joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406e7f
Capabilities:
Move file

Disassembly:
push esi
push ebx
sub esp, 0x834
mov eax, dword [esp + 0x840]
lea ebx, [esp + 0x20]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov eax, dword [esp + 0x844]
lea esi, [esp + 0x428]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], esi
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp + 4], esi
mov dword [esp], ebx
call sub.KERNEL32.dll_MoveFileW
push edx
push edx
test eax, eax
setne al
add esp, 0x834
pop ebx
pop esi
ret

Function at 0x406f1a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
sub esp, 0x438
mov eax, dword [esp + 0x440]
lea ebx, [esp + 0x28]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesW
push edx
xor edx, edx
cmp eax, 0xffffffff
je 0x406f76
shr eax, 4
xor eax, 1
and eax, 1
mov edx, eax
mov al, dl
add esp, 0x438
and eax, 1
pop ebx
ret
Function at 0x40729c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
sub esp, 0x438
mov eax, dword [esp + 0x440]
lea ebx, [esp + 0x28]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp], ebx
call sub.KERNEL32.dll_GetFileAttributesW
push edx
xor edx, edx
cmp eax, 0xffffffff
je 0x4072f5
shr eax, 4
and eax, 1
mov edx, eax
mov al, dl
add esp, 0x438
and eax, 1
pop ebx
ret

Function at 0x407302
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x84c
mov eax, dword [esp + 0x860]
lea ebx, [esp + 0x438]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp + 4], 0x422f44
mov dword [esp], ebx
call sub.msvcrt.dll__wfopen
mov esi, eax
xor eax, eax
test esi, esi
je 0x407463
mov eax, dword [esp + 0x864]
lea ebx, [esp + 0x30]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp], ebx
mov dword [esp + 4], 0x422f5c
xor ebx, ebx
call sub.msvcrt.dll__wfopen
test eax, eax
mov edi, eax
je 0x407444
mov edx, 9
mov ebx, 0x8000
mov dword [esp], ebx
mov dword [esp + 0x2c], edx
call sub.msvcrt.dll_malloc
test eax, eax
mov ebp, eax
mov edx, dword [esp + 0x2c]
je 0x407435
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], ebp
call sub.msvcrt.dll_fread
test eax, eax
jg 0x407405
mov eax, dword [esi + 0xc]
and eax, 0x30
cmp eax, 0x10
sete bl
jmp 0x40742b
mov dword [esp + 0xc], edi
mov dword [esp + 8], eax
mov dword [esp + 4], 1
mov dword [esp], ebp
mov dword [esp + 0x2c], eax
call sub.msvcrt.dll_fwrite
mov ecx, dword [esp + 0x2c]
cmp ecx, eax
je 0x4073db
xor ebx, ebx
mov dword [esp], ebp
call sub.msvcrt.dll_free
jmp 0x40743c
sar ebx, 1
dec edx
jne 0x4073c5
xor ebx, ebx
mov dword [esp], edi
call sub.msvcrt.dll_fclose
mov dword [esp], esi
call sub.msvcrt.dll_fclose
test bl, bl
mov al, 1
jne 0x407463
mov eax, dword [esp + 0x864]
mov dword [esp], eax
call fcn.00406e04
xor eax, eax
add esp, 0x84c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407ab6
Capabilities:
Create directory

Disassembly:
push ebx
sub esp, 0x438
mov eax, dword [esp + 0x440]
lea ebx, [esp + 0x28]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebx
mov dword [esp], 0xfde9
mov dword [esp + 8], eax
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp], ebx
mov dword [esp + 4], 0
call sub.KERNEL32.dll_CreateDirectoryW
push edx
push edx
test eax, eax
setne al
add esp, 0x438
pop ebx
ret

