joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a7620
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe0
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
movzx ecx, word [edi + 0x4a]
test ecx, 0x8000
jne 0x5a767a
mov ebx, dword [ebp + 8]
cmp ebx, 3
ja 0x5a77a4
test cl, 4
je 0x5a7669
movzx eax, word [edi + 0x48]
cmp eax, ebx
je 0x5a7669
push str.inconsistent_rendering_intents
jmp 0x5a77a9
test cl, 0x20
je 0x5a768d
mov edx, str.duplicate_sRGB_information_ignored
mov ecx, esi
call fcn.005a94a0
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00633732
mov esp, ebp
pop ebp
ret
test cl, 2
je 0x5a76e4
push 0x64
lea edx, [edi + 4]
mov ecx, 0x70a954
call fcn.005a7000
add esp, 4
test eax, eax
jne 0x5a76e4
test dword [esi + 0x74], 0x8000
mov ecx, esi
je 0x5a7790
test dword [esi + 0x78], 0x100000
je 0x5a77ca
push str.cHRM_chunk_does_not_match_sRGB
lea edx, [ebp - 0xe0]
call fcn.005a94e0
add esp, 4
lea edx, [ebp - 0xe0]
mov ecx, esi
call fcn.005a92b0
push 2
push 0xb18f
mov edx, edi
mov ecx, esi
call fcn.005a6700
movq xmm0, qword [0x70a954]
mov eax, dword [0x70a950]
movq qword [edi + 4], xmm0
movq xmm0, qword [0x70a95c]
movq qword [edi + 0xc], xmm0
movq xmm0, qword [0x70a964]
movq qword [edi + 0x14], xmm0
movq xmm0, qword [0x70a96c]
movq qword [edi + 0x1c], xmm0
movq xmm0, qword [0x70a930]
movq qword [edi + 0x24], xmm0
movq xmm0, qword [0x70a938]
movq qword [edi + 0x2c], xmm0
movq xmm0, qword [0x70a940]
movq qword [edi + 0x34], xmm0
movq xmm0, qword [0x70a948]
movq qword [edi + 0x3c], xmm0
mov dword [edi + 0x44], eax
mov eax, 0xe7
add esp, 8
or word [edi + 0x4a], ax
mov word [edi + 0x48], bx
mov dword [edi], 0xb18f
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00633732
mov esp, ebp
pop ebp
ret
test dword [esi + 0x78], 0x400000
mov edx, str.cHRM_chunk_does_not_match_sRGB
jne 0x5a76df
jmp 0x5a77d4
push str.invalid_sRGB_rendering_intent
push ebx
push str.sRGB
mov ecx, esi
call fcn.005a7430
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
pop ebx
call fcn.00633732
mov esp, ebp
pop ebp
ret
mov edx, str.cHRM_chunk_does_not_match_sRGB
call fcn.005a95f0
call fcn.005a9160
int3

Function at 0x5a9810
Capabilities:
Terminate process

Disassembly:
test edx, edx
push esi
mov eax, str.undefined
cmovne eax, edx
push eax
push str.libpng_error:__s
mov esi, ecx
call fcn.00636524
add eax, 0x40
push eax
call fcn.0063799b
add esp, 0xc
push 0x72cf24
call fcn.00636524
add eax, 0x40
push eax
call fcn.0063799b
add esp, 8
test esi, esi
je 0x5a9864
mov eax, dword [esi + 0x40]
test eax, eax
je 0x5a9864
mov ecx, dword [esi + 0x44]
test ecx, ecx
je 0x5a9864
push 1
push ecx
call eax
add esp, 8
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x5c6400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x24
mov edx, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
mov eax, dword [edx + 0x78]
mov ebx, dword [edx + 0x8c]
cmp eax, ebx
mov eax, dword [edx + 0x34]
mov ebx, dword [edx + 0x7c]
jl 0x5c6425
shr ebx, 2
dec ebx
shl ebx, 0x10
or ebx, eax
mov dword [esp], ebx
mov eax, dword [edx + 0x90]
mov ebx, dword [edx + 0x74]
cmp ebx, eax
jl 0x5c643d
mov ebx, eax
mov dword [esp + 0x18], ebx
mov esi, dword [edx + 0x38]
mov dword [esp + 4], esi
mov ebp, dword [edx + 0x6c]
lea edi, [ebp + esi]
mov dword [esp + 0x20], edi
mov eax, edi
neg eax
and eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [edx + 0x2c]
sub eax, 0x106
sub ebp, eax
jg 0x5c646c
xor ebp, ebp
