joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405160
Capabilities:
Enumerate network shares

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
push 0x4000
push 0
mov dword [esp + 0x1c], 0
mov dword [esp + 0x20], 0x4000
mov dword [esp + 0x18], 0xffffffff
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
mov dword [esp + 0x1c], esi
je 0x405308
mov ecx, dword [ebp + 0xc]
mov edi, dword [ebp + 8]
lea eax, [esp + 0x14]
push eax
push ecx
push 0
push 0
push edi
call sub.MPR.dll_WNetOpenEnumW
test eax, eax
je 0x4051cf
push edi
push eax
call fcn.004065c0
add esp, 8
jmp 0x4052ea
mov edi, dword [ebp + 0x10]
push 0x4000
push 0
push esi
mov dword [esp + 0x24], 0x4000
mov dword [esp + 0x1c], 0xffffffff
call fcn.00401100
mov ecx, dword [esp + 0x20]
add esp, 0xc
lea edx, [esp + 0x18]
push edx
push esi
lea eax, [esp + 0x18]
push eax
push ecx
call sub.MPR.dll_WNetEnumResourceW
test eax, eax
jne 0x4052da
mov eax, dword [ebp + 0xc]
test eax, eax
jne 0x405221
mov edx, dword [esp + 0x10]
mov eax, dword [ebp + 8]
push edx
push eax
jmp 0x40522a
mov ecx, dword [esp + 0x10]
mov edx, dword [eax + 0x14]
push ecx
push edx
call fcn.004065c0
xor ebx, ebx
add esp, 8
cmp dword [esp + 0x10], ebx
jbe 0x4051d2
add esi, 4
lea ecx, [ecx]
mov eax, dword [esi + 0x14]
test eax, eax
mov ecx, eax
jne 0x40524e
mov ecx, 0x4081ec
mov eax, dword [esi + 0x10]
test eax, eax
jne 0x40525a
mov eax, 0x4081ec
push ecx
mov ecx, dword [esi]
push ecx
push eax
call fcn.004065c0
mov eax, dword [esi + 8]
add esp, 0xc
test al, 2
je 0x4052a6
mov edx, dword [esi + 0x10]
test edx, edx
je 0x4052c1
test edi, edi
jle 0x4052c1
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x40528c
mov eax, dword [eax + 0x14]
call fcn.00403fe0
test eax, eax
je 0x4052c1
mov edx, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push edx
sub edi, 1
push edi
lea eax, [esi - 4]
push eax
push ecx
call fcn.00405160
add esp, 0x10
jmp 0x4052c1
test byte [esi], 1
je 0x4052c1
push eax
call fcn.004065c0
mov edx, dword [esi + 0x10]
mov eax, dword [ebp + 0x14]
add esp, 4
push edx
push eax
call fcn.00401c70
add ebx, 1
add esi, 0x20
cmp ebx, dword [esp + 0x10]
jb 0x405240
mov esi, dword [esp + 0x1c]
jmp 0x4051d2
cmp eax, 0x103
je 0x4052ea
push eax
call fcn.004065c0
add esp, 4
mov eax, dword [esp + 0x14]
test eax, eax
je 0x4052f8
push eax
call sub.MPR.dll_WNetCloseEnum
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405370
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
push edi
call fcn.004065d0
mov ebx, 1
mov byte [0x41b26c], al
mov byte [0x41900f], 0
mov byte [0x41900e], bl
mov byte [0x40900b], bl
mov byte [0x409008], bl
mov byte [0x409009], bl
call fcn.00406240
cmp al, 2
jne 0x4053b0
mov byte [0x41900f], bl
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push ebx
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4053d0
push eax
call fcn.00405400
mov esi, eax
jmp 0x4053d2
xor esi, esi
call fcn.004058c0
test esi, esi
je 0x4053ec
call fcn.00405690
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x4058c0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
push edi
call fcn.004065c0
push 0x20
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00401100
add esp, 0xc
push 0x20
lea ecx, [esp + 0xc]
push ecx
push 0x58
push 0x800
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x405908
mov eax, dword [esp + 8]
test eax, 0x200
je 0x405908
test eax, eax
jns 0x40597b
call fcn.00405b80
test al, al
je 0x40597b
cmp byte [0x41900f], 0
je 0x40595f
mov esi, dword [0x41b268]
mov edi, dword [0x41901c]
push esi
mov byte [0x40900b], 1
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push esi
mov dword [esi + 0x20], edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edx, dword [0x41901c]
push edx
call fcn.004065c0
add esp, 4
call fcn.00402e20
xor eax, eax
call fcn.00405a90
pop edi
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [0x41b240], 0
jne 0x405971
call fcn.00407020
cmp al, 1
je 0x40597b
call fcn.00404290
call fcn.00406420
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x405a90
Capabilities:
Create thread

Disassembly:
push ecx
cmp byte [0x40900b], 0
push esi
push edi
mov esi, eax
je 0x405b6e
mov eax, dword [0x41b264]
push 0
push eax
call fcn.004012c0
mov eax, dword [0x41b264]
call fcn.004014c0
mov eax, dword [0x41b264]
call fcn.004015d0
cmp dword [0x41b230], 0x7fffffff
jne 0x405ad4
call fcn.00404980
test esi, esi
je 0x405ae7
mov ecx, dword [0x41b264]
push esi
push ecx
call fcn.00401c70
jmp 0x405b1e
mov edx, dword [0x41b264]
push edx
call fcn.004019c0
mov eax, dword [0x41b264]
push 0
push 0
push eax
push 0x405310
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x41b264]
test eax, eax
mov edi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov esi, eax
je 0x405b40
call fcn.00401220
push esi
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push 8
push 0
call edi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x405b67
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [0x41b264], eax
pop edi
pop esi
pop ecx
ret
xor eax, eax
mov dword [0x41b264], eax
pop edi
pop esi
pop ecx
ret
Function at 0x4061f0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x41b2a4]
sub esp, 8
test eax, eax
push ebx
jne 0x406208
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x41b2a4], eax
cmp al, 6
jae 0x406213
xor al, al
pop ebx
add esp, 8
ret
cmp byte [0x40900b], 0
je 0x40620c
lea eax, [esp + 8]
push eax
call dword [0x41b254]
call fcn.00405fb0
mov ecx, dword [esp + 8]
push ecx
mov bl, al
call dword [0x41b260]
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x406240
Capabilities:
Accept command line arguments

Disassembly:
sub esp, 0x10
push ebx
lea eax, [esp + 0x10]
xor ebx, ebx
push eax
mov dword [0x41b240], ebx
mov byte [esp + 0xb], bl
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp eax, ebx
mov dword [esp + 8], eax
jne 0x406271
xor al, al
pop ebx
add esp, 0x10
ret
push edi
mov edi, 1
cmp dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
jle 0x4063ff
push ebp
mov ebp, dword [0x41b240]
push esi
lea ecx, [ecx]
mov esi, dword [eax + edi*4]
cmp word [esi], 0x6e
jne 0x4062bb
cmp word [esi + 2], 0x6f
jne 0x4062bb
lea edx, [esi + 4]
call fcn.00407080
test al, al
je 0x4063e4
mov byte [0x40900b], bl
jmp 0x4063e4
cmp ebp, ebx
jne 0x40634f
mov edx, esi
call fcn.004070a0
test al, al
je 0x40634f
lea ecx, [esi + 0xa]
mov eax, ecx
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x4062d7
sub eax, ecx
sar eax, 1
add eax, eax
je 0x406410
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
cmp ebp, ebx
mov dword [0x41b240], ebp
je 0x40634f
mov eax, dword [esp + 0x14]
mov eax, dword [eax + edi*4]
lea esi, [eax + 0xa]
mov eax, esi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406315
sub eax, esi
sar eax, 1
mov edx, ebp
mov edi, eax
jmp 0x406330
movzx ecx, word [esi]
mov word [edx], cx
add edx, 2
add esi, 2
cmp cx, bx
je 0x406346
sub edi, 1
jne 0x406330
cmp edi, ebx
jne 0x40634f
mov word [ebp + eax*2 - 2], bx
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov esi, dword [edx + eax*4]
movzx edi, word [esi]
cmp di, 0x66
jne 0x40636f
cmp word [esi + 2], bx
jne 0x40636f
mov byte [0x409008], bl
cmp di, 0x76
jne 0x406381
cmp word [esi + 2], bx
jne 0x406381
mov byte [0x41900e], bl
cmp di, 0x64
jne 0x406393
cmp word [esi + 2], bx
jne 0x406393
mov byte [0x409009], bl
cmp di, 0x6e
jne 0x4063d3
movzx eax, word [esi + 2]
lea edx, [esi + 2]
xor ecx, ecx
cmp ax, bx
je 0x4063c8
cmp ax, 0x30
jb 0x4063c8
cmp ax, 0x39
ja 0x4063c8
movzx eax, ax
lea ecx, [ecx + ecx*4]
add edx, 2
lea ecx, [eax + ecx*2 - 0x30]
movzx eax, word [edx]
cmp ax, bx
jne 0x4063a7
mov dword [0x41901c], ecx
mov byte [esp + 0x13], 2
cmp di, 0x65
jne 0x4063e4
cmp word [esi + 2], bx
jne 0x4063e4
mov byte [esp + 0x13], 1
mov edi, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
add edi, 1
cmp edi, dword [esp + 0x1c]
mov dword [esp + 0x18], edi
jl 0x406290
pop esi
pop ebp
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov al, byte [esp + 0xb]
pop edi
pop ebx
add esp, 0x10
ret
xor ebp, ebp
mov dword [0x41b240], ebp
jmp 0x40634f
Function at 0x406420
Capabilities:
Create process on windows
Query environment variable

