joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421900
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0x10]
push ebp
push esi
mov esi, dword [esp + 0x14]
push edi
push ebx
push edx
push esi
mov edi, ecx
mov dword [esp + 0x1c], 0
mov ebp, 1
call sub.Storm.dll_Ordinal_501
mov dl, 0x2e
mov ecx, esi
call sub.Storm.dll_Ordinal_569
test eax, eax
je 0x421934
mov byte [eax], 0
push ebx
push str..dll
push esi
call sub.Storm.dll_Ordinal_503
lea eax, [esp + 0x10]
push eax
push 0
push esi
push edi
call sub.Storm.dll_Ordinal_268
test eax, eax
jne 0x42195a
lea ebp, [eax + 2]
jmp 0x4219e7
mov ecx, dword [esp + 0x10]
push 0
push ecx
call sub.Storm.dll_Ordinal_265
push 0
push 0x2c
mov edi, eax
push str..W32OsBattleNet.cpp
push edi
call sub.Storm.dll_Ordinal_401
mov ebx, eax
test ebx, ebx
jne 0x421982
lea ebp, [eax + 3]
jmp 0x4219d4
mov edx, dword [esp + 0x10]
push 0
push 0
push edi
push ebx
push edx
call sub.Storm.dll_Ordinal_269
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4219cf
push 0
lea eax, [esp + 0x20]
push eax
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x1c], edi
je 0x4219d4
mov ebp, 5
test ebx, ebx
je 0x4219e7
push 0
push 0x4e
push str..W32OsBattleNet.cpp
push ebx
call sub.Storm.dll_Ordinal_403
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4219f5
push eax
call sub.Storm.dll_Ordinal_253
pop edi
pop esi
mov eax, ebp
pop ebp
pop ebx
pop ecx
ret 8
Function at 0x421a00
Capabilities:
Delete file

Disassembly:
sub esp, 0x128
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x12c]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x14c]
mov ebp, ecx
mov ecx, dword [esp + 0x13c]
push edi
mov edi, dword [esp + 0x14c]
mov dword [esp + 0x20], ecx
lea ecx, [esp + 0x14]
push ecx
push 0
mov ebx, edx
mov edx, dword [esp + 0x14c]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x150]
push 0
push ebp
mov dword [esp + 0x3c], edx
mov dword [esp + 0x2c], eax
mov dword [esp + 0x24], 0
call sub.Storm.dll_Ordinal_266
test eax, eax
jne 0x421a7b
mov eax, 4
jmp 0x421b6e
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push eax
mov byte [esp + 0x38], 0
call sub.Storm.dll_Ordinal_251
mov eax, dword [esp + 0x24]
test eax, eax
je 0x421aa9
cmp eax, 5
jae 0x421aa9
mov dword [esp + 0x10], 4
jmp 0x421b45
push 0x104
lea ecx, [esp + 0x34]
push ecx
mov ecx, dword [esp + 0x1c]
mov edx, ebp
call fcn.00421900
cmp eax, 1
mov dword [esp + 0x10], eax
jne 0x421b45
lea edx, [esp + 0x30]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esp + 0x18], eax
jne 0x421ae4
mov dword [esp + 0x10], 2
jmp 0x421b3a
push str.CheckRevision
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x421b2e
test esi, esi
jne 0x421afd
mov esi, 0x456d7a
test edi, edi
mov edx, edi
jne 0x421b08
mov edx, 0x456d7a
mov ecx, dword [esp + 0x1c]
test ecx, ecx
jne 0x421b15
mov ecx, 0x456d7a
mov edi, dword [esp + 0x2c]
push edi
mov edi, dword [esp + 0x24]
push edi
mov edi, dword [esp + 0x30]
push edi
push ebx
push esi
push edx
push ecx
call eax
test eax, eax
jne 0x421b36
mov dword [esp + 0x10], 2
mov eax, dword [esp + 0x18]
test eax, eax
je 0x421b45
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0x14]
test eax, eax
je 0x421b53
push eax
call sub.Storm.dll_Ordinal_252
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebp
call esi
cmp byte [esp + 0x30], 0
je 0x421b6a
lea eax, [esp + 0x30]
push eax
call esi
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x134]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.00401d9e
add esp, 0x128
ret 0x18
Function at 0x421b90
Capabilities:
Delete file

Disassembly:
sub esp, 0x114
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x110], eax
push ebx
push esi
lea eax, [esp + 0xc]
push eax
push 0
mov ebx, ecx
push 0
push ebx
mov esi, edx
mov dword [esp + 0x1c], 0
call sub.Storm.dll_Ordinal_266
test eax, eax
jne 0x421be1
pop esi
mov eax, 4
pop ebx
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.00401d9e
add esp, 0x114
ret
mov edx, dword [esp + 0xc]
lea ecx, [esp + 0x10]
push ecx
push edx
mov byte [esp + 0x1c], 0
call sub.Storm.dll_Ordinal_251
mov eax, dword [esp + 0x10]
test eax, eax
je 0x421c0f
cmp eax, 5
jae 0x421c0f
mov dword [esp + 8], 4
jmp 0x421c9f
mov ecx, dword [esp + 0xc]
push 0x104
lea eax, [esp + 0x18]
push eax
mov edx, ebx
call fcn.00421900
cmp eax, 1
mov dword [esp + 8], eax
jne 0x421c9f
push ebp
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebp, eax
test ebp, ebp
jne 0x421c49
mov dword [esp + 0xc], 2
jmp 0x421c93
push edi
push str.ExtraWork
push ebp
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x421c8a
push 0x1004
push 0
push esi
call sub.MSVCR80.dll_memset
add esp, 0xc
mov word [esi], 2
mov word [esi + 2], 4
call sub.Storm.dll_Ordinal_294
movzx edx, ax
mov ecx, esi
mov dword [esi + 4], edx
call edi
test eax, eax
jne 0x421c92
mov dword [esp + 0x10], 2
pop edi
test ebp, ebp
je 0x421c9e
push ebp
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
pop ebp
mov eax, dword [esp + 0xc]
test eax, eax
je 0x421cad
push eax
call sub.Storm.dll_Ordinal_252
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
push ebx
call esi
cmp byte [esp + 0x14], 0
je 0x421cc4
lea eax, [esp + 0x14]
push eax
call esi
mov ecx, dword [esp + 0x118]
mov eax, dword [esp + 8]
pop esi
pop ebx
xor ecx, esp
call fcn.00401d9e
add esp, 0x114
ret
Function at 0x422150
Capabilities:
Identify system language via api

Disassembly:
sub esp, 0xb0
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0xac], eax
push 0xac
lea eax, [esp + 4]
push 0
push eax
call sub.MSVCR80.dll_memset
add esp, 0xc
lea ecx, [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
movzx eax, ax
mov edx, eax
and edx, 0x3ff
cmp edx, 9
jne 0x4221a9
and eax, 0xfc00
cmp eax, 0xc00
mov eax, 0x1e0
je 0x4221ac
mov eax, dword [esp]
mov ecx, dword [esp + 0xac]
xor ecx, esp
call fcn.00401d9e
add esp, 0xb0
ret

Function at 0x422280
Capabilities:
Get geographical location

Disassembly:
sub esp, 0x44
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x40], eax
push 0x40
lea eax, [esp + 4]
push eax
push 7
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [esp + 0x40]
mov byte [esp + 3], 0
mov eax, dword [esp]
xor ecx, esp
call fcn.00401d9e
add esp, 0x44
ret