mov eax, dword [edx + 0x78]
mov dword [esp + 0x1c], eax
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [edi]
mov dword [esp + 0x10], ebx
movzx ebx, word [eax + edi - 1]
mov dword [esp + 0xc], ebx
mov edi, dword [edx + 0x40]
mov edx, dword [esp]
jmp 0x5c64ae
and ecx, edx
movzx ecx, word [edi + ecx*2]
cmp ecx, ebp
jbe 0x5c6582
sub edx, 0x10000
js 0x5c6582
movzx eax, word [ecx + esi - 1]
cmp eax, ebx
jne 0x5c6494
mov eax, dword [esp + 4]
movzx eax, word [ecx + eax]
cmp eax, dword [esp + 0x10]
jne 0x5c6494
mov dword [esp], edx
mov esi, dword [esp + 4]
mov edi, dword [esp + 0x20]
add esi, ecx
mov eax, dword [esp + 0x14]
mov edx, 0xfffffef8
lea edi, [eax + edi + 0x108]
lea esi, [eax + esi + 0x108]
mov eax, dword [edx + esi]
xor eax, dword [edx + edi]
jne 0x5c6505
mov eax, dword [edx + esi + 4]
xor eax, dword [edx + edi + 4]
jne 0x5c6502
add edx, 8
jne 0x5c64e9
jmp 0x5c6573
add edx, 4
test eax, 0xffff
jne 0x5c6512
add edx, 2
shr eax, 0x10
sub al, 1
adc edx, 0
lea eax, [edx + edi]
mov edi, dword [esp + 0x20]
sub eax, edi
cmp eax, 0x102
jge 0x5c6573
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
cmp eax, ebx
jg 0x5c6546
mov esi, dword [esp + 8]
mov edi, dword [edx + 0x40]
mov ebx, dword [esp + 0xc]
mov edx, dword [esp]
jmp 0x5c6494
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x1c], eax
mov dword [edx + 0x70], ecx
cmp eax, ebx
jge 0x5c6582
mov esi, dword [esp + 4]
add esi, eax
mov dword [esp + 8], esi
movzx ebx, word [eax + edi - 1]
mov edi, dword [edx + 0x40]
mov dword [esp + 0xc], ebx
mov edx, dword [esp]
jmp 0x5c6494
mov edx, dword [esp + 0x38]
mov dword [esp + 0x1c], 0x102
mov dword [edx + 0x70], ecx
mov edx, dword [esp + 0x38]
mov ebx, dword [esp + 0x1c]
mov eax, dword [edx + 0x74]
cmp ebx, eax
jg 0x5c6593
mov eax, ebx
add esp, 0x24
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x5fff20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 8]
movzx edx, word [eax]
mov ebx, dword [ebx]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], ebx
cmp ebx, eax
jb 0x5fff43
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
push esi
push edi
mov edi, dword [ebp + 0x14]
sub eax, ebx
cmp edi, eax
cmova edi, eax
xor esi, esi
mov dword [ebp + 0x14], edi
test edi, edi
je 0x5fff90
mov esi, dword [ebp + 0x10]
sub ebx, esi
lea ecx, [ecx]
movzx eax, byte [ebx + esi]
mov ecx, edx
shr ecx, 8
xor ecx, eax
add eax, edx
imul eax, eax, 0x3193
mov edx, 0x58bf
sub edx, eax
and edx, 0xffff
mov byte [esi], cl
lea esi, [esi + 1]
dec edi
jne 0x5fff60
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp - 4]
mov esi, edi
mov eax, dword [ebp + 8]
lea ecx, [ebx + edi]
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
pop edi
mov word [eax], dx
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x62ed50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
push esi
mov esi, eax
push ebx
sub esp, 0xc
cmp eax, 8
mov dword [ebp - 0x10], ecx
mov ebx, 2
jg 0x62edd4
lea ecx, [ebx*4]
cmp ecx, esi
je 0x62ee37
xor eax, eax
cmp eax, ebx
jge 0x62edcc
mov edx, edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movaps xmm0, xmmword [edx]
add eax, 8
movaps xmm1, xmmword [edx + 0x10]
movaps xmm3, xmmword [edx + ebx*4]
movaps xmm2, xmmword [edx + ebx*4 + 0x10]
movaps xmm5, xmm0
movaps xmm4, xmm1
addps xmm5, xmm3
subps xmm0, xmm3
addps xmm4, xmm2
movaps xmmword [edx], xmm5
subps xmm1, xmm2
movaps xmmword [edx + 0x10], xmm4
movaps xmmword [edx + ebx*4], xmm0
movaps xmmword [edx + ebx*4 + 0x10], xmm1
add edx, 0x20
cmp eax, ebx
jl 0x62ed90
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
call fcn.0062e210
cmp esi, 0x20
mov ebx, 8
jle 0x62ed6a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, edi
mov dword [esp], edx
mov edx, ebx
shl ebx, 2
call fcn.0062e4b0
lea eax, [ebx*4]
cmp eax, esi
jge 0x62ed6a
mov edx, dword [ebp - 0x10]
mov eax, esi
mov ecx, edi
mov dword [esp], edx
mov edx, ebx
shl ebx, 2
call fcn.0062e4b0
lea eax, [ebx*4]
cmp eax, esi
jl 0x62edf0
jmp 0x62ed6a
xor ecx, ecx
cmp ecx, ebx
jge 0x62edcc
mov eax, edi
lea edx, [ebx + ebx*2]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movaps xmm0, xmmword [eax + ebx*8]
add ecx, 4
movaps xmm6, xmmword [edi + edx*4]
movaps xmm2, xmmword [eax]
movaps xmm7, xmmword [eax + ebx*4]
movaps xmm4, xmm0
subps xmm0, xmm6
shufps xmm0, xmm0, 0xb1
movaps xmm3, xmm2
addps xmm3, xmm7
xorps xmm0, xmmword [0x6bf3e0]
subps xmm2, xmm7
addps xmm4, xmm6
movaps xmm5, xmm3
movaps xmm1, xmm2
addps xmm5, xmm4
movaps xmmword [eax], xmm5
subps xmm3, xmm4
addps xmm1, xmm0
movaps xmmword [eax + ebx*8], xmm3
subps xmm2, xmm0
movaps xmmword [eax + ebx*4], xmm1
add eax, 0x10
movaps xmmword [edi + edx*4], xmm2
add edx, 4
cmp ecx, ebx
jl 0x62ee50
add esp, 0xc
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x62ff50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.0062f830
Function at 0x64e873
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x76f950]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.0063d588
mov dword [ebp - 0x14], eax
cmp dword [0x77a4cc], edi
jne 0x64e964
push 0x800
push edi
push 0x6ddaa8
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x64e8f1
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x64ea44
push 0x6ddaa8
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x64ea44
push 0x6ddac0
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x64ea44
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x77a4cc], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x77a4d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x77a4d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x77a4dc], eax
test eax, eax
je 0x64e961
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x77a4d8], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x64e989
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x64e97c
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x64e99e
push 4
pop eax
jmp 0x64ea46
cmp dword [ebp - 0x14], edi
je 0x64e99e
push dword [0x77a4cc]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x64e983
mov eax, dword [0x77a4d8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x64e9fc
cmp dword [0x77a4dc], esi
je 0x64e9fc
push eax
call ebx
push dword [0x77a4dc]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x64e9fc
test eax, eax
je 0x64e9fc
call ecx
test eax, eax
je 0x64e9f1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x64e9f1
test byte [ebp - 8], 1
jne 0x64e9fc
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x64ea2c
mov eax, dword [0x77a4d0]
cmp eax, esi
je 0x64ea29
push eax
call ebx
test eax, eax
je 0x64ea29
call eax
mov edi, eax
test edi, edi
je 0x64ea29
mov eax, dword [0x77a4d4]
cmp eax, esi
je 0x64ea29
push eax
call ebx
test eax, eax
je 0x64ea29
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x77a4cc]
call ebx
test eax, eax
je 0x64ea44
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x64ea46
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00633732
leave
ret
Function at 0x652121
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.00643ca7
mov esi, dword [ebp + 8]
push 2
mov edi, eax
lea eax, [ebp - 4]
push eax
mov ecx, esi
and ecx, 0x3ff
push 0x20000001
or ecx, 0x400
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
jne 0x652159
xor eax, eax
jmp 0x652185
cmp esi, dword [ebp - 4]
je 0x652182
cmp dword [ebp + 0xc], 0
je 0x652182
push dword [edi + 0x9c]
call fcn.00651d2f
push dword [edi + 0x9c]
mov esi, eax
call fcn.0063d8bd
pop ecx
pop ecx
cmp esi, eax
je 0x652155
xor eax, eax
inc eax
pop edi
pop esi
leave
ret
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x3cd229d2
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x7f215ea6
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
xor dword [eax], ecx
nop
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x4014d8
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, esi
lea eax, [ebp - 4]
push eax
and esi, 0x300
mov eax, esi
or eax, 9
push eax
push dword [ebp + 0xc]
and edi, 1
push dword [ebp + 8]
call fcn.004062cd
xor ebx, ebx
cmp eax, ebx
jne 0x4015bc
test byte [ebp + 0x10], 2
je 0x40153a
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push dword [ebp - 4]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
cmp eax, 0x103
jne 0x4015a1
push 0x105
lea eax, [ebp - 0x214]
push eax
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x401576
test edi, edi
jne 0x4015a1
push dword [ebp + 0x10]
lea eax, [ebp - 0x214]
push eax
push dword [ebp - 4]
call fcn.004014d8
test eax, eax
jne 0x40157f
push 0x105
lea eax, [ebp - 0x214]
push eax
push edi
push dword [ebp - 4]
call ebx
test eax, eax
je 0x40154f
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 4
call fcn.004065e3
test eax, eax
jne 0x4015b1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jmp 0x4015bc
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x3eb
jmp 0x4015bc
push 0
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call eax
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x405ec8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push eax
push 0x425a08
xor eax, eax
push eax
push eax
push 0x4000000
push eax
push eax
push eax
push dword [ebp + 8]
mov dword [0x425a08], 0x44
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x405f07
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x405f0b
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
push eax
mov dword [eax], 0x3c
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
ret 4

Function at 0x4060d4
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push esi
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4060f4
and eax, 0xfffffffe
push eax
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
mov eax, esi
pop esi
ret 4

Function at 0x4060fa
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, eax
inc ecx
push 0
neg ecx
sbb ecx, ecx
and ecx, eax
push ecx
push dword [esp + 0x14]
push 0
push 1
push dword [esp + 0x1c]
push dword [esp + 0x1c]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
ret 0xc

Function at 0x406129
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x64
pop edi
mov eax, dword [0x409994]
mov dword [ebp - 8], eax
mov eax, dword [0x409998]
dec edi
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
pop ecx
xor edx, edx
div ecx
push esi
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
add word [ebp - 4], dx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
test eax, eax
jne 0x406179
test edi, edi
jne 0x406136
and word [esi], di
pop edi
pop esi
leave
ret 8
mov eax, esi
jmp 0x406173

Function at 0x40632e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp + 0x18]
push eax
mov eax, dword [ebp + 0x18]
neg eax
sbb eax, eax
and eax, 0x100
or eax, 0x20019
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], 0x800
push dword [ebp + 8]
call fcn.004062cd
test eax, eax
mov esi, dword [ebp + 0x14]
jne 0x40639e
push edi
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp + 0x18]
mov edi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and word [esi + 0x7fe], 0
test edi, edi
pop edi
jne 0x40639e
cmp dword [ebp + 0xc], 1
je 0x4063a2
cmp dword [ebp + 0xc], 2
je 0x4063a2
and word [esi], 0
pop esi
leave
ret 0x14
Function at 0x406573
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
push esi
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406597
xor eax, eax
test eax, eax
je 0x4065aa
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x4065aa
xor ecx, ecx
jmp 0x4065ad
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x4092c8]
push ecx
lea eax, [ebp + eax*2 - 0x23c]
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
push 8
push 0
lea eax, [ebp - 0x23c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406709
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
push esi
call fcn.004060d4
mov edi, eax
cmp edi, 0xffffffff
je 0x40674a
test byte [esp + 0x10], 1
push esi
je 0x406733
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x40673b
xor eax, eax
inc eax
jmp 0x40674c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40672a
test byte [esp + 0x10], 4
jne 0x40674a
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
xor eax, eax
pop edi
pop esi
ret 8

Function at 0x4067f2
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x425a50
push esi
call fcn.00406460
push esi
call fcn.00405ffd
mov edi, eax
test edi, edi
jne 0x406813
xor eax, eax
jmp 0x406871
push edi
call fcn.0040649d
test byte [0x42a5d0], 0x80
je 0x406830
movzx eax, word [edi]
test ax, ax
je 0x40680f
cmp ax, 0x5c
je 0x40680f
sub edi, esi
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenW]
sar edi, 1
jmp 0x406852
push esi
call fcn.0040654c
test eax, eax
je 0x40684c
test byte [eax], 0x10
je 0x406876
push esi
call fcn.00406780
push esi
call ebx
cmp eax, edi
jg 0x40683d
push esi
call fcn.00406751
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov eax, ecx
pop ebx
pop edi
pop esi
ret 4
xor eax, eax
jmp 0x406870
Function at 0x406af0
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
push ebp
push esi
mov esi, dword [esp + 0x14]
test esi, esi
push edi
mov dword [0x426250], 0x55004e
mov dword [0x426254], 0x4c
mov edi, 0x400
mov ebp, 0x426250
je 0x406b46
push 1
push 0
push esi
call fcn.004060fa
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x406c65
cmp eax, edi
jg 0x406c65
push edi
mov esi, 0x4278a0
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x406c65
cmp eax, edi
jg 0x406c65
push esi
push ebp
push str._ls_ls_r_n
push 0x426ca0
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov ebx, eax
mov eax, dword [0x42a56c]
push dword [eax + 0x128]
push esi
call fcn.0040687a
push 4
push 0xc0000000
push esi
call fcn.004060fa
mov ebp, eax
cmp ebp, 0xffffffff
mov dword [esp + 0x18], ebp
je 0x406c65
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
lea eax, [edi + ebx + 0xa]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x406c5e
push edi
push esi
push ebp
call fcn.0040617d
test eax, eax
je 0x406c5e
push str._Rename__r_n
push esi
call fcn.0040605a
test eax, eax
jne 0x406bfc
push str._Rename__r_n
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
add edi, 0xa
jmp 0x406c31
push 0x4099c4
add eax, 0xa
push eax
call fcn.0040605a
mov ebp, eax
test ebp, ebp
je 0x406c2d
lea ecx, [esi + edi]
lea eax, [ecx + ebx]
jmp 0x406c1e
mov dl, byte [ecx]
mov byte [eax], dl
dec eax
dec ecx
cmp ecx, ebp
ja 0x406c18
sub ebp, esi
inc ebp
mov eax, ebp
mov ebp, dword [esp + 0x18]
jmp 0x406c33
mov ebp, dword [esp + 0x18]
mov eax, edi
push ebx
push 0x426ca0
add eax, esi
push eax
call fcn.004060b0
xor eax, eax
push eax
push eax
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
add edi, ebx
push edi
push esi
push ebp
call fcn.004061ac
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x406c6a
Capabilities:
Move file

Disassembly:
push 5
push dword [esp + 0xc]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x406c8d
push dword [esp + 8]
push dword [esp + 8]
call fcn.00406af0
pop ecx
pop ecx
inc dword [0x42a630]
ret 8
Function at 0x406c96
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x258
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
mov eax, ebx
and eax, 4
push edi
mov dword [ebp - 4], eax
call fcn.004067f2
test bl, 8
mov dword [ebp - 8], eax
je 0x406cd4
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
inc eax
add dword [0x42a628], eax
jmp 0x406e55
mov dword [ebp + 8], ebx
and dword [ebp + 8], 1
push esi
je 0x406cef
test eax, eax
je 0x406e01
test bl, 2
je 0x406e01
push edi
mov esi, 0x4270a0
push esi
call fcn.00406460
cmp dword [ebp + 8], 0
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatW]
je 0x406d11
push str..
push esi
call ebx
jmp 0x406d17
push edi
call fcn.00406780
cmp word [edi], 0
jne 0x406d27
cmp word [0x4270a0], 0x5c
jne 0x406d2f
push 0x4092c8
push edi
call ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ebx, [edi + eax*2]
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x406df6
cmp word [ebp - 0x22c], 0x2e
jne 0x406d7a
cmp word [ebp - 0x22a], 0
je 0x406dd9
cmp word [ebp - 0x22a], 0x2e
jne 0x406d7a
cmp word [ebp - 0x228], 0
je 0x406dd9
lea eax, [ebp - 0x22c]
push eax
push ebx
call fcn.00406460
test byte [ebp - 0x258], 0x10
je 0x406da5
mov eax, dword [ebp + 0xc]
and eax, 3
cmp al, 3
jne 0x406dd9
push dword [ebp + 0xc]
push edi
call fcn.00406c96
jmp 0x406dd9
push dword [ebp - 4]
push edi
call fcn.00406709
test eax, eax
jne 0x406dd1
cmp dword [ebp - 4], eax
je 0x406dc9
push edi
push 0xfffffffffffffff1
call fcn.004051d7
push 0
push edi
call fcn.00406c6a
jmp 0x406dd9
inc dword [0x42a628]
jmp 0x406dd9
push edi
push 0xfffffffffffffff2
call fcn.004051d7
lea eax, [ebp - 0x258]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x406d52
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 8], 0
je 0x406e01
and word [ebx - 2], 0
xor esi, esi
cmp dword [ebp + 8], esi
je 0x406e54
cmp dword [ebp - 8], esi
je 0x406e44
push edi
call fcn.0040654c
test eax, eax
je 0x406e54
push edi
call fcn.00406751
mov eax, dword [ebp - 4]
or eax, 1
push eax
push edi
call fcn.00406709
test eax, eax
jne 0x406e4c
cmp dword [ebp - 4], esi
je 0x406e44
push edi
push 0xfffffffffffffff1
call fcn.004051d7
push esi
push edi
call fcn.00406c6a
jmp 0x406e54
inc dword [0x42a628]
jmp 0x406e54
push edi
push 0xffffffffffffffe5
call fcn.004051d7
pop esi
pop edi
pop ebx
leave
ret 8