joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10098380
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, ecx
push ebx
push esi
push edi
mov eax, dword [edx + 8]
cmp eax, dword [edx + 0xc]
jne 0x100983c6
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f80
mov edx, str.BlockHash::AddBlock___called_before_BlockHash::Init__
mov ecx, eax
call fcn.10015f80
push eax
call fcn.10088320
add esp, 4
cmp byte [0x10120b44], 0
je 0x10098510
jmp 0x10098517
mov esi, dword [edx + 0x34]
mov eax, dword [edx + 4]
inc esi
shr eax, 4
cmp esi, eax
jl 0x10098416
dec eax
mov edx, str.ERROR:
push eax
push ecx
push esi
push ecx
mov ecx, 0x1011f818
call fcn.10015f80
mov edx, str.BlockHash::AddBlock___called_with_block_number
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
mov edx, str._that_is_past_last_block
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
jmp 0x100983ab
mov edi, dword [edx + 0x14]
cmp dword [edi + esi*4], 0xffffffff
lea eax, [edi + esi*4]
je 0x10098467
push dword [eax]
mov edx, str.ERROR:
push ecx
push esi
push ecx
mov ecx, 0x1011f818
call fcn.10015f80
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_block_number_
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
jmp 0x100983ab
mov ecx, dword [edx + 0x2c]
and ecx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov ebx, dword [eax + ecx*4]
test ebx, ebx
jns 0x1009848a
mov dword [eax + ecx*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + esi*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov eax, dword [edx + 0x20]
mov eax, dword [eax + ebx*4]
cmp dword [edi + eax*4], 0xffffffff
je 0x10098504
push dword [edi + eax*4]
mov edx, str.ERROR:
push ecx
push eax
push ecx
push ebx
push ecx
mov ecx, 0x1011f818
call fcn.10015f80
mov edx, str.Internal_error_in_BlockHash::AddBlock__:_first_matching_block_
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
mov edx, str.__last_matching_block_
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
mov edx, str.__next_block_should_be__1_but_is
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
push eax
call fcn.10088320
add esp, 4
call fcn.100864a0
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov dword [edi + eax*4], esi
mov eax, dword [edx + 0x20]
mov dword [eax + ebx*4], esi
mov dword [edx + 0x34], esi
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x1011f818
call fcn.1001a0d0
push 1
call fcn.100a2085
int3
Function at 0x10098530
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 4]
cmp edx, eax
jle 0x1009859c
push eax
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f80
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
mov edx, str._higher_than_end_index
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.1003be50
push eax
call fcn.10088320
add esp, 4
cmp byte [0x10120b44], 0
je 0x10098663
jmp 0x1009866a
mov ecx, dword [ebx + 0x34]
shl ecx, 4
cmp edx, ecx
jg 0x100985f3
push ecx
push ecx
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f80
mov edx, str.BlockHash::AddAllBlocksThroughIndex___called_with_index
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
mov edx, str.___last_index_added__
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
mov edx, 0x100ebd98
mov ecx, eax
call fcn.10015f80
jmp 0x10098581
cmp eax, 0x10
jb 0x10098663
add eax, 0xfffffff0
cmp edx, eax
jle 0x10098602
lea edx, [eax + 1]
mov eax, dword [ebx]
add edx, eax
mov dword [ebp + 8], edx
lea edi, [eax + 0x10]
add edi, ecx
cmp edi, edx
jae 0x10098663
movzx eax, byte [edi]
lea edx, [edi + 3]
movzx ecx, byte [edi + 1]
mov esi, 7
imul eax, eax, 0x101
add eax, ecx
lea esp, [esp]
movzx ecx, byte [edx - 1]
lea edx, [edx + 2]
imul eax, eax, 0x101
add ecx, eax
imul eax, ecx, 0x101
movzx ecx, byte [edx - 2]
add eax, ecx
and eax, 0x7fffff
dec esi
jne 0x10098630
push eax
mov ecx, ebx
call fcn.10098380
add edi, 0x10
cmp edi, dword [ebp + 8]
jb 0x10098612
pop edi
pop esi
pop ebx
pop ebp
ret 4
mov ecx, 0x1011f818
call fcn.1001a0d0
push 1
call fcn.100a2085
int3

Function at 0x10098700
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ecx + 4]
mov edx, dword [ebp + 8]
shr eax, 4
cmp edx, eax
jb 0x10098750
push edx
push ecx
mov edx, str.ERROR:
mov ecx, 0x1011f818
call fcn.10015f80
mov edx, str.NextMatchingBlock_called_for_invalid_block_number
mov ecx, eax
call fcn.10015f80
add esp, 4
mov ecx, eax
call fcn.10042d40
push eax
call fcn.10088320
add esp, 4
cmp byte [0x10120b44], 0
jne 0x10098762
or eax, 0xffffffff
pop ebp
ret 8
mov eax, dword [ecx + 0x14]
push dword [ebp + 0xc]
push dword [eax + edx*4]
call fcn.10098680
pop ebp
ret 8
mov ecx, 0x1011f818
call fcn.1001a0d0
push 1
call fcn.100a2085
int3
Function at 0x100991b0
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov eax, 0x10121620
mov word [0x10121b20], 0
push esi
dec eax
mov word [0x10121620], 0x301
push edi
mov edi, 0x10121620
mov byte [0x10121b23], 1
mov ebx, 2
sub edi, eax
lea esi, [eax + 2]
mov cl, byte [esi]
lea esi, [esi + 1]
mov dl, cl
mov al, cl
and dl, 0x80
neg dl
sbb dl, dl
add al, al
xor al, cl
and dl, 0x1b
xor al, dl
mov byte [edi + esi - 1], al
movzx eax, al
mov byte [eax + 0x10121b20], bl
inc ebx
cmp ebx, 0x100
jl 0x100991e5
mov byte [0x101213a0], 0x63
mov ebx, 1
mov byte [0x10121503], 0
jmp 0x10099230
movzx eax, bl
mov ecx, 0x1012171f
movzx eax, byte [eax + 0x10121b20]
sub ecx, eax
mov cl, byte [ecx]
mov dl, cl
rol dl, 1
xor cl, dl
rol dl, 1
xor cl, dl
rol dl, 1
mov al, dl
rol al, 1
xor al, cl
xor al, dl
xor al, 0x63
mov byte [ebx + 0x101213a0], al
movzx eax, al
mov byte [eax + 0x101214a0], bl
inc ebx
cmp ebx, 0x100
jl 0x10099230
mov al, 1
mov edx, 0x101215a0
movzx ecx, al
mov dword [edx], ecx
mov cl, al
and cl, 0x80
neg cl
sbb cl, cl
add al, al
and cl, 0x1b
add edx, 4
xor al, cl
cmp edx, 0x10121618
jl 0x10099278
mov ecx, dword [0x101151bc]
xor esi, esi
mov edi, 0xff
mov ah, byte [esi + 0x101213a0]
mov bl, ah
mov bh, ah
and bl, 0x80
mov al, bl
neg al
sbb al, al
add bh, bh
and al, 0x1b
mov dl, bh
xor dl, al
xor dl, ah
neg bl
movzx edx, dl
sbb bl, bl
movzx eax, ah
shl edx, 8
and bl, 0x1b
or edx, eax
xor bh, bl
mov bl, byte [esi + 0x101214a0]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x10121720], edx
test cl, cl
je 0x1009931c
test bl, bl
je 0x1009931c
movzx eax, cl
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x10121620]
mov byte [ebp - 1], al
jmp 0x10099320
mov byte [ebp - 1], 0
test ch, ch
je 0x1009934c
test bl, bl
je 0x1009934c
movzx eax, ch
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov al, byte [edx + 0x10121620]
mov byte [ebp - 2], al
jmp 0x10099350
mov byte [ebp - 2], 0
mov al, byte [0x101151be]
test al, al
je 0x1009937e
test bl, bl
je 0x1009937e
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov bh, byte [edx + 0x10121620]
jmp 0x10099380
xor bh, bh
mov al, byte [0x101151bf]
test al, al
je 0x100993ae
test bl, bl
je 0x100993ae
movzx eax, al
movzx edx, bl
movzx eax, byte [eax + 0x10121b20]
movzx edx, byte [edx + 0x10121b20]
add eax, edx
cdq
idiv edi
mov bl, byte [edx + 0x10121620]
jmp 0x100993b0
xor bl, bl
movzx edx, byte [ebp - 1]
movzx eax, byte [ebp - 2]
shl edx, 8
or edx, eax
movzx eax, bh
shl edx, 8
or edx, eax
movzx eax, bl
shl edx, 8
or edx, eax
mov dword [esi*4 + 0x10120fa0], edx
inc esi
cmp esi, 0x100
jl 0x100992a5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100c2340
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100c2410
push 0xffffffffffffffff
push 0x100d7f48
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10113840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x101146c8]
cmp eax, 0xffffffff
jne 0x100c2449
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100c2456
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100c24bd
jmp 0x100c248c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100c24fa
test edi, edi
jne 0x100c2500
push 0x100c2010
push 0x10120a58
call fcn.100c1cb0
mov eax, dword [0x101146c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100c24bd
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100c24e6
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100c24e6
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100c2538
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100c2529
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100c2500
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100c2480
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100c2597
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100c257c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100c2597
jmp 0x100c2570
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100c2570
jmp 0x100c2597
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100c2595
cmp esi, dword [eax + 8]
jne 0x100c2595
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100c2585
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100c25ab
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100c25ab
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100c2040
cmp esi, ebx
jne 0x100c2550
mov ebp, dword [esp + 0x14]
jmp 0x100c2480
Function at 0x100c2410
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x100c2410
push 0xffffffffffffffff
push 0x100d7f48
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10113840]
xor eax, esp
push eax
lea eax, [esp + 0x24]
mov dword fs:[0], eax
mov eax, dword [0x101146c8]
cmp eax, 0xffffffff
jne 0x100c2449
xor ebp, ebp
mov dword [esp + 0x14], ebp
jmp 0x100c2456
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebp, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ebp
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov dword [esp + 0x2c], 0
test ebp, ebp
je 0x100c24bd
jmp 0x100c248c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov ebx, dword [sym.imp.KERNEL32.dll_HeapFree]
cmp dword [ebp + 0x14], 0
mov edi, dword [ebp + 0xc]
jne 0x100c24fa
test edi, edi
jne 0x100c2500
push 0x100c2010
push 0x10120a58
call fcn.100c1cb0
mov eax, dword [0x101146c8]
add esp, 8
cmp eax, 0xffffffff
je 0x100c24bd
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x2c], 0xffffffff
test ebp, ebp
je 0x100c24e6
lea eax, [ebp + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x100c24e6
mov eax, dword [ebp]
mov ecx, ebp
push 0
call dword [eax]
push ebp
push 0
call esi
push eax
call ebx
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x1c
ret
test edi, edi
je 0x100c2538
mov edi, edi
mov eax, dword [edi + 4]
mov dword [ebp + 0xc], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x100c2529
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
mov ecx, esi
push 0
mov eax, dword [esi]
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebx
push edi
push 0
call esi
push eax
call ebx
mov edi, dword [ebp + 0xc]
test edi, edi
jne 0x100c2500
mov ebx, dword [ebp + 0x10]
lea eax, [ebp + 0x10]
mov dword [esp + 0x18], eax
mov esi, dword [ebx]
cmp esi, ebx
je 0x100c2480
mov ebp, eax
mov edi, edi
cmp byte [esi + 0xd], 0
mov edi, esi
jne 0x100c2597
mov eax, dword [esi + 8]
cmp byte [eax + 0xd], 0
jne 0x100c257c
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
jne 0x100c2597
jmp 0x100c2570
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0xd], 0
je 0x100c2570
jmp 0x100c2597
mov eax, dword [esi + 4]
cmp byte [eax + 0xd], 0
jne 0x100c2595
cmp esi, dword [eax + 8]
jne 0x100c2595
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0xd], 0
je 0x100c2585
mov esi, eax
mov ecx, dword [edi + 0x14]
test ecx, ecx
je 0x100c25ab
mov edx, dword [edi + 0x1c]
test edx, edx
je 0x100c25ab
mov eax, dword [ecx]
push edx
call dword [eax + 4]
push edi
lea eax, [esp + 0x24]
mov ecx, ebp
push eax
call fcn.100c2040
cmp esi, ebx
jne 0x100c2550
mov ebp, dword [esp + 0x14]
jmp 0x100c2480
Function at 0x415c9a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareInstallShieldISWI7.0SetupExeLog
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x415cf1
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x104
push eax
push 0x4a8ce4
push 0
push 0
push str.SetupLogFileName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x415ce8
mov byte [0x4a9d14], 1
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x41733b
Capabilities:
Hide graphical window

Disassembly:
push dword [0x4a9d50]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41736b
push 0
push dword [0x4a9d50]
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [0x4a9d58]
push 0
mov ecx, dword [eax + 0x168]
call fcn.00431ced
ret

Function at 0x41736c
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_GetWindowRect]
lea eax, [ebp - 0x2c]
push edi
push eax
push dword [0x4a9d50]
call esi
lea eax, [ebp - 0x6c]
xor ebx, ebx
push eax
push ebx
call esi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 1
call edi
push eax
push ebx
call edi
push eax
push ebx
lea eax, [ebp - 0x1c]
push ebx
push eax
call dword [sym.imp.USER32.dll_SetRect]
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp + 8]
sub eax, dword [ebp - 0x2c]
mov dword [ebp - 4], 0x1e
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
sub eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
call fcn.00429d65
cmp dword [eax], 1
je 0x4173d6
cmp dword [eax + 4], ebx
je 0x41742b
push ebx
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowA]
mov edi, eax
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41742b
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], 0x46
push eax
push edi
call esi
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.USER32.dll_IntersectRect]
lea esi, [ebp - 0x1c]
lea edi, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x4c]
push eax
lea eax, [ebp - 0x5c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp - 0x1c]
push eax
movsd dword es:[edi], dword [esi]
call dword [sym.imp.USER32.dll_SubtractRect]
mov esi, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x18]
sub esi, ebx
mov ecx, dword [ebp - 0x14]
mov eax, esi
mov edi, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 4]
sub ecx, edi
push 5
push 0
push 0
sub ebx, eax
mov eax, ecx
cdq
idiv dword [ebp - 4]
sub ebx, dword [ebp - 8]
add ebx, esi
push ebx
sub edi, eax
sub edi, dword [ebp - 0xc]
add edi, ecx
push edi
push 0
push dword [0x4a9d50]
call dword [sym.imp.USER32.dll_SetWindowPos]
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418b54
Capabilities:
Check os version

Disassembly:
mov eax, 0x4829bd
call fcn.0046694c
sub esp, 0x180
push ebx
lea eax, [ebp - 0x18c]
push esi
mov dword [ebp - 0x14], ecx
push eax
mov dword [ebp - 0x18c], 0x9c
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x188], 5
jne 0x418cd2
push 2
pop esi
cmp dword [ebp - 0x184], esi
jne 0x418cd2
cmp byte [ebp - 0xf2], 1
je 0x418cd2
push 0x4a0228
push dword [ebp + 8]
call fcn.00467060
pop ecx
pop ecx
test eax, eax
push 1
je 0x418d6d
lea eax, [ebp + 0xb]
lea ecx, [ebp - 0xa0]
push eax
push dword [ebp + 8]
call fcn.00402e7f
xor ebx, ebx
mov dword [ebp - 4], esi
cmp dword [ebp - 0x94], ebx
je 0x418cc3
mov al, byte [ebp + 0xb]
push edi
mov byte [ebp - 0x28], al
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0xa0]
push eax
push ebx
push 0x2c
mov byte [ebp - 4], 3
call fcn.0040b321
lea eax, [ebp - 0xd]
push ebx
push eax
lea ecx, [ebp - 0x50]
mov dword [ebp - 0x50], 0x48a6a8
mov dword [ebp - 0x30], 0x48a6a0
call fcn.00403cd9
xor edi, edi
mov byte [ebp - 4], 4
xor esi, esi
cmp dword [ebp - 0x24], ebx
je 0x418caa
mov eax, dword [ebp - 0x20]
push 0x28
sub eax, dword [ebp - 0x24]
pop ecx
cdq
idiv ecx
cmp edi, eax
jae 0x418caa
lea eax, [ebp - 0x15]
push 1
push eax
push str.dotnetfxsp1.exe
lea ecx, [ebp - 0xf0]
call fcn.00402e7f
push eax
mov eax, dword [ebp - 0x24]
add eax, esi
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0xc8]
push eax
call fcn.00415f0d
add esp, 0xc
push ebx
lea ecx, [ebp - 0x50]
push ebx
push ecx
mov ecx, dword [ebp - 0x14]
push eax
mov byte [ebp - 4], 6
call fcn.0041ef77
lea ecx, [ebp - 0xc8]
mov byte [ebp - 4], 5
call fcn.00402438
lea ecx, [ebp - 0xf0]
mov byte [ebp - 4], 4
call fcn.00402438
inc edi
add esi, 0x28
jmp 0x418c2e
lea ecx, [ebp - 0x50]
mov byte [ebp - 4], 3
call fcn.00402438
lea ecx, [ebp - 0x28]
mov byte [ebp - 4], 2
call fcn.00407b19
pop edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xa0]
jmp 0x418d66
xor esi, esi
lea eax, [ebp - 0xd]
push esi
push eax
lea ecx, [ebp - 0x78]
mov dword [ebp - 0x78], 0x48a6a8
mov dword [ebp - 0x58], 0x48a6a0
call fcn.00403cd9
push 0x4a0228
mov dword [ebp - 4], esi
push dword [ebp + 8]
call fcn.00467060
pop ecx
test eax, eax
pop ecx
jne 0x418d5f
lea eax, [ebp + 0xb]
push 1
push eax
push str.dotnetfxsp1.exe
lea ecx, [ebp - 0x50]
call fcn.00402e7f
mov ecx, dword [ebp - 0x14]
push esi
lea eax, [ebp - 0x78]
push 1
push eax
lea eax, [ebp - 0x50]
push eax
mov byte [ebp - 4], 1
call fcn.0041ef77
mov ebx, eax
lea ecx, [ebp - 0x50]
neg ebx
sbb bl, bl
and byte [ebp - 4], 0
inc bl
call fcn.00402438
test bl, bl
je 0x418d5f
mov ecx, dword [ebp - 0x14]
call fcn.00421edc
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.00402438
xor eax, eax
jmp 0x418d6e
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.00402438
push 1
pop eax
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41b802
Capabilities:
Delete file
Enumerate files on windows
Get common file path

Disassembly:
mov eax, 0x482f0f
call fcn.0046694c
sub esp, 0x5c0
and byte [ebp - 0x5cc], 0
push esi
push edi
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x5cb]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x5cc]
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea eax, [ebp - 0xf]
push 1
push eax
lea eax, [ebp - 0x5cc]
push eax
lea ecx, [ebp - 0x64]
call fcn.00401884
and dword [ebp - 4], 0
mov eax, str..mst
mov ecx, eax
mov dword [ebp - 0x3c], 0x48a660
test ecx, ecx
mov dword [ebp - 0x1c], 0x48a658
jne 0x41b876
mov eax, 0x4a8be0
lea ecx, [ebp - 0xd]
push 0
push ecx
push eax
lea ecx, [ebp - 0x3c]
call fcn.004011a9
lea eax, [ebp - 0x3c]
lea ecx, [ebp - 0x64]
push eax
mov byte [ebp - 4], 1
call fcn.0042333c
and byte [ebp - 4], 0
lea ecx, [ebp - 0x3c]
call fcn.00401093
or edi, 0xffffffff
mov dword [ebp - 0x14], edi
lea eax, [ebp - 0x1cc]
lea ecx, [ebp - 0x64]
push eax
mov byte [ebp - 4], 2
call fcn.00401a14
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, edi
je 0x41b972
mov dword [ebp - 0x14], esi
lea eax, [ebp - 0x1c0]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jg 0x41b950
lea eax, [ebp - 0xd]
push 1
push eax
lea eax, [ebp - 0x5cc]
push eax
lea ecx, [ebp - 0x3c]
call fcn.00401884
lea eax, [ebp - 0xe]
push 1
push eax
lea eax, [ebp - 0x1a0]
push eax
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 3
call fcn.00401884
lea eax, [ebp - 0x8c]
lea ecx, [ebp - 0x3c]
push eax
mov byte [ebp - 4], 4
call fcn.0042333c
lea ecx, [ebp - 0x8c]
mov byte [ebp - 4], 3
call fcn.00401093
lea ecx, [ebp - 0x3c]
call fcn.00401a14
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], 2
call fcn.00401093
lea eax, [ebp - 0x1cc]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41b8ce
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
je 0x41b972
push esi
call eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], edi
call fcn.00401093
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret 4
Function at 0x41d9bc
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
mov eax, 0x4832d8
call fcn.0046694c
sub esp, 0x440
push ebx
push esi
mov esi, ecx
push edi
xor ebx, ebx
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x44b]
mov byte [ebp - 0x44c], bl
mov dword [ebp - 0x10], 0x208
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x10]
mov edi, dword [ebp + 8]
push eax
lea eax, [ebp - 0x44c]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 0x14], ebx
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, ebx
jne 0x41dab5
lea eax, [ebp - 0x3c]
mov ecx, esi
push eax
mov byte [ebp - 0x244], 0x22
call fcn.00401166
mov ecx, eax
call fcn.00429e35
mov ecx, eax
mov dword [ebp - 4], ebx
call fcn.004042dd
push eax
lea eax, [ebp - 0x243]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.00402438
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x244]
push str.____
push eax
call esi
lea eax, [ebp - 0x44c]
push 0x20
push eax
call fcn.00468800
pop ecx
cmp eax, ebx
pop ecx
je 0x41dab5
push eax
lea eax, [ebp - 0x244]
push eax
call esi
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x244]
push eax
push 1
push ebx
push dword [ebp + 0xc]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
neg eax
sbb eax, eax
inc eax
jmp 0x41dab7
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8