joyce8/EMBER2024-capa huggingface dataset:
Function at 0x822d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x822d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x822d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x822d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x822d94
push eax
push esi
call fcn.0082520b
add esp, 8
pop esi
ret 0x10

Function at 0x822da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x822e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x822e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x83b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00824dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x822dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x822e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x822ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x822eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x83b320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00824dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x822eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x822e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x823000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x823131
push esi
call fcn.00826145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00815080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x823131
push 0
push ebp
call fcn.008153a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00815260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x82308b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.008152f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x823121
push 0x83b918
push edi
call fcn.008243f0
push eax
push ebx
push esi
call fcn.00822f60
push 0x83b8f8
push edi
call fcn.008243f0
push eax
push ebx
push esi
call fcn.00822f60
push 0x83b8d8
push edi
call fcn.008243f0
push eax
push ebx
push esi
call fcn.00822f60
push 0x83b8c0
push edi
call fcn.008243f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00822f60
push 0x83b8a0
push edi
call fcn.008243f0
push eax
push ebx
push esi
call fcn.00822f60
push 0x83b888
push edi
call fcn.008243f0
push eax
push ebx
push esi
call fcn.00822f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x8241b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00824140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00824140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00824140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00824140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x824bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x824c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x83687c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x824c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x824c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x407050
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
xor edi, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407063
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 4]
push eax
call fcn.00468954
mov ebx, eax
add esp, 8
mov dword [ebp - 4], ebx
test ebx, ebx
je 0x407121
mov ecx, ebx
sub ecx, esi
movzx eax, word [esi]
mov word [ecx + esi], ax
lea esi, [esi + 2]
test ax, ax
jne 0x407091
push 0x5c
push ebx
call fcn.004694e7
add esp, 8
test eax, eax
je 0x4070b5
xor ecx, ecx
mov word [eax + 2], cx
cmp word [ebx], 0x5c
jne 0x4070de
cmp word [ebx + 2], 0x5c
jne 0x4070de
lea eax, [ebx + 4]
push 0x5c
push eax
call fcn.004693f6
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x407101
push 0x5c
lea eax, [ebx + 2]
push eax
jmp 0x4070f7
cmp word [ebx + 2], 0x3a
jne 0x4070f4
cmp word [ebx + 4], 0x5c
jne 0x4070f4
push 0x5c
lea eax, [ebx + 6]
push eax
jmp 0x4070f7
push 0x5c
push ebx
call fcn.004693f6
add esp, 8
mov ebx, eax
push 2
push 0x104
call fcn.00468954
mov esi, eax
add esp, 8
test esi, esi
jne 0x40712b
push dword [ebp - 4]
call fcn.00467cf6
add esp, 4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
test ebx, ebx
je 0x407198
mov eax, ebx
sub eax, ecx
sar eax, 1
push eax
push ecx
push esi
call fcn.004694a4
push esi
call fcn.00469781
add esp, 0x10
test eax, eax
je 0x407174
push esi
call fcn.0046989e
add esp, 4
test eax, eax
je 0x407161
mov edi, 1
jmp 0x407174
push esi
call fcn.00469781
add esp, 4
test eax, eax
mov eax, 1
cmovne edi, eax
lea eax, [ebx + 2]
push 0x5c
push eax
mov dword [ebp - 8], ebx
call fcn.004693f6
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x40720b
mov ecx, dword [ebp - 8]
test edi, edi
je 0x407132
jmp 0x40720b
mov edx, esi
sub edx, dword [ebp - 4]
lea ecx, [ecx]
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x4071a0
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4071b4
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x4071d7
cmp word [esi + ecx*2 - 2], 0x5c
jne 0x4071d7
xor eax, eax
mov word [esi + ecx*2 - 2], ax
push esi
call fcn.00469781
add esp, 4
test eax, eax
je 0x40720b
push esi
call fcn.0046989e
add esp, 4
test eax, eax
je 0x4071f8
mov edi, 1
jmp 0x40720b
push esi
call fcn.00469781
add esp, 4
mov ecx, 1
test eax, eax
cmovne edi, ecx
push esi
call fcn.00467cf6
push dword [ebp - 4]
call fcn.00467cf6
add esp, 8
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x407230
Capabilities:
Create directory

Disassembly:
push dword [0x4a7a1c]
push 0
push 0x4815a0
call fcn.0043c090
mov eax, dword [0x4a7a1c]
add esp, 0xc
cmp word [eax], 0
je 0x40727c
push eax
call fcn.00468a3d
add esp, 4
push 0
push dword [0x4a7a1c]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x40727c
push dword [0x4a7a1c]
call fcn.0041ee80
add esp, 4
xor eax, eax
ret
mov eax, 0x67
ret
Function at 0x407830
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push 0
push 0
push 0x186a0
push ebx
mov dword [ebp - 8], 0
call esi
push 1
push 0
push 0
push ebx
call esi
push 2
push 0
push 0
push ebx
mov edi, eax
call esi
push 0
push 0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
mov esi, eax
call edi
cmp esi, 0x155cc0
jge 0x4078a5
push 1
push 0
push 0
push ebx
call edi
push 2
push 0
push 0
push ebx
mov esi, eax
call edi
push 0
push 0
push esi
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
jmp 0x4078aa
mov edi, 0x155cc0
lea eax, [edi + 8]
push 1
push eax
call fcn.00468954
add esp, 8
mov dword [ebp - 4], eax
test eax, eax
je 0x407936
push 0
lea ecx, [ebp - 0xc]
push ecx
push edi
push eax
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4078da
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor eax, eax
test edi, edi
je 0x407923
cmp dword [esi], 0x77777777
jne 0x4078f5
cmp dword [ecx + eax + 4], 0x12478749
je 0x40790e
inc eax
inc esi
cmp eax, edi
jb 0x4078e3
push ecx
call fcn.00467cf6
mov eax, dword [ebp - 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
sub esi, ecx
add esi, 0x186a0
mov dword [0x4a7a14], esi
mov dword [ebp - 8], 1
push ecx
call fcn.00467cf6
mov eax, dword [ebp - 8]
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407940
Capabilities:
Set current directory

Disassembly:
mov eax, dword [0x4a7d30]
test eax, eax
je 0x407973
cmp dword [0x4a7d34], 0
je 0x407962
push eax
mov ecx, 0x4a7d44
call fcn.0045c690
mov eax, dword [0x4a7d30]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x4a7d30], 0
mov eax, dword [0x4a7a10]
test eax, eax
je 0x4079b3
push 0x5c
push eax
call fcn.004694e7
add esp, 8
test eax, eax
je 0x4079b3
mov ecx, eax
sub ecx, dword [0x4a7a10]
sar ecx, 1
cmp ecx, 3
jae 0x4079a2
xor ecx, ecx
mov word [eax + 2], cx
jmp 0x4079a7
xor ecx, ecx
mov word [eax], cx
push dword [0x4a7a10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
push edi
mov edi, dword [0x4a7a18]
test edi, edi
je 0x407a9d
cmp word [edi], 0
je 0x407a94
xor esi, esi
push edi
call fcn.00468a3d
add esp, 4
test eax, eax
je 0x4079fc
call fcn.0046972d
cmp dword [eax], 2
je 0x4079fc
push 0x3e8
call ebx
inc esi
cmp esi, 0xa
jl 0x4079d6
jmp 0x407a65
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407a01
sub ecx, edx
sar ecx, 1
push 2
lea eax, [ecx + 1]
push eax
call fcn.00468954
mov esi, eax
add esp, 8
test esi, esi
je 0x407a65
mov edx, esi
mov ecx, edi
sub edx, edi
lea ebx, [ebx]
movzx eax, word [ecx]
mov word [edx + ecx], ax
lea ecx, [ecx + 2]
test ax, ax
jne 0x407a30
push 0x5c
push esi
call fcn.004694e7
add esp, 8
test eax, eax
je 0x407a5c
xor ecx, ecx
push esi
mov word [eax], cx
call fcn.004698cf
add esp, 4
push esi
call fcn.00467cf6
add esp, 4
mov ecx, edi
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x407a70
sub ecx, edx
sar ecx, 1
lea edi, [edi + ecx*2]
add edi, 2
cmp word [edi], ax
jne 0x4079d4
mov edi, dword [0x4a7a18]
push edi
call fcn.00467cf6
add esp, 4
mov eax, dword [0x4a7a1c]
test eax, eax
je 0x407ae3
xor esi, esi
push eax
call fcn.0041f640
push dword [0x4a7a1c]
call fcn.004698cf
add esp, 8
test eax, eax
je 0x407ade
call fcn.0046972d
cmp dword [eax], 2
je 0x407ade
push 0x3e8
call ebx
inc esi
cmp esi, 0xa
jge 0x407ade
mov eax, dword [0x4a7a1c]
jmp 0x407aa8
mov eax, dword [0x4a7a1c]
push eax
call fcn.00467cf6
push dword [0x4a7a10]
mov dword [0x4a7a1c], 0
call fcn.00467cf6
add esp, 8
mov dword [0x4a7a10], 0
pop edi
pop esi
pop ebx
ret

Function at 0x407b70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x407ba3
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x26
neg eax
sbb eax, eax
add eax, 0x40000002
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
cmp ecx, 0xffffffff
jne 0x407bb4
mov eax, 0x40000001
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp ecx, dword [ebp + 0x10]
mov edx, 0x40000002
cmovne eax, edx
mov esp, ebp
pop ebp
ret
Function at 0x407bd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0x10]
push 0
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x407c06
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub eax, 0x70
neg eax
sbb eax, eax
add eax, 0x40000004
pop esi
mov esp, ebp
pop ebp
ret
xor eax, eax
cmp dword [ebp - 4], esi
mov ecx, 0x40000004
cmovne eax, ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x407c20
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 1
push 0x8000
call fcn.00468954
mov edi, dword [ebp + 0xc]
add esp, 8
mov ebx, eax
test edi, edi
je 0x407c88
push esi
mov edi, edi
push 0
mov esi, 0x8000
lea eax, [ebp + 0xc]
push eax
cmp edi, esi
cmovb esi, edi
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x407c81
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
je 0x407c87
cmp eax, esi
jne 0x407c87
push dword [ebp + 0x10]
push esi
push ebx
call fcn.00405c40
add esp, 0xc
mov dword [ebp + 0x10], eax
sub edi, esi
jne 0x407c40
jmp 0x407c87
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
push 0x8000
push 0
push ebx
call fcn.00468a80
push ebx
call fcn.00467cf6
mov eax, dword [ebp + 0x10]
add esp, 0x10
pop edi
pop ebx
pop ebp
ret

Function at 0x407d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, ecx
cmp dword [edi + 0x224], 0
je 0x407df2
mov eax, dword [edi + 0x20c]
mov ecx, dword [edi + 0x208]
inc eax
cmp eax, ecx
jbe 0x407d7a
lea eax, [ecx + 0x400]
push eax
push dword [edi + 0x204]
call fcn.00468992
add esp, 8
add dword [edi + 0x208], 0x400
mov dword [edi + 0x204], eax
mov eax, dword [edi + 0x20c]
mov ecx, dword [edi + 0x204]
mov byte [ecx + eax], 0
mov eax, dword [edi + 0x220]
inc dword [edi + 0x20c]
test eax, eax
je 0x407df2
push ebx
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x407df1
push 0
lea eax, [ebp - 4]
push eax
push 2
lea ecx, [edi + 0x21c]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 4]
push eax
push dword [edi + 0x20c]
push dword [edi + 0x204]
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, dword [edi + 0x220]
test eax, eax
je 0x407e05
push eax
call fcn.00467cf6
add esp, 4
mov eax, dword [edi + 0x204]
pop edi
test eax, eax
je 0x407e19
push eax
call fcn.00467cf6
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x408330
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push 0
push 0x80
push 3
push 0
push 1
mov esi, ecx
push 0x80000000
push dword [esi + 0x220]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x408434
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 2
push 0
push 0
push ebx
call edi
mov dword [ebp - 4], eax
test eax, eax
jle 0x40842d
push 0
push 0
push 0
push ebx
call edi
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [esi]
push 2
add eax, 0x18c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edi, dword [ebp - 4]
add edi, 0xfffffffe
push edi
call fcn.00467d2e
add esp, 4
mov dword [esi + 0x204], eax
test eax, eax
je 0x40842d
push 0
lea ecx, [ebp - 8]
push ecx
push edi
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x408415
mov dword [esi + 0x208], edi
xor eax, eax
mov dword [esi + 0x20c], 0
lea edi, [esi + 4]
mov ecx, 0x40
rep stosd dword es:[edi], eax
mov dword [esi + 0x210], eax
push ebx
mov dword [esi + 0x214], eax
mov dword [esi + 0x218], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x224], 0
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
push dword [esi + 0x204]
call fcn.00467cf6
add esp, 4
mov dword [esi + 0x204], 0
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4193f0
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push esi
push 0x3c
lea eax, [ebp - 0x58]
push 0
push eax
call fcn.00468a80
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x10]
add esp, 0xc
mov dword [ebp - 0x44], eax
lea eax, [ebp - 0x58]
push eax
mov dword [ebp - 0x58], 0x3c
mov dword [ebp - 0x54], 0x440
mov dword [ebp - 0x4c], str.open
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 5
mov esi, 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
je 0x41950c
push ebx
mov ebx, dword [ebp + 0x14]
test bl, 1
je 0x4194f8
call fcn.00425c30
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
and ebx, 2
je 0x41948a
mov eax, dword [0x4a7b74]
push 0
push dword [eax + 0x10]
call esi
mov eax, dword [0x4a7b74]
mov eax, dword [eax + 0x4c4]
test eax, eax
je 0x41948a
push 0
push eax
call esi
push edi
mov edi, dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
lea eax, [ebp + 0xc]
push eax
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x4194cd
cmp dword [ebp + 0xc], 0x103
jne 0x4194cd
lea eax, [ebp - 0x1c]
push 0
push eax
call fcn.00405160
add esp, 8
push 0x4ff
push 0xc8
push 0
push 0
push 0
call edi
jmp 0x419491
pop edi
test bx, bx
je 0x4194f3
mov eax, dword [0x4a7b74]
push 5
push dword [eax + 0x10]
call esi
mov eax, dword [0x4a7b74]
mov eax, dword [eax + 0x4c4]
test eax, eax
je 0x4194f3
push 5
push eax
call esi
call fcn.004245c0
push dword [ebp - 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
pop ebx
movsx eax, cx
pop esi
mov esp, ebp
pop ebp
ret
movsx eax, si
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41eed0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 2
push 0x104
xor edi, edi
call fcn.00468954
mov ebx, eax
add esp, 8
test ebx, ebx
je 0x41efb7
push ebx
push edi
push 0x4a3854
call fcn.0043c090
add esp, 0xc
cmp word [ebx], di
je 0x41efa9
push ebx
call fcn.00468a3d
mov ecx, ebx
add esp, 4
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ef16
sub ecx, edx
sar ecx, 1
cmp word [ebx + ecx*2 - 2], 0x5c
je 0x41ef45
lea edi, [ebx - 2]
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x41ef30
mov eax, dword [0x481660]
mov dword [edi], eax
xor edi, edi
mov ecx, ebx
lea edx, [ecx + 2]
lea ebx, [ebx]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x41ef50
sub ecx, edx
push esi
mov esi, dword [ebp + 8]
sar ecx, 1
push esi
lea eax, [ecx*2 + 4]
push eax
call fcn.00427a70
mov edx, dword [esi]
add esp, 8
mov ecx, ebx
pop esi
lea esp, [esp]
movzx eax, word [ecx]
mov word [edx], ax
lea ecx, [ecx + 2]
lea edx, [edx + 2]
test ax, ax
jne 0x41ef80
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push ebx
call fcn.00467cf6
add esp, 4
mov eax, edi
pop edi
pop ebx
pop ebp
ret
push ebx
mov edi, 0xe
call fcn.00467cf6
add esp, 4
mov eax, edi
pop edi
pop ebx
pop ebp
ret

Function at 0x41f5f0
Capabilities:
Get common file path
Set current directory

Disassembly:
push esi
push 2
push 0x104
call fcn.00468954
mov esi, eax
add esp, 8
test esi, esi
je 0x41f62e
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push 0x481664
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
push esi
call fcn.004698cf
push esi
call fcn.00467cf6
add esp, 8
pop esi
ret
push 0x481664
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop esi
ret

Function at 0x41f680
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push 1
push 0x250
call fcn.00468954
mov esi, eax
add esp, 8
test esi, esi
je 0x41f75a
push ebx
push esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x41f750
push edi
test byte [esi], 0x10
jne 0x41f738
lea edi, [esi + 0x2c]
mov ecx, 0x48166c
mov eax, edi
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x41f6e9
test dx, dx
je 0x41f6e5
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x41f6e9
add eax, 4
add ecx, 4
test dx, dx
jne 0x41f6c3
xor eax, eax
jmp 0x41f6ee
sbb eax, eax
or eax, 1
test eax, eax
je 0x41f738
mov eax, 0x481664
mov ecx, edi
lea esp, [esp]
mov dx, word [ecx]
cmp dx, word [eax]
jne 0x41f726
test dx, dx
je 0x41f722
mov dx, word [ecx + 2]
cmp dx, word [eax + 2]
jne 0x41f726
add ecx, 4
add eax, 4
test dx, dx
jne 0x41f700
xor eax, eax
jmp 0x41f72b
sbb eax, eax
or eax, 1
test eax, eax
je 0x41f738
push edi
call fcn.00468a3d
add esp, 4
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41f6b4
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
push esi
call fcn.00467cf6
add esp, 4
pop ebx
pop esi
pop ebp
ret