joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d4e0
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Set file attributes

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415d1b
push eax
mov dword fs:[0], esp
sub esp, 0x314
lea eax, [esp]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
push edi
push 0x104
push eax
xor ebx, ebx
call ebp
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x10]
push str.explorer.exe
push ecx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
je 0x40d5d8
lea eax, [esp + 0x10]
mov ecx, 0x41ef60
push eax
call fcn.00406110
test eax, eax
jne 0x40d5d8
lea ecx, [esp + 0x114]
push 0x104
push ecx
call ebp
lea edx, [esp + 0x114]
push str.system32dllcacheexplorer.exe
push edx
call esi
lea eax, [esp + 0x114]
push eax
call edi
test eax, eax
je 0x40d5d8
lea ecx, [esp + 0x114]
push ecx
mov ecx, 0x41ef60
call fcn.00406110
test eax, eax
je 0x40d5d8
mov eax, dword [esp + 0x334]
mov ebx, 1
test eax, eax
je 0x40d5d8
call fcn.004071c0
lea edx, [esp + 0x10]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
push 0
lea edx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x10]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [esp + 0x10]
push str.explorer.exe
push ecx
call esi
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
je 0x40d65f
lea ecx, [esp + 0x218]
call fcn.00414010
lea eax, [esp + 0x10]
lea ecx, [esp + 0x218]
push eax
mov dword [esp + 0x330], 0
call fcn.00414080
test eax, eax
jne 0x40d648
mov eax, dword [esp + 0x334]
mov ebx, 1
test eax, eax
je 0x40d648
lea ecx, [esp + 0x10]
push ecx
call fcn.004086c0
add esp, 4
lea ecx, [esp + 0x218]
mov dword [esp + 0x32c], 0xffffffff
call fcn.00414050
mov ecx, dword [esp + 0x324]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x320
ret
Function at 0x40d6e0
Capabilities:
Get common file path
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x318
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__snprintf]
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
push esi
push edi
mov dword [esp + 0x10], 0x104
mov dword [esp + 0x14], 0
mov esi, 0x41cb10
mov eax, dword [esi - 4]
lea ecx, [esp + 0x224]
push eax
push str.SYSTEMCurrentControlSetServices_sParameters
push 0x104
push ecx
call ebx
add esp, 0x10
lea edx, [esp + 0x10]
lea eax, [esp + 0x120]
lea ecx, [esp + 0x18]
push edx
push eax
push ecx
lea edx, [esp + 0x230]
push str.ServiceDll
push edx
push 0x80000002
call ebp
test eax, eax
jne 0x40d7f5
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x40d7f5
lea eax, [esp + 0x1c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [esi]
lea edx, [esp + 0x1c]
push ecx
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
mov eax, dword [esi]
push eax
lea eax, [esp + 0x124]
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
je 0x40d7af
lea ecx, [esp + 0x120]
lea edx, [esp + 0x1c]
push ecx
push edx
call fcn.0040d680
add esp, 8
test eax, eax
jne 0x40d7f5
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
xor eax, eax
mov dword [esp + 0x14], 1
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
push ecx
push eax
push 1
lea ecx, [esp + 0x230]
push str.ServiceDll
push ecx
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
lea edx, [esp + 0x120]
push edx
call fcn.004086c0
add esp, 4
add esi, 8
cmp esi, 0x41cb20
jb 0x40d70b
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x318
ret

Function at 0x40d820
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push 0x104
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [esp + eax + 0x18]
mov dword [esp + 0x14], ecx
mov ebx, 0x4166a4
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x18]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
test al, 0x10
jne 0x40d8a2
mov ecx, dword [esp + 0x120]
mov eax, 1
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x40d8b1
lea ecx, [esp + 0x18]
push ecx
call fcn.004086c0
add esp, 4
add ebx, 4
cmp ebx, 0x4166b4
jb 0x40d855
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40d8c0
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x14]
push str.system32_
push ecx
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov edi, str.reparewindow.exe
lea ebx, [esp + ecx + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
test al, 0x10
jne 0x40d955
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x10], 1
test eax, eax
je 0x40d955
lea ecx, [esp + 0x14]
push ecx
call fcn.004086c0
add esp, 4
mov edi, str.windowrepare.dll
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, ebx
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
test al, 0x10
jne 0x40d9ac
mov eax, dword [esp + 0x11c]
mov esi, 1
test eax, eax
je 0x40d99f
lea ecx, [esp + 0x14]
push ecx
call fcn.004086c0
add esp, 4
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40d9c0
Capabilities:
Check if file exists
Delete file
Delete registry value
Get common file path
Get file attributes
Move file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.TxHMoU.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], ebx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
mov ecx, 0x41ec90
call fcn.00413780
mov ebp, dword [esp + 0x11c]
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov esi, eax
cmp esi, ebx
je 0x40da8e
lea ecx, [esi + 4]
push str.crsss
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40da6e
test ebp, ebp
mov ebx, 1
je 0x40da6e
push ebx
push esi
mov ecx, 0x41ec90
call fcn.00412c10
push str.DisableTaskMgr
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call edi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
inc eax
push edx
push 1
mov ecx, 0x41ec90
mov dword [esp + 0x18], eax
call fcn.00413780
mov esi, eax
test esi, esi
jne 0x40da32
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40daf2
test al, 0x10
jne 0x40daf2
test ebp, ebp
mov eax, 1
je 0x40daf4
lea ecx, [esp + 0x14]
push ecx
call fcn.00407fc0
add esp, 4
test eax, eax
je 0x40dac0
xor esi, esi
jmp 0x40dad4
push 4
lea edx, [esp + 0x18]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, 1
push str.DisableTaskMgr
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40db00
Capabilities:
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._system32HDDGuard.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esp + 0x11c]
test al, 0x10
jne 0x40db83
test edi, edi
mov ebx, 1
je 0x40db83
lea ecx, [esp + 0x14]
push ecx
call fcn.004086c0
add esp, 4
lea edx, [esp + 0x14]
push edx
call ebp
lea eax, [esp + 0x10]
mov ecx, 0x41ec90
push eax
push 0x20
mov dword [esp + 0x18], 0
call fcn.00413780
mov esi, eax
test esi, esi
je 0x40dbff
lea ecx, [esi + 4]
push str.ATI2HDDSRV
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40dbdf
test edi, edi
mov ebx, 1
je 0x40dbdf
push eax
push esi
mov ecx, 0x41ec90
call fcn.00412c10
add esi, 0x108
push esi
call fcn.004086c0
add esp, 4
push esi
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
inc eax
push edx
push 0x20
mov ecx, 0x41ec90
mov dword [esp + 0x18], eax
call fcn.00413780
mov esi, eax
test esi, esi
jne 0x40dba2
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40e090
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Move file

Disassembly:
sub esp, 0x248
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebp, [esp + eax + 0x14]
push str._fonts_system_
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
add ebp, eax
mov edi, 0x41ce88
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x118]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x40e179
test byte [esp + 0x118], 0x10
jne 0x40e157
lea edi, [esp + 0x144]
or ecx, 0xffffffff
xor eax, eax
mov ebx, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x25c]
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x40e16e
push 4
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x118]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e0ff
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x248
ret
Function at 0x40e190
Capabilities:
Create process on windows
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x248
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebp, [esp + eax + 0x14]
push str._fonts_system_
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
add ebp, eax
mov edi, 0x41ce88
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x118]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x40e26c
test byte [esp + 0x118], 0x10
jne 0x40e24a
lea edi, [esp + 0x144]
or ecx, 0xffffffff
xor eax, eax
mov ebx, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x25c]
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x40e261
lea eax, [esp + 0x14]
push eax
call fcn.004086c0
add esp, 4
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e1ff
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [esp + 0x25c]
test eax, eax
je 0x40e2b1
test ebx, ebx
je 0x40e2b1
push 4
push 0x41a0e0
push 0x41cebc
call dword [sym.imp.USER32.dll_GetActiveWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
cmp eax, 6
jne 0x40e2be
push 5
push 0
push 0
push str.http:__dl.360safe.com_killer_ati2evxx.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x248
ret
pop edi
pop esi
pop ebp
mov dword [0x41eb24], 1
xor eax, eax
pop ebx
add esp, 0x248
ret
Function at 0x40ed30
Capabilities:
Check if file exists
Create shortcut via ishelllink
Delete file
Get common file path
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x420
lea eax, [esp + 8]
push ebx
lea ecx, [esp + 0x14]
push eax
lea edx, [esp + 0x14]
push ecx
push edx
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push 0x80000002
mov dword [esp + 0x24], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40eeb5
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [esp + 0x14]
push eax
call ebx
test al, 0x10
jne 0x40eeb5
push 0
lea ecx, [esp + 0x11c]
push 0
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40eeb5
push ebp
push esi
push edi
mov edi, str.360
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x124]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x124]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebx
pop edi
pop esi
cmp eax, 0xffffffff
pop ebp
je 0x40eeb5
lea ecx, [esp + 4]
push ecx
push 0x417b64
push 1
push 0
push 0x417b74
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x40eeb5
mov eax, dword [esp + 4]
lea ecx, [esp + 8]
push ecx
push 0x417b84
mov edx, dword [eax]
push eax
call dword [edx]
test eax, eax
mov eax, dword [esp + 4]
jl 0x40eeaf
mov ecx, dword [eax]
lea edx, [esp + 0x14]
push edx
push eax
call dword [ecx + 0x50]
mov eax, dword [esp + 4]
lea edx, [esp + 0x14]
push 0
push edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0x44]
lea eax, [esp + 0x14]
push 0x5c
push eax
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov byte [eax], 0
mov eax, dword [esp + 0xc]
add esp, 8
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push eax
call dword [ecx + 0x24]
lea eax, [esp + 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x118]
push 0x104
lea edx, [esp + 0x220]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll_mbstowcs]
mov eax, dword [esp + 0x14]
add esp, 0xc
lea edx, [esp + 0x21c]
mov ecx, dword [eax]
push 1
push edx
push eax
call dword [ecx + 0x18]
mov eax, dword [esp + 8]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 4]
mov edx, dword [eax]
push eax
call dword [edx + 8]
pop ebx
add esp, 0x420
ret
Function at 0x40eec0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
sub esp, 0x128
push ebx
push edi
xor edi, edi
call fcn.004084d0
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
lea eax, [esp + 8]
push eax
push ebx
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x40ef3f
push ebp
mov ebp, dword [esp + 0x13c]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edx, dword [esp + 0x13c]
lea ecx, [esp + 0x34]
push ecx
push edx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40ef2e
inc edi
test ebp, ebp
je 0x40ef2e
mov eax, dword [esp + 0x18]
push eax
push 0
push 1
call esi
test eax, eax
je 0x40ef2e
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 0x10]
push ecx
push ebx
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x40eef7
pop esi
pop ebp
test ebx, ebx
je 0x40ef4a
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop ebx
add esp, 0x128
ret
Function at 0x40efa0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAppendA]
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov esi, 0x41d6cc
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi - 4]
cmp eax, 9
ja case.default.0x40efdb
jmp dword [eax*4 + 0x40f138]
mov edx, dword [esi]
lea ecx, [esp + 0x14]
mov edi, 0x104
lea eax, [esp + 0x14]
sub edx, ecx
mov cl, byte [edx + eax]
cmp cl, bl
je 0x40f008
mov byte [eax], cl
inc eax
dec edi
jne 0x40eff3
dec eax
mov byte [eax], bl
jmp 0x40f0d0
cmp edi, ebx
jne 0x40f00d
dec eax
mov byte [eax], bl
jmp 0x40f0d0
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push eax
push ecx
jmp 0x40f0ce
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esi]
lea ecx, [esp + 0x14]
push eax
push ecx
jmp 0x40f0ce
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x14]
push str.drivers
push eax
call ebp
jmp 0x40f0c6
lea eax, [esp + 0x14]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [esp + 0x17], bl
jmp 0x40f0c6
push ebx
push 0x18
jmp 0x40f0a1
push ebx
push 7
jmp 0x40f0a1
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40f0c6
push ebx
push 0x26
lea eax, [esp + 0x1c]
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je case.default.0x40efdb
jmp 0x40f0c6
push ebx
lea eax, [esp + 0x18]
push 0x2b
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je case.default.0x40efdb
mov ecx, dword [esi]
lea edx, [esp + 0x14]
push ecx
push edx
call ebp
lea eax, [esp + 0x14]
push eax
call fcn.00408a20
add esp, 4
test eax, eax
je case.default.0x40efdb
mov eax, dword [esi + 4]
cmp eax, ebx
je 0x40f0f4
lea ecx, [esp + 0x14]
push ecx
call eax
add esp, 4
jmp 0x40f0f7
mov eax, dword [esi + 8]
cmp eax, 1
jb 0x40f100
inc dword [esp + 0x10]
mov edx, dword [esp + 0x120]
push edx
push eax
lea eax, [esp + 0x1c]
push eax
call dword [esp + 0x128]
add esp, 0xc
add esi, 0x10
cmp esi, 0x41d6ec
jb 0x40efbb
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40f2e0
Capabilities:
Enumerate files on windows
Get common file path
Get startup folder

Disassembly:
sub esp, 0x34c
push ebx
push ebp
push esi
xor ebx, ebx
push edi
push ebx
lea eax, [esp + 0x18]
push 0x18
push eax
push ebx
mov dword [esp + 0x20], ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40f460
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + ecx + 0x14]
mov cl, byte [esp + ecx + 0x13]
cmp cl, 0x5c
je 0x40f328
mov byte [eax], 0x5c
inc eax
mov byte [eax], bl
lea esi, [esp + 0x14]
lea edx, [esp + 0x118]
mov edi, 0x104
lea ecx, [esp + 0x118]
sub esi, edx
mov dl, byte [esi + ecx]
test dl, dl
je 0x40f350
mov byte [ecx], dl
inc ecx
dec edi
jne 0x40f341
jmp 0x40f354
test edi, edi
jne 0x40f355
dec ecx
mov edx, 0x41ce88
mov byte [ecx], 0
mov esi, 0x104
sub edx, eax
mov cl, byte [edx + eax]
test cl, cl
je 0x40f373
mov byte [eax], cl
inc eax
dec esi
jne 0x40f364
jmp 0x40f377
test esi, esi
jne 0x40f378
dec eax
mov byte [eax], 0
lea eax, [esp + 0x21c]
lea ecx, [esp + 0x14]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40f460
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov edi, dword [esp + 0x10]
test byte [esp + 0x21c], 0x10
jne 0x40f41b
mov ecx, 0x104
lea eax, [esp + 0x118]
cmp byte [eax], 0
je 0x40f3c4
inc eax
dec ecx
jne 0x40f3b9
jmp 0x40f407
test ecx, ecx
je 0x40f407
lea edx, [esp + 0x10]
test edx, edx
je 0x40f3d7
mov edi, 0x104
sub edi, ecx
mov edx, 0x104
lea eax, [esp + edi + 0x118]
sub edx, edi
je 0x40f407
lea esi, [esp + 0x248]
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x40f3ff
mov byte [eax], cl
inc eax
dec edx
jne 0x40f3f0
jmp 0x40f403
test edx, edx
jne 0x40f404
dec eax
mov byte [eax], 0
lea eax, [esp + 0x118]
push eax
call fcn.0040f260
add esp, 4
test eax, eax
jne 0x40f42f
lea ecx, [esp + 0x21c]
push ecx
push ebp
call ebx
test eax, eax
je 0x40f448
jmp 0x40f3a3
push ebp
mov esi, 1
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret
mov esi, dword [esp + 0x10]
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x34c
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x34c
ret
Function at 0x40f8f0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x104
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea edi, [esp + eax + 0x10]
mov ebx, 0x4168c8
mov byte [edi], 0x5c
inc edi
mov ecx, dword [ebx]
cmp byte [ecx], 0x30
jne 0x40f954
sub ecx, edi
mov esi, 0x104
mov eax, edi
lea edx, [ecx + 1]
mov cl, byte [edx + eax]
test cl, cl
je 0x40f93b
mov byte [eax], cl
inc eax
dec esi
jne 0x40f92c
jmp 0x40f93f
test esi, esi
jne 0x40f940
dec eax
lea ecx, [esp + 0x10]
mov byte [eax], 0
push ecx
call fcn.0040f620
add esp, 4
test eax, eax
jne 0x40f961
add ebx, 4
cmp ebx, str..Upack
jb 0x40f919
jmp 0x40f966
mov ebp, 1
lea edx, [esp + 0x10]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea edi, [esp + eax + 0x10]
mov ebx, 0x4168c8
mov byte [edi], 0x5c
inc edi
mov edx, dword [ebx]
cmp byte [edx], 0x30
je 0x40f9c0
mov esi, 0x104
mov eax, edi
sub edx, edi
mov cl, byte [edx + eax]
test cl, cl
je 0x40f9a2
mov byte [eax], cl
inc eax
dec esi
jne 0x40f993
jmp 0x40f9a6
test esi, esi
jne 0x40f9a7
dec eax
mov byte [eax], 0
lea eax, [esp + 0x10]
push eax
call fcn.0040f620
add esp, 4
test eax, eax
je 0x40f9c0
mov ebp, 1
add ebx, 4
cmp ebx, str..Upack
jb 0x40f983
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x104
ret