Function at 0x407ba7
Capabilities:
Delete file

Disassembly:
push edi
push esi
xor eax, eax
push ebx
or ecx, 0xffffffff
sub esp, 0x650
mov ebx, dword [esp + 0x660]
lea esi, [esp + 0x44]
mov edi, ebx
repne scasb al, byte es:[edi]
mov edi, esi
neg ecx
rep stosb byte es:[edi], al
lea edi, [esp + 0x248]
mov dword [esp + 4], ebx
mov dword [esp], esi
call sub.msvcrt.dll_strcpy
mov dword [esp + 0x14], 0x204
mov dword [esp + 0x10], edi
mov dword [esp + 0xc], 0x204
mov dword [esp + 8], esi
mov dword [esp + 4], 0
mov dword [esp], 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
lea eax, [esp + 0x26]
mov dword [esp + 0x26], 0
mov dword [esp + 0x2a], 3
mov dword [esp + 0x2e], edi
mov dword [esp + 0x32], 0x422f62
mov dword [esp], eax
mov word [esp + 0x36], 0x414
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
mov dword [esp + 0x40], 0x422f62
call sub.SHELL32.DLL_SHFileOperationW
push edx
xor edx, edx
test eax, eax
jne 0x407c68
mov dword [esp], ebx
call fcn.0040729c
xor eax, 1
movzx edx, al
add esp, 0x650
mov al, dl
pop ebx
and eax, 1
pop esi
pop edi
ret

Function at 0x407d7f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x41c
lea esi, [esp + 0x10]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.004129e4
mov eax, dword [esp + 0x438]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x434]
mov dword [esp], eax
call fcn.004129e4
call sub.KERNEL32.dll_GetCommandLineA
mov dword [esp + 8], 0x400
mov dword [esp + 4], eax
mov dword [esp], esi
call fcn.00412548
xor edx, edx
xor eax, eax
mov cl, byte [esp + eax + 0x10]
test cl, cl
je 0x407e7f
cmp cl, 0x22
jne 0x407e32
mov edi, dword [esp + 0x434]
lea ecx, [eax + 1]
xor esi, esi
sub edi, eax
mov al, byte [esp + ecx + 0x10]
cmp al, 0x22
je 0x407e17
test al, al
je 0x407e17
inc ecx
inc esi
mov byte [edi + ecx - 2], al
jmp 0x407e03
mov eax, dword [esp + 0x434]
mov byte [eax + esi], 0
cmp dword [esp + 0x430], edx
lea esi, [edx + 1]
jne 0x407e75
mov al, 1
jmp 0x407e81
cmp cl, 0x20
je 0x407e44
mov ebp, dword [esp + 0x434]
mov ecx, eax
sub ebp, eax
jmp 0x407e4e
inc eax
inc dword [esp + 0x430]
jmp 0x407de4
movzx esi, byte [esp + ecx + 0x10]
mov edi, ecx
sub edi, eax
test esi, 0xdf
je 0x407e68
inc ecx
mov ebx, esi
mov byte [ebp + ecx - 1], bl
jmp 0x407e4e
mov eax, dword [esp + 0x434]
mov byte [eax + edi], 0
jmp 0x407e22
lea eax, [ecx + 1]
mov edx, esi
jmp 0x407de4
xor eax, eax
add esp, 0x41c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x407e8c
Capabilities:
Read file on windows

Disassembly:
push ebx
sub esp, 0x28
mov eax, dword [esp + 0x30]
mov dword [esp + 4], 0x422f58
mov dword [esp], eax
call sub.msvcrt.dll_fopen
mov ebx, eax
xor eax, eax
test ebx, ebx
je 0x407eec
lea eax, [esp + 0x1c]
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 4
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp eax, 4
mov dword [esp], ebx
je 0x407edd
call sub.msvcrt.dll_fclose
xor eax, eax
jmp 0x407eec
call sub.msvcrt.dll_fclose
cmp word [esp + 0x1c], 0x5a4d
sete al
add esp, 0x28
pop ebx
ret

Function at 0x407f08
Capabilities:
Create thread

Disassembly:
sub esp, 0x3c
lea eax, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 4], 0
mov dword [esp], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x40]
mov dword [esp + 8], eax
call sub.msvcrt.dll__beginthreadex
xor edx, edx
test eax, eax
je 0x407f53
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
mov edx, 1
mov eax, edx
add esp, 0x3c
ret

