joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406ae7
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push 0x10
lea eax, [ebp - 0x2c]
push 0
push eax
or esi, 0xffffffff
call fcn.00425890
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
test eax, eax
je 0x406b9d
mov edi, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
push ebx
mov dword [ebp - 4], 0xa
lea eax, [ebp - 0x14]
push eax
call edi
mov eax, 0x80000000
mov bx, 0xfa0
bsf ecx, eax
dec bx
jne 0x406b31
lea eax, [ebp - 0xc]
push eax
call edi
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x14]
cmp eax, esi
jae 0x406b4a
mov esi, eax
dec dword [ebp - 4]
jne 0x406b22
mov ecx, dword [ebp - 0x1c]
push 0xa
mov eax, ecx
xor edx, edx
pop edi
imul esi, esi, 0x186a0
div edi
xor edx, edx
pop ebx
mov edi, eax
mov eax, esi
div edi
xor edx, edx
mov esi, eax
div ecx
shr ecx, 1
cmp edx, ecx
jbe 0x406b77
inc esi
mov edi, dword [ebp + 0xc]
xor edx, edx
mov eax, edi
div esi
xor edx, edx
mov ecx, eax
mov eax, edi
div esi
mov eax, esi
mov dword [ebp - 0x24], ecx
shr eax, 1
cmp edx, eax
jbe 0x406b94
inc ecx
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp + 8]
lea esi, [ebp - 0x2c]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
leave
ret

Function at 0x406bad
Capabilities:
Check for time delay via gettickcount
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4295e0
push 0x426270
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov ebx, eax
mov dword [ebp - 0x30], ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
mov dword [ebp - 0x24], eax
push 0xf
push ebx
mov edi, dword [sym.imp.KERNEL32.dll_SetThreadPriority]
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
call esi
mov dword [ebp - 0x20], eax
call esi
sub eax, dword [ebp - 0x20]
je 0x406bfe
call esi
mov dword [ebp - 0x20], eax
and dword [ebp - 4], 0
rdtsc
mov dword [ebp - 0x1c], eax
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x24]
push ebx
call edi
push 0x3c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xf
push ebx
call edi
call esi
mov dword [ebp - 0x2c], eax
call esi
sub eax, dword [ebp - 0x2c]
je 0x406c2f
call esi
mov esi, eax
rdtsc
mov dword [ebp - 0x34], eax
push dword [ebp - 0x24]
push ebx
call edi
mov eax, dword [ebp - 0x34]
sub eax, dword [ebp - 0x1c]
sub esi, dword [ebp - 0x20]
xor edx, edx
div esi
mov esi, eax
xor edx, edx
mov ecx, 0x3e8
div ecx
mov ecx, eax
mov eax, esi
xor edx, edx
push 0x64
pop esi
div esi
lea edx, [ecx + ecx*4]
shl edx, 1
sub eax, edx
cmp eax, 5
jb 0x406c75
inc ecx
mov eax, ecx
jmp 0x406c92
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40731c
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
mov dword [0x47f054], esi
call fcn.004085cf
mov ebx, eax
xor edi, edi
cmp ebx, edi
jge 0x40736e
lea ecx, [ebp - 0xc]
call fcn.0041cf73
push ebx
lea eax, [ebp - 0xc]
push str.Load_template_failed___d_
push eax
call fcn.0041d600
add esp, 0xc
lea ecx, [ebp - 0xc]
call fcn.0041decc
push eax
call fcn.0041eaf1
pop ecx
lea ecx, [ebp - 0xc]
call fcn.0041d0a9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 0x10]
call fcn.004094b5
mov eax, dword [ebp + 0x14]
mov dword [0x47f054], edi
cmp eax, edi
je 0x40738a
mov dword [eax], esi
cmp dword [esi + 4], edi
mov dword [esi + 0x6c], eax
jne 0x40739a
or eax, 0xffffffff
jmp 0x40751d
push dword [0x47f04c]
inc dword [0x47f044]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov eax, dword [0x47f044]
push 0x42
shl eax, 2
push eax
push dword [0x47f04c]
call dword [sym.imp.KERNEL32.dll_GlobalReAlloc]
push eax
mov dword [0x47f04c], eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp dword [0x47f04c], edi
mov dword [0x47f048], eax
jne 0x4073ed
mov ecx, 0x47fa24
call fcn.0041decc
push eax
call fcn.0041eaf1
pop ecx
mov eax, dword [0x47f044]
mov ecx, dword [0x47f048]
mov dword [ecx + eax*4 - 4], esi
mov ecx, esi
call fcn.004096d2
mov ecx, esi
call fcn.004081b9
test al, al
je 0x407452
mov eax, dword [0x47f050]
cmp eax, edi
je 0x407452
mov ecx, dword [eax + 0x18]
cmp ecx, dword [esi + 0x18]
jne 0x407452
mov ecx, dword [eax + 0x1c]
cmp ecx, dword [esi + 0x1c]
jne 0x407452
mov ecx, dword [eax + 0x20]
cmp ecx, dword [esi + 0x20]
jne 0x407452
lea ecx, [ebp - 0x10]
push ecx
push dword [eax + 4]
call dword [sym.imp.USER32.dll_GetWindowRect]
push edi
push dword [esi + 0x28]
push dword [esi + 0x24]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_MoveWindow]
push edi
push edi
push 0x110
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageA]
xor ebx, ebx
cmp dword [esi + 0x7c], edi
jle 0x407492
push ebx
lea ecx, [esi + 0x70]
call fcn.0041fb60
cmp dword [eax + 0x10], 1
je 0x407480
inc ebx
cmp ebx, dword [esi + 0x7c]
jl 0x407469
jmp 0x407492
push ebx
lea ecx, [esi + 0x70]
call fcn.0041fb60
push dword [eax + 0x50]
call dword [sym.imp.USER32.dll_SetFocus]
mov ecx, esi
call fcn.004081b9
test al, al
je 0x40751a
push edi
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov ebx, eax
push edi
mov edi, dword [sym.imp.USER32.dll_DeleteMenu]
push 0xf120
push ebx
call edi
push 0
push 0xf020
push ebx
call edi
push 0
push 0xf030
push ebx
call edi
push 0
push 0xf000
push ebx
call edi
push 0x400
push 1
push ebx
call edi
mov edi, dword [sym.imp.USER32.dll_AppendMenuA]
push 0x42c9e4
push 2
push 0x800
push ebx
call edi
push str.About...
push 1
push 0
push ebx
call edi
push 1
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 1
call fcn.00407f5f
pop ecx
mov dword [0x47f200], esi
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x407a4b
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x50]
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, edi
push 0xfffffffffffffff0
push edi
sete byte [ebp - 1]
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov ebx, dword [ebp + 0xc]
mov ecx, eax
mov eax, 0x8000000
push 0
and ecx, eax
pop edi
cmp ecx, eax
mov al, byte [ebx + 0x10]
sete byte [ebp + 0xb]
and al, 1
mov byte [ebp + 0xf], al
mov eax, edi
je 0x407a98
mov eax, dword [esi + 0x1c]
jmp 0x407adb
cmp byte [ebp + 0xb], 0
je 0x407aa5
mov eax, dword [esi + 0x1c]
shl eax, 1
jmp 0x407adb
mov ecx, dword [ebx + 0x10]
and ecx, 0x40
cmp cl, 0x40
jne 0x407ac1
mov ecx, dword [esi + 0x1c]
lea edx, [ecx + ecx*2 + 3]
cmp dword [esi + 0x64], edx
jle 0x407ac1
lea eax, [ecx + ecx*2]
jmp 0x407adb
cmp byte [ebp - 1], 0
je 0x407adb
mov ecx, dword [esi + 0x1c]
lea edx, [ecx*4 + 4]
cmp dword [esi + 0x64], edx
jle 0x407adb
mov eax, ecx
shl eax, 2
push 0xcc0020
push edi
push eax
push dword [esi + 0x5c]
push dword [esi + 0x20]
push dword [esi + 0x1c]
push edi
push edi
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_BitBlt]
and byte [ebp - 0xf4], 0
push 0x31
pop ecx
xor eax, eax
lea edi, [ebp - 0xf3]
push 0xc8
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0xf4]
push eax
push dword [esi + 0x50]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov edi, eax
push 1
test edi, edi
jle 0x407c02
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_SetBkMode]
cmp byte [ebp + 0xb], 0
je 0x407b44
push 0xa0a0a0
jmp 0x407b47
push dword [esi + 0x2c]
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_SetTextColor]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0xf4]
push edi
push eax
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
push 0
push dword [ebx + 0x18]
call dword [sym.imp.GDI32.dll_SetTextAlign]
mov eax, dword [esi + 0x1c]
and dword [ebp - 0x1c], 0
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x1c]
and dword [ebp - 0x18], 0
push 0x25
push eax
lea eax, [ebp - 0xf4]
push edi
push eax
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_DrawTextA]
cmp byte [ebp - 1], 0
je 0x407c00
mov eax, dword [esi + 0x1c]
lea ecx, [eax*4 + 4]
cmp dword [esi + 0x64], ecx
jg 0x407c00
add dword [ebp - 0xc], 6
add dword [ebp - 8], 4
cdq
sub eax, edx
mov ecx, eax
mov eax, dword [ebp - 0xc]
cdq
sub eax, edx
sar ecx, 1
mov edi, eax
mov eax, ecx
sar edi, 1
sub eax, edi
add edi, ecx
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x20]
cdq
sub eax, edx
mov dword [ebp - 0x24], edi
mov esi, eax
mov eax, dword [ebp - 8]
cdq
sar esi, 1
sub eax, edx
mov edx, esi
sar eax, 1
sub edx, eax
add eax, esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x28], edx
push dword [ebx + 0x18]
call dword [sym.imp.USER32.dll_DrawFocusRect]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40be28
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
lea eax, [ebp - 8]
push edi
mov edi, ecx
push eax
push 0xa
push dword [edi + 4]
call fcn.0041ee14
mov ecx, dword [ebp + 8]
add esp, 0xc
push dword [ebp - 8]
call fcn.0041d0c0
mov esi, dword [ebp + 0xc]
mov eax, dword [ebp - 8]
xor ebx, ebx
mov dword [esi], eax
cmp byte [eax], bl
jne 0x40be6c
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x47fd30
jmp 0x40c036
push eax
call fcn.00425d00
cmp eax, 2
pop ecx
jb 0x40c02c
mov ecx, dword [ebp - 8]
mov byte [ebp + 0xb], bl
mov al, byte [ecx]
mov byte [ebp - 3], 0x3a
mov byte [ebp - 4], al
mov eax, dword [esi]
mov byte [ebp - 2], 0x5c
mov byte [ebp - 1], bl
cmp byte [eax], 0x5c
jne 0x40bf30
cmp byte [eax + 1], 0x5c
jne 0x40bf30
mov byte [ebp + 0xb], 1
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov cl, byte [ebp + 0xb]
neg cl
sbb ecx, ecx
and ecx, 2
cmp ecx, eax
jge 0x40bfb3
mov esi, dword [ebp - 8]
mov dl, byte [ecx + esi]
cmp dl, 0x3a
jne 0x40bed8
cmp ecx, 1
jne 0x40bfa4
cmp dl, 0x7c
je 0x40bfa4
cmp dl, 0x2a
je 0x40bfa4
cmp dl, 0x2f
je 0x40bfa4
cmp dl, 0x3e
je 0x40bfa4
cmp dl, 0x3c
je 0x40bfa4
cmp dl, 0x3f
je 0x40bfa4
cmp dl, 0x22
je 0x40bfa4
cmp ecx, ebx
jle 0x40bf26
cmp dl, 0x5c
jne 0x40bf26
cmp byte [ecx + esi - 1], dl
je 0x40bf95
inc ecx
cmp ecx, eax
jl 0x40bec7
jmp 0x40bfb3
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov ecx, dword [ebp - 8]
cmp byte [ecx + 1], 0x3a
jne 0x40c02c
mov dl, byte [ecx + 2]
cmp dl, 0x5c
je 0x40bf57
cmp dl, bl
jne 0x40c02c
cmp eax, 1
jne 0x40bf6b
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x47fd48
jmp 0x40c036
cmp eax, 3
je 0x40beab
cmp eax, 4
je 0x40beab
cmp eax, 2
je 0x40beab
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x47fd54
jmp 0x40c036
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x47fd60
jmp 0x40c036
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x47fd6c
jmp 0x40c036
cmp byte [ebp + 0xb], bl
jne 0x40c028
lea eax, [ebp - 4]
push 1
push eax
call fcn.0040e956
cmp edx, dword [0x47f744]
pop ecx
pop ecx
mov dword [0x47f738], eax
mov dword [0x47f73c], edx
ja 0x40c028
jb 0x40bfe2
cmp eax, dword [0x47f740]
jae 0x40c028
lea ecx, [ebp - 0x14]
call fcn.0041cf73
lea eax, [ebp - 4]
mov ecx, 0x47fd78
push eax
call fcn.0041decc
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041d600
mov edi, dword [edi + 4]
add esp, 0xc
lea ecx, [ebp - 0x14]
push ebx
push ebx
call fcn.0041decc
push eax
push edi
mov ecx, 0x47f0a8
call fcn.0041c473
lea ecx, [ebp - 0x14]
call fcn.0041d0a9
jmp 0x40c047
mov al, 1
jmp 0x40c049
mov edi, dword [edi + 4]
push ebx
push ebx
mov ecx, 0x47fd3c
call fcn.0041decc
push eax
push edi
mov ecx, 0x47f0a8
call fcn.0041c473
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x40c050
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x144]
push eax
call fcn.0041decc
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 0xc], eax
je 0x40c11e
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageA]
push edi
xor ebx, ebx
test byte [ebp - 0x144], 0x10
je 0x40c103
cmp byte [ebp - 0x118], 0x2e
je 0x40c103
cmp byte [ebp - 0x118], bl
je 0x40c103
push ebx
push ebx
push 0x18b
push 0xb
push dword [ebp + 8]
call esi
xor edi, edi
cmp eax, ebx
mov dword [ebp - 4], eax
jle 0x40c0ef
lea eax, [ebp - 0x248]
mov byte [ebp - 0x248], bl
push eax
push edi
push 0x189
push 0xb
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x248]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40c103
inc edi
cmp edi, dword [ebp - 4]
jl 0x40c0b7
lea eax, [ebp - 0x118]
push eax
push ebx
push 0x180
push 0xb
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x144]
push eax
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40c086
pop edi
pop esi
pop ebx
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FindClose]
leave
ret 8
Function at 0x40e311
Capabilities:
Check if file exists
Create directory
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
and byte [ebp - 0x104], 0
push edi
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x103]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x104]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
pop edi
jne 0x40e366
lea eax, [ebp - 0x104]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
leave
ret

Function at 0x40e368
Capabilities:
Check if file exists
Delete file
Get file attributes
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40e383
and al, 0xfe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop esi
ret

Function at 0x40e38c
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push esi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x40e3aa
or eax, 0xffffffff
jmp 0x40e41d
push edi
push esi
call fcn.00426169
mov edi, eax
pop ecx
test edi, edi
jne 0x40e3c9
mov ecx, 0x47fa24
call fcn.0041decc
push eax
call fcn.0041eaf1
pop ecx
push edi
push esi
push dword [ebp - 8]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40e3de
push 0xfffffffffffffffd
jmp 0x40e412
and dword [ebp - 4], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0x42cc78
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x40e3fd
push 0xfffffffffffffffc
jmp 0x40e412
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
push 1
mov ecx, dword [eax + 8]
mov dword [edx], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
pop esi
push edi
call fcn.0042615e
pop ecx
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x40e420
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
lea eax, [ebp - 0x10]
push edi
push eax
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
xor edi, edi
cmp esi, edi
jne 0x40e444
or eax, 0xffffffff
jmp 0x40e5bf
push ebx
push esi
call fcn.00426169
mov ebx, eax
pop ecx
cmp ebx, edi
mov dword [ebp - 0xc], ebx
jne 0x40e466
mov ecx, 0x47fa24
call fcn.0041decc
push eax
call fcn.0041eaf1
pop ecx
push ebx
push esi
push dword [ebp - 0x10]
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x40e47e
push 0xfffffffffffffffd
jmp 0x40e5b2
lea eax, [ebp - 8]
mov dword [ebp - 8], edi
push eax
lea eax, [ebp - 4]
push eax
push str.VarFileInfoTranslation
push ebx
call sub.VERSION.dll_VerQueryValueA
mov eax, dword [ebp - 8]
mov bl, 3
test bl, al
jne 0x40e5b0
cmp eax, edi
je 0x40e5b0
shr eax, 2
test eax, eax
jle 0x40e596
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x40e4c2
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.0041cf73
mov eax, dword [ebp - 4]
mov esi, 0x42cdb8
movzx eax, word [eax]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0041d600
add esp, 0xc
test byte [ebp - 0x1c], bl
je 0x40e4f5
push edi
push 0x30
lea ecx, [ebp - 0x1c]
call fcn.0041dbaf
jmp 0x40e4e3
push str.StringFileInfo_
lea ecx, [ebp - 0x28]
call fcn.0041cfe3
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041d25e
push 0x42f1b8
lea ecx, [ebp - 0x1c]
call fcn.0041d0c0
mov eax, dword [ebp - 4]
movzx eax, word [eax + 2]
push eax
lea eax, [ebp - 0x1c]
push esi
push eax
call fcn.0041d600
add esp, 0xc
test byte [ebp - 0x1c], bl
je 0x40e542
push edi
push 0x30
lea ecx, [ebp - 0x1c]
call fcn.0041dbaf
jmp 0x40e530
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x28]
push eax
call fcn.0041d25e
push edi
push str.FileDescription
lea ecx, [ebp - 0x28]
call fcn.0041d1e0
lea eax, [ebp - 8]
lea ecx, [ebp - 0x28]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041decc
push eax
push dword [ebp - 0xc]
call sub.VERSION.dll_VerQueryValueA
mov ecx, dword [ebp + 0x10]
cmp ecx, edi
je 0x40e584
push dword [ebp + 8]
call fcn.0041d0c0
lea ecx, [ebp - 0x28]
call fcn.0041d0a9
lea ecx, [ebp - 0x1c]
call fcn.0041d0a9
jmp 0x40e5ac
mov eax, dword [ebp + 0xc]
mov word [ebp + 8], di
cmp eax, edi
mov word [ebp + 0xa], 0x4b0
je 0x40e5ac
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
push 1
jmp 0x40e5b2
push 0xfffffffffffffffc
pop esi
push dword [ebp - 0xc]
call fcn.0042615e
pop ecx
mov eax, esi
pop ebx
pop edi
pop esi
leave
ret
Function at 0x40ea5b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call fcn.0040e622
test al, al
pop ecx
je 0x40ea6c
xor al, al
ret
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov al, cl
ret

Function at 0x40ea81
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, 2
push edi
je 0x40eb49
cmp esi, 7
je 0x40eb49
cmp esi, 0x10
je 0x40eb49
cmp esi, 0x14
je 0x40eb49
cmp esi, 0xb
je 0x40eb49
cmp esi, 5
je 0x40eb49
cmp esi, 0x17
je 0x40eadc
cmp esi, 0x18
je 0x40eadc
cmp esi, 0x19
je 0x40eadc
cmp esi, 0x16
jne 0x40ebd2
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ebd2
cmp esi, 0x18
mov dword [ebp - 8], 0x104
mov eax, str.Common_Programs
jne 0x40eb19
mov eax, str.Common_Startup
jmp 0x40eb2f
cmp esi, 0x19
jne 0x40eb25
mov eax, str.Common_Desktop
jmp 0x40eb2f
cmp esi, 0x16
jne 0x40eb2f
mov eax, str.Common_Start_Menu
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov edi, eax
jmp 0x40ebc8
lea eax, [ebp + 8]
mov dword [ebp + 8], ebx
push eax
push 0x20019
push ebx
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40ebd2
cmp esi, 7
mov dword [ebp - 8], 0x104
mov eax, str.Programs
jne 0x40eb82
mov eax, str.Startup
jmp 0x40ebb0
cmp esi, 0x10
jne 0x40eb8e
mov eax, str.Desktop
jmp 0x40ebb0
cmp esi, 0x14
jne 0x40eb9a
mov eax, str.Fonts
jmp 0x40ebb0
cmp esi, 0xb
jne 0x40eba6
mov eax, str.Start_Menu
jmp 0x40ebb0
cmp esi, 5
jne 0x40ebb0
mov eax, str.Personal
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push ebx
push ebx
push eax
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp edi, ebx
je 0x40ec0e
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40ec12
push dword [ebp + 0xc]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
mov eax, dword [ebp + 0xc]
cmp eax, ebx
je 0x40ec0e
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov al, 1
jmp 0x40ec14
xor al, al
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40edfb
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push ebx
xor ebx, ebx
cmp dword [ebp + 8], ebx
push esi
push edi
je 0x40efc6
cmp dword [ebp + 0xc], ebx
je 0x40efc6
cmp dword [ebp + 0x14], ebx
je 0x40efc6
push dword [ebp + 8]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
call esi
add eax, 4
push eax
call fcn.00426169
mov edi, eax
pop ecx
cmp edi, ebx
jne 0x40ee50
mov ecx, 0x47fa24
call fcn.0041decc
push eax
call fcn.0041eaf1
pop ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x42cfc8
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x148]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
mov dword [ebp - 4], eax
call fcn.0042615e
cmp dword [ebp - 4], 0xffffffff
pop ecx
jne 0x40ee8b
push 0xfffffffffffffffd
jmp 0x40efa9
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
test byte [ebp - 0x148], 0x10
je 0x40ef38
cmp byte [ebp - 0x11c], 0x2e
je 0x40ef4c
push dword [ebp + 8]
call fcn.00425d00
mov edi, eax
pop ecx
lea eax, [ebp - 0x11c]
push eax
call esi
lea eax, [edi + eax + 2]
push eax
call fcn.00426169
mov edi, eax
pop ecx
test edi, edi
jne 0x40eee6
push dword [ebp - 4]
call ebx
mov ecx, 0x47fa24
call fcn.0041decc
push eax
call fcn.0041eaf1
pop ecx
push dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x11c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push edi
call esi
cmp byte [eax + edi - 1], 0x5c
je 0x40ef15
push 0x42cc78
push edi
call fcn.00426420
pop ecx
pop ecx
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push edi
call fcn.0040edfb
push edi
mov dword [ebp - 8], eax
call fcn.0042615e
add esp, 0x14
cmp dword [ebp - 8], 0
jg 0x40ef65
jmp 0x40ef4c
push dword [ebp + 0xc]
lea eax, [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x40ef6f
lea eax, [ebp - 0x148]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40efac
jmp 0x40ee91
push dword [ebp - 4]
call ebx
mov eax, dword [ebp - 8]
jmp 0x40efc9
push dword [ebp - 4]
call ebx
push dword [ebp + 8]
call esi
inc eax
push eax
call fcn.00426169
mov esi, eax
pop ecx
test esi, esi
jne 0x40ef98
mov ecx, 0x47fa24
call fcn.0041decc
push eax
call fcn.0041eaf1
pop ecx
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp + 0x14]
push 1
mov dword [eax], esi
pop eax
jmp 0x40efc9
push dword [ebp - 4]
call ebx
mov esi, 0x47f0a8
mov ecx, esi
call fcn.0041b391
cmp eax, 1
je 0x40efb6
xor eax, eax
jmp 0x40efc9
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret