joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403840
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [0x420c43], 0
je 0x4038e5
push 0x420c6f
call fcn.004038f3
call fcn.0040392e
mov ebx, dword [0x420c47]
add ebx, 8
mov dword [ebp - 4], ebx
mov dword [ebp - 8], esp
mov ebx, dword [ebp - 4]
push dword [ebx]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x40389f
push 6
call fcn.0040e01e
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push 0xd3d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4038c9
push 6
call fcn.0040e01e
add esp, 4
test eax, eax
je 0x4038e5
mov dword [0x420c43], 0
mov eax, 1
jmp 0x4038ef
mov eax, 0
jmp 0x4038ef
mov esp, ebp
pop ebp
ret
Function at 0x405f34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
mov eax, 0
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x405f84
push 6
call fcn.0040e01e
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x405fb8
mov dword [ebp - 8], esp
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x405fb3
push 6
call fcn.0040e01e
add esp, 4
jmp 0x405fc0
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x405fd1
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4083b2
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x420c6f
call fcn.004085ba
push 0x80000301
push 0
push 0x104
push 1
mov ebx, 0x1bc
call fcn.0040e740
add esp, 0x10
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x408408
push ebx
call fcn.0040e012
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0
lea eax, [ebp - 8]
push eax
push 0x104
mov eax, dword [ebp - 4]
test eax, eax
je 0x408427
add eax, 8
push eax
push dword [0x420c63]
call dword [sym.imp.KERNEL32.dll_ReadFile]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40844a
push 6
call fcn.0040e01e
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x408475
cmp dword [ebp - 8], 0
je 0x408475
cmp dword [0x420c43], 1
jne 0x408475
mov eax, 1
jmp 0x408477
xor eax, eax
test eax, eax
je 0x40859c
push 0x80000301
push 0
push dword [ebp - 8]
push htons
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40849c
mov eax, 0x42008e
push eax
push 2
mov ebx, 0x1a0
call fcn.00410270
add esp, 0x1c
mov dword [ebp - 0xc], eax
push htons
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x4084c5
mov eax, 0x42008e
push eax
push 1
mov ebx, 0x168
call fcn.0040f570
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4084eb
push ebx
call fcn.0040e012
add esp, 4
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [0x420c93]
test ebx, ebx
je 0x408502
push ebx
call fcn.0040e012
add esp, 4
pop eax
mov dword [0x420c93], eax
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [0x420c93]
test eax, eax
jne 0x40851d
mov eax, 0x41a20c
push eax
push 1
mov ebx, 0x198
call fcn.0040f2e0
add esp, 0x10
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0x42045d
mov ecx, 2
call fcn.00403b8e
add esp, 8
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x40855b
push ebx
call fcn.0040e012
add esp, 4
lea eax, [ebp - 0x10]
push eax
push 1
call fcn.004085f5
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408579
push ebx
call fcn.0040e012
add esp, 4
push 0x80000301
push 0
push 0xa
push 1
mov ebx, 0x67c
call fcn.004102d0
add esp, 0x10
jmp 0x40840c
push 0x420c6f
call fcn.0040877b
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x4085b6
push ebx
call fcn.0040e012
add esp, 4
mov esp, ebp
pop ebp
ret
Function at 0x4085f5
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov dword [ebp - 4], 0
cmp dword [0x420c8f], 0
je 0x40876b
push dword [ebp + 0xc]
call fcn.00404ca2
mov dword [ebp - 0x10], eax
fild dword [ebp - 0x10]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x42040c]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.00403b67
mov dword [ebp - 4], eax
mov ebx, dword [0x420c83]
call fcn.00404d56
push ebx
push ecx
mov eax, dword [ebp + 8]
dec eax
jns 0x40865a
push 4
call fcn.0040e01e
add esp, 4
pop ecx
pop ebx
cmp eax, ecx
jl 0x40866d
push 1
call fcn.0040e01e
add esp, 4
shl eax, 2
add ebx, eax
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
push 0x80000301
push 0
push dword [ebp - 4]
push 1
mov ebx, 0x198
call fcn.0040f2e0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x420467
mov ebx, dword [ebp + 0xc]
push dword [ebx]
push dword [ebp - 0xc]
push 0x420473
mov ecx, 4
call fcn.00403b8e
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4086c8
push ebx
call fcn.0040e012
add esp, 4
fild dword [ebp - 4]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
fadd qword [0x420481]
fstp qword [ebp - 0x20]
mov dword [ebp - 0x24], esp
push 0
fld qword [ebp - 0x20]
call fcn.00403b67
push eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x4086f5
add eax, 8
push eax
mov ebx, dword [ebp - 8]
push dword [ebx]
call dword [sym.imp.WSOCK32.dll_send]
nop
nop
nop
nop
cmp dword [ebp - 0x24], esp
je 0x408717
push 6
call fcn.0040e01e
add esp, 4
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x40872a
push ebx
call fcn.0040e012
add esp, 4
fild dword [ebp - 4]
fstp qword [ebp - 0x30]
fld qword [ebp - 0x30]
fadd qword [0x420481]
fstp qword [ebp - 0x38]
fild dword [ebp - 0x28]
fstp qword [ebp - 0x40]
fld qword [ebp - 0x40]
fsub qword [ebp - 0x38]
ftst
fnstsw ax
test ah, 1
je 0x408753
fchs
fcomp qword [0x420489]
fnstsw ax
test ah, 0x41
mov eax, 0
setne al
jmp 0x408775
mov eax, 0
jmp 0x408775
mov esp, ebp
pop ebp
ret 8
Function at 0x409768
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x409798
push 6
call fcn.0040e01e