Function at 0x408042
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x44c
mov eax, dword [esp + 0x460]
lea ebx, [esp + 0x38]
mov ebp, dword [esp + 0x468]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x204
mov dword [esp + 0x10], ebx
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], 0xfde9
mov esi, dword [esp + 0x464]
mov dword [esp + 0x2c], 0
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [ebp], 0
mov dword [esp + 4], 0x422f64
mov dword [esp], ebx
call sub.msvcrt.dll__wfopen
test eax, eax
je 0x40819d
mov dword [esp + 0xc], 2
mov dword [esp + 4], 0
mov ebx, eax
mov dword [esp + 8], 0
mov dword [esp], eax
call fcn.00407fc3
test eax, eax
jne 0x408182
lea edi, [esp + 0x30]
mov dword [esp], ebx
mov dword [esp + 4], edi
call sub.msvcrt.dll_fgetpos
test eax, eax
jne 0x408182
mov eax, dword [esp + 0x30]
test eax, eax
jle 0x408182
cmp eax, esi
jle 0x40810d
test esi, esi
jne 0x40810f
mov esi, eax
mov dword [esp + 4], edi
mov dword [esp], ebx
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
call sub.msvcrt.dll_fsetpos
test eax, eax
jne 0x408182
mov dword [esp], esi
call sub.msvcrt.dll_malloc
test eax, eax
mov dword [esp + 0x2c], eax
je 0x408182
mov dword [esp + 0xc], ebx
mov dword [esp + 8], esi
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp esi, eax
mov edi, eax
je 0x408171
mov dword [esp + 4], eax
mov eax, dword [esp + 0x2c]
mov dword [esp], eax
call sub.msvcrt.dll_realloc
mov dword [esp + 0x2c], eax
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
mov dword [ebp], edi
mov eax, dword [esp + 0x2c]
jmp 0x40819f
mov dword [esp], ebx
call sub.msvcrt.dll_fclose
cmp dword [esp + 0x2c], 0
je 0x40819d
lea eax, [esp + 0x2c]
mov dword [esp], eax
call fcn.00407f59
xor eax, eax
add esp, 0x44c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408ab3
Capabilities:
Check mutex on windows

Disassembly:
sub esp, 0x1c
mov dword [esp + 8], 0x422564
mov dword [esp + 4], 1
mov dword [esp], 0
call sub.KERNEL32.dll_CreateMutexA
sub esp, 0xc
test eax, eax
mov dword [0x4223d4], eax
mov dl, 1
je 0x408aed
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
setne dl
mov al, dl
add esp, 0x1c
ret
Function at 0x40970c
Capabilities:
Write file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x86c
mov esi, dword [0x422830]
test esi, esi
jne 0x409942
mov edi, eax
lea eax, [esp + 0x48]
mov dword [esp + 0x3c], ecx
mov ebx, edx
mov dword [esp], eax
call sub.KERNEL32.dll_GetLocalTime
push ecx
movzx eax, word [esp + 0x4e]
cmp eax, dword [0x42b480]
mov ecx, dword [esp + 0x3c]
je 0x4097a2
test cl, cl
jne 0x4097a6
movzx edx, word [esp + 0x48]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0x422400
mov dword [esp + 8], str._s_.2d__.2d__.4d
mov dword [esp + 4], 0x104
mov dword [esp], 0x42b4a0
mov dword [0x42b480], eax
mov dword [esp + 0x18], edx
movzx edx, word [esp + 0x4a]
mov dword [esp + 0x14], edx
call fcn.004127a8
mov eax, dword [0x42282c]
cmp eax, 0xffffffff
je 0x4097c5
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push edx
jmp 0x4097c5
test cl, cl
je 0x4097cf
mov eax, dword [0x42282c]
cmp eax, 0xffffffff
je 0x4097b9
mov dword [esp], eax
call sub.KERNEL32.dll_CloseHandle
push eax
mov dword [esp], 0x42b4a0
call fcn.00406e04
mov dword [0x42282c], 0xffffffff
cmp dword [0x42282c], 0xffffffff
jne 0x409906
mov dword [esp], 0x422400
call fcn.0040729c
test al, al
jne 0x4097f8
mov dword [esp], 0x422400
call fcn.00407b16
lea ebp, [esp + 0x458]
mov dword [esp + 0x14], 0x204
mov dword [esp + 0xc], 0x104
mov dword [esp + 8], 0x42b4a0
mov dword [esp + 4], 0
mov dword [esp + 0x10], ebp
mov dword [esp], 0xfde9
call sub.KERNEL32.dll_MultiByteToWideChar
sub esp, 0x18
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], pe_nt_image_headers32
mov dword [esp + 0x10], 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], 1
mov dword [esp + 4], 0x40000000
mov dword [esp], ebp
call sub.KERNEL32.dll_CreateFileW
sub esp, 0x1c
cmp eax, 0xffffffff
mov dword [0x42282c], eax
jne 0x409886
mov dword [0x422830], 1
jmp 0x409945
mov dword [esp + 0xc], 2
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.KERNEL32.dll_SetFilePointer
sub esp, 0x10
movzx eax, word [esp + 0x54]
lea ebp, [esp + 0x58]
mov dword [esp + 8], str.__.2d__.2d__d__.2d:_.2d:_.2d__r_n
mov dword [esp + 4], 0x400
mov dword [esp], ebp
mov dword [esp + 0x20], eax
movzx eax, word [esp + 0x52]
mov dword [esp + 0x1c], eax
movzx eax, word [esp + 0x50]
mov dword [esp + 0x18], eax
movzx eax, word [esp + 0x48]
mov dword [esp + 0x14], eax
movzx eax, word [esp + 0x4a]
mov dword [esp + 0x10], eax
movzx eax, word [esp + 0x4e]
mov dword [esp + 0xc], eax
call fcn.004127a8
xor ecx, ecx
mov edx, eax
mov eax, ebp
call fcn.0040970c
test ebx, ebx
jle 0x409945
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.004096f0
lea eax, [esp + 0x44]
mov dword [esp + 0x10], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp + 0xc], eax
mov eax, dword [0x42282c]
mov dword [esp], eax
call sub.KERNEL32.dll_WriteFile
sub esp, 0x14
mov esi, eax
jmp 0x409945
or esi, 0xffffffff
add esp, 0x86c
mov eax, esi
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40a23c
Capabilities:
Encode data using xor

