joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d97f
Capabilities:
Enumerate files on windows

Disassembly:
mov eax, 0x4108f4
call fcn.00410160
sub esp, 0x474
lea eax, [ebp - 0x480]
push eax
call fcn.0040d8cd
test eax, eax
pop ecx
je 0x40d9a7
xor eax, eax
jmp 0x40daf4
push ebx
lea eax, [ebp - 0x480]
push esi
xor ebx, ebx
push eax
mov byte [ebp - 0xd], bl
call sub.MSVCRT.dll_wcslen
mov esi, eax
push 2
lea eax, [ebp - 0x24]
push ebx
push eax
dec esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
call sub.MSVCRT.dll_memset
add esp, 0x10
cmp word [ebp + esi*2 - 0x480], 0x5c
lea esi, [ebp + esi*2 - 0x480]
mov dword [ebp - 4], ebx
mov eax, 0x41afe4
je 0x40d9f1
mov eax, 0x4140b8
push eax
lea eax, [ebp - 0x480]
push eax
push str._s_sMozillaFirefoxProfiles
lea ecx, [ebp - 0x28]
call fcn.004087f9
mov eax, dword [ebp - 0x28]
cmp eax, ebx
jne 0x40da10
lea eax, [ebp - 0x24]
lea ecx, [ebp - 0x278]
push edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x14], eax
xor eax, eax
cmp dword [ebp - 0x14], 0xffffffff
lea edi, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
stosd dword es:[edi], eax
pop edi
je 0x40dae4
lea eax, [ebp - 0x24c]
push 0x415adc
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
je 0x40dabb
lea eax, [ebp - 0x24c]
push 0x419e60
push eax
call sub.MSVCRT.dll_wcscmp
pop ecx
test eax, eax
pop ecx
je 0x40dabb
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
jle 0x40dabb
cmp word [esi], 0x5c
mov eax, 0x41afe4
je 0x40da89
mov eax, 0x4140b8
lea ecx, [ebp - 0x24c]
push ecx
mov ecx, dword [ebp + 8]
push eax
lea eax, [ebp - 0x480]
push eax
push str._s_sMozillaFirefoxProfiles_s_
call fcn.0040db00
mov eax, dword [ebp - 0x26c]
mov byte [ebp - 0xd], 1
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x268]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x278]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40da36
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp byte [ebp - 0xd], bl
je 0x40dae4
push 1
pop ebx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0040114a
mov eax, ebx
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x40dc64
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, 0x41093c
call fcn.00410160
sub esp, 0x18
push ebx
xor ebx, ebx
push 2
lea eax, [ebp - 0x20]
push ebx
push eax
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
call sub.MSVCRT.dll_memset
lea eax, [ebp - 0x24]
mov dword [ebp - 4], ebx
push eax
call fcn.0040d97f
add esp, 0x10
test eax, eax
je 0x40dd0f
push 2
lea eax, [ebp - 0x14]
push ebx
push eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], ebx
call sub.MSVCRT.dll_memset
add esp, 0xc
mov eax, dword [ebp - 0x24]
mov byte [ebp - 4], 1
cmp eax, ebx
jne 0x40dcbc
lea eax, [ebp - 0x20]
push eax
push str._sextensionsmozilla_cc3_internetdownloadmanager.com.xpi
lea ecx, [ebp - 0x18]
call fcn.004086fa
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x40dcd4
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x40dceb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x40dd04
mov eax, dword [ebp - 0x18]
cmp eax, ebx
jne 0x40dcf5
lea eax, [ebp - 0x14]
push ebx
push dword [ebp + 8]
push 0x41b828
push eax
call fcn.00405972
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], bl
call fcn.0040114a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24]
call fcn.0040114a
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40f8c8
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
lea eax, [ebp - 4]
push eax
push 1
push 0
push str.SoftwareDownloadManager
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40f966
