joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4093e4
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x4099e8
call fcn.00409870
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x409444
cmp eax, 0xffffffff
je 0x409444
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40943d
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40943d
cmp edx, 0x10000000
jae 0x40943d
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40943a
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.004098b5
ret 4

Function at 0x4094a0
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x4094de
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x4094d6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x4094e0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x4094c6
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x4095b0
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x4095c6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x4095e1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x401050
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push ebx
lea eax, [esp + 4]
push eax
push 0x20219
push 0
push 0x424338
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4010b0
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
lea edx, [esp + 8]
push edx
mov edx, dword [esp + 8]
push eax
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x14]
push ecx
push 0
push 0x424318
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4010a5
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0xc
ret

Function at 0x4010c0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x4010d7
test al, 0x10
jne 0x4010d7
mov al, 1
ret
xor al, al
ret

Function at 0x401170
Capabilities:
Get file version info

Disassembly:
sub esp, 0x14
push ebx
mov ebx, dword [esp + 0x1c]
push esi
lea eax, [esp + 8]
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jbe 0x4011e0
push edi
push esi
call fcn.0040cf44
mov edi, eax
add esp, 4
test edi, edi
je 0x4011df
mov ecx, dword [esp + 0xc]
push edi
push esi
push ecx
push ebx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
je 0x4011d6
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0x4243c8
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
je 0x4011d6
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
push edi
call fcn.0040d4b6
add esp, 4
pop edi
lea eax, [esp + 0x14]
push eax
call fcn.004010e0
add esp, 4
pop esi
pop ebx
add esp, 0x14
ret
Function at 0x401200
Capabilities:
Set registry value

Disassembly:
sub esp, 0x224
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x228]
push esi
lea ecx, [esp + 0x10]
push ecx
push 2
push 0
push eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov esi, eax
mov dword [esp + 4], esi
cmp esi, 0xffffffff
je 0x40142b
lea edx, [esp + 0x14]
push edx
push 0
push str.NvStUSB.Param
push esi
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x401424
xor eax, eax
push ebx
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov byte [esp + 0x30], 0
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov byte [esp + 0x4d], al
lea esp, [esp]
push 0
push 0x1000
push 0x434070
push 0
push 0
push esi
lea eax, [esp + 0x38]
push eax
call ebx
test eax, eax
je 0x40140b
cmp word [0x434070], 0
mov eax, 0x434070
mov edx, eax
je 0x4012e4
movzx ecx, word [eax]
cmp cx, 0x20
je 0x4012db
cmp cx, 9
je 0x4012db
mov word [edx], cx
add eax, 2
add edx, 2
jmp 0x4012de
add eax, 2
cmp word [eax], 0
jne 0x4012c1
push 5
xor ecx, ecx
push 0x4243dc
push 0x434070
mov word [edx], cx
call fcn.0040d844
add esp, 0xc
test eax, eax
jne 0x40140b
push 0x2c
push 0x43407a
call fcn.0040d1b6
add esp, 8
test eax, eax
je 0x40140b
xor edx, edx
mov word [eax], dx
xor ecx, ecx
jmp 0x401330
movzx edx, word [ecx + 0x43407a]
mov word [esp + ecx + 0x50], dx
add ecx, 2
test dx, dx
jne 0x401330
lea edi, [eax + 2]
push 0x2c
push edi
call fcn.0040d1b6
add esp, 8
test eax, eax
je 0x40140b
xor ecx, ecx
lea esi, [esp + 0x140]
mov word [eax], cx
mov ecx, edi
sub esi, edi
lea ebx, [ebx]
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x401370
push 2
lea edi, [eax + 2]
push 0x4243d4
push edi
call fcn.0040d844
add esp, 0xc
test eax, eax
jne 0x401407
add edi, 4
xor esi, esi
add edi, 4
mov edi, edi
lea edx, [esp + 0x18]
push edx
push 0x4243cc
push edi
call fcn.0040d6b1
add esp, 0xc
cmp eax, 1
jne 0x401407
mov al, byte [esp + 0x18]
mov byte [esp + esi + 0x30], al
inc esi
add edi, 0xa
cmp esi, 0x14
jl 0x4013a0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x401407
mov edx, dword [esp + 0x14]
push 0x14
lea eax, [esp + 0x34]
push eax
push 3
push 0
lea ecx, [esp + 0x150]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
jne 0x401290
pop edi
pop ebp
pop ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov ecx, dword [esp + 0x224]
pop esi
xor ecx, esp
call fcn.0040d609
add esp, 0x224
ret
Function at 0x401305
Capabilities:
Set registry value

Disassembly:
sub esp, 0x224
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x220], eax
mov eax, dword [esp + 0x228]
push esi
lea ecx, [esp + 0x10]
push ecx
push 2
push 0
push eax
call dword [sym.imp.SETUPAPI.dll_SetupOpenInfFileW]
mov esi, eax
mov dword [esp + 4], esi
cmp esi, 0xffffffff
je 0x40142b
lea edx, [esp + 0x14]
push edx
push 0
push str.NvStUSB.Param
push esi
call dword [sym.imp.SETUPAPI.dll_SetupFindFirstLineW]
test eax, eax
je 0x401424
xor eax, eax
push ebx
mov ebx, dword [sym.imp.SETUPAPI.dll_SetupGetLineTextW]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push edi
mov byte [esp + 0x30], 0
mov dword [esp + 0x31], eax
mov dword [esp + 0x35], eax
mov dword [esp + 0x39], eax
mov dword [esp + 0x3d], eax
mov dword [esp + 0x41], eax
mov dword [esp + 0x45], eax
mov dword [esp + 0x49], eax
mov byte [esp + 0x4d], al
lea esp, [esp]
push 0
push 0x1000
push 0x434070
push 0
push 0
push esi
lea eax, [esp + 0x38]
push eax
call ebx
test eax, eax
je 0x40140b
cmp word [0x434070], 0
mov eax, 0x434070
mov edx, eax
je 0x4012e4
movzx ecx, word [eax]
cmp cx, 0x20
je 0x4012db
cmp cx, 9
je 0x4012db
mov word [edx], cx
add eax, 2
add edx, 2
jmp 0x4012de
add eax, 2
cmp word [eax], 0
jne 0x4012c1
push 5
xor ecx, ecx
push 0x4243dc
push 0x434070
mov word [edx], cx
call fcn.0040d844
add esp, 0xc
test eax, eax
jne 0x40140b
push 0x2c
push 0x43407a
call fcn.0040d1b6
add esp, 8
test eax, eax
je 0x40140b
xor edx, edx
mov word [eax], dx
xor ecx, ecx
jmp 0x401330
movzx edx, word [ecx + 0x43407a]
mov word [esp + ecx + 0x50], dx
add ecx, 2
test dx, dx
jne 0x401330
lea edi, [eax + 2]
push 0x2c
push edi
call fcn.0040d1b6
add esp, 8
test eax, eax
je 0x40140b
xor ecx, ecx
lea esi, [esp + 0x140]
mov word [eax], cx
mov ecx, edi
sub esi, edi
lea ebx, [ebx]
movzx edx, word [ecx]
mov word [esi + ecx], dx
add ecx, 2
test dx, dx
jne 0x401370
push 2
lea edi, [eax + 2]
push 0x4243d4
push edi
call fcn.0040d844
add esp, 0xc
test eax, eax
jne 0x401407
add edi, 4
xor esi, esi
add edi, 4
mov edi, edi
lea edx, [esp + 0x18]
push edx
push 0x4243cc
push edi
call fcn.0040d6b1
add esp, 0xc
cmp eax, 1
jne 0x401407
mov al, byte [esp + 0x18]
mov byte [esp + esi + 0x30], al
inc esi
add edi, 0xa
cmp esi, 0x14
jl 0x4013a0
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x54]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x401407
mov edx, dword [esp + 0x14]
push 0x14
lea eax, [esp + 0x34]
push eax
push 3
push 0
lea ecx, [esp + 0x150]
push ecx
push edx
call ebp
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x20]
push ecx
mov edx, ecx
push edx
call dword [sym.imp.SETUPAPI.dll_SetupFindNextLine]
test eax, eax
jne 0x401290
pop edi
pop ebp
pop ebx
push esi
call dword [sym.imp.SETUPAPI.dll_SetupCloseInfFile]
mov ecx, dword [esp + 0x224]
pop esi
xor ecx, esp
call fcn.0040d609
add esp, 0x224
ret
Function at 0x401450
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push edi
mov edi, dword [esp + 0x18]
lea eax, [esp + 0x18]
push eax
push str.SystemCurrentControlSetServicesNvStUSBParameters
xor bl, bl
push 0x80000002
mov dword [esp + 0x14], 4
mov byte [edi], bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
test eax, eax
jne 0x4014bc
mov edx, dword [esp + 0x14]
push esi
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x20]
push edx
lea eax, [esp + 0x18]
push eax
push 0
push str.Version
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edx, dword [esp + 0x1c]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
mov byte [edi], 1
pop edi
sete al
pop ebx
add esp, 8
ret
pop edi
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x4014d0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ecx
push ebx
lea eax, [esp + 4]
push eax
push str.SystemCurrentControlSetServicesNvStUSBParameters
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x40151e
mov edx, dword [esp + 4]
push esi
push 4
lea ecx, [esp + 0x14]
push ecx
push 4
push eax
push str.Version
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
sete al
pop ebx
pop ecx
ret
mov al, bl
pop ebx
pop ecx
ret

Function at 0x401640
Capabilities:
Get common file path

Disassembly:
sub esp, 0x210
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x20c], eax
push esi
push edi
mov edi, dword [esp + 0x21c]
push 0x105
lea eax, [esp + 0xc]
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4016c4
lea eax, [esp + 8]
lea edx, [eax + 2]
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401680
sub eax, edx
sar eax, 1
push edi
lea ecx, [esp + eax*2 + 0xc]
push 0x4244c8
push ecx
call fcn.0040d8ea
add esp, 0xc
lea edx, [esp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
pop edi
pop esi
mov ecx, dword [esp + 0x20c]
xor ecx, esp
call fcn.0040d609
add esp, 0x210
ret
mov ecx, dword [esp + 0x214]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0040d609
add esp, 0x210
ret
Function at 0x401990
Capabilities:
Extract resource via kernel32 functions
Identify system language via api

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], 0x4244d0
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
movzx eax, ax
push eax
call fcn.004017f0
mov ecx, dword [esp + 0x20]
mov ebp, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
shr ecx, 4
add esp, 4
movzx eax, ax
inc ecx
movzx edi, cx
push eax
push edi
push 6
push ebx
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x4019f5
push esi
push edi
push 6
push esi
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov esi, eax
test esi, esi
je 0x401a3c
push esi
push 0
call ebp
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebp, eax
test ebp, ebp
je 0x401a3e
push ebp
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x401a3e
mov ecx, dword [esp + 0x1c]
and ecx, 0xf
jle 0x401a2c
jmp 0x401a20
sub ecx, 1
movzx edx, word [eax]
lea eax, [eax + edx*2 + 2]
jne 0x401a20
movzx ebx, word [eax]
test ebx, ebx
je 0x401a3e
add eax, 2
mov dword [esp + 0x10], eax
jmp 0x401a3e
mov ebp, ebx
mov esi, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
mov eax, esi
shl eax, 9
push ebx
lea edi, [eax + 0x433930]
push ecx
push edi
call fcn.0040da0a
shl esi, 8
add esi, ebx
xor edx, edx
add esp, 0xc
mov word [esi*2 + 0x433930], dx
test ebp, ebp
je 0x401a76
push ebp
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x401dc0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x11c
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push eax
push 0x20119
push 0
push str.SOFTWARENVIDIA_CorporationGlobalNVTweak
push 0x80000002
mov bl, 1
mov dword [esp + 0x1c], 0
call esi
test eax, eax
je 0x401e1a
lea ecx, [esp + 8]
push ecx
push 0x20019
push 0
push str.SOFTWARENVIDIA_CorporationGlobalNVTweak
push 0x80000002
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x401e7f
mov ecx, 4
lea edx, [esp + 0x14]
push edx
mov dword [esp + 0x18], ecx
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push str.DisableVersionCheck
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x401e57
cmp dword [esp + 0x10], eax
sete bl
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
jne 0x401e7f
pop esi
mov al, 1
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0040d609
add esp, 0x11c
ret
push edi
push str.nvd3dum.dll
xor edi, edi
call fcn.00401170
add esp, 4
push 0x105
lea ecx, [esp + 0x20]
push ecx
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x1c]
push edx
call fcn.00401170
add esp, 4
mov ebx, eax
cmp esi, 0x4a46
jae 0x401f01
push edi
push 1
push 0x3fe
call fcn.00401990
add esp, 8
push eax
push edi
push 0x401
call fcn.00401990
add esp, 8
push eax
push edi
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x118]
xor ecx, esp
call fcn.0040d609
add esp, 0x11c
ret
test ebx, ebx
je 0x401f5a
test esi, esi
je 0x401f5a
cmp ebx, esi
jae 0x401f20
push 0
push 0x405
call fcn.00401990
add esp, 8
mov edi, eax
cmp ebx, esi
jbe 0x401f3b
cmp esi, 0x445c
jae 0x401f3b
push 0
push 0x406
call fcn.00401990
add esp, 8
mov edi, eax
test edi, edi
je 0x401f5a
push 0
push 1
push 0x3ec
call fcn.00401990
add esp, 8
push eax
push edi
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x124]
pop edi
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0040d609
add esp, 0x11c
ret
Function at 0x401f80
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x264
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x260], eax
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
push ebp
mov ebp, dword [esp + 0x278]
push esi
mov esi, dword [esp + 0x274]
push edi
mov edi, dword [esp + 0x27c]
lea eax, [esp + 0x24]
push eax
call ebx
push edi
push esi
lea ecx, [esp + 0x70]
push str.__s___s
push ecx
call fcn.0040d54d
add esp, 0x10
lea edx, [esp + 0x24]
push edx
call ebx
lea eax, [esp + 0x14]
push eax
lea ecx, [esp + 0x28]
push ecx
push 0
push 0
push 0
push 1
push 0
push 0
lea edx, [esp + 0x88]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
setne bl
call dword [sym.imp.KERNEL32.dll_GetLastError]
test bl, bl
je 0x402049
cmp byte [esp + 0x284], 0
mov esi, dword [esp + 0x14]
je 0x402040
mov edi, dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
lea ecx, [ecx]
push 0x64
push esi
call edi
cmp eax, 0x102
je 0x402020
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
cmp dword [esp + 0x10], 0
sete bl
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x402068
test ebp, ebp
je 0x402068
push 0
push ebp
push 0
push 0x402
call fcn.00401990
add esp, 8
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [esp + 0x270]
pop edi
pop esi
pop ebp
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x264
ret

Function at 0x4020b0
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x140], eax
mov eax, dword [esp + 0x148]
push ebx
push esi
push eax
push str._s.
push 0x436078
mov bl, 1
call fcn.0040d54d
add esp, 0xc
lea eax, [esp + 8]
push eax
push 0x436078
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4021a4
push edi
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov ecx, 0x4245c8
lea eax, [esp + 0x38]
lea ecx, [ecx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402130
test dl, dl
je 0x40212c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402130
add eax, 2
add ecx, 2
test dl, dl
jne 0x402110
xor eax, eax
jmp 0x402135
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40216b
mov ecx, 0x4245c4
lea eax, [esp + 0x38]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x402162
test dl, dl
je 0x40215e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x402162
add eax, 2
add ecx, 2
test dl, dl
jne 0x402142
xor eax, eax
jmp 0x402167
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x402172
test byte [esp + 0xc], 0x10
jne 0x402188
lea ecx, [esp + 0x38]
push str.desktop.ini
push ecx
call fcn.0040db62
add esp, 8
test eax, eax
jne 0x40219a
lea edx, [esp + 0xc]
push edx
push esi
call edi
test eax, eax
jne 0x402104
jmp 0x40219c
xor bl, bl
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov ecx, dword [esp + 0x148]
pop esi
mov al, bl
pop ebx
xor ecx, esp
call fcn.0040d609
add esp, 0x144
ret
Function at 0x4021c0
Capabilities:
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push edi
mov edi, dword [esp + 8]
push edi
call fcn.004020b0
add esp, 4
test al, al
je 0x402237
push ebp
push esi
push edi
push str._sdesktop.ini
push 0x436180
call fcn.0040d54d
add esp, 0xc
push 0x436180
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and eax, 0xfffffff8
push eax
push 0x436180
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 0x436180
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
setne bl
test bl, bl
jne 0x402232
push 0x1f4
call ebp
inc esi
cmp esi, 0x64
jl 0x402215
mov al, bl
pop ebx
pop esi
pop ebp
pop edi
ret

Function at 0x402240
Capabilities:
Check if file exists
Get file attributes
Move file
Query environment variable

Disassembly:
sub esp, 0x214
mov eax, dword [0x42a0d0]
xor eax, esp
mov dword [esp + 0x210], eax
push ebx
mov ebx, dword [esp + 0x21c]
push esi
push 0x5c
push ebx
call fcn.0040d100
mov esi, eax
push 0x104
lea eax, [esp + 0x11d]
push 0
push eax
inc esi
mov byte [esp + 0x124], 0
call fcn.0040d990
push ebx
call fcn.004020b0
add esp, 0x18
test al, al
jne 0x4022aa
pop esi
xor al, al
pop ebx
mov ecx, dword [esp + 0x210]
xor ecx, esp
call fcn.0040d609
add esp, 0x214
ret
push esi
push str._Temp_
lea ecx, [esp + 0x10]
push 0x4245ec
push ecx
call fcn.0040d54d
add esp, 0x10
push 0x104
lea edx, [esp + 0x114]
push edx
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor eax, eax
lea esp, [esp]
mov cl, byte [esp + eax + 0x110]
mov byte [esp + eax + 8], cl
inc eax
test cl, cl
jne 0x4022e0
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [esp + 0xc]
push ecx
xor esi, esi
call edi
cmp eax, 0xffffffff
je 0x402352
lea edx, [esp + 0xc]
push edx
call fcn.004021c0
add esp, 4
test al, al
jne 0x402340
push esi
lea eax, [esp + 0x118]
push eax
lea ecx, [esp + 0x14]
push str._s_d
push ecx
call fcn.0040d54d
add esp, 0x10
lea edx, [esp + 0xc]
push edx
inc esi
call edi
cmp eax, 0xffffffff
jne 0x402305
jmp 0x402352
xor eax, eax
mov cl, byte [esp + eax + 0xc]
mov byte [esp + eax + 0x114], cl
inc eax
test cl, cl
jne 0x402342
lea eax, [esp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
pop edi
test eax, eax
je 0x402291
lea ecx, [esp + 8]
push ecx
call fcn.004021c0
mov ecx, dword [esp + 0x21c]
add esp, 4
pop esi
pop ebx
xor ecx, esp
mov al, 1
call fcn.0040d609
add esp, 0x214
ret
Function at 0x402390
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWARENVIDIA_CorporationGlobalStereo3D
push 0x80000002
xor bl, bl
mov dword [esp + 0x1c], 2
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4023f0
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x14]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4023e5
mov bl, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 8
ret

Function at 0x402400
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallNVIDIAStereo
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40246a
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.Integrated
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40245f
cmp dword [esp + 0x10], eax
setne bl
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x10
ret

Function at 0x402480
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
push ebx
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionUninstallNVIDIAStereo
push 0x80000002
xor bl, bl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4024ea
lea ecx, [esp + 8]
push ecx
mov ecx, dword [esp + 8]
lea edx, [esp + 0x14]
push edx
lea eax, [esp + 0x14]
push eax
push 0
push str.Emitter
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4024df
cmp dword [esp + 0x10], eax
setne bl
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
pop ebx
add esp, 0x10
ret