Disassembly:
push ebp
push edi
xor eax, eax
push esi
push ebx
or ecx, 0xffffffff
sub esp, 0x20
mov edx, dword [esp + 0x34]
mov esi, dword [esp + 0x38]
mov ebx, dword [esp + 0x3c]
mov edi, edx
repne scasb al, byte es:[edi]
xor edi, edi
not ecx
dec ecx
cmp edi, ecx
jge 0x40a26d
mov al, byte [edx + edi]
rol al, 4
mov byte [esp + edi], al
inc edi
jmp 0x40a25d
mov eax, ecx
cmp eax, 0x1f
jg 0x40a281
mov dl, al
rol dl, 3
and edx, eax
mov byte [esp + eax], dl
inc eax
jmp 0x40a26f
mov eax, ecx
sar eax, 2
movzx edi, byte [esp + eax]
xor eax, eax
xor edi, ecx
mov dl, byte [esp + eax]
xor dl, byte [esi + eax]
xor edx, edi
mov byte [ebx + eax], dl
movzx edi, byte [esi + eax]
lea ebp, [edx*4]
rol dl, 3
not edi
xor edi, ebp
lea ebp, [ecx + eax]
xor ebp, eax
or edx, ebp
mov byte [ebx + eax], dl
inc eax
cmp eax, 0x20
jne 0x40a28e
add esp, 0x20
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40adea
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
mov dword [eax], 0
mov dword [eax + 4], 0
ret

Function at 0x40b016
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x21c
mov eax, dword [esp + 0x238]
mov edi, dword [esp + 0x234]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.004129e4
mov eax, dword [esp + 0x230]
mov dword [esp + 4], 0x423378
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
je 0x40b0f8
lea ebx, [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fread
test eax, eax
jne 0x40b08d
xor ebx, ebx
jmp 0x40b0f0
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Path
mov dword [esp], 0
mov byte [esp + 0x20f], 0
call fcn.004125de
lea ebp, [eax + 5]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x423380
mov dword [esp], ebp
call fcn.004125de
inc eax
cmp ebp, 5
jle 0x40b089
cmp ebp, eax
jge 0x40b089
sub eax, ebp
cmp dword [esp + 0x238], eax
jbe 0x40b089
add ebx, ebp
mov dword [esp + 8], eax
mov dword [esp], edi
mov dword [esp + 4], ebx
call fcn.00412548
test eax, eax
setne bl
mov dword [esp], esi
call sub.msvcrt.dll_fclose
add esp, 0x21c
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x40b105
Capabilities:
Read file on windows

Disassembly:
push ebp
push edi
push esi
push ebx
xor ebx, ebx
sub esp, 0x21c
mov eax, dword [esp + 0x238]
mov edi, dword [esp + 0x234]
mov dword [esp + 4], 0
mov dword [esp + 8], eax
mov dword [esp], edi
call fcn.004129e4
mov eax, dword [esp + 0x230]
mov dword [esp + 4], 0x423378
mov dword [esp], eax
call sub.msvcrt.dll_fopen
test eax, eax
je 0x40b1e7
lea ebx, [esp + 0x10]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x200
mov dword [esp + 4], 1
mov esi, eax
mov dword [esp], ebx
call sub.msvcrt.dll_fread
test eax, eax
jne 0x40b17c
xor ebx, ebx
jmp 0x40b1df
mov dword [esp + 8], ebx
mov dword [esp + 4], str.Default
mov dword [esp], 0
mov byte [esp + 0x20f], 0
call fcn.004125de
lea ebp, [eax + 8]
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x423380
mov dword [esp], ebp
call fcn.004125de
inc eax
cmp ebp, 8
jle 0x40b178
cmp ebp, eax
jge 0x40b178
sub eax, ebp
cmp dword [esp + 0x238], eax
jbe 0x40b178
add ebx, ebp
mov dword [esp + 8], eax
mov dword [esp], edi
mov dword [esp + 4], ebx
call fcn.00412548
test eax, eax
setne bl
mov dword [esp], esi
call sub.msvcrt.dll_fclose
add esp, 0x21c
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40c2db
Capabilities:
Query environment variable

Disassembly:
push edi
push esi
push ebx
sub esp, 0x330
mov dword [esp], str.APPDATA
mov dword [esp + 0x24], 0
call sub.msvcrt.dll_getenv
mov dword [esp], str._6.sQ0sidCYYWQR56.fli
mov ebx, eax
call fcn.004081aa
mov dword [esp + 0xc], ebx
lea ebx, [esp + 0x12c]
mov dword [esp + 8], eax
mov dword [esp + 4], 0x204
mov dword [esp], ebx
call fcn.004127a8
mov dword [esp + 4], 0x423378
mov dword [esp], ebx
call sub.msvcrt.dll_fopen
test eax, eax
je 0x40c460
lea ebx, [esp + 0x2d]
lea edi, [esp + 0x28]
mov esi, eax
mov dword [esp + 0x28], 0
mov dword [esp + 8], esi
mov dword [esp + 4], 0xff
mov dword [esp], ebx
call sub.msvcrt.dll_fgets
test eax, eax
je 0x40c452
mov dword [esp], str._s0W5WYWi_
mov dword [esp + 0x28], 0
call fcn.004081aa
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004125de
inc eax
je 0x40c3f1
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 2
mov dword [esp + 4], str._d_s_a
mov dword [esp], edi
call fcn.00412755
inc eax
je 0x40c45c
cmp dword [esp + 0x28], 0
je 0x40c34f
lea eax, [esp + 0x24]
mov dword [esp + 0x10], 1
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 8], edi
mov dword [esp + 4], 0xffffffff
mov dword [esp], eax
call fcn.00412abf
mov dword [esp + 0x24], eax
jmp 0x40c34f
mov dword [esp], str._RCld_
call fcn.004081aa
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004125de
inc eax
je 0x40c42a
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x4236a0
mov dword [esp], edi
call fcn.00412755
jmp 0x40c3b2
mov dword [esp], str._sC66gW0S_
call fcn.004081aa
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], 0
call fcn.004125de
inc eax
jne 0x40c414
jmp 0x40c3b9
mov dword [esp], esi
call sub.msvcrt.dll_fclose
jmp 0x40c460
xor eax, eax
jmp 0x40c464
mov eax, dword [esp + 0x24]
add esp, 0x330
pop ebx
pop esi
pop edi
ret

Function at 0x40c46e
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x2c
mov eax, dword [esp + 0x40]
mov edx, dword [esp + 0x3c]
mov dword [eax], edx
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x38]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x30]
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
sete al
add esp, 0x2c
ret
Function at 0x40d235
Capabilities:
Read file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [esp + 0x2c]
mov esi, dword [esp + 0x20]
mov dword [esp + 0xc], 0
mov ebx, dword [esp + 0x28]
mov dword [esp + 4], eax
sar eax, 0x1f
mov dword [esp], esi
mov dword [esp + 8], eax
call fcn.00407fc3
xor edx, edx
test eax, eax
jne 0x40d288
mov eax, dword [esp + 0x24]
mov dword [esp + 0xc], esi
mov dword [esp + 8], ebx
mov dword [esp + 4], 1
mov dword [esp], eax
call sub.msvcrt.dll_fread
cmp ebx, eax
sete dl
add esp, 0x14
mov al, dl
pop ebx
pop esi
ret

Function at 0x40d290
Capabilities:
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x4c
mov esi, dword [esp + 0x68]
mov dword [esp + 8], 4
mov dword [esp + 4], 0
mov dword [esp + 0x24], 0
mov dword [esp], esi
call fcn.004129e4
mov dword [esp + 0x10], 0xf0000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], 0x42b5cc
call sub.ADVAPI32.DLL_CryptAcquireContextA
xor edx, edx
sub esp, 0x14
test eax, eax
je 0x40d416
lea eax, [esp + 0x24]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0x8004
mov dword [esp + 0x10], eax
mov eax, dword [0x42b5cc]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptCreateHash
sub esp, 0x14
test eax, eax
je 0x40d3fd
mov eax, dword [esp + 0x64]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptHashData
sub esp, 0x10
test eax, eax
je 0x40d3f0
lea eax, [esp + 0x28]
lea ebp, [esp + 0x2c]
mov dword [esp + 0x10], 0
mov dword [esp + 4], 2
mov dword [esp + 0x28], 0x14
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x24]
mov dword [esp + 8], ebp
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptGetHashParam
sub esp, 0x14
test eax, eax
je 0x40d3f0
xor edi, edi
xor ebx, ebx
movzx eax, byte [ebp + ebx]
mov dword [esp + 8], str._.2X
mov dword [esp + 4], 2
add edi, eax
mov dword [esp + 0xc], eax
lea eax, [ebx + ebx]
inc ebx
add eax, esi
mov dword [esp], eax
call fcn.004127a8
cmp ebx, 0x14
jne 0x40d39a
mov eax, edi
add esi, 0x28
mov dword [esp + 8], str._.2X
movzx edi, al
mov dword [esp + 4], 2
mov dword [esp], esi
mov dword [esp + 0xc], edi
call fcn.004127a8
mov dl, 1
jmp 0x40d416
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptDestroyHash
push edx
mov eax, dword [0x42b5cc]
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.ADVAPI32.DLL_CryptReleaseContext
push eax
push eax
xor edx, edx
add esp, 0x4c
mov al, dl
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x40d420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x88c
mov eax, dword [esp + 0x8b0]
mov dword [esp + 4], 0
lea ebp, [esp + 0x55]
mov esi, dword [esp + 0x8a4]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x8ac]
mov dword [esp], eax
call fcn.004129e4
mov eax, dword [esp + 0x8a8]
mov dword [esp + 8], ebp
mov dword [esp], esi
mov dword [esp + 4], eax
call fcn.0040d290
test al, al
mov bl, al
je 0x40d5ca
mov dword [esp], str.Y0Zs5Nh.Sii
mov byte [esp + 0x7f], 0
mov dword [esp + 0x38], 0x800
call fcn.004081aa
mov dword [esp], eax
call fcn.00407f7a
mov dword [esp], str.P0Zs5uRs0W5dY5aC5C
mov edi, eax
call fcn.004081aa
mov dword [esp], edi
mov dword [esp + 4], eax
call fcn.00407f8e
mov dword [esp + 0x28], eax
lea eax, [esp + 0x38]
lea edx, [esp + 0x80]
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x8a0]
mov dword [esp + 0x10], edx
mov dword [esp + 4], ebp
mov dword [esp + 0x2c], edx
mov dword [esp], eax
call sub.ADVAPI32.DLL_RegQueryValueExA
sub esp, 0x18
test eax, eax
jne 0x40d5c0
mov eax, dword [esp + 0x38]
mov edx, dword [esp + 0x2c]
mov dword [esp + 0x50], esi
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x3c], eax
mov eax, dword [esp + 0x8a8]
mov dword [esp + 0x40], edx
mov dword [esp + 4], 0
mov dword [esp + 0x4c], eax
lea eax, [esp + 0x44]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x4c]
mov dword [esp + 8], eax
lea eax, [esp + 0x3c]
mov dword [esp], eax
call dword [esp + 0x28]
sub esp, 0x1c
test eax, eax
je 0x40d5c0
mov edx, dword [esp + 0x48]
mov eax, dword [edx + 4]
add eax, dword [edx]
mov ecx, dword [edx + 8]
add ecx, eax
cmp dword [esp + 0x44], ecx
jb 0x40d5b1
mov ecx, dword [edx + 0x34]
add eax, edx
add ecx, eax
mov dword [esp + 0x18], ecx
add eax, dword [edx + 0x24]
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], 2
mov dword [esp + 8], str._c_S_a_S:_S_b_b_b_b
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x8b0]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x8ac]
mov dword [esp], eax
call fcn.004127a8
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sub.KERNEL32.dll_LocalFree
push eax
jmp 0x40d5ca
mov dword [esp], edi
xor ebx, ebx
call fcn.00407fab
add esp, 0x88c
mov al, bl
pop ebx
pop esi
pop edi
pop ebp
ret