joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411cd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
lea eax, [ebp - 0x18]
push edi
mov esi, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetClientRect]
push 1
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetBkMode]
mov eax, dword [esi + 0x80]
cmp eax, 0xffffffff
jne 0x411d06
push 9
call dword [sym.imp.USER32.dll_GetSysColor]
push eax
push dword [ebp + 8]
call dword [sym.imp.GDI32.dll_SetTextColor]
push dword [esi + 0x20]
mov ebx, dword [sym.imp.GDI32.dll_SelectObject]
push dword [ebp + 8]
call ebx
push dword [esi + 4]
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
test eax, eax
jle 0x411d8d
lea edi, [eax + 1]
lea eax, [edi + edi]
add eax, 3
and al, 0xfc
call fcn.0042e5d0
mov dword [ebp - 4], esp
push edi
push dword [ebp - 4]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x411d8d
push 0xfffffffffffffff0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
xor ecx, ecx
test al, 1
je 0x411d67
push 1
jmp 0x411d6d
test al, 2
je 0x411d6e
push 2
pop ecx
test al, 0xb
je 0x411d75
push 0x24
pop ecx
or cx, 0x210
lea eax, [ebp - 0x18]
push ecx
push eax
push 0xffffffffffffffff
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_DrawTextW]
push dword [ebp - 8]
push dword [ebp + 8]
call ebx
lea esp, [ebp - 0x24]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x414948
Capabilities:
Check if file exists
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41498f
push 0x43c868
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
pop ecx
test esi, esi
pop ecx
mov dword [ebp + 8], 0xfeff
je 0x41498f
push esi
push 1
lea eax, [ebp + 8]
push 2
push eax
call dword [sym.imp.MSVCRT.dll_fwrite]
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
add esp, 0x14
pop esi
pop ebp
ret 4

Function at 0x414994
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [ecx + 4]
push ebx
push esi
xor ebx, ebx
mov eax, dword [eax + 4]
xor edx, edx
push 1
cmp eax, 7
pop esi
jl 0x4149b8
cmp eax, 9
jg 0x4149b8
mov edx, esi
push edi
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x20e]
mov word [ebp - 0x210], bx
push 0x103
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x210]
mov dword [ebp - 4], esi
push eax
push edx
mov dword [ebp - 8], 0x104
call fcn.004080d9
add esp, 0xc
mov dword [0x443a70], eax
test eax, eax
pop edi
jne 0x414a33
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 4]
push eax
push 0x441ed4
push 0x43c870
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x414a50
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x414a50
lea eax, [ebp - 0x210]
mov ebx, esi
push eax
push 0x439dc8
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
mov eax, ebx
pop esi
pop ebx
leave
ret 8
Function at 0x415606
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x22ec
call fcn.0042e5d0
push ebx
mov ebx, dword [ebp + 8]
push esi
xor esi, esi
cmp ebx, esi
je 0x415722
cmp word [ebx], si
je 0x415722
mov ax, word [0x441ed4]
push edi
mov word [ebp - 0x25c], ax
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x25a]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [ebp - 0x25c]
push 0x103
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x12a2]
mov word [ebp - 0x12a4], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__snwprintf]
push 0x439dc8
lea eax, [ebp - 0x12a4]
push 0x823
push eax
call ebx
mov ecx, 0x411
xor eax, eax
lea edi, [ebp - 0x22ea]
mov word [ebp - 0x22ec], si
rep stosd dword es:[edi], eax
add esp, 0x10
stosw word es:[edi], ax
