joyce8/EMBER2024-capa huggingface dataset:
Function at 0x538639
Capabilities:
Encode data using xor

Disassembly:
xor dword [ecx], 0xf4b2917f
pop es
xchg edi, eax
add eax, 0x6a0af777
xor al, 1
push ecx
rcr byte gs:[esi + 0x69], 0xb3
retf 0x702
pop esi
imul esi, dword [ebx + 0x150702ca], 0x283524e7
fsubr st(4), st(0)
pop edx
jnp 0x538636
les esi, [eax - 0x5373fbd4]
pop ecx
shr byte [eax - 0x4c], 1
cdq
scasb al, byte es:[edi]
push ebp
ficom word [edx]
xor byte [0x3aa7728b], 0x26
or dword [ebx + eax*2 - 0x182b1d4a], 0x80473e36
xor al, 0x8d
or ch, byte [ebx + 0x24e529a]
mov word [edi], fs
clc
mov bh, 0x3a
loop 0x5385cb
out 0x36, eax
inc edi
xor byte [ecx*4 + 0x529aab0a], 0x4e
add cl, byte [edi + 0x3ab765f8]
mov dh, pe_nt_image_headers32
inc ebx
mov eax, ebp
jb 0x5385db
pushfd
sbb bl, byte [ebx - 0x7c]
inc edx
movsb byte es:[edi], byte [esi]
pop ebx
test byte [edx - 0x5c], al
in al, dx
mov bl, 0xa4
xor byte [edx + 0xe30ab33], al
les edi, [ecx + ebp*8]
js 0x5385b9
mov ebx, 0xf6b9a278
popfd
add esi, dword [ecx + 0x39]
popal
add dh, byte [ecx - 0x68]
adc al, 0x60
xor al, 0xa1
sub byte [eax - 0x3f], dl
mov edx, ss
shl byte [ecx - 8], cl
mov ah, cl
lock adc byte [eax - 0x6b944e7d], dl
leave
stosd dword es:[edi], eax
mov bl, 0xc7
add edx, ebx
sub dh, ah
sbb al, 0xf5
js 0x5385f5
pop esi
and eax, 0xc18e2d10
pop ebx
aad 0xe0
outsb dx, byte [esi]
xchg ebx, eax
sub al, dh
popfd
cmp dh, cl
pop edx
xchg byte [ebp + 0x2b], bh
pop ecx
cmp eax, 0xc4f3141a
jl 0x538613
fidivr word [edx - 0x202de02c]
sub al, 0x9f
xor cl, byte [eax + esi*4 + 0x5e]
add dword [eax + eax*2 - 0x71], ebx
je 0x5386ea
push es
or al, 0xb7
jae 0x538648
pop ds
xchg esi, eax
cmp ebp, esi
add dl, byte [ecx + 0x4bfbaafe]
lahf
xchg esi, eax
or bh, byte [0x45be970c]
lcall 0x861b, 0x62ffadc9
cmc
push dword [ebx + 8]
jp 0x538651
jo 0x5386cd
lds esi, [eax]
inc esp
test al, 0xb8
add ah, byte [ecx - 0x2f]
jecxz 0x538664
inc edi
mov dl, 0x14
mov eax, dword [0xe6a2bfa9]
dec edx
lcall 0x3319, 0xffd41935
xor al, 0xd2
push ebp
cmp eax, 0x1d44bc97
add al, 2
wait
add bh, byte [ecx + 0x56d5fc02]
cdq
add dl, ah
push eax
out 0xdb, al
invalid
fisub word [ebx - 0x605bd133]
and dword [ecx + ebp*2 - 0x247ca2fe], ebp
pop es
xor al, 0xc2
retf 0x7a92
Function at 0x579969
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
in al, dx
add byte [ebx], dh
rcl byte [ebp + 0x68], 0x50
nop
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
inc esp
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
inc ebp
add byte [ecx], al
leave
mov edx, 0x68000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
pop es
add byte [edx + 0x40], bh
call 0xff5899b9
cmp ebx, 0x40
jle 0x57998b
add dh, al
mov edx, dword [ebp - 4]
call 0x1579cb1
call int.00583449
push eax
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
inc ecx
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x5799cb
add bl, bl
jle 0x579a0d
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x1257cda5
add byte [ebp - 4], al
call fcn.0057ca49
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.00569ad2
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
mov es, word [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4b], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec ebx
add cl, ch
ja 0x579a48
add byte [eax], al
jmp 0x579a1a
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
xchg ebp, eax
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 8
lea eax, [ebp - 4]
call fcn.00589a9d
mov eax, dword [ebp + 8]
mov esp, dword [edi]
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x9fc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x6ad3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
daa
add byte [ebp - 4], al
call fcn.0057c489
add byte [ecx], al
loopne 0x579a99
in eax, dx
pop ds
add bh, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x5c5259
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
in al, dx
add byte [ebx], dh
rcl byte [ebp + 0x68], 0x50
nop
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
inc esp
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
inc ebp
add byte [ecx], al
leave
mov edx, 0x68000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
pop es
add byte [edx + 0x40], bh
call 0xff5d52a9
cmp ebx, 0x40
jle 0x5c527b
add dh, al
mov edx, dword [ebp - 4]
call 0x15c55a1
call fcn.005ced39
push eax
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
inc ecx
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x5c52bb
add bl, bl
jle 0x5c52fd
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x125c8695
add byte [ebp - 4], al
call fcn.005c8339
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call fcn.005b53c2
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
mov es, word [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4b], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec ebx
add cl, ch
ja 0x5c5338
add byte [eax], al
jmp 0x5c530a
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
xchg ebp, eax
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 8
lea eax, [ebp - 4]
call fcn.005d538d
mov eax, dword [ebp + 8]
mov esp, dword [edi]
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x9fc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x6ad3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
daa
add byte [ebp - 4], al
call fcn.005c7d79
add byte [ecx], al
loopne 0x5c5389
in eax, dx
pop ds
add bh, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x6100e9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add byte [ecx], al
push ebx
push esi
push edi
mov ebx, edx
in al, dx
add byte [ebx], dh
rcl byte [ebp + 0x68], 0x50
nop
inc eax
add byte [ecx], al
push dword [eax]
mov dword fs:[eax], esp
inc esp
add byte [ebx + 0x4a7e40fb], al
lea eax, [ebp]
add ecx, ecx
inc ebp
add byte [ecx], al
leave
mov edx, 0x68000040
add byte [esp + esi], cl
add byte [eax], al
lea eax, [ebp - 4]
add byte [ecx], al
xor byte [eax], al
add byte [esi - 0x47], ah
pop es
add byte [edx + 0x40], bh
call 0xff620139
cmp ebx, 0x40
jle 0x61010b
add dh, al
mov edx, dword [ebp - 4]
call 0x1610431
call fcn.00619bc9
push eax
add byte [eax + eax], al
add byte [eax], al
add byte [ebp + 0x41], dh
inc ecx
add byte [ecx], al
inc eax
cmp ebx, 0x40
jg 0x61014b
add bl, bl
jle 0x61018d
lea eax, [ebp - 4]
xor eax, dword [eax]
add ebx, edx
call 0x12613525
add byte [ebp - 4], al
call fcn.006131c9
add byte [ecx], al
and byte [eax], al
mov edx, ebx
call 0x600252
mov eax, esi
mov edx, dword [ebp - 4]
add byte [ecx], al
add al, byte [eax]
add al, ch
inc ebx
mov es, word [eax]
add byte [ebx + 0x4b8], al
add byte [eax], al
add eax, eax
pop edx
pop ecx
pop ecx
out dx, al
add byte [eax + 0x57], ch
nop
inc eax
add byte [ebp - 0x74feffbb], cl
sub al, byte [eax]
add byte [eax + 0x4b], bl
lea eax, [ebp]
add dword [ebx + 0x5800002a], ecx
dec ebx
add cl, ch
ja 0x6101c8
add byte [eax], al
jmp 0x61019a
mov eax, dword [0x885980]
add dword [ebx + 0x488b0845], ecx
xchg ebp, eax
add byte [esi + 0x2d289], bh
add byte [ebx + 0x508b0100], cl
cld
add edx, 8
lea eax, [ebp - 4]
call fcn.0062021d
mov eax, dword [ebp + 8]
mov esp, dword [edi]
add byte [ebx - 0x5b1703ab], cl
add eax, dword [eax]
add byte [ecx], al
inc ebp
or byte [ebx + 0x9fc40], cl
rol byte [edx], cl
add byte [eax], al
add byte [ebx + 0x40010045], cl
cld
mov byte [eax + 0x6ad3], 0
xor eax, eax
pop edx
pop ecx
pop ecx
add byte [ecx], al
adc byte [eax - 0x1f], ch
nop
inc eax
daa
add byte [ebp - 4], al
call fcn.00612c09
add byte [ecx], al
loopne 0x610219
in eax, dx
pop ds
add bh, dh
add dh, ch
pop ecx
pop ebp
ret
Function at 0x6599ad
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x662398
cmp edx, dword [eax]
je 0x6599cf
add eax, 8
inc ecx
cmp eax, 0x662428
jl 0x6599c0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x662398]
jne 0x659afd
mov eax, dword [0xa5f0fc]
cmp eax, 1
je 0x659ad7
test eax, eax
jne 0x659a00
cmp dword [0x6622c4], 1
je 0x659ad7
cmp edx, 0xfc
je 0x659afd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
invalid
invalid
test eax, eax
jne 0x659a37
lea eax, [ebp - 0x1a4]
push 0x65eab0
push eax
call fcn.0065a390
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.0065a820
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x659a7a
lea eax, [ebp - 0x1a4]
push eax
call fcn.0065a820
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x65eaac
push edi
call fcn.0065c6f0
add esp, 0x10
lea eax, [ebp - 0xa0]
push 0x65ea90
push eax
call fcn.0065a390
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.0065a3a0
lea eax, [ebp - 0xa0]
push 0x65ea8c
push eax
call fcn.0065a3a0
push dword [esi + 0x66239c]
lea eax, [ebp - 0xa0]
push eax
call fcn.0065a3a0
push 0x12010
lea eax, [ebp - 0xa0]
push 0x65ea64
push eax
call fcn.0065c664
add esp, 0x2c
pop edi
jmp 0x659afd
lea eax, [ebp + 8]
lea esi, [esi + 0x66239c]
push 0
push eax
push dword [esi]
call fcn.0065a820
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x406a26
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406a4a
xor eax, eax
test eax, eax
je 0x406a5d
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x406a5d
xor ecx, ecx
jmp 0x406a60
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406b83
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4275ec], 0
push esi
jne 0x406bba
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406b94
mov dword [ecx*4 + 0x4275e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406b8f
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406beb
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4275e8]
xor eax, esi
inc ecx
dec edx
jne 0x406bcd
pop edi
not eax
pop esi
ret 0xc

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x4011cb
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.004032dc
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x4032dc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call sub.KERNEL32.DLL_GetCommandLineA
mov edi, eax
cmp byte [edi], 0x22
jne 0x403310
push 0x22
mov eax, edi
inc eax
push eax
call sub.CRTDLL.DLL_strchr
add esp, 8
mov dword [ebp - 4], eax
or eax, eax
je 0x40332b
mov edi, eax
inc edi
jmp 0x403308
inc edi
cmp byte [edi], 0x20
je 0x403307
jmp 0x40332b
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x40331c
cmp eax, 0x20
jne 0x40330f
jmp 0x40331f
inc edi
movsx eax, byte [edi]
or eax, eax
je 0x40332b
cmp eax, 0x20
je 0x40331e
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
push 1
push edi
push 0
push eax
call fcn.00402fb8
pop edi
leave
ret
Function at 0x40a0db
Capabilities:
Encode data using xor

Disassembly:
cmp dword [0x415c9c], 0
je 0x40a0bf
mov eax, dword [0x415c9c]
mov byte [eax + 0x18], 1
mov eax, dword [0x415c9c]
mov edx, dword [eax]
call dword [edx - 8]
xor eax, eax
mov dword [0x415c9c], eax
cmp dword [0x415ca0], 0
je 0x40a0e2
mov eax, dword [0x415ca0]
mov byte [eax + 0x18], 1
mov eax, dword [0x415ca0]
call fcn.00403894
mov edi, dword [esp]
sub esp, 0xfffffffc
mov ecx, dword [esp]
or al, 0x24
add esp, 4
mov eax, 0x50a2518c
xor ecx, eax
xor ecx, 0x1f0020d6
pop edx
sub esp, 4
mov esi, esp
mov dword [esi], edx
mov esi, edi
sub esp, 4
mov dword [esp], esi
mov esi, 0x774d1fe8
shr esi, 6
mov ebx, 0x19df571
xor ebx, esi

Function at 0x40aa03
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00404914
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
mov edi, eax
cmp edi, 0x104
jbe 0x40aa26
mov eax, edi
add eax, eax
call fcn.00402e04
mov esi, eax
jmp 0x40aa28
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call sub.kernel32.dll_MultiByteToWideChar_1
push edi
push esi
call sub.user32.dll_CharUpperBuffW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x40aa61
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x40aa4b
mov eax, esp
cmp esi, eax
je 0x40aa6e
mov eax, esi
call fcn.00402e20
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x40aaa8
cmp bl, 0
je 0x40aaa4
cmp bl, 0x41
jl 0x40aa9f
cmp bl, 0x5a
jg 0x40aa9f
or bl, 0x20
xor al, bl
inc esi
jmp 0x40aa83
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x40a9e8

Function at 0x40b698
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x40b6de
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b62c
mov eax, dword [ebp - 4]
call fcn.00404d24
push eax
call sub.kernel32.dll_GetFileAttributesW
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b6e5
lea eax, [ebp - 4]
call fcn.00404c88
ret
Function at 0x40b8fc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x40b993
push dword fs:[eax]
mov dword fs:[eax], esp
test esi, esi
jne 0x40b947
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameW_1
mov ecx, eax
lea edx, [ebp - 0x20c]
mov eax, edi
call fcn.00404dd4
jmp 0x40b97d
call sub.kernel32.dll_GetCommandLineW_1
mov ebx, eax
cmp word [ebx], 0
jne 0x40b960
lea eax, [ebp - 4]
xor edx, edx
call fcn.00404cec
jmp 0x40b973
lea edx, [ebp - 4]
mov eax, ebx
call fcn.0040b7bc
mov ebx, eax
test esi, esi
je 0x40b973
dec esi
jmp 0x40b94e
mov eax, edi
mov edx, dword [ebp - 4]
call fcn.00404c98
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40b99a
lea eax, [ebp - 4]
call fcn.00404c88
ret

Function at 0x40b9a4
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408218
add esp, 0x208
pop ebx
ret

Function at 0x40b9d0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf8
mov ebx, eax
push 0x104
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemDirectoryW
mov edx, ebx
mov eax, esp
call fcn.00408218
add esp, 0x208
pop ebx
ret
Function at 0x401000
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x108
push ebp
mov ebp, dword [esp + 0x114]
test ebp, ebp
je 0x4010d8
push ebp
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
je 0x4010d8
mov ecx, dword [esp + 0x110]
lea eax, [esp + 4]
push eax
push 0x10008
push 0
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4010dd
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ecx, dword [esp + 0xc]
push 0
push 0
push 0
lea edx, [esp + 0x1c]
push 0
lea eax, [esp + 0x24]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x30], 0xff
call edi
mov esi, eax
cmp esi, 0x103
je 0x4010b0
test esi, esi
jne 0x4010c1
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push eax
call fcn.00401000
mov esi, eax
add esp, 8
test esi, esi
je 0x401050
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x108
ret
mov ecx, dword [esp + 0x118]
push ebp
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
pop ebp
add esp, 0x108
ret
mov eax, 0x3f2
pop ebp
add esp, 0x108
ret

Function at 0x4010f0
Capabilities:
Set registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
lea eax, [esp + 8]
push 0
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x401153
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
push 4
push eax
push 4
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x401148
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
ret

Function at 0x401220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40123a
test al, 0x10
jne 0x40123a
mov eax, 1
ret
xor eax, eax
ret
Function at 0x401240
Capabilities:
Copy file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
sub esp, 0x658
push esi
push edi
mov edi, dword [esp + 0x664]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x354]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x406404
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x560]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x358]
push ecx
push edx
call fcn.004011d0
add esp, 0xc
lea eax, [esp + 0x214]
lea ecx, [esp + 0x55c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [esp + 8], esi
je 0x4013c1
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
cmp byte [esp + 0x248], 0x2e
je 0x4013a4
test byte [esp + 0x21c], 0x10
je 0x4013a4
lea edx, [esp + 0x248]
lea eax, [esp + 0x35c]
push edx
lea ecx, [esp + 0x18]
push eax
push ecx
call fcn.004011d0
lea edx, [esp + 0x20]
push edx
call fcn.00401240
add esp, 0x10
lea eax, [esp + 0x14]
push 6
push eax
call ebp
lea ecx, [esp + 0x460]
push 0x104
push ecx
push 0
call ebx
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x118]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str..exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x118]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00401220
add esp, 4
test eax, eax
jne 0x4013a4
lea ecx, [esp + 0x118]
push eax
lea edx, [esp + 0x464]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esi, dword [esp + 0x10]
lea eax, [esp + 0x21c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4012c3
pop ebp
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
add esp, 0x658
ret

Function at 0x4013e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x104
lea eax, [esp]
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edi, [esp + 4]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
add ecx, 0xfffffffe
pop edi
test ecx, ecx
jle 0x401422
mov al, 0x2e
cmp byte [esp + ecx], al
je 0x40141d
dec ecx
test ecx, ecx
jg 0x401410
jmp 0x401422
mov byte [esp + ecx], 0
push 0xa
lea ecx, [esp + 4]
push 0
push ecx
push str.Explorer.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x104
ret