joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4103e8
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov esi, ecx
mov ebx, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb60
xor eax, eax
push ebp
push 0x410492
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x410422
call fcn.00402020
jmp 0x410499
push 0
push esi
push ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_send
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x41047c
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x41047c
lea eax, [ebp - 0xc]
push eax
mov cl, 1
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00401c7c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x41047c
call fcn.00402020
jmp 0x410499
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410499
mov eax, dword [ebp - 4]
call fcn.0040fb6c
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4104c0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
mov ebx, ecx
mov esi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.0040fb60
xor eax, eax
push ebp
push 0x41058f
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
cmp ebx, 0xffffffff
jne 0x41050f
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
je 0x41050f
lea eax, [ebp - 8]
push eax
push 0x4004667f
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_ioctlsocket
jmp 0x410579
mov eax, dword [ebp - 4]
cmp byte [eax + 8], 0
jne 0x41051f
call fcn.00402020
jmp 0x410596
push 0
push ebx
push esi
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.wsock32.dll_recv
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x410579
call sub.wsock32.dll_WSAGetLastError
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2733
je 0x410579
lea eax, [ebp - 0xc]
push eax
mov cl, 2
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 4]
mov si, 0xfffe
call fcn.00401c7c
mov eax, dword [ebp - 4]
mov edx, dword [eax + 4]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0xc], 0
je 0x410579
call fcn.00402020
jmp 0x410596
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x410596
mov eax, dword [ebp - 4]
call fcn.0040fb6c
ret
mov eax, dword [ebp - 8]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415dc0
Capabilities:
Capture microphone audio

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp byte [eax + 4], 0
je 0x415eff
mov eax, dword [ebp - 8]
mov ebx, dword [eax + 8]
mov eax, dword [ebp - 4]
cmp word [eax + 0xa2], 0
je 0x415e47
mov eax, ebx
call fcn.004011a4
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x415e40
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, ebx
call fcn.004012b8
push ebx
mov ebx, dword [ebp - 4]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 4]
mov eax, dword [ebx + 0xa4]
call dword [ebx + 0xa0]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415e47
mov eax, dword [ebp - 0xc]
call fcn.004011bc
ret
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInUnprepareHeader
test eax, eax
je 0x415e6f
mov ecx, eax
mov edx, 0x415f18
mov eax, dword [ebp - 4]
call fcn.0041608c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0xc]
mov edx, dword [ebp - 8]
mov dword [edx + 4], eax
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x10], edx
mov eax, dword [ebp - 8]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [ebp - 4]
mov edx, dword [eax + 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
xor ecx, ecx
call fcn.00403cb8
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
je 0x415ed5
mov ecx, eax
mov edx, 0x415f38
mov eax, dword [ebp - 4]
call fcn.0041608c
push 0x20
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
je 0x415f0a
mov ecx, eax
mov edx, 0x415f58
mov eax, dword [ebp - 4]
call fcn.0041608c
jmp 0x415f0a
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004161e0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415f68
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff7c
mov esi, edx
lea edi, [esp]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov ebx, eax
cmp byte [ebx + 4], 0
jne 0x41600b
xor eax, eax
mov dword [ebx + 0x94], eax
mov esi, esp
lea edi, [ebx + 0x10]
mov ecx, 0x20
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
or eax, 0xffffffff
push 0x10000
push 0
mov edx, dword [ebx + 0x98]
push edx
lea edx, [esp + 0xc]
push edx
push eax
lea eax, [ebx + 0x94]
push eax
call sub.winmm.dll_waveInOpen
test eax, eax
je 0x415fd4
mov ecx, eax
mov edx, 0x416020
mov eax, ebx
call fcn.0041608c
movzx esi, byte [ebx + 0x91]
test esi, esi
jle 0x415fe9
mov eax, ebx
call fcn.00416120
dec esi
jne 0x415fdf
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInStart
test eax, eax
je 0x416007
mov ecx, eax
mov edx, 0x416034
mov eax, ebx
call fcn.0041608c
mov byte [ebx + 4], 1
add esp, 0x84
pop edi
pop esi
pop ebx
ret

Function at 0x416120
Capabilities:
Capture microphone audio

Disassembly:
push ebx
push esi
push edi
mov ebx, eax
mov eax, 0x20
call fcn.004011a4
mov edi, eax
mov edx, edi
mov eax, dword [ebx + 8]
call fcn.0040e64c
mov esi, edi
mov eax, dword [ebx + 0xc]
call fcn.004011a4
mov dword [esi], eax
mov eax, dword [ebx + 0xc]
mov dword [esi + 4], eax
xor eax, eax
mov dword [esi + 8], eax
xor eax, eax
mov dword [esi + 0x10], eax
xor eax, eax
mov dword [esi + 0x14], eax
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInPrepareHeader
test eax, eax
je 0x41617d
mov ecx, eax
mov edx, 0x4161ac
mov eax, ebx
call fcn.0041608c
push 0x20
push edi
mov eax, dword [ebx + 0x94]
push eax
call sub.winmm.dll_waveInAddBuffer
test eax, eax
je 0x41619e
mov ecx, eax
mov edx, 0x4161cc
mov eax, ebx
call fcn.0041608c
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x4197a4
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, eax
mov ebp, dword [ebx + 0x24]
dec ebp
test ebp, ebp
jl 0x41980f
inc ebp
xor esi, esi
push 0xcc0020
mov eax, esi
add eax, eax
mov edx, dword [ebx + 0x20]
mov eax, dword [edx + eax*8 + 4]
push eax
mov eax, esi
add eax, eax
mov edx, dword [ebx + 0x20]
mov eax, dword [edx + eax*8]
push eax
mov eax, dword [ebx + 0x34]
push eax
mov edi, esi
add edi, edi
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 0xc]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 8]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 4]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8]
push eax
mov eax, dword [ebx + 0x2c]
call fcn.00417bd8
call fcn.004169bc
push eax
call sub.gdi32.dll_BitBlt
inc esi
dec ebp
jne 0x4197b5
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4199bc
Capabilities:
Capture screenshot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov dword [esp], edx
mov ebx, eax
mov byte [esp + 4], 0
mov eax, ebx
call fcn.0041987c
test al, al
je 0x4199ec
mov edx, dword [esp]
mov eax, ebx
call fcn.004198d8
mov byte [esp + 4], 1
jmp 0x419b04
push 0
push 0
mov eax, dword [esp + 8]
call fcn.0040ea34
mov byte [esp + 0xc], 0x4e
lea edx, [esp + 0xc]
mov ecx, 1
mov eax, dword [esp]
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, ebx
call fcn.00419814
mov ebp, dword [ebx + 0x24]
dec ebp
test ebp, ebp
jl 0x419b04
inc ebp
xor esi, esi
mov edi, esi
add edi, edi
mov eax, dword [ebx + 0x20]
mov edx, dword [eax + edi*8 + 8]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebx + 0x20]
mov edx, dword [eax + edi*8 + 0xc]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x10]
push 0xcc0020
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 4]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8]
push eax
mov eax, dword [ebx + 0x2c]
call fcn.00417bd8
call fcn.004169bc
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 0xc]
push eax
mov eax, dword [ebx + 0x20]
mov eax, dword [eax + edi*8 + 8]
push eax
push 0
push 0
mov eax, dword [ebx + 0xc]
call fcn.00417bd8
call fcn.004169bc
push eax
call sub.gdi32.dll_BitBlt
mov eax, dword [ebx + 8]
call fcn.0040f014
mov edx, dword [ebx + 8]
mov eax, dword [ebx + 0xc]
mov ecx, dword [eax]
call dword [ecx + 0x24]
mov eax, dword [ebx + 0x20]
lea edx, [eax + edi*8]
mov ecx, 4
mov eax, dword [esp]
call fcn.0040eb8c
mov eax, dword [ebx + 0x20]
lea edx, [eax + edi*8 + 4]
mov ecx, 4
mov eax, dword [esp]
call fcn.0040eb8c
mov eax, dword [ebx + 8]
call fcn.0040e9e4
mov dword [esp + 8], eax
lea edx, [esp + 8]
mov ecx, 4
mov eax, dword [esp]
call fcn.0040eb8c
push 0
push 0
mov edx, dword [ebx + 8]
mov eax, dword [esp + 8]
call fcn.0040ebac
mov byte [esp + 4], 1
inc esi
dec ebp
jne 0x419a25
mov al, byte [esp + 4]
add esp, 0x10
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41c6e8
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebx
push esi
push edi
mov edi, eax
or ebx, 0xffffffff
mov eax, edi
call fcn.004025b8
dec eax
test eax, eax
jl 0x41c71c
inc eax
xor esi, esi
mov dl, byte [edi + esi]
xor dl, bl
and edx, 0xff
mov edx, dword [edx*4 + 0x4345a4]
shr ebx, 8
xor edx, ebx
mov ebx, edx
inc esi
dec eax
jne 0x41c6ff
xor ebx, 0xffffffff
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x41c7b8
Capabilities:
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
add esp, 0xffffffd8
mov ebx, eax
call fcn.0041c790
cmp dword [0x4349a4], 2
jne 0x41c836
push esp
push 0x28
call sub.user32.dll_mouse_event
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
cmp eax, 1
sbb eax, eax
inc eax
test al, al
je 0x41c836
lea eax, [esp + 0xc]
push eax
push 0x41c84c
push 0
call sub.advapi32.dll_RegQueryValueExA
cmp eax, 1
sbb eax, eax
inc eax
mov dword [esp + 8], 1
mov dword [esp + 0x14], 2
mov edx, 0x10
xor ecx, ecx
mov dword [esp + 4], ecx
test al, al
je 0x41c836
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x1c]
push eax
push edx
lea eax, [esp + 0x14]
push eax
push 0
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegSetValueExA
push 0
push ebx
call sub.user32.dll_CreateWindowExA
cmp eax, 1
sbb eax, eax
inc eax
add esp, 0x28
pop ebx
ret
Function at 0x41ea18
Capabilities:
Acquire debug privileges
Query or enumerate registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebx
add esp, 0xffffffd0
lea eax, [esp + 4]
push eax
push 0x20
call sub.user32.dll_mouse_event
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
lea eax, [esp + 8]
push eax
push 0x41eab4
push 0
call sub.advapi32.dll_RegQueryValueExA
mov eax, dword [esp + 8]
mov dword [esp + 0x24], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], 1
xor ebx, ebx
mov dword [esp + 0x2c], ebx
push esp
lea eax, [esp + 0x14]
push eax
push 0x10
lea eax, [esp + 0x2c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegSetValueExA
mov eax, dword [esp + 8]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
mov dword [esp + 0x10], 1
or ebx, 2
mov dword [esp + 0x1c], ebx
push esp
push 0
mov eax, dword [esp + 8]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
mov eax, dword [esp + 0x18]
push eax
call sub.advapi32.dll_RegSetValueExA
add esp, 0x30
pop ebx
ret

Function at 0x41fce4
Capabilities:
Create directory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov dword [esp], edx
mov ebp, eax
push ebp
call sub.KERNEL32.DLL_CreateFileA
mov ebx, eax
lea edi, [ebx + 1]
mov eax, edi
call fcn.004011a4
mov esi, eax
push edi
push esi
push ebp
call sub.KERNEL32.DLL_CreateDirectoryA
mov eax, dword [esp]
mov edx, esi
call fcn.00402540
mov edx, edi
mov eax, esi
call fcn.004011bc
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x41ff9c
Capabilities:
Get common file path

Disassembly:
push ecx
mov edx, esp
mov eax, 0x435bc8
mov ecx, 2
call fcn.004012b8
mov al, byte [esp + 1]
sub al, 0x44
je 0x41ffbc
sub al, 0x11
je 0x41ffce
jmp 0x41ffde
push 0
push 0
push 0
mov al, byte [esp + 0xc]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
pop edx
ret
push 0
push 2
push 0
mov al, byte [esp + 0xc]
push eax
call sub.KERNEL32.DLL_GetSystemDirectoryA
pop edx
ret
Function at 0x41ffe0
Capabilities:
Get hostname
Get system information on windows

Disassembly:
add esp, 0xfffffff0
mov edx, esp
mov eax, 0x435bb8
mov ecx, 0x10
call fcn.004012b8
mov eax, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.KERNEL32.DLL_GetComputerNameA
mov al, byte [esp]
sub al, 0x4c
je 0x42001f
dec al
je 0x420082
sub al, 5
je 0x420054
sub al, 5
je 0x4200b0
jmp 0x4200cc
mov al, byte [esp + 1]
cmp al, 0x44
jne 0x42003b
push 0
push 0
push 0
push 0
push 2
call sub.KERNEL32.DLL_GetSystemInfo
jmp 0x4200cc
cmp al, 0x55
jne 0x4200cc
push 0
push 0
push 0
push 0
push 4
call sub.KERNEL32.DLL_GetSystemInfo
jmp 0x4200cc
mov al, byte [esp + 1]
cmp al, 0x44
jne 0x42006d
push 0
push 0
push 0
push 0
push 8
call sub.KERNEL32.DLL_GetSystemInfo
jmp 0x4200cc
cmp al, 0x55
jne 0x4200cc
push 0
push 0
push 0
push 0
push 0x10
call sub.KERNEL32.DLL_GetSystemInfo
jmp 0x4200cc
mov al, byte [esp + 1]
cmp al, 0x44
jne 0x42009b
push 0
push 0
push 0
push 0
push 0x20
call sub.KERNEL32.DLL_GetSystemInfo
jmp 0x4200cc
cmp al, 0x55
jne 0x4200cc
push 0
push 0
push 0
push 0
push pe_nt_image_headers32
call sub.KERNEL32.DLL_GetSystemInfo
jmp 0x4200cc
cmp byte [esp + 1], 0x43
jne 0x4200cc
push 0
mov eax, dword [esp + 0x10]
push eax
push 0
push 0
push 0x800
call sub.KERNEL32.DLL_GetSystemInfo
add esp, 0x10
ret

Function at 0x420eec
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x420fea
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x41b390]
call fcn.0041b464
mov esi, eax
mov edx, 0x80000001
mov eax, esi
call fcn.0041b504
mov cl, 1
mov edx, 0x421000
mov eax, esi
call fcn.0041b620
mov cl, 1
mov edx, 0x421014
mov eax, esi
call fcn.0041b620
mov cl, 1
mov edx, 0x421028
mov eax, esi
call fcn.0041b620
mov cl, 1
mov edx, 0x421038
mov eax, esi
call fcn.0041b620
mov cl, 1
mov edx, 0x421050
mov eax, esi
call fcn.0041b620
mov cl, 1
mov edx, 0x421064
mov eax, esi
call fcn.0041b620
test bl, bl
je 0x420f9b
push 0
push 0
push 0
push 0x61
call sub.KERNEL32.DLL_GetLocaleInfoA
lea edx, [ebp - 4]
mov eax, 0x421074
call fcn.0041e5fc
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.0041b978
test bl, bl
jne 0x420fc8
push 0
push 0
push 1
push 0x61
call sub.KERNEL32.DLL_GetLocaleInfoA
lea edx, [ebp - 8]
mov eax, 0x421074
call fcn.0041e5fc
mov edx, dword [ebp - 8]
mov ecx, 0x42108c
mov eax, esi
call fcn.0041b820
mov eax, esi
call fcn.0041b4d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x420ff1
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402438
ret
Function at 0x421fe8
Capabilities:
Swap mouse buttons

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004027a0
mov eax, dword [ebp - 8]
call fcn.004027a0
xor eax, eax
push ebp
push 0x4220a8
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf003f
push 0
mov eax, dword [ebp - 4]
call fcn.004027b0
push eax
call sub.user32.dll_SetTimer
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x42208d
xor eax, eax
push ebp
push 0x422086
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xf01ff
mov eax, dword [ebp - 8]
call fcn.004027b0
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SetWindowTextA
mov ebx, eax
xor eax, eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push 0
push ebx
call sub.user32.dll_SwapMouseButton
push ebx
call sub.user32.dll_SetWindowPos
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x42208d
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_SetWindowPos
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4220af
lea eax, [ebp - 8]
mov edx, 2
call fcn.00402438
ret
Function at 0x422574
Capabilities:
Create directory
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, 5
push 0
push 0
dec ecx
jne 0x42257d
push ecx
xchg dword [ebp - 4], ecx
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov byte [ebp - 1], dl
mov edi, eax
xor eax, eax
push ebp
push 0x4226f4
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x15], 0xd
push 0
push edi
call sub.KERNEL32.DLL_RtlUnwind
mov ebx, eax
test ebx, ebx
jbe 0x4226b0
cmp edi, ebx
je 0x42269e
mov eax, ebx
xor edx, edx
push edx
push eax
mov eax, dword [0x435c14]
cdq
cmp edx, dword [esp + 4]
jne 0x4225d4
cmp eax, dword [esp]
pop edx
pop eax
je 0x42269e
push ebx
call sub.KERNEL32.DLL_CreateFileA
mov esi, eax
inc esi
lea eax, [ebp - 0xc]
mov edx, esi
call fcn.004028dc
push esi
mov eax, dword [ebp - 0xc]
call fcn.004027b0
push eax
push ebx
call sub.KERNEL32.DLL_CreateDirectoryA
mov esi, eax
test esi, esi
jle 0x42269e
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 0xc]
call fcn.0040580c
cmp byte [ebp - 1], 0
je 0x422658
push dword [ebp - 0x14]
push dword [ebp - 0x10]
lea eax, [ebp - 0x1c]
mov dl, byte [ebp - 0x15]
call fcn.00402530
push dword [ebp - 0x1c]
lea edx, [ebp - 0x20]
mov eax, ebx
call fcn.00419d28
push dword [ebp - 0x20]
lea eax, [ebp - 0x24]
mov dl, byte [ebp - 0x15]
call fcn.00402530
push dword [ebp - 0x24]
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00402678
jmp 0x42269e
push ebx
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x42269e
push dword [ebp - 0x14]
push dword [ebp - 0x10]
lea eax, [ebp - 0x28]
mov dl, byte [ebp - 0x15]
call fcn.00402530
push dword [ebp - 0x28]
lea edx, [ebp - 0x2c]
mov eax, ebx
call fcn.00419d28
push dword [ebp - 0x2c]
lea eax, [ebp - 0x30]
mov dl, byte [ebp - 0x15]
call fcn.00402530
push dword [ebp - 0x30]
lea eax, [ebp - 0x14]
mov edx, 5
call fcn.00402678
push 2
push ebx
call sub.KERNEL32.DLL_RtlUnwind
mov ebx, eax
test ebx, ebx
ja 0x4225b7
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.004025b8
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x14]
call fcn.0040280c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4226fb
lea eax, [ebp - 0x30]
mov edx, 6
call fcn.00402438
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.00402438
ret

Function at 0x422874
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.004027a0
xor eax, eax
push ebp
push 0x4228b9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004027b0
push eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4228c0
lea eax, [ebp - 4]
call fcn.00402414
ret

Function at 0x4228c4
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
jne 0x4228d9
push 5
push ebx
call sub.KERNEL32.DLL_GetLastError
pop ebx
ret
Function at 0x4228dc
Capabilities:
Create process on windows

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_CreateProcessA
test eax, eax
je 0x4228f1
push 0
push ebx
call sub.KERNEL32.DLL_GetLastError
pop ebx
ret

Function at 0x424dc8
Capabilities:
Get file size

Disassembly:
push ebx
xor ebx, ebx
cmp byte [0x434b1c], 0
je 0x424dd8
mov bl, 1
jmp 0x424e03
push 0
mov eax, dword [0x435680]
push eax
push 0x424dbc
push 2
call sub.KERNEL32.DLL_GetFileSize
mov dword [0x435c28], eax
cmp dword [0x435c28], 0
je 0x424e03
mov bl, 1
mov byte [0x434b1c], 1
mov eax, ebx
pop ebx
ret

Function at 0x425084
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
push edi
lea eax, [ebp - 0xa4]
mov edx, 0x94
call fcn.00403cc4
mov dword [ebp - 0xa4], 0x94
lea eax, [ebp - 0xa4]
push eax
call sub.user32.dll_keybd_event
mov eax, dword [ebp - 0x94]
cmp eax, 1
sete dl
neg dl
sbb edx, edx
mov dword [ebp - 4], edx
cmp eax, 2
jne 0x4251cc
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 8
call sub.user32.dll_mouse_event
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
je 0x4251cc
xor eax, eax
push ebp
push 0x4251c5
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 2
mov eax, dword [ebp - 8]
push eax
call fcn.00403660
mov eax, dword [ebp - 0xc]
push eax
call fcn.004033e4
pop ecx
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4251ae
xor eax, eax
push ebp
push 0x4251a7
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
push 2
mov eax, dword [ebp - 8]
push eax
call fcn.00403660
test eax, eax
je 0x42518f
call fcn.00425054
mov edi, eax
mov eax, dword [ebp - 0x10]
mov ebx, dword [eax]
dec ebx
test ebx, ebx
jl 0x425189
inc ebx
xor esi, esi
push edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + esi*8 + 4]
push eax
call fcn.00403650
test eax, eax
je 0x425185
mov dword [ebp - 4], 0xffffffff
jmp 0x425189
inc esi
dec ebx
jne 0x42516a
push edi
call fcn.00403658
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4251ae
mov eax, dword [ebp - 0x10]
push eax
call fcn.004033f4
pop ecx
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4251cc
mov eax, dword [ebp - 8]
push eax
call fcn.004036c8
ret
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret