joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4012bc
Capabilities:
Hash data with crc32

Disassembly:
cmp dword [0x44d424], 0
push ebp
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x4012f9
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x4012e4
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x4012d6
mov dword [ecx*4 + 0x44d420], eax
inc ecx
cmp ecx, 0x100
jne 0x4012cf
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x40131b
mov cl, byte [edx]
inc edx
xor cl, al
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x44d420]
jmp 0x401303
pop ebx
not eax
pop esi
pop ebp
ret 0xc

Function at 0x40139c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x38]
sub esp, 0x3c
mov dword [esp + 4], eax
mov esi, dword [ebp + 8]
lea edi, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x40001
mov dword [ebp - 0x28], 0x40d9f0
mov dword [ebp - 0x24], 0x40d9f0
mov dword [esp], esi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x40d9e0
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x30], 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edx
test eax, eax
push edx
je 0x4013f9
xor eax, eax
jmp 0x401426
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x401426
mov dword [esp + 8], edi
mov dword [esp + 4], 0x80000007
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
sub esp, 0xc
test eax, eax
jne 0x4013f5
call ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x401430
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
lea eax, [ebp - 0x228]
sub esp, 0x22c
mov edi, dword [ebp + 0x10]
mov dword [esp + 0xc], eax
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
and edi, 0x300
mov dword [esp], ebx
mov eax, edi
mov dword [esp + 4], esi
or eax, 8
mov dword [esp + 8], eax
call fcn.00406610
sub esp, 0x10
test eax, eax
jne 0x40152c
mov dword [esp + 0xc], 0x105
mov eax, dword [ebp - 0x228]
lea edx, [ebp - 0x222]
mov dword [esp + 8], edx
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
lea edx, [ebp - 0x222]
sub esp, 0x10
test eax, eax
jne 0x4014e2
test byte [ebp + 0x10], 1
mov eax, dword [ebp - 0x228]
je 0x4014c8
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
push ecx
jmp 0x40152c
mov dword [esp + 4], edx
mov ecx, dword [ebp + 0x10]
mov dword [esp], eax
mov dword [esp + 8], ecx
call fcn.00401430
sub esp, 0xc
test eax, eax
je 0x401475
mov eax, dword [ebp - 0x228]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ecx
mov dword [esp], 3
call fcn.00409dd0
push edx
test eax, eax
je 0x40151d
mov dword [esp + 0xc], 0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call eax
sub esp, 0x10
jmp 0x40152c
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push edx
push edx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 0xc
Function at 0x405c0c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x405c4a
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x405c51
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40d3a0
add eax, ebx
mov dword [esp + 8], edx
mov dword [esp], eax
mov dword [esp + 0xc], ecx
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4
Function at 0x406724
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov dword [0x448bc0], 0x55004e
mov esi, dword [ebp + 0xc]
mov dword [0x448bc4], 0x4c
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
test esi, esi
jne 0x40677d
mov dword [esp + 8], 0x400
mov eax, dword [ebp + 8]
mov dword [esp + 4], 0x4483c0
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x406971
cmp eax, 0x400
jle 0x4067ce
jmp 0x406971
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.00409e1c
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x448bc0
mov dword [esp], esi
call ebx
sub esp, 0xc
test eax, eax
je 0x406971
cmp eax, 0x400
jle 0x40674e
jmp 0x406971
mov dword [esp + 0xc], 0x4483c0
mov dword [esp + 8], 0x448bc0
mov dword [esp + 4], str._ls_ls_r_n
mov dword [esp], 0x447fc0
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x44ea60]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x4483c0
mov dword [esp + 4], eax
call fcn.00404e40
push esi
push esi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x4483c0
call fcn.00409e1c
sub esp, 0xc
cmp eax, 0xffffffff
mov edi, eax
je 0x406971
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ecx
mov esi, eax
mov eax, dword [ebp - 0x1c]
push ecx
mov dword [esp], 0x40
add eax, esi
mov dword [ebp - 0x24], eax
add eax, 0xa
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push ebx
test eax, eax
push ebx
mov ebx, eax
je 0x406967
mov dword [esp + 8], esi
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00409e74
sub esp, 0xc
test eax, eax
je 0x406967
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], ebx
call fcn.0040a11c
push edx
test eax, eax
push edx
lea edx, [ebx + esi]
jne 0x4068c8
mov dword [esp + 4], str._Rename__r_n
add esi, 0xa
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, esi
push eax
push eax
jmp 0x406907
mov dword [esp + 4], 0x40d3cb
add eax, 0xa
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call fcn.0040a11c
push ecx
test eax, eax
push ecx
mov ecx, esi
mov dword [ebp - 0x20], eax
je 0x406907
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add ecx, ebx
cmp dword [ebp - 0x20], edx
jae 0x4068ff
mov al, byte [edx]
dec edx
dec ecx
mov byte [ecx + 1], al
jmp 0x4068f1
mov eax, dword [ebp - 0x20]
sub eax, ebx
lea ecx, [eax + 1]
mov dword [esp + 4], 0x447fc0
mov eax, dword [ebp - 0x1c]
add ecx, ebx
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.00409a40
add esi, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 8], esi
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00409f84
sub esp, 0xc
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408000
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.0040a280
push ecx
cmp eax, 0xffffffff
jne 0x408021
xor edi, edi
jmp 0x40805e
mov dword [esp], ebx
test edi, 1
mov esi, eax
je 0x408056
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
push edx
jne 0x40804f
and edi, 4
jne 0x40801d
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x40805e
mov edi, 1
jmp 0x40805e
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x408034
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8

Function at 0x4080d0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp dword [ebp + 8], 0
mov eax, dword [0x42c080]
je 0x4080fb
test eax, eax
je 0x4080ef
mov dword [esp], eax
call dword [sym.imp.USER32.dll_DestroyWindow]
push ecx
mov dword [0x42c080], 0
jmp 0x408165
test eax, eax
je 0x40810e
mov dword [esp], 0
call fcn.00405c9c
push edx
jmp 0x408165
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [0x44eac0]
jbe 0x408165
mov dword [esp + 0x10], 0
mov eax, dword [0x44eaec]
mov dword [esp + 0xc], 0x40ac8c
mov dword [esp + 8], 0
mov dword [esp + 4], 0x6f
mov dword [esp], eax
call dword [sym.imp.USER32.dll_CreateDialogParamW]
mov dword [0x42c080], eax
sub esp, 0x14
mov dword [esp + 4], 5
mov dword [esp], eax
call dword [sym.imp.USER32.dll_ShowWindow]
push eax
push eax
leave
ret

Function at 0x4094b4
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov dword [esp], 0x4493c0
mov eax, dword [ebp + 8]
mov dword [esp + 4], eax
call fcn.0040a0ec
push ebx
push ebx
mov dword [esp], 0x4493c0
call fcn.0040a3cc
push edx
test eax, eax
jne 0x4094e5
xor eax, eax
jmp 0x40955f
mov dword [esp], eax
mov ebx, eax
call fcn.0040ab7c
test byte [0x44eac4], 0x80
push ecx
je 0x409505
movzx eax, word [ebx]
test eax, eax
je 0x4094e1
cmp eax, 0x5c
je 0x4094e1
sub ebx, 0x4493c0
sar ebx, 1
mov dword [esp], 0x4493c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
cmp ebx, eax
mov dword [esp], 0x4493c0
jge 0x409544
call fcn.0040806c
push edx
test eax, eax
je 0x409535
test byte [eax], 0x10
je 0x4094e1
mov dword [esp], 0x4493c0
call fcn.0040a514
push eax
jmp 0x40950d
call fcn.00407f78
push eax
mov dword [esp], 0x4493c0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
inc eax
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x409a60
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [esp + 0x20], 0x44d3c0
lea eax, [ebp - 0x18]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
mov dword [0x44d3c0], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x409ade
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4
Function at 0x409e1c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x24
mov ebx, dword [ebp + 8]
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
cmp eax, 0xffffffff
jne 0x409e37
xor eax, eax
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [esp], ebx
mov dword [esp + 0x18], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 8], 1
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, dword [ebp - 4]
sub esp, 0x1c
leave
ret 0xc

Function at 0x409e74
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov ebx, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
sub esp, 0x14
test eax, eax
je 0x409eb3
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc

Function at 0x409ebc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
mov dword [ebp - 0x10], 0x2000
mov eax, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x14]
test eax, eax
je 0x409eda
mov eax, 0x100
lea edx, [ebp - 0x14]
or eax, 0x20019
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0xc], edx
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call fcn.00406610
sub esp, 0x10
test eax, eax
je 0x409f0a
mov word [ebx], 0
jmp 0x409f5f
mov dword [esp + 0x10], ebx
lea eax, [ebp - 0x10]
mov dword [esp + 0x14], eax
lea eax, [ebp - 0xc]
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x14]
sub esp, 0x18
mov dword [esp], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
push eax
mov word [ebx + 0x1ffe], 0
jne 0x409f03
mov eax, dword [ebp - 0xc]
dec eax
cmp eax, 1
ja 0x409f03
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret 0x14

Function at 0x409f68
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x409f84
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp - 0xc]
sub esp, 0x34
mov dword [esp + 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 0x10], 0
mov ebx, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp + 8], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x14
test eax, eax
je 0x409fc3
xor eax, eax
cmp dword [ebp - 0xc], ebx
sete al
mov ebx, dword [ebp - 4]
leave
ret 0xc
Function at 0x40a000
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, 0x65
push ebx
sub esp, 0x20
mov ebx, dword [ebp + 8]
dec esi
je 0x40a05c
mov dword [ebp - 0x10], 0x73006e
mov dword [ebp - 0xc], 0x61
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, 0x1a
xor edx, edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], 0
div ecx
lea eax, [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esp], eax
add word [ebp - 0xc], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
sub esp, 0x10
test eax, eax
je 0x40a010
jmp 0x40a063
mov word [ebx], 0
xor ebx, ebx
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 8

Function at 0x40a280
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push edx
mov ebx, eax
inc eax
je 0x40a2ae
mov dword [esp], esi
mov eax, ebx
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10007c2e
pop dword [ebp - 0x28]
mov eax, 0x10007c2e
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x554e6922
add dword [ebp - 0x38], 0xf903dc29
mov dword [ebp - 0x34], 0xdc293a80
sub dword [ebp - 0x34], 0xa9f5ee3b
mov dword [ebp - 0x30], 0x3fe6587a
add dword [ebp - 0x30], 0xc65ebb4
mov dword [ebp - 0x2c], 0x4e3aac29
add dword [ebp - 0x2c], 0xb1c553d7
lea eax, [ebp - 0x38]
push eax
mov eax, 0xd4d82bef
sub eax, 0xc4d7ab9b
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x83fe38a5
add dword [ebp - 0x38], 0xf07430b1
mov dword [ebp - 0x34], 0xe3d8752b
sub dword [ebp - 0x34], 0xa26c13b6
mov dword [ebp - 0x30], 0xe46a31eb
add dword [ebp - 0x30], 0x7f053a81
mov dword [ebp - 0x2c], 0xb939a652
add dword [ebp - 0x2c], 0x46c659ae
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x36d8a
push 0
call eax
mov ecx, 0xd159e7db
sub ecx, 0xd1599f24
mov edx, eax
mov ebx, 0xa1f9fcd0
sub ebx, 0x91f902d0
add ebx, dword [ebp - 0x28]
mov edi, 0x78eb1fb2
add edi, 0xad287c5c
mov dword [ebp - 0x24], 0xc626c81b
mov esi, dword [ebx]
sub dword [ebp - 0xc], 0xcf589bde
sub esi, edi
sub dword [ebp - 4], ecx
mov dword [edx], esi
xor dword [ebp - 0xc], ebx
add edx, 0x45a6010f
add edx, 0xba59fef5
add ebx, 0x250736d5
add ebx, 0xdaf8c92f
loop 0x10007d46
add eax, 0x4aed6e5b
add eax, 0xb513a754
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8e35dc10
add ecx, 0x81ca23f0
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x401443
pop dword [ebp - 0x18]
mov eax, 0xa0f4249a
add eax, 0x5f4befa9
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0x74ab886
sub dword [ebp - 0x28], 0xb8f8733b
mov dword [ebp - 0x24], 0x8241d687
sub dword [ebp - 0x24], 0x500e8a42
mov dword [ebp - 0x20], 0x56f0894f
sub dword [ebp - 0x20], 0xaa44521
mov dword [ebp - 0x1c], 0xca7b923d
sub dword [ebp - 0x1c], 0xca7b923d
lea eax, [ebp - 0x28]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x7b5003eb
add dword [ebp - 0x28], 0xf922656b
mov dword [ebp - 0x24], 0x166f0a1a
add dword [ebp - 0x24], 0x2afd575b
mov dword [ebp - 0x20], 0xc87fe2d3
add dword [ebp - 0x20], 0x9aef8999
mov dword [ebp - 0x1c], 0x5074bbaa
sub dword [ebp - 0x1c], 0x5074bbaa
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x39006
push 0
call eax
mov ecx, 0x4ad8
xor edi, edi
add edi, eax
mov ebx, 0x3045d1fb
sub ebx, 0x2ffeedfb
add ebx, dword [ebp - 0x18]
mov edx, 0x6ac0ad0f
xor dword [ebp - 0xc], 0xab22bdef
mov esi, dword [ebx]
sub dword [ebp - 0x14], ecx
xor esi, edx
xor dword [ebp - 8], 0x17fb5d90
mov dword [edi], esi
sub dword [ebp - 0x10], esi
add edi, 0xe5d9872c
sub edi, 0xe5d98728
add ebx, 0xf1a22c8
add ebx, 0xf0e5dd3c
loop 0x401551
add eax, 0x73119424
sub eax, 0x731075f1
xor ebx, ebx
add ebx, eax
add eax, 0x93c9c3d3
add eax, 0x6c363c32
mov ecx, 0xadd6d3f8
sub ecx, 0xad96d3f8
add ecx, dword [ebp - 0x18]
call ebx
leave
ret

Function at 0x402c93
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
push esi
lea eax, [ebp - 4]
push edi
push eax
mov eax, dword [0x42a2f0]
or al, 8
xor ebx, ebx
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x402d27
mov esi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
mov edi, 0x105
jmp 0x402ce4
cmp dword [ebp + 0x10], ebx
jne 0x402d1b
lea eax, [ebp - 0x210]
push ebx
push eax
push dword [ebp - 4]
call fcn.00401434
test eax, eax
jne 0x402cf6
lea eax, [ebp - 0x210]
push edi
push eax
push ebx
push dword [ebp - 4]
call esi
test eax, eax
je 0x402ccb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 3
call fcn.004065ec
cmp eax, ebx
je 0x402d2e
push ebx
push dword [0x42a2f0]
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
jmp 0x402d27
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret 0xc
cmp dword [0x42a2f0], ebx
jne 0x402d24
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x402d24
jmp 0x402d27
Function at 0x4017ee
Capabilities:
Copy file

Disassembly:
push 0x270
mov eax, 0x5307a6
call fcn.00498d88
mov dword [ebp - 0x27c], ecx
push str._build
lea ecx, [ebp - 0x260]
call fcn.004019d4
call fcn.004da206
mov edi, dword [eax]
test edi, edi
je 0x40185c
call fcn.004da200
mov esi, dword [eax]
shl esi, 2
call fcn.004da206
mov ebx, dword [eax]
add ebx, esi
cmp edi, ebx
je 0x40185c
push dword [edi]
lea ecx, [ebp - 0x260]
call fcn.00401fd3
test eax, eax
je 0x40184d
add edi, 4
cmp edi, ebx
jne 0x401835
cmp edi, ebx
je 0x40185c
lea esi, [edi + 4]
cmp esi, ebx
je 0x40185c
mov esi, dword [esi]
jmp 0x40185e
xor esi, esi
push 0
push 1
lea ecx, [ebp - 0x260]
call fcn.00401a2d
test esi, esi
jne 0x401878
xor al, al
jmp 0x40193d
push 0x104
lea eax, [ebp - 0x218]
push eax
push dword [ebp - 0x27c]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x401871
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x248]
call fcn.004019d4
and dword [ebp - 4], 0
lea ecx, [ebp - 0x230]
push esi
call fcn.004019d4
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x230]
cmp dword [ebp - 0x21c], 8
lea eax, [ebp - 0x248]
push 0
cmovae ecx, dword [ebp - 0x230]
cmp dword [ebp - 0x234], 8
push ecx
cmovae eax, dword [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x4018f4
xor bl, bl
jmp 0x40191d
lea ecx, [ebp - 0x278]
call fcn.00401943
mov edx, eax
lea ecx, [ebp - 0x230]
call fcn.00432bd7
push 0
push 1
lea ecx, [ebp - 0x278]
mov bl, al
call fcn.00401c36
push 0
push 1
lea ecx, [ebp - 0x230]
call fcn.00401a2d
push 0
push 1
lea ecx, [ebp - 0x248]
call fcn.00401a2d
mov al, bl
call fcn.00498d32
ret
Function at 0x405919
Capabilities:
Write file on windows

Disassembly:
push 0x34
mov eax, 0x5310c8
call fcn.00498d88
mov esi, ecx
mov dword [ebp - 0x30], esi
mov edi, dword [ebp + 8]
mov ebx, 0xffff
cmp bx, di
jne 0x40593e
xor eax, eax
jmp 0x405ab1
mov eax, dword [esi + 0x20]
mov ecx, dword [eax]
test ecx, ecx
je 0x40596a
mov edx, dword [esi + 0x30]
mov eax, dword [edx]
lea eax, [ecx + eax*2]
cmp ecx, eax
jae 0x40596a
dec dword [edx]
mov ax, di
mov edx, dword [esi + 0x20]
mov esi, dword [edx]
lea ecx, [esi + 2]
mov dword [edx], ecx
mov word [esi], di
jmp 0x405ab1
cmp dword [esi + 0x4c], 0
je 0x405aae
mov ecx, esi
call fcn.00407f41
xor ecx, ecx
cmp dword [esi + 0x38], ecx
jne 0x40599d
push dword [esi + 0x4c]
push edi
call fcn.00403f7f
pop ecx
pop ecx
test al, al
je 0x405aae
movzx ebx, di
jmp 0x405aae
push ecx
movzx eax, di
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x28], cl
lea ecx, [ebp - 0x28]
push 8
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x14], 0xf
call fcn.00407baf
and dword [ebp - 4], 0
lea eax, [esi + 0x40]
mov dword [ebp - 0x34], eax
mov edi, dword [ebp - 0x14]
mov esi, dword [esi + 0x38]
lea eax, [ebp - 0x38]
push eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x28]
cmp edi, 0x10
lea edx, [ebp - 0x28]
mov edi, dword [esi]
cmovae ecx, dword [ebp - 0x28]
cmovae edx, dword [ebp - 0x28]
add eax, ecx
push eax
push edx
lea eax, [ebp - 0x40]
mov ecx, esi
push eax
lea eax, [ebp - 0x2a]
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 0x34]
call dword [edi + 0x1c]
test eax, eax
js 0x405aa2
cmp eax, 1
jg 0x405a7d
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
cmp edi, 0x10
mov edx, dword [ebp - 0x38]
mov esi, dword [ebp - 0x30]
cmovae eax, ecx
sub edx, eax
mov dword [ebp - 0x3c], edx
je 0x405a48
push dword [esi + 0x4c]
cmp edi, 0x10
lea eax, [ebp - 0x28]
push edx
cmovae eax, ecx
push 1
push eax
call fcn.004de5b7
mov edx, dword [ebp - 0x3c]
add esp, 0x10
cmp edx, eax
jne 0x405a78
mov edi, dword [ebp - 0x14]
lea eax, [ebp - 0x2c]
mov byte [esi + 0x3e], 1
cmp dword [ebp - 0x40], eax
jne 0x405a72
test edx, edx
jne 0x4059c8
cmp dword [ebp - 0x18], 0x20
jae 0x405a9c
push edx
push 8
lea ecx, [ebp - 0x28]
call fcn.00407d0c
jmp 0x4059c5
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx ebx, bx
jmp 0x405a9c
cmp eax, 3
jne 0x405aa2
mov eax, dword [ebp - 0x30]
push dword [eax + 0x4c]
push dword [ebp - 0x2c]
call fcn.00403f7f
pop ecx
pop ecx
test al, al
je 0x405a9c
mov eax, dword [ebp + 8]
movzx ebx, ax
movzx eax, bx
movzx ebx, ax
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00401c36
mov ax, bx
call fcn.00498d32
ret 4