lea eax, [ebp - 0x12a4]
push eax
lea eax, [ebp - 0x25c]
push str._post
push eax
push 0x43d048
lea eax, [ebp - 0x22ec]
push 0x823
push eax
call ebx
add esp, 0x18
xor eax, eax
lea edi, [ebp - 0x50]
mov dword [ebp - 0x10], esi
push 0x10
pop ecx
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc]
mov dword [ebp - 0x54], 0x44
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
mov word [ebp - 0x24], si
push eax
lea eax, [ebp - 0x54]
push eax
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x22ec]
push esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
pop edi
je 0x415722
push dword [ebp - 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10]
call esi
pop esi
pop ebx
leave
ret 4
Function at 0x415728
Capabilities:
Delete registry key
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
push edi
mov edi, 0x43d128
mov esi, 0x80000002
push edi
mov ebp, ecx
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov eax, dword [0x43950c]
push 0x43a1d0
mov dword [esp + 0x14], eax
lea eax, [esp + 0x14]
push 0x439dc8
push eax
call fcn.0040a3c5
mov eax, dword [esp + 0x1c]
add esp, 0xc
mov ebx, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push 0x43d110
push edi
push esi
call ebx
mov eax, dword [ebp + 0x30]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push 0x43d0f8
push edi
push esi
call ebx
mov eax, dword [ebp + 4]
push 0x43d0d8
add eax, 0x14
push 0x43adcc
push eax
lea eax, [esp + 0x24]
push eax
call fcn.0041b302
push eax
lea eax, [esp + 0x1c]
push eax
call fcn.0041b302
lea ecx, [esp + 0x18]
call fcn.00404c0d
mov eax, dword [esp + 0x14]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push 0x43d0b8
push edi
push esi
call ebx
mov ebp, dword [sym.imp.MSVCRT.dll_wcslen]
push 0x43c9e8
call ebp
pop ecx
shl eax, 1
push eax
push 0x43c9e8
push 1
push 0x43d098
push edi
push esi
call ebx
push 0x43d088
call ebp
pop ecx
shl eax, 1
push eax
push 0x43d088
push 1
push 0x43d074
push edi
push esi
call ebx
push 0x43d05c
call ebp
pop ecx
shl eax, 1
push eax
push 0x43d05c
push 1
push 0x43d074
push edi
push esi
call ebx
lea ecx, [esp + 0x14]
call fcn.00404c0d
lea ecx, [esp + 0x10]
call fcn.00404c0d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0x41584a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, ecx
push edi
lea ecx, [ebp - 4]
mov eax, dword [esi + 4]
add eax, 0x14
push eax
call fcn.004046e3
mov esi, dword [esi + 0x30]
mov ebx, 0x43c870
mov edi, 0x80000002
mov eax, dword [esi - 8]
shl eax, 1
push eax
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push 1
push 0x441ed4
push ebx
push edi
call esi
mov eax, dword [ebp - 4]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push str.Path
push ebx
push edi
call esi
push 0x5c
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_wcsrchr]
pop ecx
test eax, eax
pop ecx
je 0x4158e4
sub eax, dword [ebp - 4]
sar eax, 1
cmp eax, 0xffffffff
je 0x4158e4
push eax
lea eax, [ebp - 8]
push 0
push eax
lea ecx, [ebp - 4]
call fcn.0040d75b
mov eax, dword [ebp - 8]
mov ecx, dword [eax - 8]
shl ecx, 1
push ecx
push eax
push 1
push 0x43d1e0
push ebx
push edi
call esi
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4163cf
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_FindWindowW]
push edi
mov ebx, 0x43de38
mov edi, ecx
push 0
push ebx
mov dword [ebp - 0x10], edi
call esi
test eax, eax
je 0x41645a
mov edi, dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 1
push 0x401
push eax
call edi
and dword [ebp - 8], 0
push 0xc8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0
push ebx
call esi
test eax, eax
je 0x416432
push 0
push 1
push 0x401
push eax
call edi
mov eax, dword [ebp - 8]
inc dword [ebp - 8]
cmp eax, 0xa
jle 0x416407
mov eax, dword [ebp - 0x10]
push 0x43d4c0
add eax, 0x34
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041b302
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0xc]
call fcn.00404c0d
mov edi, dword [ebp - 0x10]
mov eax, dword [edi + 4]
cmp dword [eax + 4], 9
jge 0x4165f2
push 3
push ecx
mov ecx, esp
push 0x43de1c
call fcn.00404729
mov ecx, edi
call fcn.0041a9d1
mov eax, dword [0x43950c]
push dword [edi + 0x34]
lea esi, [edi + 0x34]
mov dword [ebp - 4], eax
mov ebx, 0x43de08
lea eax, [ebp - 4]
push ebx
push eax
call fcn.0040a3c5
add esp, 0xc
push 0
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov eax, dword [0x43950c]
push dword [edi + 0x38]
add edi, 0x38
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.0040a3c5
add esp, 0xc
lea eax, [ebp - 4]
push 0x43dde8
push eax
lea eax, [ebp - 0x14]
push eax
call fcn.0041b302
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
mov ebx, eax
lea ecx, [ebp - 0x14]
neg ebx
sbb bl, bl
inc bl
call fcn.00404c0d
test bl, bl
je 0x416535
mov ebx, 0x43dde8
lea eax, [ebp - 4]
push ebx
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.0041b302
mov eax, dword [eax]
push ebx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0041b302
mov eax, dword [eax]
push 0
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x18]
call fcn.00404c0d
lea ecx, [ebp - 0x1c]
call fcn.00404c0d
mov ebx, dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 0x43dd94
push 0x80000002
call ebx
push 0x43dd40
push 0x80000002
call ebx
mov eax, dword [0x43950c]
push dword [esi]
mov dword [ebp - 8], eax
mov ebx, 0x43dcf8
lea eax, [ebp - 8]
push ebx
push eax
call fcn.0040a3c5
push dword [ebp - 8]
call fcn.0042059f
mov eax, dword [0x43950c]
add esp, 0x10
push dword [edi]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push ebx
push eax
call fcn.0040a3c5
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.00420842
add esp, 0x14
mov ebx, 0x43dcb8
lea eax, [ebp - 0x18]
push ebx
push esi
push eax
call fcn.0041b302
mov esi, dword [eax]
push ebx
lea eax, [ebp - 0x1c]
push edi
push eax
call fcn.0041b302
mov eax, dword [eax]
push 0
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileW]
lea ecx, [ebp - 0x1c]
call fcn.00404c0d
lea ecx, [ebp - 0x18]
call fcn.00404c0d
lea ecx, [ebp - 0xc]
call fcn.00404c0d
lea ecx, [ebp - 8]
call fcn.00404c0d
lea ecx, [ebp - 0x10]
call fcn.00404c0d
lea ecx, [ebp - 4]
call fcn.00404c0d
pop edi
pop esi
pop ebx
leave
ret
Function at 0x417ecb
Capabilities:
Check if file exists
Copy file
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov esi, ecx
push edi
push 0x43ec84
lea eax, [ebp - 0x10]
lea edi, [esi + 0x2c]
push edi
push eax
call fcn.0041b302
push dword [eax]
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
mov ebx, eax
lea ecx, [ebp - 0x10]
neg ebx
sbb bl, bl
inc bl
call fcn.00404c0d
test bl, bl
mov ebx, dword [sym.imp.KERNEL32.dll_CopyFileW]
je 0x418020
push 0x43ec84
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0041b302
push dword [eax]
call fcn.0042059f
pop ecx
lea ecx, [ebp - 0x24]
call fcn.00404c0d
lea eax, [esi + 0x34]
push 0x43ec5c
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0041b302
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417f76
push 0x43ec5c
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0041b302
mov eax, dword [eax]
push 0
push eax
push dword [ebp - 0x10]
call ebx
lea ecx, [ebp - 0x24]
call fcn.00404c0d
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi + 0x34]
push 0x43ec38
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.0041b302
push dword [ebp - 0xc]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x417fbf
push 0x43ec38
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0041b302
mov eax, dword [eax]
push 0
push eax
push dword [ebp - 0xc]
call ebx
lea ecx, [ebp - 0x24]
call fcn.00404c0d
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [esi + 0x34]
push 0x43ec18
push eax
lea eax, [ebp - 8]
push eax
call fcn.0041b302
push dword [ebp - 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x418008
push 0x43ec18
lea eax, [ebp - 0x24]
push edi
push eax
call fcn.0041b302
mov eax, dword [eax]
push 0
adc eax, 0x8b000033
add byte [edx], ch
push eax
push dword [ebp - 8]
call ebx
lea ecx, [ebp - 0x24]
call fcn.00404c0d
dec dword [ecx]
sahf
scasb al, byte es:[edi]
mov dword [0x5199dc8f], eax
mov ch, 0x16
push ecx
dec esp
scasb al, byte es:[edi]
retf 0x2d24
loop 0x418008
xchg dword [ebp - 0x7ea6386d], eax
inc edi
fild word ss:[edi + eax*8 + 0x5a32d791]
aad 0x92
inc esp
sbb eax, 0x6a4c52ec
fld xword [esi + 0x76]
leave
jg 0x417fe9
xor ebp, ebp
lds ebx, [0x98032817]
add al, 0xf4
mov byte [0xecd385e3], al
ret
Function at 0x41c5ef
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
push ebx
push esi
xor esi, esi
push edi
cmp dword [0x443b1c], esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
jne 0x41c623
mov dword [0x443b1c], 1
push dword [ecx]
push 0x443b18
call fcn.00420eca
pop ecx
pop ecx
cmp dword [0x443b18], esi
je 0x41c74f
push dword [ebp + 0xc]
mov ebx, 0x82
mov ecx, ebx
xor eax, eax
push dword [ebp + 8]
lea edi, [ebp - 0x216]
mov word [ebp - 0x218], si
mov esi, 0x104
rep stosd dword es:[edi], eax
push 0x43add0
lea eax, [ebp - 0x218]
push esi
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
xor edi, edi
lea eax, [ebp - 0x218]
push edi
push 0x80
push 4
push edi
push 1
push reloc.KERNEL32.dll_GetFileSize
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0xc], eax
je 0x41c74f
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push dword [ebp - 0xc]
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp + 8], edi
je 0x41c74f
cmp dword [ebp + 8], 0xffffffff
je 0x41c74f
push edi
push 0x440228
push dword [ebp + 0xc]
push dword [0x443b18]
call fcn.00421843
add esp, 0x10
cmp dword [ebp + 8], eax
jne 0x41c74f
mov word [ebp - 0x630], di
mov ecx, ebx
xor eax, eax
lea edi, [ebp - 0x62e]
and word [ebp - 0x424], ax
push esi
rep stosd dword es:[edi], eax
mov ecx, ebx
lea edi, [ebp - 0x422]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x424]
push eax
push 0x440220
push dword [ebp + 0xc]
push dword [0x443b18]
call fcn.0042172b
mov ecx, dword [ebp - 8]
add esp, 0x14
lea eax, [ebp - 0x630]
push esi
push eax
lea eax, [ebp - 0x218]
push eax
call fcn.0041c83d
lea eax, [ebp - 0x424]
push esi
push eax
lea eax, [ebp - 0x630]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpNW]
test eax, eax
jne 0x41c74f
mov dword [ebp - 4], 1
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x41c83d
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
push ebx
push esi
push edi
push 0x43bbc0
push dword [ebp + 8]
mov dword [ebp - 8], ecx
call dword [sym.imp.MSVCRT.dll__wfopen]
mov esi, eax
xor ebx, ebx
pop ecx
cmp esi, ebx
pop ecx
mov dword [ebp - 4], esi
je 0x41c963
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
push 2
push ebx
push esi
call edi
push esi
call dword [sym.imp.MSVCRT.dll_ftell]
push ebx
push ebx
push dword [ebp - 4]
mov esi, eax
call edi
add esp, 0x1c
cmp esi, ebx
je 0x41c959
lea edi, [esi + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp + 8], eax
je 0x41c959
push edi
push ebx
push eax
call sub.MSVCRT.dll_memset
push dword [ebp - 4]
push 1
push esi
push dword [ebp + 8]
call dword [sym.imp.MSVCRT.dll_fread]
add esp, 0x1c
test eax, eax
je 0x41c950
push 0x41
xor eax, eax
pop ecx
lea edi, [ebp - 0x10f]
mov byte [ebp - 0x110], bl
push 0x104
rep stosd dword es:[edi], eax
mov ecx, dword [ebp - 8]
lea eax, [ebp - 0x110]
push eax
push esi
push dword [ebp + 8]
call fcn.0041c759
test eax, eax
je 0x41c950
lea eax, [ebp - 0x110]
test eax, eax
je 0x41c939
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
inc esi
lea eax, [esi + esi]
add eax, 3
and al, 0xfc
call fcn.0042e5d0
mov edi, esp
push esi
push edi
lea eax, [ebp - 0x110]
push 0xffffffffffffffff
push eax
push ebx
push ebx
mov word [edi], bx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ebx, edi
mov eax, dword [ebp + 0x10]
push ebx
dec eax
push 0x439dc8
push eax
push dword [ebp + 0xc]
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x10
push dword [ebp + 8]
call fcn.0042e52c
pop ecx
push dword [ebp - 4]
call dword [sym.imp.MSVCRT.dll_fclose]
pop ecx
push 1
pop eax
lea esp, [ebp - 0x11c]
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x41d8c3
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
lea eax, [ebp - 0x114]
mov dword [ebp - 0x114], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x104], 2
jne 0x41d937
cmp dword [ebp - 0x110], 5
jne 0x41d937
cmp dword [ebp - 0x10c], 1
jne 0x41d937
push esi
mov esi, dword [sym.imp.MSVCRT.dll_wcscmp]
lea eax, reloc.KERNEL32.dll_RemoveDirectoryW
push str.Service_Pack_2
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x41d931
lea eax, reloc.KERNEL32.dll_RemoveDirectoryW
push str.Service_Pack_3
push eax
call esi
pop ecx
test eax, eax
pop ecx
je 0x41d931
xor eax, eax
jmp 0x41d934
push 1
pop eax
pop esi
leave
ret
xor eax, eax
leave
ret
Function at 0x41e102
Capabilities:
Delete file
Move file

Disassembly:
cmp dword [esp + 8], 0
jne 0x41e123
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp eax, 1
jne 0x41e11b
xor eax, eax
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x41e126
push 5
pop eax
cmp eax, 5
je 0x41e134
cmp eax, 0x20
je 0x41e134
push 1
pop eax
ret
cmp dword [0x443b28], 0
je 0x41e155
push 0
push dword [esp + 8]
call fcn.0041e167
pop ecx
pop ecx
xor ecx, ecx
test eax, eax
setne cl
inc ecx
mov eax, ecx
ret
push 4
push 0
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push 2
pop eax
ret

Function at 0x41e346
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
mov esi, 0x207
lea eax, [ebp - 0x208]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x41e3c7
cmp eax, esi
ja 0x41e3c7
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
cmp word [ebp + eax*2 - 0x20a], 0x5c
pop ecx
je 0x41e398
lea eax, [ebp - 0x208]
push 0x43adcc
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x208]
push str.wininit.ini
push eax
push 0x43e2f8
push esi
push edi
call dword [sym.imp.MSVCRT.dll__snwprintf]
add esp, 0x14
and word [edi + esi*2 - 2], 0
push 1
pop eax
pop edi
jmp 0x41e3c9
xor eax, eax
pop esi
leave
ret

Function at 0x41e3cc
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x167c
call fcn.0042e5d0
push esi
xor esi, esi
cmp dword [ebp + 0xc], esi
je 0x41e4c5
push ebx
push edi
mov ecx, 0x513
xor eax, eax
lea edi, [ebp - 0x167a]
mov word [ebp - 0x167c], si
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
mov eax, dword [0x4402ec]
mov ebx, dword [sym.imp.MSVCRT.dll_wcstok]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
call ebx
pop ecx
pop ecx
mov edx, eax
test edx, edx
je 0x41e487
and word [ebp - 0x22c], 0
mov ecx, 0x81
xor eax, eax
lea edi, [ebp - 0x22a]
rep stosd dword es:[edi], eax
push edx
push dword [ebp + 8]
stosw word es:[edi], ax
push 0x4402e0
lea eax, [ebp - 0x22c]
push 0x103
push eax
call dword [sym.imp.MSVCRT.dll__snwprintf]
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.MSVCRT.dll_wcslen]
mov edi, eax
lea eax, [ebp - 0x22c]
push eax
lea eax, [ebp + esi*2 - 0x167c]
push eax
call dword [sym.imp.MSVCRT.dll_wcscat]
lea eax, [ebp - 4]
lea esi, [esi + edi + 1]
push eax
push 0
call ebx
add esp, 0x28
jmp 0x41e418
xor esi, esi
push 0x1e
lea eax, [ebp - 0x24]
push esi
push eax
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x167c]
add esp, 0xc
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
mov dword [ebp - 0xe], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0xa], esi
mov dword [ebp - 0x20], 3
mov word [ebp - 0x14], 0x454
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
pop edi
pop ebx
jmp 0x41e4c7
xor eax, eax
pop esi
leave
ret
Function at 0x41e86d
Capabilities:
Get common file path
Get program files directory

Disassembly:
xor eax, eax
push esi
cmp word [0x443b54], ax
mov esi, 0x443b54
jne 0x41e897
push eax
push 0x26
push esi
push eax
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push str.internet_exploreriexplore.exe
push esi
call dword [sym.imp.MSVCRT.dll_wcscat]
pop ecx
pop ecx
mov eax, esi
pop esi
ret

Function at 0x41e8bb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push dword [ebp + 0xc]
push esi
call fcn.0041e86d
push eax
call fcn.0042a2cd
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x41e90c
lea eax, [ebp + 0xc]
mov dword [ebp + 8], 4
push eax
lea eax, [ebp + 8]
push esi
push eax
push 0x43cb4c
push 0x43cb00
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x41e90c
cmp word [esi], ax
je 0x41e90c
push 1
pop edi
mov eax, edi
pop edi
pop esi
pop ebp
ret

Function at 0x41eea2
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push edi
xor edi, edi
xor ebx, ebx
cmp dword [ebp + 0xc], edi
mov dword [ebp - 4], edi
je 0x41efa2
lea eax, [ebp - 4]
push esi
push eax
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push 0x40000
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41ef93
push dword [ebp + 0x10]
push 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
test eax, eax
jne 0x41ef93
cmp dword [ebp + 0x14], edi
je 0x41ef90
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push 0x20019
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
test eax, eax
jne 0x41ef93
push edi
lea eax, [ebp - 0xc]
push edi
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push edi
push eax
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x41ef93
push 0x20a
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
cmp dword [ebp - 8], edi
pop ecx
mov esi, eax
jbe 0x41ef89
push 0x105
push esi
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
cmp eax, edi
jne 0x41ef7c
push 1
push dword [ebp + 0x10]
push esi
push dword [ebp - 4]
call fcn.0041eea2
add esp, 0x10
jmp 0x41ef83
cmp eax, 0x103
je 0x41ef89
inc ebx
cmp ebx, dword [ebp - 8]
jb 0x41ef55
push esi
call fcn.0042e52c
pop ecx
push 1
pop ebx
cmp dword [ebp - 4], edi
pop esi
je 0x41efa2
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
pop edi
pop ebx
leave
ret