joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41ccd4
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push 0x294
mov eax, 0x45d0a0
call fcn.00440136
mov edi, dword [ebp + 8]
push 7
pop esi
mov dword [ebp - 0x2a0], ecx
xor ebx, ebx
push ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 0x299], 0
mov dword [ebp - 0x14], esi
call fcn.0040171f
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], ebx
mov dword [ebp - 0x30], esi
call fcn.0040171f
or esi, 0xffffffff
push esi
push ebx
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.00401480
push str..
lea ecx, [ebp - 0x48]
call fcn.004013bd
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x41cd3e
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x298]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
cmp ebx, esi
je 0x41ce98
cmp word [ebp - 0x26c], 0x2e
je 0x41ce1c
push esi
push 0
lea ecx, [ebp - 0x2c]
call fcn.0040169f
push esi
push 0
push edi
lea ecx, [ebp - 0x2c]
call fcn.00401480
push 0x462a20
lea ecx, [ebp - 0x2c]
call fcn.004013bd
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004013bd
test byte [ebp - 0x298], 0x10
je 0x41cde9
cmp byte [ebp + 0xc], 0
je 0x41cde0
push dword [ebp + 0xc]
mov ecx, dword [ebp - 0x2a0]
lea eax, [ebp - 0x2c]
push eax
call fcn.0041ccd4
test eax, eax
je 0x41ce1c
mov esi, eax
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.00401537
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401537
mov eax, esi
call fcn.004401b9
ret 8
mov byte [ebp - 0x299], 1
jmp 0x41ce1c
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41cdf5
lea eax, [ebp - 0x28]
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x41ce61
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x41ce11
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41ce61
lea eax, [ebp - 0x298]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x41cd56
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0x12
jne 0x41cdbc
cmp byte [ebp - 0x299], 0
jne 0x41ce98
cmp dword [edi + 0x18], 8
lea esi, [edi + 4]
jb 0x41ce6c
mov eax, dword [esi]
jmp 0x41ce6e
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41cdbc
mov eax, esi
push 0x80
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jne 0x41ce85
call ebx
jmp 0x41cdbc
cmp dword [edi + 0x18], 8
jb 0x41ce8d
mov esi, dword [esi]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x41ce7e
xor esi, esi
jmp 0x41cdbe
Function at 0x41dc14
Capabilities:
Delete file

Disassembly:
push ebp
sub esp, 0x80
lea ebp, [esp - 4]
mov eax, dword [0x47cbc0]
xor eax, ebp
mov dword [ebp + 0x80], eax
push 0x3c
mov eax, 0x45d42d
call fcn.004400cd
xor ebx, ebx
mov dword [ebp - 4], ebx
push 7
pop esi
push ebx
lea ecx, [ebp + 0x64]
mov dword [ebp + 0x7c], esi
call fcn.0040171f
push ebx
lea ecx, [ebp + 0x48]
mov dword [ebp + 0x60], esi
call fcn.0040171f
push dword [0x462734]
mov esi, 0x47e098
push esi
mov byte [ebp - 4], 3
call fcn.00401926
mov ecx, eax
call fcn.0041c2d6
xor edi, edi
inc edi
test al, al
je 0x41dcc2
push str.RsrcMgr::cleanSfx:
lea ecx, [ebp - 0x48]
call fcn.0041ee2f
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.0041f062
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x48]
mov byte [ebp - 4], 5
call fcn.00401480
push ebx
push edi
lea ecx, [ebp - 0x28]
call fcn.00401537
push ebx
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 3
call fcn.00401537
push edi
push dword [0x462734]
lea eax, [ebp + 0x48]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x2c], esp
push eax
call fcn.0040138d
push esi
mov byte [ebp - 4], 6
call fcn.00401926
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 3
call fcn.0041c3c6
mov eax, dword [ebp + 0xbc]
dec eax
push eax
lea ecx, [ebp + 0xa8]
mov byte [ebp - 4], 7
call fcn.0041cb49
cmp word [eax], 0x5c
je 0x41dd1e
push 0x462a20
lea ecx, [ebp + 0xa8]
call fcn.004013bd
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0xa8]
push eax
lea ecx, [ebp + 0x64]
call fcn.00401582
push 0xffffffffffffffff
push ebx
lea eax, [ebp + 0x8c]
push eax
lea ecx, [ebp + 0x64]
call fcn.00401582
cmp dword [ebp + 0x7c], 8
mov eax, dword [ebp + 0x68]
jae 0x41dd4e
lea eax, [ebp + 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x41dda6
cmp byte [ebp + 0x3c], bl
je 0x41ddeb
push str.Error:_Unable_to_remove_SFX_from_temp_directory
lea ecx, [ebp - 0x48]
call fcn.0041ee2f
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 8
call fcn.0041f062
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 9
call fcn.0041c485
push ebx
push edi
lea ecx, [ebp - 0x28]
call fcn.00401537
push ebx
push edi
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 7
call fcn.00401537
cmp byte [ebp + 0x3c], bl
je 0x41ddeb
push str.SFX_cleaning_completed_successfully_
lea ecx, [ebp - 0x48]
call fcn.0041ee2f
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.0041f062
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp]
mov byte [ebp - 4], 0xb
call fcn.0041c485
push ebx
push edi
lea ecx, [ebp - 0x28]
call fcn.00401537
push ebx
push edi
lea ecx, [ebp - 0x48]
call fcn.00401537
lea ecx, [ebp]
mov byte [ebp - 4], 3
call fcn.0041b10c
push ebx
push edi
lea ecx, [ebp + 0x48]
call fcn.00401537
push ebx
push edi
lea ecx, [ebp + 0x64]
call fcn.00401537
push ebx
push edi
lea ecx, [ebp + 0x8c]
call fcn.00401537
push ebx
push edi
lea ecx, [ebp + 0xa8]
call fcn.00401537
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.0043f432
add ebp, 0x84
leave
ret 0x38
Function at 0x41e33f
Capabilities:
Enumerate files on windows

Disassembly:
push 0x2ac
mov eax, 0x45d4f5
call fcn.00440136
mov ebx, dword [ebp + 8]
push 7
pop esi
mov dword [ebp - 0x2a0], ecx
xor edi, edi
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], esi
call fcn.0040171f
push edi
lea ecx, [ebp - 0x48]
mov dword [ebp - 4], edi
mov dword [ebp - 0x30], esi
call fcn.0040171f
lea ecx, [ebp - 0x2b8]
mov byte [ebp - 4], 1
call fcn.0041de4c
or esi, 0xffffffff
push esi
push edi
push ebx
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.00401480
push str..
lea ecx, [ebp - 0x48]
call fcn.004013bd
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x41e3b1
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x298]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x29c], eax
cmp eax, esi
je 0x41e448
cmp word [ebp - 0x26c], 0x2e
je 0x41e430
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040169f
push esi
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.00401480
push 0x462a20
lea ecx, [ebp - 0x2c]
call fcn.004013bd
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004013bd
test byte [ebp - 0x298], 0x10
je 0x41e430
push 4
push edi
push str.FUU_
lea ecx, [ebp - 0x2c]
call fcn.00416670
cmp eax, esi
je 0x41e430
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x2b8]
call fcn.0041e2e5
lea eax, [ebp - 0x298]
push eax
push dword [ebp - 0x29c]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, 1
je 0x41e3c9
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x2ac]
push 0x1c
cdq
pop ecx
idiv ecx
xor esi, esi
test eax, eax
je 0x41e491
push 1
push esi
lea ecx, [ebp - 0x2b8]
call fcn.00407a30
mov ecx, dword [ebp - 0x2a0]
push eax
call fcn.0041ccd4
mov eax, dword [ebp - 0x2a8]
sub eax, dword [ebp - 0x2ac]
push 0x1c
cdq
pop ecx
idiv ecx
inc esi
cmp esi, eax
jne 0x41e460
lea ecx, [ebp - 0x2b8]
call fcn.0041df64
push dword [ebp - 0x2b8]
call fcn.00422a4d
pop ecx
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.00401537
push edi
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401537
xor eax, eax
call fcn.004401b9
ret 4
Function at 0x425d72
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
xor ebx, ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], ebx
je 0x425dba
call fcn.004257fc
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x425dba
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0x425dfd
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov esi, dword [ebp + 8]
mov dword [ebp + 0xc], 1
test ebx, ebx
je 0x425de6
push dword [ebp + 0x10]
mov eax, dword [edi]
push ebx
push esi
mov ecx, edi
call dword [eax + 0x20]
cmp dword [ebp - 4], 0
mov dword [ebp + 0xc], eax
je 0x425de6
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FreeResource]
cmp dword [esi + 0x4c], 0
je 0x425dfa
mov ecx, dword [esi + 0x4c]
push dword [ebp + 0x10]
mov eax, dword [ecx]
call dword [eax + 0xa0]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x4283d2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x4283f6
cmp dword [edi + 0x54], 0
jne 0x4283f6
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.004257fc
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.00428393
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x428bb5
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x45e7ad
call fcn.004400cd
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x428bda
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x428c20
lea ecx, [ebp - 0x10]
call fcn.00409a60
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00423819
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.00409a20
mov eax, esi
call fcn.004401a5
ret 8
Function at 0x42f3f3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x42f43a
call fcn.004257fc
mov esi, dword [eax + 0xc]
push pe_nt_image_headers32
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x42f43a
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x42f456
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0042ef6b
mov esi, eax
test edi, edi
je 0x42f454
test ebx, ebx
je 0x42f454
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x43f432
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47cbc0]
jne 0x43f43c
repz ret
jmp fcn.004457c3

Function at 0x4508c5
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00445d0f
and dword [ebp - 4], 0
cmp dword [0x4811c0], 0
mov ebx, eax
jne 0x450976
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x450a27
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x450a27
push eax
call fcn.00445c9d
mov dword [esp], 0x4690f0
push edi
mov dword [0x4811c0], eax
call esi
push eax
call fcn.00445c9d
mov dword [esp], 0x4690dc
push edi
mov dword [0x4811c4], eax
call esi
push eax
call fcn.00445c9d
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x4811c8], eax
call esi
push eax
call fcn.00445c9d
pop ecx
mov dword [0x4811d0], eax
test eax, eax
je 0x450976
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00445c9d
pop ecx
mov dword [0x4811cc], eax
mov eax, dword [0x4811cc]
cmp eax, ebx
je 0x4509ce
cmp dword [0x4811d0], ebx
je 0x4509ce
push eax
call fcn.00445d18
push dword [0x4811d0]
mov esi, eax
call fcn.00445d18
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4509ce
test edi, edi
je 0x4509ce
call esi
test eax, eax
je 0x4509c5
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4509c5
test byte [ebp - 0xc], 1
jne 0x4509ce
or dword [ebp + 0x10], 0x200000
jmp 0x450a07
mov eax, dword [0x4811c4]
cmp eax, ebx
je 0x450a07
push eax
call fcn.00445d18
pop ecx
test eax, eax
je 0x450a07
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x450a07
mov eax, dword [0x4811c8]
cmp eax, ebx
je 0x450a07
push eax
call fcn.00445d18
pop ecx
test eax, eax
je 0x450a07
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4811c0]
call fcn.00445d18
pop ecx
test eax, eax
je 0x450a27
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x450a29
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x459f23
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x45f592
call fcn.00440136
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x45a035
cmp byte [esi + 0x42], bl
je 0x45a035
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x459f5f
xor al, al
jmp 0x45a037
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00418019
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004178f5
mov ecx, eax
call fcn.00415a41
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004178f5
mov ecx, eax
call fcn.00415a41
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x459fcf
dec eax
je 0x459fd3
dec eax
dec eax
je 0x45a031
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.004090e0
mov al, bl
jmp 0x45a037
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004178f5
mov ecx, eax
call fcn.00415a41
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x45a013
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.004178f5
mov ecx, eax
call fcn.00415a41
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.00440f2f
add esp, 0x10
cmp edi, eax
jne 0x459fbd
cmp byte [esi + 0x42], 0
