joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431f02
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
push ebx
push esi
push edi
push 1
pop ebx
mov esi, ecx
mov byte [ebp - 1], bl
push dword [esi]
lea eax, [ebp - 0x14]
push 4
push ebx
push eax
call fcn.00437221
add esp, 0x10
lea eax, [ebp - 0x14]
mov ecx, esi
push 0x16fa
push 4
push eax
call fcn.00431bf2
and byte [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push 0x49c018
push eax
call fcn.004373e0
pop ecx
test eax, eax
pop ecx
jne 0x432033
push dword [esi]
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00437221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29bc
lea eax, [ebp - 0x11c]
push edi
push ebx
push eax
call fcn.00437221
add esp, 0x20
lea eax, [edi + 0xa25e]
mov ecx, esi
push eax
lea eax, [ebp - 0x11c]
push edi
push eax
call fcn.00431bf2
push dword [esi]
and byte [ebp + edi - 0x11c], 0
lea eax, [ebp - 0xc]
push ebx
push 4
push eax
call fcn.00437221
mov edi, dword [ebp - 0xc]
push dword [esi]
xor edi, 0x29ac
push edi
push ebx
push dword [ebp + 0xc]
call fcn.00437221
add esp, 0x20
lea eax, [edi + 0xf25e]
mov ecx, esi
push eax
push edi
push dword [ebp + 0xc]
call fcn.00431bf2
mov eax, dword [ebp + 0xc]
push dword [ebp + 8]
and byte [edi + eax], 0
lea eax, [ebp - 0x11c]
push eax
call fcn.004373e0
pop ecx
test eax, eax
pop ecx
je 0x43204a
push ebx
push ebx
push dword [esi]
call fcn.004372c8
push dword [esi]
lea eax, [ebp - 8]
push ebx
push 4
push eax
call fcn.00437221
xor dword [ebp - 8], 0x45aa
push ebx
push 4
push dword [esi]
call fcn.004372c8
push ebx
push 0x10
push dword [esi]
call fcn.004372c8
push ebx
push dword [ebp - 8]
push dword [esi]
call fcn.004372c8
add esp, 0x40
jmp 0x432037
and byte [ebp - 1], 0
cmp byte [ebp - 1], bl
je 0x431f16
push 6
pop eax
pop edi
pop esi
pop ebx
leave
ret 8
xor eax, eax
jmp 0x432043

Function at 0x43208e
Capabilities:
Hash data using crc32b

Disassembly:
mov eax, ecx
push esi
push edi
mov edi, eax
or dword [eax + 0x400], 0xffffffff
xor esi, esi
mov edx, esi
push 8
shl edx, 0x18
pop ecx
test edx, 0x80000000
je 0x4320b7
add edx, edx
xor edx, 0x4c11db7
jmp 0x4320b9
shl edx, 1
dec ecx
jne 0x4320a5
mov dword [edi], edx
inc esi
add edi, 4
cmp esi, 0x100
jl 0x43209d
pop edi
pop esi
ret

Function at 0x432241
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
cmp dword [esi + 0x14], 1
jne 0x432266
mov eax, dword [esi + 0xc]
push 8
add eax, dword [esi + 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.00437470
add esp, 0xc
jmp 0x432279
push dword [esi + 0x1c]
lea eax, [ebp - 8]
push 8
push 1
push eax
call fcn.00437221
add esp, 0x10
movzx eax, byte [ebp - 4]
movzx ecx, byte [ebp - 3]
shl eax, 8
or eax, ecx
add dword [esi + 0xc], 8
movzx ecx, byte [ebp - 2]
shl eax, 8
or eax, ecx
and byte [ebp - 4], 0
movzx ecx, byte [ebp - 1]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 8]
push 0x49c020
mov dword [ecx], eax
lea eax, [ebp - 8]
push eax
call fcn.004373e0
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
pop esi
leave
ret 4
Function at 0x46b6d0
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, 0x2f00
call 0x4ec480
mov al, byte [0x4a14e1]
or al, byte [0x4a14e0]
push ebx
push ebp
push esi
push edi
mov byte [esp + 0x2c], al
jne 0x46b706
push 0
push 0
call fcn.0046c230
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f00
ret
mov ebp, dword [0x4a14d8]
xor esi, esi
cmp ebp, esi
jne 0x46b877
push 0x12000
call 0x4dbd59
add esp, 4
mov dword [0x4a14d8], eax
cmp eax, esi
je 0x46b867
push 0x24000
call 0x4dbd59
add esp, 4
mov dword [0x4a14dc], eax
cmp eax, esi
je 0x46b867
push 0x20000
call 0x4dbd59
add esp, 4
mov dword [0x4a14cc], eax
cmp eax, esi
je 0x46b867
push 0x40000
call 0x4dbd59
add esp, 4
mov dword [0x4a14d0], eax
cmp eax, esi
je 0x46b867
push 0x7d0
call 0x4dbd59
add esp, 4
mov dword [0x4a14d4], eax
cmp eax, esi
je 0x46b867
mov ebp, dword [0x4a14d8]
push 0x12000
push esi
push ebp
call 0x4e52e0
mov ebx, dword [0x4a14dc]
add esp, 0xc
push 0x24000
push esi
push ebx
call 0x4e52e0
mov byte [ebp + 0x1324], 3
mov byte [ebp + 0xb644], 1
mov byte [ebp + 0xb764], 2
mov byte [ebp + 0x1444], 0xc
mov byte [ebp + 0xb884], 4
mov byte [ebp + 0xb9a4], 8
mov byte [ebp + 0x1204], 0x30
call fcn.0046c900
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2f00
ret
mov ebx, dword [0x4a14dc]

Function at 0x475710
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov eax, dword [esp + 4]
mov dword [0x49f988], eax
mov edx, 1
mov eax, 0x49f988
push edi
mov ecx, dword [eax]
mov edi, ecx
shr edi, 0x1e
xor edi, ecx
imul edi, edi, 0x6c078965
add edi, edx
mov dword [eax + 4], edi
add eax, 4
inc edx
cmp eax, 0x4a0344
jl 0x475724
mov dword [0x49d318], 1
mov dword [0x4a2504], 1
pop edi
ret
Function at 0x47e640
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov al, byte [0x49d350]
push ebp
mov ebp, dword [esp + 0x24]
push esi
push edi
mov byte [esp + 0xc], 0x20
mov byte [esp + 0xd], al
mov dword [esp + 0xe], 0x3e3c0928
mov dword [esp + 0x12], 0x2d2b3d3a
mov dword [esp + 0x16], 0x7e212f2a
mov dword [esp + 0x1a], 0x5b5e7c26
mov word [esp + 0x1e], 0x3f2e
mov byte [esp + 0x20], 0
mov edi, ebp
test ebp, ebp
je 0x47e6ab
mov dl, byte [ebp]
test dl, dl
je 0x47e6ab
lea ecx, [esp + 0xc]
mov al, 0x20
cmp dl, al
je 0x47e6fe
mov al, byte [ecx + 1]
inc ecx
test al, al
jne 0x47e697
mov dl, byte [edi + 1]
inc edi
test dl, dl
jne 0x47e691
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x47e6b0
sub eax, edx
lea edi, [eax + ebp - 1]
cmp edi, ebp
jbe 0x47e6d0
mov al, byte [edi]
cmp al, 0x20
je 0x47e6cb
cmp al, 9
jne 0x47e6d0
dec edi
cmp edi, ebp
ja 0x47e6c1
mov esi, edi
sub esi, ebp
inc esi
cmp esi, 0xfd
jbe 0x47e705
cmp byte [esp + 0x30], 0
je 0x47e6f3
mov ecx, dword [esp + 0x28]
push ebp
push 0x492298
call 0x48d900
xor eax, eax
pop edi
pop esi
pop ebp
add esp, 0x18
ret 0xc
cmp edi, ebp
jbe 0x47e6d0
dec edi
jmp 0x47e6bd
push esi
push ebp
push ebx
call 0x4de8e0
add esp, 0xc
mov eax, edi
pop edi
mov byte [esi + ebx], 0
pop esi
pop ebp
add esp, 0x18
ret 0xc
Function at 0x10002d20
Capabilities:
Get file version info

Disassembly:
sub esp, 0x218
mov eax, dword [esp + 0x220]
push ebx
push ebp
xor ebx, ebx
push esi
push edi
test eax, eax
mov dword [esp + 0x1c], 0x34
mov dword [esp + 0x14], 1
jne 0x10002d82
lea eax, [esp + 0x124]
push eax
call fcn.10003350
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x10002ef5
lea ecx, [esp + 0x124]
push str.outlook.exe
push ecx
lea edx, [esp + 0x28]
push str._s_s
push edx
call fcn.10005dd0
add esp, 0x10
jmp 0x10002d99
push str.outlook.exe
lea eax, [esp + 0x24]
push 0x1000dbb4
push eax
call fcn.10005dd0
add esp, 0xc
push 0
push pe_nt_image_headers32
push 3
push 0
push 0
lea ecx, [esp + 0x34]
push 0x80000000
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x10002dcb
mov eax, 0xe0001000
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
push eax
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x10002dfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov ebx, eax
jmp 0x10002eeb
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, eax
push edi
push 8
push ebp
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x10002e21
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10002eeb
push esi
push edi
lea ecx, [esp + 0x28]
push 0
push ecx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x10002e40
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10002eeb
lea edx, [esp + 0x1c]
lea eax, [esp + 0x18]
push edx
push eax
push 0x1000dbb0
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x10002e66
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x10002eeb
mov ecx, dword [esp + 0x18]
xor eax, eax
mov ax, word [ecx + 8]
mov ecx, dword [ecx + 8]
shr ecx, 0x10
cmp ecx, 8
jne case.default.0x10002e80
cmp eax, 5
ja case.default.0x10002e80
jmp dword [eax*4 + 0x10002f04]
mov edx, dword [esp + 0x22c]
mov dword [edx], 0x50
jmp 0x10002eeb
mov eax, dword [esp + 0x22c]
mov dword [eax], 0x51
jmp 0x10002eeb
mov ecx, dword [esp + 0x22c]
mov dword [ecx], 0x52
jmp 0x10002eeb
mov edx, dword [esp + 0x22c]
mov dword [edx], 0x53
jmp 0x10002eeb
lea eax, [esp + 0x14]
push eax
call fcn.100042c0
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x230]
add esp, 4
neg ecx
sbb ecx, ecx
add ecx, 0x56
mov dword [edx], ecx
jmp 0x10002eeb
mov ebx, 0xe0001000
push esi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x218
ret
Function at 0x10003000
Capabilities:
Get common file path
Get file version info

Disassembly:
sub esp, 0x214
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x120]
push 0x104
push eax
xor ebx, ebx
mov dword [esp + 0x18], 0x34
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10003075
mov eax, dword [esp + 0x22c]
test eax, eax
mov eax, str.mapi32x.dll
jne 0x10003040
mov eax, str.mapi32.dll
push eax
lea ecx, [esp + 0x124]
push str.system
push ecx
lea edx, [esp + 0x28]
push 0x1000dc9c
push edx
call fcn.10005dd0
add esp, 0x14
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov esi, eax
test esi, esi
jne 0x1000308a
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, dword [esp + 0x10]
mov edi, dword [esp + 0x10]
mov ebx, eax
jmp 0x100031ad
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebp, eax
push esi
push 8
push ebp
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
jne 0x100030af
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100031ad
push edi
push esi
lea edx, [esp + 0x24]
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x100030ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100031ad
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
push 0x1000dbb0
push edi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x100030f4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
jmp 0x100031ad
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx + 0xc]
shr eax, 0x10
cmp eax, 0x3e1
jg 0x1000312f
je 0x10003120
cmp eax, 0x345
jne 0x1000318a
mov edx, dword [esp + 0x228]
mov dword [edx], 0x28
jmp 0x100031ad
mov eax, dword [esp + 0x228]
mov dword [eax], 0x29
jmp 0x100031ad
cmp eax, 0x5b1
jg 0x1000317e
je 0x1000316f
sub eax, 0x3e2
je 0x10003151
dec eax
jne 0x1000318a
mov ecx, dword [esp + 0x228]
mov dword [ecx], 0x2c
jmp 0x100031ad
mov dx, word [ecx + 0xc]
mov eax, dword [esp + 0x228]
sub dx, 0x19
neg dx
sbb edx, edx
and edx, 2
add edx, 0x29
mov dword [eax], edx
jmp 0x100031ad
mov ecx, dword [esp + 0x228]
mov dword [ecx], 0x32
jmp 0x100031ad
sub eax, 0x5b2
je 0x100031a0
sub eax, 2
je 0x10003191
mov ebx, 0xe0001000
jmp 0x100031ad
mov edx, dword [esp + 0x228]
mov dword [edx], 0x34
jmp 0x100031ad
mov eax, dword [esp + 0x228]
mov dword [eax], 0x33
push edi
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
pop edi
test ebx, ebx
pop esi
pop ebp
sete al
pop ebx
add esp, 0x214
ret
Function at 0x100031d0
Capabilities:
Get common file path
Get file version info

Disassembly:
sub esp, 0x214
lea eax, [esp + 0x110]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000323d
mov eax, dword [esp + 0x22c]
test eax, eax
mov eax, str.mapi32x.dll
jne 0x10003208
mov eax, str.mapi32.dll
push eax
lea ecx, [esp + 0x124]
push str.system
push ecx
lea edx, [esp + 0x28]
push 0x1000dc9c
push edx
call fcn.10005dd0
add esp, 0x14
lea eax, [esp + 0x18]
lea ecx, [esp + 0x1c]
push eax
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeA
mov edi, eax
test edi, edi
jne 0x1000324f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x10]
mov ebp, eax
jmp 0x100032bd
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, eax
push edi
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
jne 0x10003271
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x100032bd
push esi
push edi
lea edx, [esp + 0x24]
push 0
push edx
call sub.VERSION.dll_GetFileVersionInfoA
test eax, eax
jne 0x1000328d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
jmp 0x100032bd
lea eax, [esp + 0x14]
lea ecx, [esp + 0x10]
push eax
push ecx
push str.VarFileInfoTranslation
push esi
call sub.VERSION.dll_VerQueryValueA
test eax, eax
jne 0x100032ae
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 0x228]
mov eax, dword [edx]
mov dword [ecx], eax
push esi
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_HeapFree]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x214
ret

Function at 0x10003350
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
push esi
lea eax, [esp + 4]
push edi
push eax
push 1
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Pathsoutlook.EXE
push 0x80000002
mov dword [esp + 0x1c], 0
mov dword [esp + 0x24], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100033f2
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.Path
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 8]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x100033ca
mov eax, esi
pop edi
pop esi
add esp, 0x110
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x11c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
xor eax, eax
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x110
ret
Function at 0x10003740
Capabilities:
Get common file path

Disassembly:
sub esp, 0x208
push 0
push str.HKEY_LOCAL_MACHINESoftwareClassesCLSID00020D75_0000_0000_C000_000000000046
push str.Handled
push 5
call fcn.10001290
add esp, 0x10
push 0
push str.00020D75_0000_0000_C000_000000000046
push str.Handled
push 6
call fcn.10001290
add esp, 0x10
lea eax, [esp + 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10003817
push str.mapisrvr.exe
lea ecx, [esp + 0x108]
push str.system
push ecx
lea edx, [esp + 0xc]
push 0x1000dc9c
push edx
call fcn.10005dd0
add esp, 0x14
lea eax, [esp]
push 0
push eax
push str.Handled
push 1
call fcn.10001290
add esp, 0x10
lea ecx, [esp + 0x104]
lea edx, [esp]
push str.mapi32.dll
push str.system
push ecx
push 0x1000dc9c
push edx
call fcn.10005dd0
add esp, 0x14
lea eax, [esp]
push 0
push eax
push str.Handled
push 1
call fcn.10001290
add esp, 0x10
push 0
push str.MapiNotHandled
push str.Handled
push 5
call fcn.10001290
add esp, 0x10
xor eax, eax
add esp, 0x208
ret

Function at 0x10003990
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
sub esp, 0x514
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x100039b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
add esp, 0x514
ret
mov eax, dword [esp + 0x518]
test eax, eax
jle 0x10003ac8
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
mov esi, dword [esp + 0x524]
push ebp
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, eax
mov ecx, dword [esp + 0x52c]
cmp dword [ecx], 0
je 0x10003aba
mov edx, dword [esi]
lea eax, [esp + 0x10]
push edx
push str.system
push eax
lea ecx, [esp + 0x120]
push 0x1000dc9c
push ecx
call fcn.10005dd0
mov edx, dword [esi]
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x218]
push edx
push str.system32
push eax
push 0x1000dc9c
push ecx
call fcn.10005dd0
mov edx, dword [esi]
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x420]
push edx
push str.system
push eax
push 0x1000dc9c
push ecx
call fcn.10005dd0
add esp, 0x14
lea edx, [esp + 0x218]
lea eax, [esp + 0x114]
push 0
push edx
push eax
call edi
test eax, eax
jne 0x10003aac
lea ecx, [esp + 0x218]
lea edx, [esp + 0x114]
push ecx
push edx
lea eax, [esp + 0x324]
push str.Copy_file_from__s_to__s_fails_
push eax
call fcn.10005dd0
add esp, 0x10
call ebx
push eax
lea ecx, [esp + 0x320]
push str.Copy_file_fails_with_error_code__d
push ecx
call fcn.10005dd0
add esp, 0xc
jmp 0x10003aba
lea edx, [esp + 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esi, 4
dec ebp
jne 0x100039df
pop ebx
pop ebp
pop esi
pop edi
xor eax, eax
add esp, 0x514
ret
Function at 0x100040a0
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x100040e7
lea ecx, [esp]
push str.extend.dat
push ecx
lea edx, [esp + 0x10c]
push 0x1000d914
push edx
call fcn.10005dd0
add esp, 0x10
lea eax, [esp + 0x104]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x208
ret

Function at 0x100040f0
Capabilities:
Create process on windows
Get common file path

Disassembly:
sub esp, 0x30c
lea eax, [esp + 0x104]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x10004176
mov eax, dword [esp + 0x310]
test eax, eax
mov eax, 0x1000de88
jne 0x10004122
mov eax, 0x1000de84
lea ecx, [esp + 0x104]
push str.forms_frmcache
push ecx
push eax
lea edx, [esp + 0x214]
push str._s_s_s
push edx
call fcn.10005dd0
add esp, 0x14
lea eax, [esp]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
lea ecx, [esp]
push 0
lea edx, [esp + 0x20c]
push ecx
push edx
push str.mkntfrmcache.exe
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
add esp, 0x30c
ret

Function at 0x100041d0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
push ebx
push esi
lea eax, [esp + 8]
push edi
push eax
push 3
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallMsExchng
push 0x80000002
mov dword [esp + 0x20], 0
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x100042aa
lea ecx, [esp + 0x10]
lea edx, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push edx
push eax
push 0
push str.UninstallString
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov esi, eax
test esi, esi
jne 0x100042a8
lea edx, [esp + 0x18]
push str.WIN95
push edx
call fcn.10005e70
add esp, 8
test eax, eax
je 0x100042a8
mov byte [eax], 0
mov edi, str.WINNTI386_setup.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x18]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x18]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x18]
push ecx
mov ecx, dword [esp + 0x10]
push eax
push 1
push 0
push str.UninstallString
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x110
ret
Function at 0x100042c0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
mov eax, 4
mov dword [esp], 0
mov dword [esp + 8], eax
mov dword [esp + 4], eax
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWAREMicrosoftOffice8.0OutlookSetup
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004316
mov edx, dword [esp + 0x10]
lea ecx, [esp + 4]
push ecx
mov ecx, dword [esp + 4]
lea eax, [esp + 0xc]
push edx
push eax
push 0
push str.MailSupport
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0xc
ret

Function at 0x100043c0
Capabilities:
Copy file
Delete file

Disassembly:
sub esp, 0x510
lea eax, [esp + 0x208]
push esi
push eax
call fcn.10003350
add esp, 4
test eax, eax
jne 0x10004525
push str.omint.dll
lea ecx, [esp + 8]
push 0x1000dbb4
push ecx
call fcn.10005dd0
add esp, 0xc
lea edx, [esp + 0x20c]
lea eax, [esp + 0x108]
push str.omint.dll
push edx
push str._s_s
push eax
call fcn.10005dd0
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x10
lea ecx, [esp + 0x108]
lea edx, [esp + 4]
push 0
push ecx
push edx
call esi
test eax, eax
je 0x10004481
push str.omipstnt.dll
lea ecx, [esp + 8]
push 0x1000dbb4
push ecx
call fcn.10005dd0
add esp, 0xc
lea edx, [esp + 0x20c]
lea eax, [esp + 0x108]
push str.omipstnt.dll
push edx
push str._s_s
push eax
call fcn.10005dd0
add esp, 0x10
lea ecx, [esp + 0x108]
lea edx, [esp + 4]
push 0
push ecx
push edx
call esi
test eax, eax
jne 0x100044c5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
lea eax, [esp + 0x108]
lea ecx, [esp + 4]
push eax
push ecx
lea edx, [esp + 0x318]
push str.Copy_file_from__s_to__s_fails_
push edx
call fcn.10005dd0
add esp, 0x10
lea eax, [esp + 0x310]
push 2
push eax
call dword [sym.imp.SETUPAPI.dll_SetupLogErrorA]
mov eax, esi
pop esi
add esp, 0x510
ret
lea ecx, [esp + 0x20c]
push str.omi9.dll
push ecx
lea edx, [esp + 0x418]
push str._s_s
push edx
call fcn.10005dd0
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
add esp, 0x10
lea eax, [esp + 0x410]
push eax
call esi
lea ecx, [esp + 0x20c]
push str.omipst9.dll
push ecx
lea edx, [esp + 0x418]
push str._s_s
push edx
call fcn.10005dd0
add esp, 0x10
lea eax, [esp + 0x410]
push eax
call esi
xor eax, eax
pop esi
add esp, 0x510
ret
Function at 0x10004530
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x110
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 3
push 0
push str.SOFTWAREClientsMailMicrosoft_Outlook
push 0x80000002
mov dword [esp + 0x24], 0
mov dword [esp + 0x2c], 1
mov dword [esp + 0x28], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1000469d
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
lea edx, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
push eax
push 0
push str.DllPath
push ecx
call ebp
test eax, eax
jne 0x1000469d
lea edx, [esp + 0x1c]
push str.OMI9.DLL
push edx
call fcn.10005e70
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
add esp, 8
test eax, eax
je 0x1000460d
mov byte [eax], 0
mov edi, str.OMINT.DLL
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.DllPath
push ecx
call ebx
lea edx, [esp + 0x14]
lea eax, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push 0
push str.DllPathEx
push edx
call ebp
mov esi, eax
test esi, esi
jne 0x1000469b
lea eax, [esp + 0x1c]
push str.OMI9.DLL
push eax
call fcn.10005e70
add esp, 8
test eax, eax
je 0x1000469b
mov byte [eax], 0
mov edi, str.OMINT.DLL
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x1c]
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x1c]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea eax, [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0x14]
push eax
push 1
push 0
push str.DllPathEx
push ecx
call ebx
mov esi, eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret