebx
push ecx
mov dword [esp + 0x10], ebx
call fcn.004117a3
add esp, 0xc
test eax, eax
jne 0x409a47
mov edx, dword [esp + 4]
push edi
push edx
call fcn.0040a800
mov edi, eax
add esp, 4
cmp edi, ebx
jbe 0x409a39
push esi
lea eax, [edi + 2]
push eax
push 1
call fcn.00411c26
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x409a38
mov ecx, dword [esp + 0xc]
push ecx
push 1
push edi
push esi
call fcn.004115a7
add esp, 0x10
cmp eax, 1
jne 0x409a2f
mov edx, dword [esp + 0x14]
push esi
push edx
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov ebx, 1
push esi
call fcn.00410fa2
add esp, 4
pop esi
mov eax, dword [esp + 8]
push eax
call fcn.004110a7
add esp, 4
pop edi
mov eax, ebx
pop ebx
pop ecx
ret