je 0x45a031
test edi, edi
jne 0x459f6d
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00417c86
jmp 0x459f6d
mov bl, 1
jmp 0x459fbf
mov al, 1
call fcn.004401b9
ret
Function at 0x45a9f9
Capabilities:
Set registry value

Disassembly:
push 0x13c
mov eax, 0x45f6eb
call fcn.00440136
mov esi, dword [ebp + 8]
xor ebx, ebx
mov ecx, esi
mov dword [ebp - 4], ebx
call fcn.00420ce1
xor edi, edi
cmp eax, ebx
mov dword [ebp - 0x144], eax
jle 0x45ac4c
lea ecx, [ebp - 0x58]
call fcn.0042110d
lea eax, [ebp - 0x58]
push eax
push edi
mov ecx, esi
mov byte [ebp - 4], 1
call fcn.00420d7b
lea ecx, [ebp - 0x58]
call fcn.004218d0
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x58]
cmp eax, 1
je 0x45aa65
call fcn.0042135b
inc edi
cmp edi, dword [ebp - 0x144]
jl 0x45aa27
jmp 0x45ac4c
call fcn.0042135b
lea ecx, [ebp - 0x13c]
call fcn.0045ad35
sub esp, 0x1c
mov eax, esp
mov dword [ebp - 0x140], esp
push eax
mov ecx, esi
mov byte [ebp - 4], 2
call fcn.0042104c
lea ecx, [ebp - 0x13c]
call fcn.0045ac5d
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x140], esp
push str.DriverModelName
call fcn.0040136b
lea ecx, [ebp - 0x13c]
call fcn.0045b035
push ebx
lea ecx, [ebp - 0x2c]
mov esi, eax
mov dword [ebp - 0x14], 7
call fcn.0040171f
mov eax, dword [esi + 0x10]
sub eax, dword [esi + 0xc]
push 0x1c
cdq
pop ecx
idiv ecx
mov byte [ebp - 4], 3
test eax, eax
jne 0x45aaec
push 0x46b080
lea ecx, [ebp - 0x2c]
call fcn.00401513
jmp 0x45ab00
push ebx
mov ecx, esi
call fcn.00407a30
push 0xffffffffffffffff
push ebx
push eax
lea ecx, [ebp - 0x2c]
call fcn.00401480
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x45ab0c
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x148]
call fcn.00409470
push 0x46b3ac
push 0x46c604
lea ecx, [ebp - 0x148]
mov byte [ebp - 4], 4
call fcn.004073e0
mov eax, dword [ebp + 0xc]
mov eax, dword [eax - 0xc]
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x140], esp
push str.Vendor
lea edi, [eax + eax + 2]
call fcn.0040136b
lea ecx, [ebp - 0x13c]
call fcn.0045b035
mov ecx, eax
call fcn.00407a30
push eax
lea ecx, [ebp - 0x48]
call fcn.0040138d
mov byte [ebp - 4], 5
call fcn.00423e8f
push eax
lea ecx, [ebp - 0x140]
call fcn.004099f0
push str.Lexmark
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 6
call fcn.0041edbf
test eax, eax
jne 0x45ab9d
push str.SoftwareLexmarkInkjetFUU
jmp 0x45abb3
push str.Dell
lea ecx, [ebp - 0x48]
call fcn.0041edbf
test eax, eax
jne 0x45ac0c
push str.SoftwareDellInkjetFUU
lea ecx, [ebp - 0x140]
call fcn.00409530
mov esi, dword [ebp - 0x140]
push ebx
lea eax, [ebp - 0x144]
push eax
push ebx
push 2
push ebx
push ebx
push ebx
push esi
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x45ac07
push edi
push dword [ebp + 0xc]
push 1
push ebx
push dword [ebp - 0x148]
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0x144]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esi - 0x10]
jmp 0x45ac15
mov ecx, dword [ebp - 0x140]
add ecx, 0xfffffff0
call fcn.00409a20
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.00401537
mov ecx, dword [ebp - 0x148]
add ecx, 0xfffffff0
call fcn.00409a20
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401537
lea ecx, [ebp - 0x13c]
mov byte [ebp - 4], bl
call fcn.0045ae9a
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.00409a20
call fcn.004401b9
ret
Function at 0x45ae9a
Capabilities:
Get process heap flags

Disassembly:
push ebp
sub esp, 0x6c
lea ebp, [esp - 4]
mov eax, dword [0x47cbc0]
xor eax, ebp
mov dword [ebp + 0x6c], eax
push 0x38
mov eax, 0x45f7cf
call fcn.004400cd
mov esi, ecx
mov dword [ebp + 4], esi
xor ebx, ebx
mov dword [ebp - 4], ebx
push ebx
lea ecx, [ebp + 0x50]
mov dword [ebp + 0x68], 7
call fcn.0040171f
push dword [0x462734]
mov edi, 0x47e098
push edi
mov byte [ebp - 4], 9
call fcn.00401926
mov ecx, eax
call fcn.0041c2d6
test al, al
je 0x45af3b
push str.CIniReader::CIniReader:
lea ecx, [ebp - 0x44]
call fcn.0041ee2f
lea ecx, [ebp - 0x28]
push ecx
mov ecx, eax
mov byte [ebp - 4], 0xa
call fcn.0041f062
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp + 0x50]
mov byte [ebp - 4], 0xb
call fcn.00401480
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00401537
push ebx
push 1
lea ecx, [ebp - 0x44]
mov byte [ebp - 4], 9
call fcn.00401537
push 1
push dword [0x462734]
lea eax, [ebp + 0x50]
sub esp, 0x1c
mov ecx, esp
mov dword [ebp], esp
push eax
call fcn.0040138d
push edi
mov byte [ebp - 4], 0xc
call fcn.00401926
push eax
lea ecx, [ebp + 8]
mov byte [ebp - 4], 9
call fcn.0041c3c6
lea ecx, [ebp + 8]
call fcn.0041b10c
push ebx
push 1
lea ecx, [ebp + 0x50]
call fcn.00401537
push ebx
push 1
lea ecx, [esi + 0xc8]
call fcn.00401537
push ebx
push 1
lea ecx, [esi + 0xa8]
call fcn.00401537
lea edi, [esi + 0x90]
mov ecx, edi
call fcn.0041df64
push dword [edi]
call fcn.00422a4d
pop ecx
lea edi, [esi + 0x78]
mov ecx, edi
call fcn.0041df64
push dword [edi]
call fcn.00422a4d
pop ecx
lea edi, [esi + 0x60]
mov ecx, edi
call fcn.0041df64
push dword [edi]
call fcn.00422a4d
pop ecx
lea edi, [esi + 0x48]
mov ecx, edi
call fcn.0041df64
push dword [edi]
call fcn.00422a4d
pop ecx
lea edi, [esi + 0x30]
mov ecx, edi
call fcn.0041df64
push dword [edi]
call fcn.00422a4d
pop ecx
lea edi, [esi + 0x18]
mov ecx, edi
call fcn.0041df64
push dword [edi]
call fcn.00422a4d
pop ecx
mov ecx, esi
call fcn.0041df64
push dword [esi]
call fcn.00422a4d
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x6c]
xor ecx, ebp
call fcn.0043f432
add ebp, 0x70
leave
ret
Function at 0x4016bf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
add eax, eax
mov dword [edi], ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 4]
push eax
push ebx
push str.LocalService
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40172a
cmp dword [ebp - 4], 1
je 0x4016ff
cmp dword [ebp - 4], 2
jne 0x40171a
mov ecx, dword [ebp - 8]
test esi, esi
je 0x401724
test ecx, ecx
je 0x40171f
test cl, 1
jne 0x40171a
mov eax, ecx
shr eax, 1
cmp word [esi + eax*2 - 2], bx
je 0x401724
push 0xd
pop eax
jmp 0x40172a
xor eax, eax
mov word [esi], ax
shr ecx, 1
xor eax, eax
mov dword [edi], ecx
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x402758
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax + 0x56]
push dword [ebp + 8]
call fcn.00402312
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.0040235d
push eax
push esi
push dword [ebp + 8]
call fcn.00402312
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.0040234d
cwde
mov cs, word [edx + 0x7c9d8877]
invalid

Function at 0x4045e3
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0xc], ecx
push esi
push 0x80
push 1
push esi
push 1
push 0x40000000
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404697
mov eax, 0x100000
mov dword [ebp - 8], esi
push eax
mov dword [ebp - 4], eax
mov edi, esi
call fcn.0040d559
pop ecx
mov esi, eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 4]
push esi
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x404687
cmp dword [ebp - 8], 0
jbe 0x404687
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push 0
push eax
push dword [ebp - 8]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x404667
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
and dword [ebp - 8], 0
mov eax, 0x100000
mov dword [ebp - 4], eax
test esi, esi
je 0x404683
push eax
push 0
push esi
call fcn.004095e0
add esp, 0xc
test edi, edi
je 0x404629
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call fcn.0040d414
pop ecx
jmp 0x40469f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x404823
Capabilities:
Get common file path

Disassembly:
push 0x41c
mov eax, 0x41a46b
call fcn.004198de
mov esi, dword [ebp + 8]
push 1
push dword [ebp + 0xc]
call fcn.00404298
pop ecx
pop ecx
lea ecx, [ebp - 0x424]
call fcn.00406594
lea eax, [ebp - 0x425]
xor ebx, ebx
push eax
push dword [ebp + 0xc]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x424]
push esi
mov byte [ebp - 0x425], bl
call fcn.0040692b
push 0x208
lea eax, [ebp - 0x218]
push ebx
push eax
call fcn.004095e0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x2b
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x4048bc
push str.AdobeARM1.0Temp
mov edx, 0x104
lea ecx, [ebp - 0x218]
call fcn.00403aa0
test eax, eax
js 0x4048bc
lea ecx, [ebp - 0x218]
call fcn.004046a6
call fcn.00419888
ret