joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10273ae
Capabilities:
Modify service

Disassembly:
mov edi, edi
push ebx
push esi
push edi
push 0x100ec48
call fcn.010260df
pop ecx
push 2
xor esi, esi
push esi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
cmp edi, esi
jl 0x102745a
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
cmp ebx, esi
je 0x102744b
push 0xf01ff
push 0x100d818
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
cmp eax, esi
je 0x102742e
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push 2
push 0xffffffffffffffff
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
test eax, eax
je 0x1027426
call fcn.010271c3
mov edi, eax
cmp edi, esi
jge 0x1027442
push edi
push 0x100ebf8
jmp 0x102743b
push edi
push 0x100eba8
jmp 0x102743b
call fcn.01025f61
mov edi, eax
push edi
push 0x100d738
call fcn.010260df
pop ecx
pop ecx
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x1027467
call fcn.01025f61
mov edi, eax
push edi
push 0x100d6f0
jmp 0x1027460
push edi
push 0x100dea0
call fcn.010260df
pop ecx
pop ecx
call dword [sym.imp.ole32.dll_CoUninitialize]
push 0x100eb68
call fcn.010260df
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x1027a36
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x10350f8]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x100f338
call fcn.010260df
pop ecx
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1027b46
lea eax, [ebp - 0x20c]
push eax
push 0x100f30c
lea eax, [ebp - 0x414]
push esi
push eax
call fcn.01025754
add esp, 0x10
test eax, eax
jl 0x1027b3b
lea eax, [ebp - 0x20c]
push eax
push 0x100f2f8
lea eax, [ebp - 0x61c]
push esi
push eax
call fcn.01025754
add esp, 0x10
test eax, eax
jl 0x1027b3b
push edi
push 0x44
xor esi, esi
lea eax, [ebp - 0x670]
push esi
push eax
call sub.msvcrt.dll_memset
xor eax, eax
lea edi, [ebp - 0x62c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
lea eax, [ebp - 0x61c]
push eax
push esi
push 0x20
push esi
push esi
push esi
push 0x100f2cc
lea eax, [ebp - 0x414]
push eax
mov dword [ebp - 0x670], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
pop edi
test eax, eax
je 0x1027b34
push dword [ebp - 0x62c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x628]
call esi
push 0x100f238
jmp 0x1027b40
push 0x100f150
jmp 0x1027b40
push 0x100f098
call fcn.010260df
pop ecx
push 0x100f058
call fcn.010260df
pop ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0102b1ee
leave
ret
Function at 0x102b1ad
Capabilities:
Terminate process

Disassembly:
push 0x5c
push 0x1033138
call fcn.0102b834
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x20], ebx
mov edi, 0x10359d8
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x102af68
cmp eax, esi
jne 0x102af5b
xor esi, esi
inc esi
mov dword [ebp - 0x20], esi
jmp 0x102af6b
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x102af42
xor esi, esi
inc esi
mov eax, dword [0x10359d4]
cmp eax, esi
jne 0x102af7e
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x102afad
mov eax, dword [0x10359d4]
test eax, eax
jne 0x102afa7
mov dword [0x10359d4], esi
push 0x10013e8
push 0x10013dc
call fcn.0102aea1
pop ecx
pop ecx
test eax, eax
je 0x102afad
jmp 0x102b0d1
mov dword [0x103568c], esi
mov eax, dword [0x10359d4]
cmp eax, esi
jne 0x102afd1
push 0x10013d8
push 0x1001378
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10359d4], 2
cmp dword [ebp - 0x20], ebx
jne 0x102afde
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x10359e4], ebx
je 0x102afff
push 0x10359e4
call fcn.0102b7a9
pop ecx
test eax, eax
je 0x102afff
push ebx
push 2
push ebx
call dword [0x10359e4]
mov eax, dword [sym.imp.msvcrt.dll__wcmdln]
cmp dword [eax], ebx
je 0x102b0d1
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
movzx ecx, word [eax]
cmp cx, 0x20
ja 0x102b069
cmp cx, bx
je 0x102b024
cmp dword [ebp - 0x1c], ebx
jne 0x102b069
movzx ecx, word [eax]
cmp cx, bx
je 0x102b039
cmp cx, 0x20
ja 0x102b039
inc eax
inc eax
mov dword [ebp - 0x24], eax
jmp 0x102b024
test byte [ebp - 0x40], 1
je 0x102b045
movzx ecx, word [ebp - 0x3c]
jmp 0x102b048
push 0xa
pop ecx
push ecx
push eax
push ebx
push 0x1000000
call main
mov dword [0x1035688], eax
cmp dword [0x103567c], ebx
jne 0x102b0ae
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cx, 0x22
jne 0x102b07a
xor ecx, ecx
cmp dword [ebp - 0x1c], ebx
sete cl
mov dword [ebp - 0x1c], ecx
inc eax
inc eax
jmp 0x102b00e
cmp dword [0x103568c], ebx
jne 0x102b0bc
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1035688]
jmp 0x102b0dd
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0102b879
ret
call fcn.0102b957
jmp 0x102af05
Function at 0x102c594
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push 0x8e8
mov eax, 0x103172e
call fcn.0102b282
mov edx, ecx
mov edi, dword [edx + 8]
mov dword [ebp - 0x68c], edx
test edi, edi
je 0x102c7a6
mov eax, dword [edx + 0x14]
test eax, eax
je 0x102c7a6
lea esi, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x102c5c4
sub eax, esi
sar eax, 1
lea esi, [eax + 4]
mov eax, edi
lea ecx, [eax + 2]
mov bx, word [eax]
inc eax
inc eax
test bx, bx
jne 0x102c5da
sub eax, ecx
sar eax, 1
lea ecx, [eax + 1]
mov eax, ecx
sub eax, dword [edx + 0x18]
sub ecx, esi
sub eax, 4
push eax
push edi
mov ebx, 0x105
push ebx
lea eax, [ebp - 0x21c]
dec ecx
push eax
mov dword [ebp - 0x688], ecx
call fcn.0102be78
test eax, eax
jl 0x102c7ab
push 0x100a0f4
push ebx
lea eax, [ebp - 0x21c]
push eax
call fcn.0101cdf6
mov dword [ebp - 0x684], eax
test eax, eax
jl 0x102c7ab
lea eax, [ebp - 0x678]
push eax
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x680], eax
cmp eax, 0xffffffff
je 0x102c79e
push 0xa
lea ecx, [ebp - 0x6a4]
call fcn.0102bd26
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x6a4]
mov dword [ebp - 0x67c], eax
test eax, eax
je 0x102c6da
push dword [ebp - 0x67c]
lea ecx, [ebp - 0x6a4]
call fcn.0102bdbf
add eax, 0x14
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
lea ecx, [ebp - 0x6a4]
test eax, eax
jl 0x102c6bf
lea eax, [ebp - 0x67c]
push eax
call fcn.0102bd97
cmp dword [ebp - 0x67c], 0
jne 0x102c67c
jmp 0x102c6da
lea eax, [ebp - 0x678]
push eax
push dword [ebp - 0x67c]
call fcn.0102c553
cmp dword [ebp - 0x67c], 0
jne 0x102c6ec
lea eax, [ebp - 0x678]
push eax
lea ecx, [ebp - 0x6a4]
call fcn.0102c4f6
cmp dword [ebp - 0x69c], 9
jbe 0x102c75b
lea eax, [ebp - 0x8f4]
push eax
lea ecx, [ebp - 0x6a4]
call fcn.0102c4a5
push dword [ebp - 0x688]
mov esi, eax
mov eax, dword [ebp - 0x68c]
push dword [eax + 8]
lea eax, [ebp - 0x428]
push ebx
mov ecx, 0x94
lea edi, [ebp - 0x678]
push eax
rep movsd dword es:[edi], dword [esi]
call fcn.0102be78
test eax, eax
jl 0x102c75b
lea eax, [ebp - 0x64c]
push eax
push ebx
lea eax, [ebp - 0x428]
push eax
call fcn.0101cdf6
test eax, eax
jl 0x102c75b
lea eax, [ebp - 0x428]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x678]
push eax
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x102c66c
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 0x680]
call dword [sym.imp.KERNEL32.dll_FindClose]
lea ecx, [ebp - 0x6a4]
call fcn.0102bd4c
lea ecx, [ebp - 0x6a4]
call fcn.0102bd4c
mov eax, dword [ebp - 0x684]
jmp 0x102c7ab
mov eax, 0x80004003
call fcn.0102b314
ret
Function at 0x102ca9a
Capabilities:
Print debug messages
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1f5c
call fcn.0102b630
mov eax, dword [0x10350f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
push edi
mov edi, dword [ebp + 8]
cmp dword [ebp + 0x14], ebx
jne 0x102cac9
mov ebx, 0x80004003
jmp 0x102cc22
test byte [ebp + 0xc], 0x10
jne 0x102cae4
mov eax, dword [ebp + 0x10]
dec eax
je 0x102cafd
dec eax
je 0x102caf8
dec eax
je 0x102caf4
dec eax
je 0x102caf0
dec eax
je 0x102caec
dec eax
je 0x102cae8
xor eax, eax
jmp 0x102cb00
push 6
jmp 0x102cafa
push 5
jmp 0x102cafa
push 4
jmp 0x102cafa
push 3
jmp 0x102cafa
push 2
pop eax
jmp 0x102cb00
xor eax, eax
inc eax
push eax
mov ecx, edi
call fcn.0102bc78
test eax, eax
je 0x102cc22
push esi
lea eax, [ebp + 0x18]
push eax
push dword [ebp + 0x14]
mov esi, 0xfa0
push esi
lea eax, [ebp - 0x1f44]
push eax
call fcn.01026018
mov ebx, eax
test ebx, ebx
jl 0x102cba4
lea eax, [ebp - 0x1f58]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x1f44]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push dword [ebp + 0xc]
movzx eax, word [ebp - 0x1f4a]
push eax
movzx eax, word [ebp - 0x1f4c]
push eax
movzx eax, word [ebp - 0x1f4e]
push eax
movzx eax, word [ebp - 0x1f50]
push eax
movzx eax, word [ebp - 0x1f52]
push eax
movzx eax, word [ebp - 0x1f56]
push eax
movzx eax, word [ebp - 0x1f58]
push eax
push 0x1010818
lea eax, [ebp - 0xfa4]
push esi
push eax
call fcn.01026055
add esp, 0x38
mov ebx, eax
and dword [ebp - 0x1f48], 0
test ebx, ebx
jl 0x102cc21
lea eax, [ebp - 0x1f48]
push eax
push esi
lea eax, [ebp - 0xfa4]
push eax
call fcn.01026091
mov ebx, eax
xor esi, esi
cmp ebx, esi
jl 0x102cc21
cmp byte [edi + 5], 0
je 0x102cbde
lea eax, [ebp - 0xfa4]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push dword [ebp - 0x1f48]
mov ecx, edi
call fcn.0102ca3d
test eax, eax
jl 0x102cc21
push esi
lea eax, [ebp - 0x1f5c]
push eax
push dword [ebp - 0x1f48]
lea eax, [ebp - 0xfa4]
push eax
push dword [edi + 0xc]
mov dword [ebp - 0x1f5c], esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x102cc21
mov ecx, edi
call fcn.0102bccb
mov dword [edi + 0x38], esi
pop esi
mov ecx, dword [ebp - 4]
pop edi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.0102b1ee
leave
ret
Function at 0x102d918
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10350f8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [ecx], bl
jne 0x102d93b
xor al, al
jmp 0x102da69
push esi
mov esi, dword [ebp + 8]
imul esi, esi, 0x1c
push edi
push dword [ebp + 0xc]
add esi, 0x1017288
push dword [ebp + 8]
call fcn.0102d385
mov dword [ebp - 0x21c], eax
lea eax, [ebp - 0x210]
push eax
push 0x20019
push ebx
push 0x10110c0
push 0x80000002
mov dword [ebp - 0x210], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102da65
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push ebx
push dword [esi]
mov dword [ebp - 0x214], ebx
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 4
call edi
test eax, eax
jne 0x102d9d2
cmp dword [ebp - 0x214], ebx
je 0x102d9d2
mov eax, dword [ebp - 0x21c]
push dword [eax]
push dword [esi]
push 0x10112d8
jmp 0x102da39
mov eax, dword [ebp - 0x21c]
push dword [eax]
lea eax, [ebp - 0x20c]
push dword [esi]
push 0x10112c8
push 0x104
push eax
call fcn.01025754
add esp, 0x14
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x214]
push eax
push ebx
push ebx
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 0x210]
mov dword [ebp - 0x218], 4
call edi
test eax, eax
jne 0x102da59
cmp dword [ebp - 0x214], ebx
je 0x102da59
mov eax, dword [ebp - 0x21c]
push dword [eax]
push dword [esi]
push 0x1011250
push ebx
push 0x12
push 0x1035128
call fcn.0102ca9a
add esp, 0x18
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
jmp 0x102da67
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.0102b1ee
leave
ret 8

Function at 0x102feb3
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 8]
push eax
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push dword [ebp + 0xc]
xor edi, edi
push dword [ebp + 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x102ff07
cmp dword [ebp - 4], esi
je 0x102ff07
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x102ff0c
mov edi, 0xc2140108
cmp dword [ebp - 4], esi
je 0x102ff1a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret 0x18
Function at 0x102ff27
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push edi
lea eax, [ebp - 4]
push eax
xor edi, edi
push 0x20019
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], edi
push dword [ebp + 8]
mov dword [ebp - 4], edi
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x102ffb9
cmp dword [ebp - 4], edi
je 0x102ffb9
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
mov ebx, dword [ebp + 0x1c]
cmp eax, 0xea
jne 0x102ffa5
mov eax, dword [ebx]
cmp dword [ebp - 8], eax
jbe 0x102ff91
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x18]
lea eax, [ebp - 0xc]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call esi
pop esi
cmp eax, edi
jne 0x102ffb9
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x14]
jne 0x102ffb9
mov eax, dword [ebp - 8]
mov dword [ebx], eax
jmp 0x102ffc0
mov dword [ebp - 0x10], 0xc2140108
cmp dword [ebp - 4], edi
pop edi
pop ebx
je 0x102ffd0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
leave
ret 0x18
Function at 0x401bc0
Capabilities:
Get file attributes
Set file attributes

Disassembly:
sub esp, 0x22c
mov eax, dword [0x415070]
push ebx
xor ebx, ebx
push ebp
push esi
mov esi, dword [esp + 0x23c]
cmp esi, ebx
push edi
mov edi, dword [esp + 0x244]
mov dword [esp + 0x238], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], ebx
mov dword [esp + 0x1c], ebx
je 0x401c34
cmp byte [esi], bl
je 0x401c34
push str.t.tmp
push esi
lea eax, [esp + 0x138]
push str._s_s
push eax
call fcn.00408f9f
push edi
push esi
lea ecx, [esp + 0x40]
push str._s_s
push ecx
call fcn.00408f9f
add esp, 0x20
jmp 0x401c5e
push str.t.tmp
lea edx, [esp + 0x134]
push 0x411500
push edx
call fcn.00408f9f
push edi
lea eax, [esp + 0x38]
push 0x411500
push eax
call fcn.00408f9f
add esp, 0x18
lea ecx, [esp + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea edx, [esp + 0x28]
push 0x4114fc
push edx
mov ebp, eax
call fcn.00408f87
mov esi, eax
add esp, 8
cmp esi, ebx
je 0x401d62
lea eax, [esp + 0x20]
push eax
push 0x411370
push esi
call fcn.00401780
add esp, 0xc
test eax, eax
jne 0x401d3e
lea ecx, [esp + 0x18]
push ecx
push 0x411364
push esi
call fcn.00401780
add esp, 0xc
test eax, eax
jne 0x401d3e
lea edx, [esp + 0x24]
push edx
push 0x411360
push esi
call fcn.00401780
add esp, 0xc
test eax, eax
jne 0x401d3e
lea eax, [esp + 0x10]
push eax
push 0x411358
push esi
call fcn.00401780
add esp, 0xc
test eax, eax
jne 0x401d3e
lea ecx, [esp + 0x14]
push ecx
push 0x411324
push esi
call fcn.00401780
add esp, 0xc
test eax, eax
jne 0x401d3e
lea edx, [esp + 0x1c]
push edx
push 0x4112e0
push esi
call fcn.00401780
add esp, 0xc
test eax, eax
jne 0x401d3e
push esi
call fcn.00408efd
add esp, 4
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x228]
call fcn.0040851d
add esp, 0x22c
ret
lea eax, [esp + 0x130]
push 0x4114f8
push eax
call fcn.00408f87
mov edi, eax
add esp, 8
cmp edi, ebx
jne 0x401d7b
push esi
call fcn.00408efd
add esp, 4
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x228]
call fcn.0040851d
add esp, 0x22c
ret
push edi
push esi
call fcn.00401740
push esi
call fcn.00408efd
push edi
call fcn.00408efd
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
add esp, 0x10
mov ecx, ebp
and ecx, 0xfffffffe
push ecx
lea edx, [esp + 0x2c]
push edx
call esi
lea eax, [esp + 0x28]
push eax
call fcn.00408ece
add esp, 4
test eax, eax
jne 0x401d62
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x134]
push edx
call fcn.00408e9b
add esp, 8
push ebp
lea eax, [esp + 0x134]
push eax
call esi
mov ecx, dword [esp + 0x238]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
call fcn.0040851d
add esp, 0x22c
ret
Function at 0x401f60
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x24c
mov eax, dword [0x415070]
mov ecx, dword [esp + 0x254]
push ebp
mov ebp, dword [esp + 0x25c]
push edi
push ecx
mov dword [esp + 0x254], eax
mov eax, dword [esp + 0x25c]
push eax
push str._s_s
lea eax, [esp + 0x154]
push 0x105
push eax
call fcn.00401a80
add esp, 0x14
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x401fda
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebp
mov ecx, dword [esp + 0x248]
call fcn.0040851d
add esp, 0x24c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
test byte [esp + 0x10], 0x10
jne 0x402015
lea eax, [esp + 0x3c]
push eax
call ebx
inc eax
push eax
call fcn.004089a7
mov esi, eax
add esp, 4
test esi, esi
je 0x402015
lea ecx, [esp + 0x3c]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, dword [ebp]
push esi
call fcn.004018e0
lea edx, [esp + 0x10]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x401fe2
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x258]
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
call fcn.0040851d
add esp, 0x24c
ret

Function at 0x402050
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x24c
mov eax, dword [0x415070]
mov ecx, dword [esp + 0x254]
push esi
push edi
mov edi, dword [esp + 0x260]
push ecx
mov dword [esp + 0x254], eax
mov eax, dword [esp + 0x25c]
push eax
push str._s_s
lea eax, [esp + 0x154]
push 0x105
push eax
call fcn.00401a80
add esp, 0x14
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x14c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x4020ca
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [esp + 0x248]
call fcn.0040851d
add esp, 0x24c
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.00401ab0
lea ecx, [esp + 0xc]
push ecx
push esi
call ebx
test eax, eax
jne 0x4020d1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x254]
pop ebx
pop edi
xor eax, eax
pop esi
call fcn.0040851d
add esp, 0x24c
ret

Function at 0x402520
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov eax, dword [esi + 4]
test eax, eax
jne 0x402531
call fcn.004024c0
mov eax, dword [esi + 4]
test eax, eax
je 0x40256a
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [esi + 4]
push 1
push 0
push eax
mov dword [esi + 0xc], 1
call dword [sym.imp.USER32.dll_InvalidateRect]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.USER32.dll_UpdateWindow]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
pop esi
ret
Function at 0x4025d0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x108
mov eax, dword [0x415070]
push ebx
push esi
mov esi, dword [esp + 0x114]
mov cl, byte [esi]
push edi
xor edi, edi
cmp cl, 0x22
mov dword [esp + 0x110], eax
mov eax, esi
jne 0x402611
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edi, eax
mov cl, byte [esi + edi - 1]
dec edi
cmp cl, 0x22
lea eax, [esi + 1]
jne 0x402611
mov byte [esi + edi], 0
push 0x104
lea ecx, [esp + 0x10]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
test ebx, ebx
jbe 0x40263e
cmp ebx, 0x104
ja 0x40263e
lea edx, [esp + 0xc]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
jmp 0x402646
test edi, edi
je 0x402646
mov byte [esi + edi], 0x22
test ebx, ebx
jbe 0x40266d
cmp ebx, 0x104
ja 0x40266d
pop edi
pop esi
mov eax, 1
pop ebx
mov ecx, dword [esp + 0x104]
call fcn.0040851d
add esp, 0x108
ret
mov ecx, dword [esp + 0x110]
pop edi
pop esi
xor eax, eax
pop ebx
call fcn.0040851d
add esp, 0x108
ret

Function at 0x402690
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x20c
mov eax, dword [0x415070]
mov ecx, dword [0x416b54]
push ebx
push ebp
push esi
mov esi, dword [esp + 0x21c]
push edi
push 0x104
mov dword [esp + 0x21c], eax
lea eax, [esp + 0x118]
push eax
push 0x12
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
mov al, byte [0x415c28]
test al, al
je 0x4026f9
push 0x415c28
push 0x104
lea edx, [esp + 0x18]
push edx
lea eax, [esp + 0x120]
push eax
push str.Autorun.inf
push str.AutoRun
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0x415720
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0x412614
push esi
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
lea ecx, [esp + 0x10]
push ecx
mov ebp, eax
call edi
add ebp, eax
cmp ebp, 0x104
jge 0x402737
lea edx, [esp + 0x10]
push edx
push esi
call ebx
mov ecx, dword [esp + 0x218]
pop edi
pop esi
pop ebp
pop ebx
call fcn.0040851d
add esp, 0x20c
ret

Function at 0x402760
Capabilities:
Read .ini file

Disassembly:
sub esp, 0x108
mov eax, dword [0x415070]
mov dword [esp + 0x104], eax
push esi
mov esi, dword [esp + 0x110]
lea eax, [esp + 4]
push eax
call fcn.00402690
add esp, 4
lea ecx, [esp + 4]
push ecx
push 0x104
push esi
push 0x411dd6
push str.DisplayName
push str.ProductInformation
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov ecx, dword [esp + 0x108]
pop esi
call fcn.0040851d
add esp, 0x108
ret