add esp, 4
jmp 0x40979d
mov esp, ebp
pop ebp
ret 4
Function at 0x40cbf5
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x32
push 1
mov ebx, 0x184
call fcn.0040ed70
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40cc3a
push ebx
call fcn.0040e012
add esp, 4
pop eax
mov dword [ebp - 4], eax
push reloc.WSOCK32.dll_connect
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x40cc51
mov eax, 0x41a20c
push eax
push 1
mov ebx, 0x130
call fcn.0040fcf0
add esp, 0x10
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x40cc8d
push 6
call fcn.0040e01e
add esp, 4
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x40ccbb
mov eax, dword [ebp - 4]
test eax, eax
je 0x40ccb6
push eax
mov ebx, eax
call fcn.00401000
inc eax
push eax
call fcn.0040e018
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x40ccc5
mov eax, 0x41a20c
jmp 0x40ccc5
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x40ccd6
push ebx
call fcn.0040e012
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x40e580
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x40e612
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x40e604
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x40e5fc
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x40e5c5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x40e770
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x40e7d9
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.0040e2b0
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x40e7e0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x40e821.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x40e821.2
jmp dword [eax*4 + 0x40e8ac]
mov word [esp + 0x48], di
jmp 0x40e85a
mov word [esp + 0x48], 2
jmp 0x40e85a
mov word [esp + 0x48], 3
jmp 0x40e85a
mov word [esp + 0x48], 4
jmp 0x40e85a
mov word [esp + 0x48], 7
jmp 0x40e85a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x40e8a4
cmp dword [esp + 0x70], edi
je 0x40e890
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret
Function at 0x40e8d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.00411930
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x40ea20
test ecx, ecx
je 0x40ea20
inc ecx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov edi, eax
add esp, 0xc
test edi, edi
je 0x40e949
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40ea0d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x40e9d1
cmp eax, 0xea
jne 0x40e9f9
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ecx, dword [esp + 0x18]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x40e99c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x40e9df
cmp eax, 2
jne 0x40e9f9
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.004118f0
add esp, 8
mov dword [esp + 0x10], eax
push esi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x40ea4e
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x40ea5a
mov edx, dword [esp + 0x40]
test edx, edx
je 0x40ea5a
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.004118f0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x40eb80
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 0x28]
sub esp, 0x18
push ebx
push ebp
xor ebx, ebx
xor ebp, ebp
cmp eax, 0x80000301
push edi
ja 0x40ec00
je 0x40ebf1
cmp eax, 0x80000101
ja 0x40ebea
je 0x40ebf1
cmp eax, reloc.WSOCK32.dll_connect
je 0x40ebcd
cmp eax, 0x80000005
jne 0x40ec15
mov eax, dword [esp + 0x44]
mov dword [esp + 0xc], 3
test eax, eax
je 0x40ec5b
mov ebx, dword [eax + 4]
lea ebp, [eax + 8]
jmp 0x40ec5b
mov ebp, dword [esp + 0x44]
or ecx, 0xffffffff
mov edi, ebp
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0xc], 1
mov ebx, ecx
inc ebx
jmp 0x40ec5b
cmp eax, 0x80000201
jne 0x40ec15
mov ebx, 4
lea ebp, [esp + 0x44]
mov dword [esp + 0xc], ebx
jmp 0x40ec5b
cmp eax, 0x80000401
je 0x40ec46
cmp eax, 0x80000501
je 0x40ec32
cmp eax, 0x80000601
je 0x40ec1e
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
fld qword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call sub.MSVCRT.dll__ftol
jmp 0x40ec53
fld dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
call sub.MSVCRT.dll__ftol
jmp 0x40ec53
mov eax, dword [esp + 0x44]
mov ebx, 4
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], eax
lea ebp, [esp + 0x10]
mov ecx, dword [esp + 0x2c]
push ecx
call fcn.00411930
mov edi, dword [esp + 0x3c]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
add esp, 4
mov dword [esp + 0x20], edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x18], 0
test edx, edx
je 0x40ed36
test ecx, ecx
je 0x40ed36
inc ecx
push esi
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edi, dword [esp + 0x40]
mov edx, eax
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov eax, ecx
mov esi, edi
mov edi, edx
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [esp + 0x2c], edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x40ecd8
mov byte [esi], 0
inc esi
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x18]
push 0
push ecx
push 0
push 0x20006
push 0
push 0
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40ed2c
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
push eax
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40ed21
mov dword [esp + 0x1c], 1
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop esi
mov eax, dword [esp + 0x18]
pop edi
pop ebp
pop ebx
add esp, 0x18
ret
Function at 0x40fea0
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x40febe
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x40feb3
pop esi
ret

Function at 0x410300
Capabilities:
Set file attributes

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret

Function at 0x410320
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
push ebp
push esi
push edi
push eax
call fcn.00411930
mov esi, dword [esp + 0x28]
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor edx, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ebp, ebp
je 0x4103f1
test ecx, ecx
je 0x4103f1
inc ecx
push ebx
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call sub.MSVCRT.dll_strrchr
mov esi, eax
add esp, 0xc
test esi, esi
je 0x410393
mov byte [esi], 0
inc esi
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push ebx
push ebp
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4103cd
mov ecx, dword [esp + 0x10]
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edx, dword [esp + 0x10]
mov esi, eax
neg esi
sbb esi, esi
push edx
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4103e0
mov eax, dword [esp + 0x28]
push eax
push ebp
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esi, eax
neg esi
sbb esi, esi
inc esi
push ebx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, esi
pop ebx
pop edi
pop esi
pop ebp
pop ecx
ret
pop edi
pop esi
mov eax, edx
pop ebp
pop ecx
ret
Function at 0x4104f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x410503
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.004128e0
add esp, 4
test eax, eax
jne 0x410515
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x41058c
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x4105be
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x410578
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x410548
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x4105be
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x4105be
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x4105a7
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x410630
Capabilities:
Get file size

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
jne 0x41063e
or eax, 0xffffffff
pop esi
ret
push esi
call fcn.004128e0
add esp, 4
test eax, eax
jne 0x410650
or eax, 0xffffffff
pop esi
ret
mov ecx, dword [esi]
or eax, 0xffffffff
cmp ecx, 1
jne 0x41066b
mov esi, dword [esi + 4]
lea eax, [esp + 0xc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
ret
cmp ecx, 2
jne 0x410678
mov ecx, dword [esi + 4]
call fcn.004128d0
pop esi
ret
Function at 0x410680
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
test ebx, ebx
push edi
jne 0x410693
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
push ebx
call fcn.004128e0
add esp, 4
test eax, eax
jne 0x4106a5
pop edi
pop esi
pop ebp
pop ebx
ret
mov edi, dword [esp + 0x24]
test edi, edi
jg 0x4106b4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x41070b
mov ebx, dword [ebx + 4]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov ebp, eax
lea eax, [esp + 0x18]
push esi
push eax
push edi
push ebp
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x4106ee
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov ecx, dword [esp + 0x18]
push ecx
push ebp
call fcn.00411a40
push ebp
mov esi, eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 0xc
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
cmp eax, 2
jne 0x41074d
mov ebx, dword [ebx + 4]
lea edx, [edi + 8]
push edx
call fcn.0040e2b0
mov esi, eax
add esp, 4
lea ecx, [esi + 8]
mov dword [esi], 1
mov dword [esi + 4], edi
mov eax, dword [ebx]
push edi
push ecx
mov ecx, ebx
call dword [eax + 0x20]
test eax, eax
jne 0x41074a
push esi
call fcn.0040e340
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret
mov dword [esi + 4], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x410770
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x410783
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call fcn.004128e0
add esp, 4
test eax, eax
jne 0x410795
pop esi
add esp, 0x10
ret
mov eax, dword [esi]
mov ecx, 1
push ebx
push ebp
cmp eax, ecx
push edi
mov dword [esp + 0x10], 0
jne 0x410856
mov eax, dword [esi + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x14], ecx
jle 0x4108d3
lea ebx, [esp + 0x34]
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, reloc.WSOCK32.dll_connect
jne 0x4107de
mov esi, dword [ebx]
jmp 0x4107f2
push ebx
call fcn.00412910
mov esi, eax
add esp, 4
test esi, esi
je 0x410836
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x41081d
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x41081d
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x41082a
push esi
call sub.MSVCRT.dll_free
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4108d3
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x4107ce
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp eax, 2
jne 0x4108d3
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
jle 0x4108d3
dec eax
lea ebx, [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, reloc.WSOCK32.dll_connect
jne 0x410887
mov esi, dword [ebx]
jmp 0x41089b
push ebx
call fcn.00412910
mov esi, eax
add esp, 4
test esi, esi
je 0x4108c5
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4108b8
mov eax, dword [esp + 0x18]
push ecx
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
test ebp, ebp
je 0x4108c5
push esi
call sub.MSVCRT.dll_free
add esp, 4
mov eax, dword [esp + 0x24]
add ebx, 0xc
dec eax
mov dword [esp + 0x24], eax
jne 0x410877
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret