joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41eb1c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ecx
mov word [ebp - 2], dx
xor eax, eax
push ebp
push 0x6660cb
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
call fcn.00404cd0
xor ebx, ebx
mov eax, ebx
and eax, 0x80000001
jns 0x41eb57
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x41eb70
lea eax, [ebp - 0x10]
mov edx, dword [0x67e258]
mov edx, dword [edx]
mov edx, dword [edx + 0xc]
call fcn.00404d30
jmp 0x41eb83
lea eax, [ebp - 0x10]
mov edx, dword [0x67e258]
mov edx, dword [edx]
mov edx, dword [edx + 0x10]
call fcn.00404d30
lea eax, [ebp - 0x10]
mov edx, ebx
sar edx, 1
jns 0x41eb8f
adc edx, 0
mov edx, dword [edx*4 + 0x67d0e8]
call fcn.00404f20
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp - 0x10]
call fcn.00404f04
push eax
call fcn.00406b1c
mov esi, eax
cmp esi, 0xffffffff
je 0x41ec9d
mov eax, 0x40
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x40
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp word [eax], 0x5a4d
jne 0x41ec90
push 0
push 0
mov eax, dword [eax + 0x3c]
push eax
push esi
call fcn.00406dcc
mov eax, edi
call fcn.00403288
mov eax, 0x18
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x18
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
cmp dword [eax], 0x4550
jne 0x41ec90
add eax, 4
mov dx, word [eax]
cmp dx, 0x14c
jb 0x41ec90
cmp dx, 0x150
ja 0x41ec90
mov eax, edi
call fcn.00403288
mov eax, 0xe0
call fcn.00403268
mov edi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0xe0
push edi
push esi
call fcn.00406d6c
test eax, eax
je 0x41ec90
mov eax, edi
mov dx, word [eax + 0x44]
cmp dx, word [ebp - 2]
jne 0x41ec90
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 8]
mov dword [edx], eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp - 0x10]
call fcn.00404d0c
mov eax, edi
call fcn.00403288
push esi
call fcn.00406ad4
mov eax, dword [ebp + 8]
mov eax, dword [eax]
xor edx, edx
call fcn.0040502c
jne 0x41ecb5
inc ebx
cmp ebx, 0x19
jne 0x41eb49
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x6660d2
lea eax, [ebp - 0x10]
call fcn.00404cd0
ret
Function at 0x4028ff
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x402917
push dword [esp + 4]
push 0x402898
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x402954
push esi
mov esi, dword [0x40c24c]
test esi, esi
je 0x402953
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40294b
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40c24c
call fcn.00408ac6
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x402924
pop edi
pop ebx
pop esi
ret 4
Function at 0x403dc5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
push dword [ebp + 8]
xor edi, edi
push dword [0x40ca30]
xor esi, esi
call fcn.004088a3
push edi
push edi
push 3
push edi
push edi
push 0x80000000
push dword [ebp + 0xc]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
je 0x403f2a
push edi
lea ecx, [ebp - 0xc]
push ecx
push 2
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 4], 0x4d42
jne 0x403e8a
mov al, byte [ebp + 0x10]
and al, 0x80
neg al
sbb eax, eax
and eax, 0xffffe000
add eax, 0x2010
push eax
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [0x40c224]
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
cmp esi, edi
je 0x403f2a
lea eax, [ebp - 0x38]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp word [ebp - 0x26], 8
ja 0x403f00
push esi
call dword [sym.imp.GDI32.dll_DeleteObject]
push 0x10
push edi
push edi
push edi
push dword [ebp + 0xc]
push dword [0x40c224]
call dword [sym.imp.USER32.dll_LoadImageA]
jmp 0x403eed
push 0x10
push edi
push edi
push 1
push dword [ebp + 0xc]
push dword [0x40c224]
call dword [sym.imp.USER32.dll_LoadImageA]
mov esi, eax
cmp esi, edi
je 0x403ed7
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x403f00
lea eax, [ebp - 0x38]
push eax
push 0x18
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_GetObjectA]
push dword [ebp - 0x14]
call dword [sym.imp.GDI32.dll_DeleteObject]
push dword [ebp - 0x10]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x403f00
push edi
push dword [ebp + 0xc]
call fcn.00408129
cmp eax, edi
je 0x403f00
push dword [ebp + 0x10]
push eax
call fcn.00403f45
mov esi, eax
cmp esi, edi
je 0x403f2a
lea eax, [ebp - 0x38]
push eax
push 0x18
push esi
call dword [sym.imp.GDI32.dll_GetObjectA]
cmp esi, edi
je 0x403f2a
cmp dword [ebp + 8], 0xffffffff
mov dword [ebx], esi
mov ax, word [ebp - 0x34]
mov word [ebx + 4], ax
mov ax, word [ebp - 0x30]
mov word [ebx + 6], ax
mov al, byte [ebp - 0x26]
mov byte [ebx + 8], al
mov al, byte [ebp + 0x10]
mov byte [ebx + 9], al
jne 0x403f2a
mov esi, ebx
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0xc

Function at 0x404ea9
Capabilities:
Get graphical window text

Disassembly:
push edi
push dword [esp + 8]
push dword [0x40ca54]
call fcn.00408907
mov edi, eax
test edi, edi
je 0x404f0b
mov eax, dword [edi + 4]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x404ed2
push dword [esp + 0xc]
push edi
call eax
jmp 0x404f0b
push ebx
push esi
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
push dword [esp + 0x14]
mov esi, eax
push esi
call fcn.00408ca0
mov ebx, eax
lea eax, [esi + 1]
push eax
push ebx
mov byte [ebx], 0
push dword [edi]
call dword [sym.imp.USER32.dll_GetWindowTextA]
push ebx
call sub.MSVCRT.dll_strlen
pop ecx
sub esi, eax
push esi
call fcn.00408d20
pop esi
pop ebx
pop edi
ret 8
Function at 0x406518
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 9
call esi
test al, al
jns 0x406586
push 0x11
call esi
test al, al
js 0x406586
push 0x10
call esi
test al, al
js 0x406586
push 0x12
call esi
test al, al
js 0x406586
mov esi, dword [sym.imp.USER32.dll_GetFocus]
push 5
lea eax, [ebp - 8]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameA]
push 4
lea eax, [ebp - 8]
push str.Rich
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
test eax, eax
jne 0x406586
push eax
push eax
push 0x44e
call esi
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
test ax, 0x800
je 0x4065aa
push str.PB_WindowID
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetPropA]
test eax, eax
je 0x4065aa
dec eax
push eax
push dword [0x40ca5c]
call fcn.00408907
mov eax, dword [eax + 8]
jmp 0x4065ac
xor eax, eax
pop esi
leave
ret 4
Function at 0x4ad01550
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
cmp word [ebp + 0xc], 0
mov eax, dword [0x4ad33b78]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
jne 0x4ad09d22
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01305
leave
ret 8
push edi
push dword [ebp + 0xc]
mov edi, dword [sym.imp.msvcrt.dll_towupper]
mov word [ebp - 0xc], 0x3d
call edi
and word [ebp - 6], 0
mov word [ebp - 0xa], ax
pop ecx
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 8], 0x3a
call fcn.4ad01b70
test eax, eax
je 0x4ad17491
test esi, esi
je 0x4ad09d63
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
xor eax, eax
pop edi
jmp 0x4ad0157d
push dword [ebp + 0xc]
call edi
mov word [esi], ax
inc esi
inc esi
mov word [esi], 0x3a
inc esi
inc esi
mov word [esi], 0x5c
and word [esi + 2], 0
xor eax, eax
pop ecx
inc eax
jmp 0x4ad09d65

Function at 0x4ad01a26
Capabilities:
Set console window title

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
xor edi, edi
cmp dword [ebp + 8], edi
je 0x4ad01a49
cmp dword [0x4ad2fac4], edi
jne 0x4ad01a49
cmp dword [0x4ad2fabc], edi
je 0x4ad0f384
pop edi
leave
ret 4
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x20c
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
cmp ebx, edi
mov dword [ebp - 8], ebx
je 0x4ad0f435
push 0x104
push ebx
call dword [sym.imp.KERNEL32.dll_GetConsoleTitleW]
cmp eax, edi
mov dword [ebp - 4], eax
je 0x4ad0f435
push dword [ebp + 8]
mov edi, dword [sym.imp.msvcrt.dll_wcslen]
call edi
pop ecx
mov ecx, dword [0x4ad33af8]
add ecx, eax
add ecx, dword [ebp - 4]
lea eax, [ecx + ecx + 0x14]
push eax
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapReAlloc]
mov ebx, eax
test ebx, ebx
je 0x4ad17123
cmp byte [0x4ad33afc], 0
jne 0x4ad1712b
push 0x4ad0f43c
push ebx
call dword [sym.imp.msvcrt.dll_wcscat]
push ebx
call edi
push dword [ebp + 8]
mov dword [0x4ad33af8], eax
push ebx
call dword [sym.imp.msvcrt.dll_wcscat]
add esp, 0x14
mov byte [0x4ad33afc], 1
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
push ebx
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
pop ebx
jmp 0x4ad01a49
push dword [ebp - 8]
jmp 0x4ad0f42a
mov eax, dword [0x4ad33af8]
push dword [ebp + 8]
lea eax, [ebx + eax*2]
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
pop ecx
pop ecx
jmp 0x4ad0f422
Function at 0x4ad01b70
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
and word [0x4ad2ba20], 0
push ebx
push esi
mov ebx, 0x2000
push ebx
mov esi, 0x4ad2ba20
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4ad045aa
mov eax, esi
pop esi
pop ebx
pop ebp
ret 4
cmp byte [0x4ad2fa64], 0
push edi
je 0x4ad0464a
mov edi, dword [sym.imp.msvcrt.dll__wcsicmp]
push 0x4ad34190
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12df9
push str.ERRORLEVEL
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad0a861
push str.CMDEXTVERSION
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e05
push 0x4ad04664
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e0c
push str.DATE
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e17
push str.TIME
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e23
push 0x4ad04654
push dword [ebp + 8]
call edi
test eax, eax
pop ecx
pop ecx
je 0x4ad12e3b
xor eax, eax
pop edi
jmp 0x4ad01b9e
push dword [0x4ad2fa20]
push 0x4ad081bc
push esi
call dword [sym.imp.msvcrt.dll_swprintf]
add esp, 0xc
mov eax, esi
jmp 0x4ad0464c
push eax
push esi
call fcn.4ad01550
jmp 0x4ad0a876
push 2
jmp 0x4ad0a867
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x4ad0464c
push ebx
push esi
push 1
push eax
call fcn.4ad0b5cc
jmp 0x4ad12e2d
push ebx
push esi
push 1
push eax
call fcn.4ad0b380
and word [eax*2 + 0x4ad2ba20], 0
jmp 0x4ad0a876
call dword [sym.imp.msvcrt.dll_rand]
push eax
jmp 0x4ad0a867
Function at 0x4ad02a5b
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4ad33b78]
and word [ebp - 6], 0
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0xc], ax
mov ax, word [0x4ad33b8c]
mov word [ebp - 8], ax
lea eax, [ebp - 0xc]
push eax
mov word [ebp - 0xa], 0x3a
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor ecx, ecx
inc ecx
cmp ecx, eax
mov ecx, dword [ebp - 4]
sbb eax, eax
neg eax
call fcn.4ad01305
leave
ret 4

Function at 0x4ad02bc9
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
je 0x4ad12dcf
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
cmp esi, ebx
je 0x4ad12dd6
push edi
push ebx
push dword [ebp + 8]
call fcn.4ad02b6b
mov edi, eax
push 0x20
push edi
mov dword [ebp + 8], edi
call fcn.4ad01a53
cmp eax, ebx
jne 0x4ad12ddd
cmp edi, ebx
je 0x4ad02c58
push edi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov edi, eax
test esi, esi
je 0x4ad02c5c
push esi
call dword [sym.imp.msvcrt.dll_wcslen]
pop ecx
mov ebx, eax
test ebx, ebx
jbe 0x4ad02c4f
cmp dword [0x4ad2b9e8], 0
jne 0x4ad02c4f
push edi
push esi
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4ad12de5
lea esi, [esi + ebx*2 + 2]
jmp 0x4ad02c18
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 4
xor edi, edi
jmp 0x4ad02c18
xor ebx, ebx
jmp 0x4ad02c26
xor eax, eax
jmp 0x4ad02c53
xor eax, eax
jmp 0x4ad02c52
mov word [eax], bx
jmp 0x4ad02c0a
cmp word [esi + edi*2], 0x3d
jne 0x4ad02c49
lea eax, [esi + edi*2 + 2]
jmp 0x4ad02c51
Function at 0x4ad02e82
Capabilities:
Get file size
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0xc]
push ebx
push esi
xor ebx, ebx
push edi
inc ebx
xor edi, edi
and eax, 3
cmp eax, 2
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0xc
ja 0x4ad0e2c0
test byte [ebp + 0xc], bl
je 0x4ad02ebd
test byte [ebp + 0xc], 8
jne 0x4ad0e2c0
cmp eax, edi
mov esi, 0x80000000
je 0x4ad067fa
push 0x4ad03d08
push dword [ebp + 8]
mov dword [ebp - 8], 0x40000000
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
pop ecx
pop ecx
je 0x4ad02ee8
mov dword [ebp + 0x10], ebx
push 2
cmp dword [ebp + 0xc], 0x10a
pop eax
push edi
je 0x4ad0e272
push 0x80
push eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad17170
push 8
push ebx
call dword [sym.imp.msvcrt.dll__open_osfhandle]
test byte [ebp + 0xc], 8
pop ecx
pop ecx
mov dword [ebp + 0x10], eax
jne 0x4ad0e030
push dword [ebp + 0x10]
call fcn.4ad02e4b
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebx
leave
ret 0xc
mov dword [ebp - 8], esi
push 3
jmp 0x4ad02eea
push eax
call fcn.4ad02c65
test eax, eax
jne 0x4ad02f35
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
test eax, eax
je 0x4ad02f35
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
mov dword [ebp - 0xc], edi
call esi
cmp eax, 0xffffffff
je 0x4ad17144
push edi
lea eax, [ebp - 0x10]
push eax
push 1
lea eax, [ebp - 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4ad17193
cmp word [ebp - 0xc], 0x1a
jne 0x4ad02f35
jmp 0x4ad171a5
mov edi, 0x80
push edi
push 3
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
mov eax, dword [ebp - 8]
or eax, esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateFileW]
push eax
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4ad0e2a0
xor edi, edi
jmp 0x4ad02f1d
push 0
push edi
push 4
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x10]
push dword [ebp - 8]
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x4ad0e299
jmp 0x4ad17170
or eax, 0xffffffff
jmp 0x4ad02f40
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
mov dword [0x4ad2ba04], eax
je 0x4ad0e06f
cmp dword [ebp + 0x10], 0xffffffff
je 0x4ad0e2c0
push dword [ebp + 0x10]
call dword [sym.imp.msvcrt.dll__close]
pop ecx
jmp 0x4ad0e2c0
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x6e
mov dword [0x4ad2ba04], eax
jne 0x4ad0e2c0
mov dword [0x4ad2ba04], 2
jmp 0x4ad0e2c0
push 2
lea eax, [ebp - 4]
push eax
push edi
push ebx
mov dword [ebp - 4], edi
call esi
jmp 0x4ad0e089
or dword [ebp - 4], 0xffffffff
push 2
lea eax, [ebp - 4]
push eax
push 0xffffffffffffffff
push ebx
call esi
jmp 0x4ad02f35
Function at 0x4ad02f53
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x220
mov eax, dword [0x4ad33b78]
mov dword [ebp - 4], eax
mov ax, word [ebp + 8]
mov word [ebp - 0x10], ax
mov ax, word [0x4ad33b8c]
push esi
mov word [ebp - 0xc], ax
lea eax, [ebp - 0x10]
xor esi, esi
push eax
mov word [ebp - 0xe], 0x3a
mov word [ebp - 0xa], si
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 1
jbe 0x4ad02fd6
cmp eax, 2
je 0x4ad02fc7
cmp eax, 5
je 0x4ad02fc7
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x220]
push eax
push 0x104
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
je 0x4ad17103
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
call fcn.4ad01305
leave
ret 4
xor eax, eax
inc eax
jmp 0x4ad02fc9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 5
je 0x4ad02fd6
jmp 0x4ad02fc7
Function at 0x4ad04e81
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
and dword [esi], 0
lea eax, [ebp + 8]
push eax
push 0x20019
push 0
push 0x4ad04eb8
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4ad1492e
pop esi
leave
ret 4
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 8]
push eax
push 0
push 0x4ad1495c
push dword [ebp + 8]
mov dword [ebp - 4], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4ad04eb2

Function at 0x4ad05046
Capabilities:
Parse pe header

Disassembly:
push 0x28
push 0x4ad05168
call fcn.4ad0161a
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x4ad05159
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4ad05159
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
jne 0x4ad1903e
cmp dword [ecx + 0x74], 0xe
jbe 0x4ad05159
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x4ad2fa50], 0xffffffff
or dword [0x4ad2fa4c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x4ad34878]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x4ad34874]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x4ad2fa54], eax
call fcn.4ad04fd0
cmp dword [0x4ad34868], edi
je 0x4ad19063
call fcn.4ad05184
push 0x4ad34860
push 0x4ad3485c
call sub.msvcrt.dll__initterm
mov eax, dword [0x4ad34870]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x4ad3486c]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x4ad34858
push 0x4ad34850
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.4ad03fdd
jmp 0x4ad19074
mov dword [ebp - 0x1c], edi
jmp 0x4ad0509e
cmp eax, 0x20b
jne 0x4ad05159
cmp dword [ecx + 0x84], 0xe
jbe 0x4ad05159
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x4ad05098
push fcn.4ad04fd0
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
jmp 0x4ad050f1
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x4ad19088
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x4ad190c7
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.4ad01442
ret
Function at 0x4ad062eb
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4ad33b78]
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
push 0x20
mov dword [ebp - 4], eax
call fcn.4ad01758
mov esi, eax
push esi
mov dword [esi], edi
call fcn.4ad06142
mov eax, dword [esi + 0x14]
mov ebx, dword [esi]
mov edi, dword [esi + 8]
push 0x208
mov dword [ebp - 0x210], eax
call fcn.4ad01758
push 0
push eax
mov dword [0x4ad33ae8], eax
call fcn.4ad01550
push 0x104
push ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01aa5
test eax, eax
jne 0x4ad0640f
mov ax, word [0x4ad33b8c]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.4ad01a53
and word [eax + 2], 0
lea eax, [ebp - 0x20c]
push eax
push 0x4ad34400
call dword [sym.imp.msvcrt.dll_wcscpy]
test edi, edi
pop ecx
pop ecx
je 0x4ad063eb
mov ax, word [edi]
cmp ax, 0x3a
je 0x4ad063eb
cmp ax, word [0x4ad33b8c]
jne 0x4ad063b3
cmp edi, ebx
je 0x4ad0640b
push edi
push ebx
call fcn.4ad06419
mov ax, word [eax]
cmp ax, 0x3a
je 0x4ad0640b
cmp ax, word [0x4ad33b8c]
je 0x4ad0640b
mov ax, word [edi]
and word [edi], 0
push ebx
mov word [ebp - 0x214], ax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4ad16de0
and dword [0x4ad2ba04], 0
mov ax, word [ebp - 0x214]
mov word [edi], ax
cmp dword [0x4ad2ba04], 0
jne 0x4ad0640f
push esi
call fcn.4ad06142
mov eax, dword [ebp - 0x210]
mov dword [esi + 0x14], eax
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.4ad01305
leave
ret 4
inc edi
inc edi
jmp 0x4ad063b3
xor eax, eax
inc eax
jmp 0x4ad063fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x4ad2ba04], eax
jmp 0x4ad063d8
Function at 0x4ad064bd
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0x10]
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.msvcrt.dll__get_osfhandle]
xor ebx, ebx
cmp byte [0x4ad34b74], bl
pop ecx
mov dword [ebp + 8], eax
jne 0x4ad15df1
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp + 0xc], eax
mov edi, 0x4ad290a0
mov esi, 0x2000
cmp dword [ebp + 0x10], esi
ja 0x4ad15e05
cmp dword [ebp + 0x10], ebx
je 0x4ad0654a
push ebx
push ebx
push esi
push edi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push dword [0x4ad2b9ec]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push ebx
mov ebx, dword [ebp + 0x14]
mov esi, eax
push ebx
dec esi
push esi
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad06546
cmp dword [ebx], esi
jne 0x4ad06546
mov eax, dword [ebp - 8]
mov dword [ebx], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
jmp 0x4ad0653f
mov ebx, dword [ebp + 0x14]
jmp 0x4ad06537
push ebx
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x4ad06540
push ebx
push ebx
push esi
push edi
push 0x1000
push dword [ebp + 0xc]
push ebx
push dword [0x4ad2b9ec]
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
add dword [ebp + 0xc], esi
sub dword [ebp + 0x10], esi
push ebx
push dword [ebp + 0x14]
mov dword [ebp - 4], eax
push eax
push edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4ad06546
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], eax
je 0x4ad064f8
jmp 0x4ad06546