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x208
push eax
lea eax, [ebp - 0x210]
push eax
push 0
push 0
push str.CommonAppDataIDMFolder
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x40f95d
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40f95d
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x418]
push str._sproxy.pac
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret

Function at 0x40f968
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push 0x104
lea eax, [ebp - 0x20c]
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x40f9df
lea eax, [ebp - 0x20c]
push eax
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x40f9df
lea eax, [ebp - 0x20c]
push 0x4140b8
push eax
call sub.MSVCRT.dll_wcscat
lea eax, [ebp - 0x20c]
push str.Internet_Download_Manager.lnk
push eax
call sub.MSVCRT.dll_wcscat
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
leave
ret

Function at 0x40fd11
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push ebx
push esi
push edi
xor edi, edi
push edi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
push edi
push 0x18b
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
mov ebx, eax
cmp ebx, edi
jbe 0x40fd80
lea eax, [ebp - 0x208]
push eax
push edi
push 0x189
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
lea eax, [ebp - 0x208]
push 0x417d30
push eax
call sub.MSVCRT.dll_wcsstr
pop ecx
test eax, eax
pop ecx
lea eax, [ebp - 0x208]
push eax
je 0x40fd75
call fcn.0040fd87
pop ecx
jmp 0x40fd7b
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
inc edi
cmp edi, ebx
jb 0x40fd3a
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x40fd87
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x664
push ebx
push edi
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x664]
push 0x41604c
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x254]
push eax
lea eax, [ebp - 0x664]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
or eax, 0xffffffff
cmp ebx, eax
je 0x40fe80
lea eax, [ebp - 0x254]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
push eax
push ebx
call esi
and dword [ebp - 4], 0
lea eax, [ebp - 0x254]
push eax
push ebx
call esi
test eax, eax
je 0x40fe57
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x45c]
push dword [ebp + 8]
push 0x4146e4
push eax
call edi
mov eax, dword [ebp - 0x254]
add esp, 0x10
and eax, 0x10
cmp al, 0x10
je 0x40fe31
lea eax, [ebp - 4]
push 0
push eax
lea eax, [ebp - 0x45c]
push 0x41b828
push eax
call fcn.00405972
jmp 0x40fde2
lea eax, [ebp - 0x45c]
push eax
lea eax, [ebp - 0x45c]
push 0x41ad24
push eax
call edi
lea eax, [ebp - 0x45c]
push eax
call fcn.0040fd87
add esp, 0x10
jmp 0x40fde2
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
pop esi
jne 0x40fe7e
push eax
lea eax, [ebp - 4]
push eax
push 0x41b828
push dword [ebp + 8]
call fcn.00405972
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x40ff70
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x4140b0
push ebx
call sub.MSVCRT.dll_wcsstr
xor edi, edi
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp + 8], eax
je 0x4100ad
push esi
mov esi, dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp + 8]
cmp word [eax - 2], 0x5c
je 0x41008e
push 0x104
lea eax, [ebp - 0x210]
push edi
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [ebp + 8]
sub eax, ebx
sar eax, 1
push eax
lea eax, [ebp - 0x210]
push ebx
push eax
call sub.MSVCRT.dll_memcpy
lea eax, [ebp - 0x210]
push 0x41ad8c
push eax
call sub.MSVCRT.dll_wcsstr
add esp, 0x20
test eax, eax
jne 0x41008e
lea eax, [ebp - 0x210]
push eax
call sub.MSVCRT.dll_wcslen
test eax, eax
pop ecx
je 0x41008e
lea eax, [ebp - 0x210]
push eax
push edi
push 0x180
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
push edi
push edi
push 3
mov dword [ebp - 4], eax
push edi
push 1
lea eax, [ebp - 0x210]
push 0x80000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x410062
push 0x4140b0
push edi
lea eax, [ebp - 0x210]
push 1
push eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Could_not_to_open_file_in_dialogs_FillFileList
call fcn.00405d3c
add esp, 0x18
jmp 0x410074
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp - 8]
push ebx
push dword [ebp - 4]
push 0x19a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call esi
add dword [0x41cb98], ebx
mov eax, dword [ebp + 8]
push 0x4140b0
lea ebx, [eax + 4]
push ebx
call sub.MSVCRT.dll_wcsstr
pop ecx
cmp eax, edi
pop ecx
mov dword [ebp + 8], eax
jne 0x40ff9f
pop esi
pop edi
xor eax, eax
pop ebx
leave
ret
Function at 0x1028ef5
Capabilities:
Terminate process

Disassembly:
sub esp, 0x38
mov eax, dword [0x1251b5c]
xor eax, dword [esp + 0x38]
push esi
mov esi, ecx
lea ecx, [esi + 0x2c0]
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], ecx
call fcn.0101eb36
cmp eax, 0xffffffff
mov dword [esp + 8], eax
je 0x102910b
push ebx
mov ebx, dword [esi + 0x7c]
push ebp
xor ebp, ebp
cmp dword [ebx + 0x1010], ebp
push edi
jle 0x1028fac
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x7c]
push dword [eax + 0x174]
mov edi, dword [eax + 0x100c]
push dword [eax + 0x170]
add edi, dword [esp + 0x18]
push dword [eax + 0x16c]
push dword [eax + 0x168]
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.0101a461
cmp edx, dword [esi + 0x6c]
jb 0x1028f9b
ja 0x1028f74
cmp eax, dword [esi + 0x68]
jb 0x1028f9b
cmp edx, dword [esi + 0x74]
ja 0x1028fac
jb 0x1028f80
cmp eax, dword [esi + 0x70]
ja 0x1028fac
push dword [edi + 0x18]
lea ecx, [ebx + 0x101c]
push dword [edi + 4]
push dword [edi]
call fcn.0101cfdb
test eax, eax
je 0x1028f9b
or byte [eax + 0x40], 0x80
mov ebx, dword [esi + 0x7c]
add dword [esp + 0x10], 0x40
inc ebp
cmp ebp, dword [ebx + 0x1010]
jl 0x1028f38
lea ebx, [esi + 0x240]
mov ecx, ebx
call fcn.010285c6
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0x1003c28
push 0
push 0x180
push dword [esi + 0x260]
call ebp
push 0
push eax
mov ecx, ebx
call fcn.010285ad
lea ecx, [esi + 0x340]
mov dword [esp + 0x10], ecx
call fcn.0101a24c
mov eax, dword [esi + 0x7c]
mov edi, dword [eax + 0x1030]
add eax, 0x101c
mov dword [eax + 0x24], edi
jmp 0x10290d5
test byte [edi + 0x40], 0x80
je 0x10290bb
lea eax, [edi + 0x20]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
test eax, eax
pop ecx
lea eax, [edi + 0x20]
push eax
je 0x1029055
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
push eax
lea eax, [edi + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
lea eax, [edi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x24]
sub ecx, 4
mov byte [eax + ecx], 0
jmp 0x1029060
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [edi + 0x1c]
lea eax, [esp + 0x28]
push eax
push 0x1003c20
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x24]
push eax
push 0
push 0x180
push dword [esi + 0x260]
call ebp
mov ecx, dword [edi + 0x44]
push dword [ecx*4 + 0x1079d68]
mov ecx, ebx
push eax
call fcn.010285ad
and dword [edi + 0x40], 0x7f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 1
call fcn.0101b5bf
mov eax, dword [esi + 0x7c]
mov ecx, dword [eax + 0x1040]
add eax, 0x101c
test ecx, ecx
je 0x10290d2
mov ecx, dword [ecx]
mov dword [eax + 0x24], ecx
mov edi, dword [eax + 0x24]
test edi, edi
jne 0x1029002
push edi
push 1
push 0x185