Disassembly:
sub esp, 0x26c
cmp byte [0x409009], 0
push ebx
push ebp
push esi
push edi
je 0x4065a7
call fcn.004065c0
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x41b280]
push 0x17
call fcn.00402940
lea ecx, [esp + 0x14]
push ecx
mov ebp, eax
mov eax, dword [0x41b280]
push 0x38
call fcn.00402940
mov edi, eax
test edi, edi
je 0x4065a7
test ebp, ebp
je 0x4065a7
push 0x104
lea edx, [esp + 0x74]
push edx
push ebp
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x4065a7
lea edx, [esp + 0x70]
nop
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x406490
mov ecx, edi
lea ecx, [ecx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4064a0
mov eax, 0x419230
mov si, word [eax]
add eax, 2
test si, si
jne 0x4064b0
sub eax, 0x419230
sub ecx, edi
sar eax, 1
sar ecx, 1
lea eax, [ecx + eax*2 - 2]
lea ecx, [esp + 0x70]
sub edx, ecx
sar edx, 1
add eax, edx
lea eax, [eax + eax + 2]
test eax, eax
je 0x4065a7
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x4065a7
push 0x419230
push 0x419230
lea edx, [esp + 0x78]
push edx
push edi
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x44
lea eax, [esp + 0x2c]
push 0
push eax
call fcn.00401100
add esp, 0xc
push 0x10
lea ecx, [esp + 0x1c]
push 0
push ecx
call fcn.00401100
add esp, 0xc
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x2c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
push esi
push 0
mov dword [esp + 0x50], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x40657e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.004065c0
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26c
ret
mov ecx, dword [esp + 0x1c]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call ebx
mov edx, dword [esp + 0x18]
push edx
call ebx
mov eax, ebp
call fcn.00404240
mov eax, edi
call fcn.00404240
mov eax, esi
call fcn.00404240
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x26c
ret

Function at 0x4065d0
Capabilities:
Check os version

Disassembly:
mov eax, dword [0x41b2a4]
sub esp, 0xc
test eax, eax
jne 0x4065e7
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov dword [0x41b2a4], eax
cmp al, 6
jae 0x4065fb
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
neg eax
sbb eax, eax
neg eax
add esp, 0xc
ret
lea eax, [esp]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40661b
xor al, al
add esp, 0xc
ret
mov eax, dword [esp]
lea ecx, [esp + 8]
push ecx
push 4
lea edx, [esp + 0xc]
push edx
push 0x14
push eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [esp + 4], eax
setne al
add esp, 0xc
ret
Function at 0x406650
Capabilities:
Get common file path

Disassembly:
push edi
push 0x104
push 0x419028
call dword [sym.imp.KERNEL32.dll_GetSystemWindowsDirectoryW]
xor edi, edi
test eax, eax
jne 0x406670
mov word [0x419028], di
jmp 0x40669f
mov eax, 0x419028
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406675
sub eax, 0x419028
sar eax, 1
sub eax, 1
je 0x40669f
cmp word [eax*2 + 0x419026], 0x5c
jne 0x40669f
mov word [eax*2 + 0x419026], di
push 0x400
push 0x419230
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x4066c4
mov word [0x419a30], di
mov word [0x419230], di
jmp 0x40672b
mov edx, 0x400
xor eax, eax
jmp 0x4066d0
movzx ecx, word [eax + 0x419230]
mov word [eax + 0x419a30], cx
add eax, 2
cmp cx, di
je 0x4066eb
sub edx, 1
jne 0x4066d0
cmp edx, edi
jne 0x4066f6
mov word [0x41a22e], di
mov eax, 0x419a30
jmp 0x406700
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x406700
jmp 0x406710
sub eax, 2
cmp eax, 0x419a30
je 0x406722
cmp word [eax], 0x5c
jne 0x406710
jmp 0x406728
cmp word [eax], 0x5c
jne 0x40672b
mov word [eax], di
push esi
mov esi, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push edi
push 0x1a
push 0x41a230
push edi
call esi
test eax, eax
jne 0x40674a
mov word [0x41a230], di
jmp 0x40677a
mov eax, 0x41a230
nop
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406750
sub eax, 0x41a230
sar eax, 1
sub eax, 1
je 0x40677a
cmp word [eax*2 + 0x41a22e], 0x5c
jne 0x40677a
mov word [eax*2 + 0x41a22e], di
push edi
push edi
push 0x41aa30
push edi
call esi
test eax, eax
pop esi
jne 0x406792
mov word [0x41aa30], di
pop edi
ret
mov eax, 0x41aa30
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x406797
sub eax, 0x41aa30
sar eax, 1
sub eax, 1
je 0x4067c1
cmp word [eax*2 + 0x41aa2e], 0x5c
jne 0x4067c1
mov word [eax*2 + 0x41aa2e], di
pop edi
ret

Function at 0x4067d0
Capabilities:
Get disk information
Query environment variable

Disassembly:
sub esp, 0x214
push esi
push edi
lea eax, [esp + 0xc]
push eax
mov eax, dword [0x41b280]
push 0x16
call fcn.00402940
mov edi, eax
test edi, edi
je 0x4068a1
push 0x104
lea ecx, [esp + 0x14]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x406891
mov edx, 0x4081d8
lea eax, [esp + 0x10]
mov esi, 0x104
lea ebx, [ebx]
cmp word [eax], 0
je 0x40682e
add eax, 2
sub esi, 1
jne 0x406820
test esi, esi
je 0x406854
movzx ecx, word [edx]
mov word [eax], cx
add eax, 2
add edx, 2
test cx, cx
je 0x406848
sub esi, 1
jne 0x406832
test esi, esi
jne 0x406854
mov word [esp + 0x216], si
push 0
push 0
push 0
push 0
lea edx, [esp + 0x18]
push edx
push 0
push 0
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
push edi
push 0
je 0x406894
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x214
ret
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
xor eax, eax
pop esi
add esp, 0x214
ret
Function at 0x406c90
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
sub esp, 0x23c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x41b280]
push 5
mov dword [esp + 0x18], 0
call fcn.00402940
mov esi, eax
test esi, esi
mov dword [esp + 0x14], esi
je 0x406dbe
lea edi, [esp + 0x10]
call fcn.00403000
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebp, eax
cmp ebp, 0xffffffff
jne 0x406ce4
call fcn.004065c0
jmp 0x406dae
lea ecx, [esp + 0x1c]
push ecx
push ebp
mov dword [esp + 0x24], 0x22c
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x406da7
mov ebx, dword [esp + 0x10]
test ebx, ebx
mov edi, ebx
je 0x406d90
lea ecx, [ecx]
mov esi, dword [edi]
lea edx, [esp + 0x40]
mov eax, edx
sub esi, eax
lea ebx, [ebx]
movzx eax, word [esi + edx]
cmp ax, 0x41
jb 0x406d33
cmp ax, 0x5a
ja 0x406d33
add eax, 0x20
movzx ecx, ax
movzx eax, word [edx]
cmp ax, 0x41
jb 0x406d48
cmp ax, 0x5a
ja 0x406d48
add eax, 0x20
add edx, 2
test cx, cx
movzx eax, ax
je 0x406d58
cmp cx, ax
je 0x406d20
movzx edx, ax
movzx eax, cx
sub eax, edx
je 0x406d6b
mov edi, dword [edi + 4]
test edi, edi
jne 0x406d10
jmp 0x406d90
mov ecx, dword [esp + 0x24]
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x406d90
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x1c]
push edx
push ebp
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x406d03
mov esi, dword [esp + 0x14]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
lea eax, [esp + 0x10]
call fcn.00402f00
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x23c
ret

Function at 0x406de0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x210
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push eax
mov eax, dword [0x41b280]
push 0x16
call fcn.00402940
mov edx, dword [esp + 0x224]
lea ecx, [esp + 0x14]
push ecx
mov esi, eax
mov eax, dword [0x41b280]
push edx
call fcn.00402940
test esi, esi
mov edi, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
je 0x406e8b
test ebx, ebx
je 0x406e83
push 0x104
lea eax, [esp + 0x1c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x406e83
lea eax, [esp + 0x18]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406e43
mov edi, dword [esp + 0x14]
lea edx, [esp + 0x18]
sub eax, edx
sar eax, 1
sub eax, 1
push eax
call fcn.00403fa0
add esp, 4
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x210
ret
push esi
push 0
call ebp
push eax
call edi
test ebx, ebx
je 0x406e97
push ebx
push 0
call ebp
push eax
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x210
ret
Function at 0x406eb0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x410
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push eax
mov eax, dword [0x41b280]
push 0x10
call fcn.00402940
lea ecx, [esp + 0x18]
push ecx
mov esi, eax
mov eax, dword [0x41b280]
push 0x11
call fcn.00402940
test esi, esi
mov edi, eax
mov dword [esp + 0x1c], 0x400
je 0x406f3d
test edi, edi
je 0x406f3d
lea edx, [esp + 0x14]
push edx
push 0x20119
push 0
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x406f3d
mov edx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push eax
lea ecx, [esp + 0x24]
push ecx
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ebx, eax
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x406f42
mov byte [esp + 0x20], 0
test esi, esi
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
je 0x406f5a
push esi
push 0
call ebp
push eax
call ebx
test edi, edi
je 0x406f66
push edi
push 0
call ebp
push eax
call ebx
call fcn.004067d0
lea ecx, [esp + 0x20]
xor edx, edx
cmp byte [ecx], 0
je 0x406fab
add ecx, 1
cmp byte [ecx], 0
je 0x406f9e
add ecx, 1
cmp byte [ecx], 0
je 0x406fa3
add ecx, 1
cmp byte [ecx], 0
je 0x406fa8
add edx, 4
add ecx, 1
cmp edx, 0x400
jb 0x406f71
jmp 0x406fab
add edx, 1
jmp 0x406fab
add edx, 2
jmp 0x406fab
add edx, 3
push eax
lea ecx, [esp + edx + 0x24]
push str.__08X
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [esp + 0x20]
xor edx, edx
cmp byte [eax], 0
je 0x406fff
add eax, 1
cmp byte [eax], 0
je 0x406ff2
add eax, 1
cmp byte [eax], 0
je 0x406ff7
add eax, 1
cmp byte [eax], 0
je 0x406ffc
add edx, 4
add eax, 1
cmp edx, 0x400
jb 0x406fc5
jmp 0x406fff
add edx, 1
jmp 0x406fff
add edx, 2
jmp 0x406fff
add edx, 3
lea eax, [esp + 0x20]
call fcn.004040e0
push eax
lea edx, [esp + 0x24]
push edx
call fcn.004065c0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407020
Capabilities:
Check mutex on windows

Disassembly:
push ecx
push ebx
push esi
lea eax, [esp + 8]
push eax
mov eax, dword [0x41b280]
push 0x1d
xor bl, bl
call fcn.00402940
mov esi, eax
test esi, esi
jne 0x407042
mov al, 1
pop esi
pop ebx
pop ecx
ret
push esi
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40705c
mov bl, 1
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop esi
mov al, bl
pop ebx
pop ecx
ret
Function at 0x4074b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x14
push esi
mov esi, eax
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4075d4
push ebp
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
je 0x4075d3
movzx eax, word [esi + 8]
mov ecx, dword [esp + 0x24]
mov edx, dword [esp + 0x28]
push 0
push esi
push ebp
push eax
push 0
push ecx
push edx
call dword [sym.imp.GDI32.dll_GetDIBits]
test eax, eax
je 0x4075d3
mov eax, dword [esp + 0x20]
push edi
push 0
push 0x80
push 2
push 0
push 0
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4075d2
mov eax, dword [esi + 0x20]
mov ecx, dword [esi]
push ebx
mov ebx, dword [esi + 0x14]
add eax, eax
add eax, eax
lea edx, [ecx + eax]
lea edx, [edx + ebx + 0xe]
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [esp + 0x16], edx
xor edx, edx
push edx
lea eax, [ecx + eax + 0xe]
lea ecx, [esp + 0x14]
push ecx
mov word [esp + 0x22], dx
mov word [esp + 0x24], dx
push 0xe
lea edx, [esp + 0x20]
push edx
push edi
mov word [esp + 0x28], 0x4d42
mov dword [esp + 0x32], eax
call ebx
test eax, eax
je 0x4075d1
cmp dword [esp + 0x10], 0xe
jne 0x4075d1
mov ecx, dword [esi + 0x20]
push 0
lea eax, [esp + 0x14]
push eax
lea edx, [ecx*4 + 0x28]
push edx
push esi
push edi
call ebx
test eax, eax
je 0x4075d1
mov eax, dword [esi + 0x20]
lea ecx, [eax*4 + 0x28]
cmp dword [esp + 0x10], ecx
jne 0x4075d1
mov esi, dword [esi + 0x14]
push 0
lea edx, [esp + 0x14]
push edx
push esi
push ebp
push edi
call ebx
test eax, eax
je 0x4075d1
cmp dword [esp + 0x10], esi
jne 0x4075d1
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x4075d1
mov eax, ebp
call fcn.00404240
pop ebx
pop edi
pop ebp
pop esi
add esp, 0x14
ret

Function at 0x4075e0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x804
push esi
push eax
push ecx
lea edx, [esp + 0x10]
push str._s_s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
push 0x80
push 1
push 0
push 0
push 0x40000000
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x407656
mov edx, dword [esp + 0x80c]
push edi
push 0
lea ecx, [esp + 0xc]
push ecx
push ebx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
pop edi
je 0x407656
cmp dword [esp + 4], ebx
jb 0x407656
mov al, 1
pop esi
add esp, 0x804
ret
xor al, al
pop esi
add esp, 0x804
ret
Function at 0x407660
Capabilities:
Create directory

Disassembly:
sub esp, 0x800
cmp byte [0x41b26c], 0
push ebx
mov ebx, eax
jne 0x4076d6
mov eax, ecx
mov dx, word [eax]
add eax, 2
test dx, dx
jne 0x407674
sub eax, ecx
sar eax, 1
sub eax, 1
cmp word [ecx + eax*2 - 2], 0x5c
jne 0x407691
sub eax, 1
xor edx, edx
test eax, eax
jbe 0x4076a5
cmp word [ecx + edx*2], 0x5c
je 0x4076d6
add edx, 1
cmp edx, eax
jb 0x407697
mov eax, dword [esp + 0x808]
push eax
push ecx
lea ecx, [esp + 0xc]
push str._s_s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 0
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4076e1
lea ecx, [esp + 4]
push esi
mov eax, edi
call fcn.004075e0
add esp, 4
pop ebx
add esp, 0x800
ret