Function at 0x422eb7
Capabilities:
Hash data with crc32

Disassembly:
cmp dword [0x47005c], 0
push esi
mov esi, ecx
je 0x422fa0
mov ecx, dword [0x470058]
call fcn.00444810
test eax, eax
je 0x422fa0
mov ecx, dword [eax + 0x14]
test ecx, ecx
push ebx
mov ebx, dword [eax + 0x1818]
je 0x422f9f
cmp dword [0x463ef0], 0
je 0x422f9f
cmp dword [eax + 0x10], 0
je 0x422f9f
mov eax, dword [ecx + 0xc]
mov edx, eax
xor edx, esi
shr eax, 8
and edx, 0xff
xor eax, dword [edx*4 + 0x458490]
push edi
mov edx, eax
mov edi, edx
shr edx, 8
mov eax, esi
shr eax, 8
xor edi, eax
and edi, 0xff
xor edx, dword [edi*4 + 0x458490]
shr eax, 8
mov edi, edx
xor edi, eax
shr edx, 8
shr eax, 8
and edi, 0xff
xor edx, dword [edi*4 + 0x458490]
or bl, 0x80
xor eax, edx
and eax, 0xff
shr edx, 8
xor edx, dword [eax*4 + 0x458490]
mov eax, dword [ecx + 0x4524]
mov dword [ecx + 0xc], edx
movzx edx, al
add eax, 1
mov dword [ecx + 0x4524], eax
lea eax, [ecx + edx*4]
lea eax, [edx + eax + 0x4020]
mov dword [eax], esi
mov byte [eax + 4], bl
mov eax, dword [ecx + 0x4520]
lea edx, [eax + 0x101]
cmp dword [ecx + 0x4524], edx
pop edi
jne 0x422f9f
add eax, 1
mov dword [ecx + 0x4520], eax
pop ebx
pop esi
ret
Function at 0x423b10
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
push esi
mov ebp, ecx
push edi
mov ecx, 0x470060
call fcn.004129a0
mov eax, dword [0x47005c]
mov ecx, eax
add eax, 1
test ecx, ecx
mov dword [0x47005c], eax
jne 0x423b3c
call sub.KERNEL32.dll_TlsAlloc
mov dword [0x470058], eax
mov ecx, dword [0x470058]
call fcn.00444810
test eax, eax
je 0x423b89
mov esi, dword [eax]
test esi, esi
je 0x423b7a
mov edx, dword [eax + 4]
test edx, edx
jg 0x423b5c
not edx
jmp 0x423b63
mov ecx, eax
sub ecx, dword [esi + 4]
add edx, ecx
mov dword [edx], esi
mov edx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [edx + 4], ecx
mov dword [eax], 0
mov dword [eax + 4], 0
push 0
push 0xffffffffffffffff
push 0x456b10
push eax
call sub.Storm.dll_Ordinal_403
push 8
push 0xe5
push str..W32OsCall.cpp
push 0x189c
call sub.Storm.dll_Ordinal_401
test eax, eax
je 0x423bb4
mov dword [eax], 0
mov dword [eax + 4], 0
mov esi, eax
jmp 0x423bb6
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push 2
push 0
push 0
lea edx, [esi + 0xc]
push edx
mov dword [esi + 8], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
mov eax, dword [esi + 8]
push eax
push ebp
push str._s___u_
lea ecx, [esi + 0x181c]
push 0x80
push ecx
call sub.Storm.dll_Ordinal_578
mov ecx, dword [0x470058]
add esp, 0x14
mov edx, esi
call fcn.00444840
mov edx, dword [esi]
test edx, edx
je 0x423c3c
mov ecx, dword [esi + 4]
test ecx, ecx
jg 0x423c1e
not ecx
jmp 0x423c25
mov eax, esi
sub eax, dword [edx + 4]
add ecx, eax
mov dword [ecx], edx
mov edx, dword [esi]
mov eax, dword [esi + 4]
mov dword [edx + 4], eax
mov dword [esi], 0
mov dword [esi + 4], 0
mov eax, dword [0x463ef8]
mov dword [esi], eax
mov ecx, dword [eax + 4]
mov dword [esi + 4], ecx
mov dword [eax + 4], esi
mov edx, dword [0x470064]
push edx
mov dword [0x463ef8], esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
pop esi
pop ebp
ret

Function at 0x4240c0
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
xor eax, eax
mov dword [esp], eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x14]
test eax, eax
jne 0x4240ff
mov eax, 1
add esp, 0x24
ret
Function at 0x424330
Capabilities:
Check os version

Disassembly:
sub esp, 0xa0
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
push edi
push 0x9c
xor esi, esi
lea eax, [esp + 0xc]
push esi
push eax
call sub.MSVCR80.dll_memset
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
jne 0x42439e
lea edx, [esp + 8]
push edx
mov dword [esp + 0xc], 0x94
call edi
test eax, eax
jne 0x42439e
pop edi
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.00401d9e
add esp, 0xa0
ret
mov eax, dword [esp + 0x18]
sub eax, 1
je 0x424403
sub eax, 1
jne 0x424446
mov eax, dword [esp + 0xc]
cmp eax, 4
jne 0x4243c1
lea esi, [eax + 2]
jmp 0x424446
cmp eax, 5
jne 0x4243e7
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4243d3
lea esi, [eax + 7]
jmp 0x424446
cmp eax, 1
jne 0x4243dd
lea esi, [eax + 7]
jmp 0x424446
cmp eax, 2
jne 0x424446
lea esi, [eax + 7]
jmp 0x424446
cmp eax, 6
jne 0x424446
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x4243f9
lea esi, [eax + 0xa]
jmp 0x424446
cmp eax, 1
jne 0x424446
lea esi, [eax + 0xa]
jmp 0x424446
cmp dword [esp + 0xc], 4
jne 0x424446
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x424428
lea esi, [eax + 1]
mov al, byte [esp + 0x1d]
cmp al, 0x43
je 0x424421
cmp al, 0x42
jne 0x424446
mov esi, 2
jmp 0x424446
cmp eax, 0xa
jne 0x42443c
cmp byte [esp + 0x1d], 0x41
lea esi, [eax - 7]
jne 0x424446
lea esi, [eax - 6]
jmp 0x424446
cmp eax, 0x5a
jne 0x424446
mov esi, 5
mov ecx, dword [esp + 0xa4]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00401d9e
add esp, 0xa0
ret

Function at 0x424480
Capabilities:
Get memory capacity

Disassembly:
sub esp, 0x20
lea eax, [esp]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [esp + 8]
add esp, 0x20
ret
Function at 0x4244f0
Capabilities:
Create process on windows
Delete file

Disassembly:
sub esp, 0x104
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x100], eax
push edi
mov edi, ecx
test edi, edi
je 0x4245eb
cmp byte [edi], 0
je 0x4245eb
push ebx
call dword [sym.imp.USER32.dll_GetActiveWindow]
mov ebx, eax
test ebx, ebx
jne 0x42453c
pop ebx
pop edi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00401d9e
add esp, 0x104
ret
push ebp
mov ebp, dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 1
push 0
push 0
push edi
push str.open
push ebx
call ebp
cmp eax, 0x20
jbe 0x424574
pop ebp
pop ebx
mov eax, 1
pop edi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00401d9e
add esp, 0x104
ret
push esi
push 0x458948
push str.8BLZ2112.HTM
call dword [sym.imp.MSVCR80.dll_fopen]
push eax
call dword [sym.imp.MSVCR80.dll_fclose]
add esp, 0xc
lea eax, [esp + 0x10]
push eax
push 0
push str.8BLZ2112.HTM
call dword [sym.imp.SHELL32.dll_FindExecutableA]
mov esi, eax
cmp esi, 0x20
jbe 0x4245bc
push 1
push 0
push edi
lea ecx, [esp + 0x1c]
push ecx
push str.open
push ebx
call ebp
mov esi, eax
push str.8BLZ2112.HTM
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edx, 0x20
cmp edx, esi
pop esi
pop ebp
sbb eax, eax
pop ebx
neg eax
pop edi
mov ecx, dword [esp + 0x100]
xor ecx, esp
call fcn.00401d9e
add esp, 0x104
ret
mov ecx, dword [esp + 0x104]
pop edi
xor ecx, esp
xor eax, eax
call fcn.00401d9e
add esp, 0x104
ret

Function at 0x4246e0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x4246f2
ret
push esi
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
jne 0x42470b
call dword [sym.imp.USER32.dll_CloseClipboard]
xor eax, eax
pop esi
ret
push ebx
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GlobalSize]
push 0
push 0x34
mov edi, eax
push str..W32OsClipboard.cpp
push edi
call sub.Storm.dll_Ordinal_401
push esi
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x42473e
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
xor eax, eax
pop esi
ret
push edi
push eax
push ebx
call sub.Storm.dll_Ordinal_501
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
mov eax, ebx
pop ebx
pop esi
ret
Function at 0x424760
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push ebp
push esi
push edi
mov ebx, ecx
call dword [sym.imp.USER32.dll_GetActiveWindow]
push ebx
mov ebp, eax
call sub.Storm.dll_Ordinal_506
mov esi, eax
add esi, 1
push esi
push 0x2042
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edi, eax
test edi, edi
je 0x42479c
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
jne 0x4247a3
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push esi
push ebx
push eax
call sub.Storm.dll_Ordinal_501
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push ebp
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x4247cd
call dword [sym.imp.USER32.dll_EmptyClipboard]
test eax, eax
jne 0x4247db
call dword [sym.imp.USER32.dll_CloseClipboard]
push edi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push edi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret

Function at 0x424850
Capabilities:
Read file on windows

Disassembly:
test edx, edx
jne 0x424860
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
ret 8
mov eax, dword [esp + 8]
test eax, eax
je 0x424854
push 0
push eax
mov eax, dword [esp + 0xc]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
ret 8

Function at 0x424880
Capabilities:
Write file on windows

Disassembly:
test edx, edx
jne 0x424890
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
ret 8
mov eax, dword [esp + 8]
test eax, eax
je 0x424884
push 0
push eax
mov eax, dword [esp + 0xc]
push eax
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
ret 8

Function at 0x424910
Capabilities:
Get file size

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [esp + 4]
add esp, 8
ret

Function at 0x424a00
Capabilities:
Get file attributes

Disassembly:
test ecx, ecx
jne 0x424a0e
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
ret
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret

Function at 0x424a20
Capabilities:
Set file attributes

Disassembly:
test ecx, ecx
jne 0x424a2e
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
ret
push edx
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret
Function at 0x424a90
Capabilities:
Create directory

Disassembly:
sub esp, 0x108
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x104], eax
push edi
mov edi, ecx
test edi, edi
jne 0x424aca
push 0x57
call sub.Storm.dll_Ordinal_465
xor eax, eax
pop edi
mov ecx, dword [esp + 0x104]
xor ecx, esp
call fcn.00401d9e
add esp, 0x108
ret
test edx, edx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
je 0x424b30
push esi
push 0x104
push edi
lea eax, [esp + 0x14]
push eax
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0xc]
call sym.War3.exe_HX
lea ecx, [esp + 0xc]
call sym.War3.exe_LQ
lea ecx, [esp + eax + 0xc]
mov dl, 0x5c
call sub.Storm.dll_Ordinal_569
mov esi, eax
test esi, esi
je 0x424b2f
lea esp, [esp]
push 0
lea ecx, [esp + 0x10]
push ecx
mov byte [esi], 0
call ebx
lea ecx, [esi + 1]
mov dl, 0x5c
mov byte [esi], 0x5c
call sub.Storm.dll_Ordinal_569
mov esi, eax
test esi, esi
jne 0x424b10
pop esi
push 0
push edi
call ebx
mov ecx, dword [esp + 0x10c]
pop ebx
pop edi
xor ecx, esp
call fcn.00401d9e
add esp, 0x108
ret

Function at 0x424cf0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x364
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x360], eax
push ebx
mov ebx, dword [esp + 0x370]
push esi
push edi
mov edi, dword [esp + 0x374]
push bind
push ecx
lea eax, [esp + 0x270]
push eax
mov esi, edx
call sub.Storm.dll_Ordinal_501
lea ecx, [esp + 0x268]
call sym.War3.exe_HW
push bind
push esi
lea ecx, [esp + 0x270]
push ecx
call sub.Storm.dll_Ordinal_503
lea edx, [esp + 0x128]
push edx
lea eax, [esp + 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
xor eax, eax
cmp esi, 0xffffffff
mov dword [esp + 0xc], eax
je 0x424e41
push ebp
push bind
lea ecx, [esp + 0x15c]
push ecx
lea edx, [esp + 0x24]
push edx
call sub.Storm.dll_Ordinal_501
mov edx, dword [esp + 0x140]
mov ecx, dword [esp + 0x144]
xor eax, eax
or eax, edx
mov dword [esp + 0x124], eax
mov eax, dword [esp + 0x14c]
xor ebp, ebp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x12c]
or ecx, ebp
test al, 0x10
mov dword [esp + 0x128], ecx
mov dword [esp + 0x18], ebp
je 0x424dce
mov dword [esp + 0x18], 0x10
test al, 1
je 0x424dd7
or dword [esp + 0x18], 1
mov ecx, eax
and ecx, 2
je 0x424de3
or dword [esp + 0x18], 2
and eax, 4
je 0x424ded
or dword [esp + 0x18], 4
cmp dword [esp + 0x380], 0
jne 0x424dfb
test ecx, ecx
jne 0x424e15
cmp dword [esp + 0x384], 0
jne 0x424e09
test eax, eax
jne 0x424e15
mov edx, ebx
lea ecx, [esp + 0x14]
call edi
test eax, eax
jne 0x424e32
lea ecx, [esp + 0x12c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x424d71
mov edi, dword [esp + 0x10]
jmp 0x424e37
mov edi, 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, edi
pop ebp
mov ecx, dword [esp + 0x36c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.00401d9e
add esp, 0x364
ret 0x10
Function at 0x424e60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push ecx
push connect
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x424e8b
xor eax, eax
pop esi
add esp, 0xc
ret 4
mov ecx, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
push esi
lea eax, [esp + 0x14]
push eax
push 0
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x14]
push 0x456d7a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [esp + 0xc], 1
jne 0x424ecb
test esi, esi
sete al
pop esi
add esp, 0xc
ret 4

Function at 0x424ee0
Capabilities:
Set registry value

Disassembly:
push ecx
push esi
push 0
lea eax, [esp + 8]
push eax
push 0
push 0x20006
push 0
push 0
push 0
push ecx
push connect
mov esi, edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x424f32
push esi
call sub.Storm.dll_Ordinal_506
mov ecx, dword [esp + 4]
add eax, 1
push eax
push esi
push 1
push 0
push 0x456d7a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
ret

Function at 0x425040
Capabilities:
Set registry value

Disassembly:
sub esp, 0x210
mov eax, dword [0x46304c]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
mov eax, 2
mov esi, edx
cmp eax, esi
sbb eax, eax
neg eax
sub eax, 1
push edi
mov edi, dword [esp + 0x21c]
jne 0x42507b
push 0x57
call sub.Storm.dll_Ordinal_465
jmp 0x425114
push 0x104
lea edx, [esp + 0x114]
call sym.War3.exe_Fe
test eax, eax
je 0x425114
push bind
lea ecx, [esp + 0x114]
push ecx
lea edx, [esp + 0x14]
push edx
call sub.Storm.dll_Ordinal_501
mov eax, dword [esi*4 + 0x4589f4]
push bind
push eax
lea ecx, [esp + 0x14]
push ecx
call sub.Storm.dll_Ordinal_503
push 0
lea edx, [esp + 0xc]
push edx
push 0
push 0x20006
push 0
push 0
push 0
lea eax, [esp + 0x28]
push eax
push connect
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x425114
push edi
call sub.Storm.dll_Ordinal_506
mov ecx, dword [esp + 8]
add eax, 1
push eax
push edi
push 1
push 0
push 0x456d7a
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x214]
pop edi
pop esi
xor ecx, esp
call fcn.00401d9e
add esp, 0x210
ret 4