push dword [esi + 0x260]
call ebp
push dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
call fcn.010285d9
push dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
push eax
call fcn.0101af65
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, dword [esp + 0x3c]
pop esi
add esp, 0x38
jmp fcn.0105b9a4
Function at 0x1028f01
Capabilities:
Terminate process

Disassembly:
sub esp, 0x38
mov eax, dword [0x1251b5c]
xor eax, dword [esp + 0x38]
push esi
mov esi, ecx
lea ecx, [esi + 0x2c0]
mov dword [esp + 0x38], eax
mov dword [esp + 0xc], ecx
call fcn.0101eb36
cmp eax, 0xffffffff
mov dword [esp + 8], eax
je 0x102910b
push ebx
mov ebx, dword [esi + 0x7c]
push ebp
xor ebp, ebp
cmp dword [ebx + 0x1010], ebp
push edi
jle 0x1028fac
mov dword [esp + 0x10], ebp
mov eax, dword [esi + 0x7c]
push dword [eax + 0x174]
mov edi, dword [eax + 0x100c]
push dword [eax + 0x170]
add edi, dword [esp + 0x18]
push dword [eax + 0x16c]
push dword [eax + 0x168]
push dword [edi + 0xc]
push dword [edi + 8]
call fcn.0101a461
cmp edx, dword [esi + 0x6c]
jb 0x1028f9b
ja 0x1028f74
cmp eax, dword [esi + 0x68]
jb 0x1028f9b
cmp edx, dword [esi + 0x74]
ja 0x1028fac
jb 0x1028f80
cmp eax, dword [esi + 0x70]
ja 0x1028fac
push dword [edi + 0x18]
lea ecx, [ebx + 0x101c]
push dword [edi + 4]
push dword [edi]
call fcn.0101cfdb
test eax, eax
je 0x1028f9b
or byte [eax + 0x40], 0x80
mov ebx, dword [esi + 0x7c]
add dword [esp + 0x10], 0x40
inc ebp
cmp ebp, dword [ebx + 0x1010]
jl 0x1028f38
lea ebx, [esi + 0x240]
mov ecx, ebx
call fcn.010285c6
mov ebp, dword [sym.imp.USER32.dll_SendMessageA]
push 0x1003c28
push 0
push 0x180
push dword [esi + 0x260]
call ebp
push 0
push eax
mov ecx, ebx
call fcn.010285ad
lea ecx, [esi + 0x340]
mov dword [esp + 0x10], ecx
call fcn.0101a24c
mov eax, dword [esi + 0x7c]
mov edi, dword [eax + 0x1030]
add eax, 0x101c
mov dword [eax + 0x24], edi
jmp 0x10290d5
test byte [edi + 0x40], 0x80
je 0x10290bb
lea eax, [edi + 0x20]
push 0x2e
push eax
call dword [sym.imp.msvcrt.dll_strchr]
pop ecx
test eax, eax
pop ecx
lea eax, [edi + 0x20]
push eax
je 0x1029055
call dword [sym.imp.KERNEL32.dll_lstrlenA]
sub eax, 4
push eax
lea eax, [edi + 0x20]
push eax
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
lea eax, [edi + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea ecx, [esp + 0x24]
sub ecx, 4
mov byte [eax + ecx], 0
jmp 0x1029060
lea eax, [esp + 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push dword [edi + 0x1c]
lea eax, [esp + 0x28]
push eax
push 0x1003c20
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
lea eax, [esp + 0x24]
push eax
push 0
push 0x180
push dword [esi + 0x260]
call ebp
mov ecx, dword [edi + 0x44]
push dword [ecx*4 + 0x1079d68]
mov ecx, ebx
push eax
call fcn.010285ad
and dword [edi + 0x40], 0x7f
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], 1
call fcn.0101b5bf
mov eax, dword [esi + 0x7c]
mov ecx, dword [eax + 0x1040]
add eax, 0x101c
test ecx, ecx
je 0x10290d2
mov ecx, dword [ecx]
mov dword [eax + 0x24], ecx
mov edi, dword [eax + 0x24]
test edi, edi
jne 0x1029002
push edi
push 1
push 0x185
push dword [esi + 0x260]
call ebp
push dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
call fcn.010285d9
push dword [esp + 0x14]
mov ecx, dword [esp + 0x14]
push eax
call fcn.0101af65
pop edi
pop ebp
pop ebx
mov ecx, dword [esp + 0x38]
xor ecx, dword [esp + 0x3c]
pop esi
add esp, 0x38
jmp fcn.0105b9a4
Function at 0x1039941
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x1251b5c]
xor eax, dword [ebp + 0x7c]
push edi
push 0x25
mov dword [ebp + 0x74], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x20]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
pop edi
jge 0x1039983
push 0
push 0x30
push 0x1006fe0
jmp 0x10399b4
cmp dword [ebp - 0x1c], 5
jb 0x10399ab
xor eax, eax
inc eax
cmp dword [ebp - 0x1c], 5
jne 0x1039997
cmp dword [ebp - 0x18], eax
jb 0x10399ab
cmp dword [ebp - 0x14], 0xa28
jae 0x10399bb
push 0
push 0x30
push 0x1006f80
jmp 0x10399b4
push 0
push 0x30
push 0x1006f50
call fcn.0102e0c1
xor eax, eax
mov ecx, dword [ebp + 0x74]
xor ecx, dword [ebp + 0x7c]
call fcn.0105b9a4
add ebp, 0x78
leave
ret
Function at 0x103a5af
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
lea eax, [ebp - 8]
push eax
push 3
xor edi, edi
push edi
push 0x1007338
push 0x80000002
mov dword [ebp - 8], edi
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x103a61d
push esi
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
mov esi, 0x1007324
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
cmp dword [ebp + 8], edi
je 0x103a5fc
or byte [ebp - 3], 0x10
jmp 0x103a600
and byte [ebp - 3], 0xef
push 4
lea eax, [ebp - 4]
push eax
push 4
push edi
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop edi
leave
ret 4

Function at 0x103a8ca
Capabilities:
Get common file path
Get startup folder

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x18
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jne 0x103a91c
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListA]
cmp dword [ebp - 4], 0
je 0x103a91c
lea eax, [ebp - 8]
push eax
push 1
call dword [sym.imp.ole32.dll_CoGetMalloc]
test eax, eax
jne 0x103a91c
mov eax, dword [ebp - 8]
push dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
leave
ret 4

Function at 0x103aaba
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x1251b5c]
xor eax, dword [ebp + 4]
push esi
push edi
mov edi, ecx
push dword [edi + 0x90]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov esi, eax
dec esi
js 0x103aaf2
mov eax, dword [edi + 0x90]
cmp byte [eax + esi], 0x5c
je 0x103aaf2
dec esi
jns 0x103aae9
test esi, esi
jle 0x103ab49
push dword [edi + 0x90]
mov edi, dword [sym.imp.msvcrt.dll__snprintf]
lea eax, [ebp - 0x108]
push esi
push eax
call edi
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
mov byte [ebp + esi - 0x108], 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 1
je 0x103ab44
lea eax, [ebp - 0x108]
push eax
push 0x100760c
lea eax, [ebp - 0x20c]
push 0x104
push eax
call edi
jmp 0x103ab65
xor eax, eax
inc eax
jmp 0x103ab7a
push 0x1004dc8
push 0x10075e0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x10
push 0
lea eax, [ebp - 0x20c]
push 0x30
push eax
call fcn.0102e0c1
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
call fcn.0105b9a4
leave
ret
Function at 0x103b889
Capabilities:
Extract resource via kernel32 functions
Persist via lnk shortcut
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x528
mov eax, dword [0x1251b5c]
xor eax, dword [ebp + 4]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x528]
mov esi, ecx
xor ebx, ebx
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
call fcn.0103a8ca
push 0x1007a64
lea eax, [ebp - 0x528]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
add esi, 0x90
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [esi]
mov edi, eax
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [edi - 1]
cmp eax, ebx
jl 0x103b904
cmp byte [ebp + eax - 0x118], 0x5c
je 0x103b8fd
dec eax
jns 0x103b8ee
jmp 0x103b904
mov byte [ebp + eax - 0x118], bl
push 0xa
push 0xe0
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
cmp esi, ebx
jne 0x103b925
push ebx
push 0x30
push 0x1007a34
jmp 0x103b9bc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp eax, ebx
mov dword [ebp - 0x14], eax
jne 0x103b945
push ebx
push 0x30
push 0x1007a00
jmp 0x103b9bc
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
lea eax, [ebp - 0x118]
push eax
push 0x10079e8
mov esi, 0x104
lea eax, [ebp - 0x320]
push esi
push eax
call dword [sym.imp.msvcrt.dll__snprintf]
add esp, 0x10
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
lea eax, [ebp - 0x320]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 8], eax
push ebx
jne 0x103b9a0
push 0x30
push 0x10079b4
jmp 0x103b9bc
lea ecx, [ebp - 0x10]
push ecx
push edi
push dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
cmp dword [ebp - 0x10], edi
je 0x103b9c6
push ebx
push 0x30
push 0x100798c
call fcn.0102e0c1
jmp 0x103ba53
cmp dword [ebp - 8], ebx
je 0x103b9d4
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
lea eax, [ebp - 0x424]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp dword [ebp + 8], ebx
je 0x103ba0a
push 0x1007248
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x103ba2f
lea eax, [ebp - 0x424]
push eax
push 0x32
push 0x1007978
jmp 0x103ba1f
lea eax, [ebp - 0x424]
push eax
mov eax, dword [ebp - 0xc]
push dword [eax + 0x438]
push 0x1007970
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0x10
mov ecx, dword [ebp - 0xc]
lea eax, [ebp - 0x21c]
push eax
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x528]
push eax
call fcn.0103a731
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.0105b9a4
leave
ret 4
Function at 0x103ba65
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1251b5c]
xor eax, dword [ebp + 4]
push ebx
push esi
mov dword [ebp - 4], eax
push edi
lea eax, [ebp - 0x20c]
push eax
mov esi, ecx
call fcn.0103a8ca
push 0x1007a64
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x20c]
push eax
call edi
add esi, 0x90
push dword [esi]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push dword [esi]
mov ebx, eax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebx - 1]
test eax, eax
jl 0x103bae8
cmp byte [ebp + eax - 0x108], 0x5c
je 0x103bae0
dec eax
jns 0x103bad1
jmp 0x103bae8
mov byte [ebp + eax - 0x108], 0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x310]
push 0x10079e8
push eax
call dword [sym.imp.msvcrt.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
call edi
mov ecx, dword [ebp - 4]
xor ecx, dword [ebp + 4]
pop edi
pop esi
pop ebx
call fcn.0105b9a4
leave
ret
Function at 0x103d53c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0x40
call sub.MFC42.DLL_operatornew
pop ecx
mov ecx, dword [ebp + 8]
xor edx, edx
cmp eax, edx
mov dword [ecx], eax
jne 0x103d567
push edx
push 0x30
push 0x10067b8
call fcn.0102e0c1
push 1
call dword [sym.imp.msvcrt.dll_exit]
push esi
mov esi, dword [ebp + 0xc]
mov dword [eax + 0xc], esi
mov eax, dword [ecx]
mov si, word [ebp + 0x14]
mov word [eax + 0x14], si
mov eax, dword [ecx]
mov esi, dword [ebp + 0x10]
mov dword [eax + 0x10], esi
mov eax, dword [ecx]
mov si, word [ebp + 0x18]
mov word [eax + 0x16], si
mov eax, dword [ecx]
mov esi, dword [ebp + 0x1c]
mov dword [eax + 0x24], esi
mov eax, dword [ecx]
mov dword [eax], edx
mov eax, dword [ecx]
mov dword [eax + 4], edx
mov eax, dword [ecx]
mov dword [eax + 8], edx
mov eax, dword [ecx]
mov dword [eax + 0x18], edx
mov eax, dword [ecx]
mov dword [eax + 0x1c], edx
mov eax, dword [ecx]
mov dword [eax + 0x20], edx
mov eax, dword [ecx]
mov dword [eax + 0x28], edx
mov dword [eax + 0x2c], edx
mov eax, dword [ecx]
mov dword [eax + 0x30], edx
mov dword [eax + 0x34], edx
pop esi
pop ebp
ret 0x18