joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025d2b
Capabilities:
Contain obfuscated stackstrings
Get number of processors

Disassembly:
mov dword [esp + 0x167], 0x72695674
mov dword [esp + 0x16b], 0x6c617574
mov dword [esp + 0x16f], 0x6f6d654d
mov dword [esp + 0x172], 0x79726f
push ecx
jmp 0x10001109
mov ecx, 0x5b38394f
add ecx, 0x46143af2
jmp 0x100188b2
add ecx, 0x33e84a9f
jmp 0x1003695e
jg 0x1000624f
sub ecx, esi
jmp 0x1002e9da
mov esi, 0xbd3448fd
jmp 0x10033738
mov eax, dword [esp + ecx]
jmp 0x10020405
xor edx, ebx
pop ebx
lea edx, [edx]
mov eax, dword [esp + edx]
pop edx
push edi
mov edi, 0xb5430860
xor edi, 0x5bce1a59
jmp 0x1001152d
add edi, 0xfdf720a3
push ecx
mov ecx, 0x8a2ee545
sub ecx, 0x37f36e6e
jmp 0x1000361d
xor ecx, 0xd1d5ef60
push edx
mov edx, 0x77d47919
add edx, 0x9d98a49b
jmp 0x100188de
jmp 0x10018903
sub edx, 0x4e64c2d4
xor ecx, edx
pop edx
push esi
mov esi, 0x9598bd15
add esi, 0x82830552
xor esi, 0xaf8a7fa2
jmp 0x1001892b
jmp 0x1000800f
add esi, 0xd2a59b28
xor edi, esi
pop esi
lea edi, [edi]
mov dword [esp + edi], eax
jmp 0x10025459
pop ecx
push ecx
jmp 0x10038414
pop edi
jmp 0x10025468
jmp 0x10025492
mov dword [esp + 0x15f], 0x7250744e
mov dword [esp + 0x163], 0x6365746f
jmp 0x100010d1
sub esi, 0xe457b74d
add esi, 0x21238119
jmp 0x100345fe
pop esi
lea ecx, [ecx]
jmp 0x1000b92b
push edx
mov edx, 0x2eff2433
xor edx, 0xcee9d5b6
add edx, 0x1ee2aacf
jmp 0x1004f4cd
sub esi, 0x2531f3cf
jmp 0x1001dc72
add esi, 0x6c410eec
jmp 0x1003466e
add esi, dword [esp]
jmp 0x1003b33d
xor edi, ecx
jmp 0x1004ec99
mov ecx, 0x3d9cc6ad
jmp 0x100473ce
dec esi
pop esp
call fcn.10006270
jmp 0x10049bee
mov dword [esp + 8], esi
jmp 0x1003b35a
mov esi, dword [esp + 4]
add esp, 8
push eax
mov eax, 0xc143f8bc
call fcn.1003b370
jne 0x1003b371
jne 0x1003b319
call 0xb22d2fce
xor ecx, 0x4f506b25
jmp 0x1004b4f3
sbb al, 0x23
mov dword [esp + ebx], eax
pop ebx
jmp 0x10032834
jg 0x10049b72
jmp 0x1000626e
xor eax, 0xb7bbb129
jmp 0x10049dbd
xor ecx, eax
pop eax
push ebx
mov ebx, 0xc97c63a
add ebx, 0xf957e3e3
xor ecx, 0x3073b4fd
push eax
jmp 0x1004b504
mov eax, 0xe8ff69ee
jmp 0x1004b535
xor eax, 0x848e8bbf
jmp 0x10049dae
pop ecx
push esi
jmp 0x10008f7b
push esi
mov esi, 0x4b4b9032
xor esi, 0x7e9263c0
xor esi, 0x709c93d9
xor edx, esi
pop esi
push ebx
mov ebx, 0x1b20060b
xor ebx, 0x39fb8bcf
sub ebx, 0x671e8ecd
jmp 0x1004f50c
jmp 0x10011508

Function at 0x100408fa
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebx
sub esp, 0xc8
push esi
jmp 0x10012b6e
push ecx
mov ecx, 0xfaf1396e
xor ecx, 0x2db6b033
add ecx, 0x2e855a52
push ebx
push ebp
jmp 0x10021210
mov ebp, 0xcf43d275
call fcn.1000eee4
jmp 0x10021227
jmp 0x1004797a
jmp 0x10012b47
add byte fs:[eax], al
nop
jg 0x10047935
jmp fcn.1000eee4
Function at 0x1005d1d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1005d1fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1005d1fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x405c8c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422aa4], 0
push esi
jne 0x405cc3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405c9d
mov dword [ecx*4 + 0x422aa0], eax
inc ecx
cmp ecx, 0x100
jl 0x405c98
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405cf4
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422aa0]
xor eax, esi
inc ecx
dec edx
jne 0x405cd6
pop edi
not eax
pop esi
ret 0xc

Function at 0xf25238
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf25242
pushal
call 0xf25248
pop ebp
sub ebp, 0x10
sub ebp, 0xb25238
jmp 0xf2525e
mov eax, 0xb25238
add eax, ebp
add eax, 0x4c
mov ecx, 0x5a1
mov edx, 0x66b08905
xor byte [eax], dl
inc eax
dec ecx
jne 0xf25275
jmp 0xf25288
mov cs, eax
mov cs, word [ecx + edi - 0x7bfafafb]
invalid
Function at 0x404ee0
Capabilities:
Inspect load icon resource

Disassembly:
push ebx
push ebp
push esi
push edi
mov esi, ecx
push 0x517d7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push 0
push 0
lea edi, [esi + 0x44]
push 0x20
push 0x10
push 0x10
mov ecx, edi
mov dword [esi + 0x54], eax
call sub.MFC42.DLL_CImageList::Create
mov eax, dword [esi + 0x48]
mov ebx, dword [sym.imp.COMCTL32.dll_ImageList_SetBkColor]
push 0xffffff
push eax
call ebx
push 1
push 1
lea ebp, [esi + 0x4c]
push 0x20
push 0xd
push 0xd
mov ecx, ebp
call sub.MFC42.DLL_CImageList::Create
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
push 0x232c
push eax
call dword [sym.imp.USER32.dll_LoadBitmapA]
push eax
call sub.MFC42.DLL_CGdiObject::FromHandle
test eax, eax
je 0x404f4e
mov eax, dword [eax + 4]
mov ecx, dword [esi + 0x50]
push 0
push eax
push ecx
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
call sub.MFC42.DLL_AfxGetModuleState
push 0x7e
push 0xe
push 0x7e
call sub.MFC42.DLL_AfxFindResourceHandle
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
mov edx, dword [esi + 0x48]
push eax
push 0xffffffffffffffff
push edx
call dword [sym.imp.COMCTL32.dll_ImageList_ReplaceIcon]
mov eax, dword [esi + 0x48]
push 0xeef3f4
push eax
call ebx
mov ecx, dword [esi + 0x50]
push 0xeef3f4
push ecx
call ebx
test edi, edi
je 0x404f9c
mov edi, dword [edi + 4]
mov edx, dword [esi + 0x20]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
push 0
push 0x1109
push edx
call edi
push eax
call sub.MFC42.DLL_CImageList::FromHandle
test ebp, ebp
je 0x404fbd
mov ebp, dword [ebp + 4]
mov eax, dword [esi + 0x20]
push ebp
push 2
push 0x1109
push eax
call edi
push eax
call sub.MFC42.DLL_CImageList::FromHandle
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x420790
Capabilities:
Get file attributes
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x4d5da8
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov edi, dword [esp + 0x30]
test edi, edi
jne 0x4207c7
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov ebx, dword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [esp + 0xc]
push ecx
mov dword [esp + 0x28], 0
call ebx
test eax, eax
jge 0x4207f1
push eax
call fcn.004cf728
mov esi, dword [esp + 0x2c]
mov word [esp + 0xc], 8
push esi
call fcn.004cf7d5
test eax, eax
mov dword [esp + 0x14], eax
jne 0x420818
test esi, esi
je 0x420818
push 0x8007000e
call fcn.004cf728
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, dword [esp + 0xc]
sub esp, 0x10
mov eax, esp
mov edx, dword [edi]
push edi
mov dword [eax], ecx
mov ecx, dword [esp + 0x24]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x28]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x2c]
mov dword [eax + 0xc], ecx
call dword [edx + 0x108]
mov esi, eax
test esi, esi
jge 0x420866
push 0x518788
push edi
push esi
call fcn.004cf736
test esi, esi
mov dword [esp + 0x24], 0xffffffff
je 0x420895
lea edx, [esp + 0xc]
push edx
call ebx
test eax, eax
jge 0x420881
push eax
call fcn.004cf728
xor eax, eax
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
lea eax, [esp + 0xc]
push eax
call ebx
test eax, eax
jge 0x4208a6
push eax
call fcn.004cf728
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
mov eax, 1
mov dword fs:[0], ecx
pop ebx
add esp, 0x1c
ret

Function at 0x420930
Capabilities:
Shutdown system

Disassembly:
sub esp, 0x14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x42094f
add esp, 0x14
ret
lea ecx, [esp + 8]
push ecx
push 0x519788
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x420999
xor eax, eax
add esp, 0x14
ret
push 0
push 5
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
add esp, 0x14
ret
Function at 0x420ce0
Capabilities:
Get file version info

Disassembly:
sub esp, 0x18
mov edx, dword [esp + 0x1c]
push ebx
push ebp
push esi
lea ecx, [esp + 0x10]
push edi
lea eax, [esp + 0x18]
push ecx
push edx
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x420d5a
push ebx
call sub.MFC42.DLL_operatornew
mov ebp, eax
add esp, 4
test ebp, ebp
je 0x420d5a
mov eax, dword [esp + 0x2c]
push ebp
push ebx
push edi
push eax
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x420d51
lea ecx, [esp + 0x2c]
lea edx, [esp + 0x10]
push ecx
push edx
push 0x518854
push ebp
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x420d51
mov eax, dword [esp + 0x10]
xor ecx, ecx
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
or esi, eax
or edi, ecx
push ebp
call sub.MFC42.DLL_operatordelete
add esp, 4
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x18
ret

Function at 0x420e40
Capabilities:
Check if file exists
Create directory
Get common file path

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
push 0x5266f4
push 0
push 0
push 0x23
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathA]
push 0x5266f4
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x5197c0
push 0x5266f4
call esi
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x420e8d
push eax
push 0x5266f4
call esi
push 0x5266f4
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
mov eax, 0x5266f4
jne 0x420f09
mov cl, byte [0x5266f4]
test cl, cl
je 0x420f04
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpynA]
mov ebp, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push 0x518854
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov esi, eax
test esi, esi
je 0x420f04
mov edx, esi
sub edx, 0x5266f4
test edx, edx
jle 0x420efa
mov ecx, 0x41
xor eax, eax
lea edi, [esp + 0x10]
inc edx
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
push edx
lea eax, [esp + 0x14]
push 0x5266f4
push eax
call ebx
lea ecx, [esp + 0x10]
push 0
push ecx
call ebp
mov cl, byte [esi + 1]
lea eax, [esi + 1]
test cl, cl
jne 0x420eb7
mov eax, 0x5266f4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x421000
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x20c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0xd]
mov byte [esp + 0xc], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call sub.MFC42.DLL_AfxGetModuleState
mov eax, dword [eax + 8]
lea ecx, [esp + 0xc]
push 0x104
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0xc]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x111]
mov byte [esp + 0x110], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0xc]
push 0x5197dc
stosw word es:[edi], ax
push ecx
push 0x5197c8
lea edx, [esp + 0x11c]
push 0x104
push edx
stosb byte es:[edi], al
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
lea eax, [esp + 0x110]
push 0
push 0x80
push 3
push 0
push 3
push SysReAllocStringLen
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4210f2
mov edx, dword [esp + 0x218]
lea ecx, [esp + 8]
push 0
push ecx
push 8
push edx
push esi
mov dword [esp + 0x1c], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
je 0x4210ec
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor eax, eax
pop esi
add esp, 0x20c
ret

Function at 0x421100
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push esi
push 0x104
push eax
call fcn.00420f20
add esp, 8
test eax, eax
jne 0x42117d
push eax
push 0x80
push 3
push eax
push 3
lea ecx, [esp + 0x1c]
push SysReAllocStringLen
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x42117d
mov eax, dword [esp + 0x110]
lea edx, [esp + 4]
push 0
push edx
push 8
push eax
push esi
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
push esi
je 0x421177
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
add esp, 0x108
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
add esp, 0x108
ret
Function at 0x4211c0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x464
push ebx
push esi
push edi
xor ebx, ebx
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x61]
mov byte [esp + 0x60], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x60]
push 0x104
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x60]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x60]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x165]
mov byte [esp + 0x164], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov esi, dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x164]
stosb byte es:[edi], al
lea eax, [esp + 0x60]
push eax
push 0x5197f8
push 0x104
push ecx
call esi
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x279]
mov byte [esp + 0x278], bl
rep stosd dword es:[edi], eax
mov edx, dword [esp + 0x484]
add esp, 0x10
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x164]
push edx
push eax
push 0x5197e8
lea ecx, [esp + 0x274]
push 0x208
push ecx
call esi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x34]
add esp, 0x14
rep stosd dword es:[edi], eax
lea eax, [esp + 0xc]
xor edx, edx
lea ecx, [esp + 0x1c]
push eax
mov dword [esp + 0x14], edx
push ecx
push ebx
mov dword [esp + 0x20], edx
push ebx
push ebx
mov dword [esp + 0x2c], edx
push ebx
push ebx
lea edx, [esp + 0x284]
push ebx
push edx
push ebx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x44], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4212ee
mov eax, dword [esp + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.USER32.dll_WaitForInputIdle]
mov edx, dword [esp + 0xc]
push edx
call esi
pop edi
pop esi
pop ebx
add esp, 0x464
ret
Function at 0x421300
Capabilities:
Create process on windows
Query service status

Disassembly:
sub esp, 0x484
push esi
push edi
push SysReAllocStringLen
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
je 0x421397
push ebx
push ebp
push SysReAllocStringLen
push 0x519808
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x42137e
lea eax, [esp + 0x24]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
je 0x42136b
mov eax, dword [esp + 0x28]
cmp eax, 4
jne 0x42135c
push esi
xor ebp, ebp
call ebx
jmp 0x421383
cmp eax, 1
jne 0x421375
push esi
mov ebp, 0xfffffff6
call ebx
jmp 0x421383
push esi
mov ebp, 0xfffffff5
call ebx
jmp 0x421383
mov ebp, dword [esp + 0x20]
push esi
call ebx
jmp 0x421383
mov ebp, 0xfffffff7
push edi
call ebx
test ebp, ebp
pop ebp
pop ebx
jne 0x421397
pop edi
xor eax, eax
pop esi
add esp, 0x484
ret
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x7d]
mov byte [esp + 0x7c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea ecx, [esp + 0x7c]
push 0x104
push ecx
push 0
stosb byte es:[edi], al
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x7c]
push edx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea eax, [esp + 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveBackslashA]
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x181]
mov byte [esp + 0x180], 0
rep stosd dword es:[edi], eax
mov esi, dword [sym.imp.MSVCRT.dll__snprintf]
lea ecx, [esp + 0x7c]
stosw word es:[edi], ax
push ecx
push 0x5197f8
lea edx, [esp + 0x188]
push 0x104
push edx
stosb byte es:[edi], al
call esi
add esp, 0x10
lea eax, [esp + 0x180]
push 0
push eax
call fcn.004ce410
test eax, eax
jne 0x421432
pop edi
mov eax, 0x80030002
pop esi
add esp, 0x484
ret
mov ecx, 0x81
xor eax, eax
lea edi, [esp + 0x285]
mov byte [esp + 0x284], 0
rep stosd dword es:[edi], eax
lea ecx, [esp + 0x180]
lea edx, [esp + 0x284]
stosw word es:[edi], ax
push ecx
push 0x519810
push 0x208
push edx
stosb byte es:[edi], al
call esi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x4c]
add esp, 0x10
rep stosd dword es:[edi], eax
mov dword [esp + 8], eax
mov dword [esp + 0xc], eax
lea ecx, [esp + 8]
lea edx, [esp + 0x38]
mov dword [esp + 0x10], eax
push ecx
push edx
push eax
push eax
push eax
push eax
push eax
mov dword [esp + 0x30], eax
push eax
lea eax, [esp + 0x2a4]
mov dword [esp + 0x58], 0x44
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x4214d4
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 8]
push edx
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x484
ret
pop edi
mov eax, 0x80004005
pop esi
add esp, 0x484
ret
Function at 0x4214f0
Capabilities:
Query environment variable
Set environment variable

Disassembly:
sub esp, 0x208
lea eax, [esp + 0x104]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
lea edx, [esp + 0x114]
lea eax, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x10]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
lea edx, [esp + 0x10]
push 0x51983c
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
push 0
push 0
push 0x519834
call ebp
mov edi, eax
lea ebx, [edi + 0x208]
push ebx
call sub.MFC42.DLL_operatornew
add esp, 4
mov esi, eax
test edi, edi
jne 0x42158d
lea eax, [esp + 0x10]
lea ecx, [esp + 0x114]
push eax
push ecx
push 0x51982c
push 0x208
push esi
jmp 0x4215c3
push ebx
push esi
push 0x519834
call ebp
push 0x518940
push esi
call dword [sym.imp.SHLWAPI.dll_StrTrimA]
lea edx, [esp + 0x10]
lea eax, [esp + 0x114]
push edx
push eax
push 0x519824
push 0x208
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, esi
push eax
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x14
push esi
push 0x51981c
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
push esi
call sub.MFC42.DLL_operatordelete
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x4215f0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x4d5e19
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push ebx
push esi
lea eax, [esp + 0x160]
lea ecx, [esp + 8]
push eax
mov dword [esp + 0x15c], 0
call sub.MFC42.DLL_CString::CString_1
mov bl, 1
push 0x5c
push 0x2f
lea ecx, [esp + 0x10]
mov byte [esp + 0x160], bl
call sub.MFC42.DLL_CString::Replace_1
push 0x5c
lea ecx, [esp + 0xc]
call sub.MFC42.DLL_CString::ReverseFind
inc eax
lea ecx, [esp + 0xc]
push eax
push ecx
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::Left
push eax
lea ecx, [esp + 0xc]
mov byte [esp + 0x15c], 2
call fcn.004ceb40
lea ecx, [esp + 0xc]
mov byte [esp + 0x158], bl
call sub.MFC42.DLL_CString::CString
mov eax, dword [esp + 0x160]
lea edx, [esp + 0x10]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4216ee
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push edi
mov edi, dword [esp + 0x16c]
lea ecx, [esp + 0x44]
lea edx, [esp + 0x10]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
call sub.MFC42.DLL_operator_2
push eax
mov ecx, edi
mov byte [esp + 0x164], 3
call sub.MFC42.DLL_CStringList::AddTail
lea ecx, [esp + 0x14]
mov byte [esp + 0x160], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x18]
push ecx
push esi
call ebp
test eax, eax
jne 0x4216a5
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop ebp
lea ecx, [esp + 8]
mov byte [esp + 0x158], 0
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x160]
mov dword [esp + 0x158], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov ecx, dword [esp + 0x150]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x154
ret
Function at 0x42d1a0
Capabilities:
Delete registry value
Query or enumerate registry value
Set registry value

Disassembly:
push 0xffffffffffffffff
push 0x4d712b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x21c
push esi
push edi
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esp + 0x238]
lea ecx, [esp + 0x1c]
push eax
push 0x51b230
push 0x103
push ecx
mov dword [esp + 0x24], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
test eax, eax
jl 0x42d362
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea edx, [esp + 0x18]
lea eax, [esp + 0x120]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
lea edx, [esp + 0x28]
push 0x5265c0
push edx
push SysReAllocStringLen
call esi
test eax, eax
jne 0x42d362
lea ecx, [esp + 8]
call sub.MFC42.DLL_CString::CString_3
mov ecx, dword [0x51af80]
lea eax, [esp + 0x1c]
push eax
push ecx
lea edx, [esp + 0x10]
push 0x5197c8
push edx
mov dword [esp + 0x23c], 0
call sub.MFC42.DLL_CString::Format
mov eax, dword [esp + 0x18]
lea ecx, [esp + 0x130]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 0x18
test eax, eax
jne 0x42d34e
mov byte [esp + 0x120], al
lea edx, [esp + 0xc]
lea eax, [esp + 0x120]
push edx
mov edx, dword [0x51af84]
lea ecx, [esp + 0x14]
push eax
push ecx
lea eax, [esp + 0x28]
push edx
push eax
push SysReAllocStringLen
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call esi
test eax, eax
jne 0x42d307
mov ecx, dword [0x51af84]
lea edx, [esp + 0x1c]
push ecx
push edx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
lea edi, [esp + 0x120]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x120]
push ecx
push eax
push 1
lea ecx, [esp + 0x28]
push 0x5265c0
push ecx
jmp 0x42d328
mov edi, 0x519750
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x1c]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push 0x519750
push 1
push 0x5265c0
push edx
push SysReAllocStringLen
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea ecx, [esp + 8]
mov dword [esp + 0x22c], 0xffffffff
call sub.MFC42.DLL_CString::CString
mov eax, 1
jmp 0x42d364
lea ecx, [esp + 8]
mov dword [esp + 0x22c], 0xffffffff
call sub.MFC42.DLL_CString::CString
xor eax, eax
mov ecx, dword [esp + 0x224]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x228
ret 8