joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407b80
Capabilities:
Delete file
Read .ini file
Set file attributes

Disassembly:
sub esp, 0x140
mov al, byte [0x414498]
push esi
mov esi, dword [esp + 0x148]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push esi
lea ecx, [esp + 0x10]
push 0x38
lea edx, [esp + 0x13]
push ecx
push edx
push str.Class
push str.Version
mov byte [esp + 0x23], al
mov byte [esp + 0x24], 0
call edi
lea eax, [esp + 0xc]
push str.Modem
push eax
call fcn.0040a7c0
add esp, 8
test eax, eax
jne 0x407ce7
push esi
lea ecx, [esp + 0x10]
push 0x38
lea edx, [esp + 0x13]
push ecx
push edx
push 0x410be0
push str.Strings
mov byte [esp + 0x24], al
call edi
mov eax, dword [0x410060]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0040a7c0
add esp, 8
test eax, eax
je 0x407c88
mov edx, dword [str.LUCENT]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.0040a7c0
add esp, 8
test eax, eax
je 0x407c88
mov ecx, dword [str.AGERE]
lea edx, [esp + 0xc]
push ecx
push edx
call fcn.0040a7c0
add esp, 8
test eax, eax
je 0x407c88
mov eax, dword [str.COMPAQ]
lea ecx, [esp + 0xc]
push eax
push ecx
call fcn.0040a7c0
add esp, 8
test eax, eax
je 0x407c88
mov edx, dword [str.TOSHIBA]
lea eax, [esp + 0xc]
push edx
push eax
call fcn.0040a7c0
add esp, 8
test eax, eax
je 0x407c88
mov eax, dword [0x414470]
test eax, eax
je 0x407ce7
lea ecx, [esp + 0xc]
push 0x4149e0
push ecx
call fcn.0040a7c0
add esp, 8
test eax, eax
jne 0x407ce7
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
add eax, 0xfffffffe
lea edx, [esp + 0x44]
push eax
push esi
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp + 0x44]
push 0x41114c
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatA]
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push pe_nt_image_headers32
push esi
call edi
lea ecx, [esp + 0x44]
push pe_nt_image_headers32
push ecx
call edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
call esi
lea edx, [esp + 0x44]
push edx
call esi
mov eax, 1
pop edi
pop esi
add esp, 0x140
ret
pop edi
xor eax, eax
pop esi
add esp, 0x140
ret
Function at 0x407d00
Capabilities:
Delete registry key
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
lea eax, [esp + 4]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x20019
push 0
push str.SystemCurrentControlSetServicesClassNoDevice
push 0x80000002
call ebp
test eax, eax
jne 0x407e56
push edi
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor edi, edi
lea ecx, [esp + 0x20]
lea edx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
lea ecx, [esp + 0xb8]
mov eax, edi
push edx
mov edx, dword [esp + 0x28]
push ecx
push eax
push edx
mov dword [esp + 0x38], 0x100
mov dword [esp + 0x3c], pe_nt_image_headers32
inc edi
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x407e48
lea eax, [esp + 0x28]
push str.SystemCurrentControlSetServicesClassNoDevice
push eax
call ebx
lea ecx, [esp + 0x28]
push 0x410350
push ecx
call esi
lea edx, [esp + 0xa8]
lea eax, [esp + 0x28]
push edx
push eax
call esi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x28]
push ecx
push 0x20019
push 0
push edx
push 0x80000002
call ebp
test eax, eax
jne 0x407e38
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x18]
lea ecx, [esp + 0x128]
push eax
push ecx
push 0
push 0
push str.ProviderName
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x407e38
lea eax, [esp + 0x128]
push eax
call fcn.0040a330
add esp, 4
lea ecx, [esp + 0x128]
push 0x411150
push ecx
call fcn.0040a7c0
add esp, 8
test eax, eax
je 0x407e27
lea edx, [esp + 0x128]
push str.LUCENT
push edx
call fcn.0040a7c0
add esp, 8
test eax, eax
jne 0x407e38
lea eax, [esp + 0x28]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
dec edi
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x407d3e
mov edx, dword [esp + 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop esi
pop edi
pop ebp
add esp, 0x218
ret
Function at 0x408420
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x194
lea eax, [esp]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1a8]
push eax
push 0x20019
push 0
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea ecx, [esp + 0x18]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0x14]
push 0
push 0
push 0
lea eax, [esp + 0x30]
push edx
push eax
push 0
push ecx
mov dword [esp + 0x34], 0x100
call ebp
test eax, eax
jne 0x4084c0
lea edx, [esp + 0xa0]
push edi
push edx
call ebx
lea eax, [esp + 0xa0]
push 0x410350
push eax
call esi
lea ecx, [esp + 0x20]
lea edx, [esp + 0xa0]
push ecx
push edx
call esi
lea eax, [esp + 0xa0]
push eax
call fcn.00408420
add esp, 4
jmp 0x40845b
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x194
ret

Function at 0x408720
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xb00
lea eax, [esp]
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x415080
push eax
xor esi, esi
call edi
push 0x415080
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp eax, 3
jle 0x40875f
lea ecx, [esp + 0xc]
push 0x410350
push ecx
call ebx
cmp dword [0x410220], 4
je 0x408774
lea edx, [esp + 0xc]
push str.ltsetup.ini
push edx
jmp 0x40877e
lea eax, [esp + 0xc]
push str.agsetup.ini
push eax
call ebx
mov ecx, dword [esp + 0xb10]
lea edx, [esp + 0x18c]
push ecx
push edx
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x310]
push 0x800
push ecx
push 0
lea edx, [esp + 0x19c]
push 0
push edx
call ebx
mov al, byte [esp + 0x30c]
test al, al
je 0x408815
mov byte [esp + esi + 0x10c], al
mov al, byte [esp + esi + 0x30d]
inc esi
test al, al
jne 0x4087c3
mov byte [esp + esi + 0x10c], al
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x210]
push 0x100
push ecx
lea edx, [esp + 0x118]
push 0
lea eax, [esp + 0x19c]
push edx
push eax
call ebx
mov edx, dword [esp + 0xb14]
lea ecx, [esp + 0x20c]
push ecx
push edx
call edi
pop edi
pop esi
pop ebx
add esp, 0xb00
ret
Function at 0x408940
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xb84
mov eax, dword [0x410a08]
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
push edi
lea ecx, [esp + 0x114]
push 0x415080
push ecx
mov dword [esp + 0x18], eax
xor ebx, ebx
xor edi, edi
xor esi, esi
call ebp
push 0x415080
call dword [sym.imp.KERNEL32.dll_lstrlenA]
cmp eax, 3
jle 0x408991
lea edx, [esp + 0x114]
push 0x410350
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp dword [0x410220], 4
je 0x4089a9
lea eax, [esp + 0x114]
push str.ltsetup.ini
push eax
jmp 0x4089b6
lea ecx, [esp + 0x114]
push str.agsetup.ini
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea edx, [esp + 0x94]
push str.MOH_COPY_FILES
push edx
call ebp
lea eax, [esp + 0x114]
lea ecx, [esp + 0x394]
push eax
push 0x800
push ecx
push ebx
lea edx, [esp + 0xa4]
push ebx
push edx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + edi + 0x394]
cmp al, bl
je 0x408a8f
mov byte [esp + esi + 0x14], al
mov al, byte [esp + edi + 0x395]
inc esi
inc edi
cmp al, bl
jne 0x4089ff
lea eax, [esp + 0x114]
lea ecx, [esp + 0x294]
push eax
push 0x100
push ecx
lea edx, [esp + 0x20]
push ebx
lea eax, [esp + 0xa4]
push edx
push eax
mov byte [esp + esi + 0x2c], bl
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x294]
push ecx
push edx
call fcn.0040a180
add esp, 8
push eax
lea eax, [esp + 0x218]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push ebx
call fcn.0040a180
add esp, 8
cmp eax, ebx
jne 0x408a87
mov eax, dword [esp + 0xb98]
lea edx, [esp + 0x214]
push edx
push eax
call fcn.00403040
add esp, 8
xor esi, esi
inc edi
jmp 0x4089f0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xb84
ret
Function at 0x409470
Capabilities:
Read .ini file

Disassembly:
sub esp, 0xa84
lea eax, [esp + 0x80]
push ebx
push ebp
push esi
push edi
push 0x415080
push eax
xor ebx, ebx
xor edi, edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea ecx, [esp + 0x90]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
cmp eax, 3
jle 0x4094bb
lea edx, [esp + 0x90]
push 0x410350
push edx
call ebp
cmp dword [0x410220], 4
je 0x4094d3
lea eax, [esp + 0x90]
push str.ltsetup.ini
push eax
jmp 0x4094e0
lea ecx, [esp + 0x90]
push str.agsetup.ini
push ecx
call ebp
mov ebp, dword [esp + 0xa98]
lea edx, [esp + 0x90]
push edx
lea eax, [esp + 0x298]
push 0x800
push eax
push ebx
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
mov al, byte [esp + edi + 0x294]
cmp al, bl
je 0x409625
mov byte [esp + esi + 0x10], al
mov al, byte [esp + edi + 0x295]
inc esi
inc edi
cmp al, bl
jne 0x409516
lea ecx, [esp + 0x194]
push 0x414498
push ecx
mov byte [esp + esi + 0x18], bl
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [esp + 0x90]
lea eax, [esp + 0x194]
push edx
push 0x100
push eax
lea ecx, [esp + 0x1c]
push ebx
push ecx
push ebp
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
lea edx, [esp + 0x10]
push edx
call fcn.0040a330
add esp, 4
lea eax, [esp + 0x10]
push str.CABFILE
push eax
call fcn.0040a100
add esp, 8
test eax, eax
je 0x40959b
lea ecx, [esp + 0x194]
push ecx
call fcn.00408e10
add esp, 4
xor esi, esi
inc edi
jmp 0x409507
lea edx, [esp + 0x10]
push str.COPYFILE
push edx
call fcn.0040a100
add esp, 8
test eax, eax
je 0x4095c9
lea eax, [esp + 0x194]
push eax
call fcn.00408e60
add esp, 4
xor esi, esi
inc edi
jmp 0x409507
lea ecx, [esp + 0x10]
push str.EXEFILE
push ecx
call fcn.0040a100
add esp, 8
test eax, eax
je 0x4095f7
lea edx, [esp + 0x194]
push edx
call fcn.00409010
add esp, 4
xor esi, esi
inc edi
jmp 0x409507
lea eax, [esp + 0x10]
push str.HOMOLFILE
push eax
call fcn.0040a100
add esp, 8
test eax, eax
je 0x40961d
lea ecx, [esp + 0x194]
push ecx
call fcn.00409310
add esp, 4
xor esi, esi
inc edi
jmp 0x409507
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xa84
ret
Function at 0x409750
Capabilities:
Delete directory
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 0x138
mov ecx, 0xb
xor eax, eax
lea edx, [esp + 0x34]
push ebx
push esi
push edi
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea edi, [esp + 0x10]
push str.ltmoh.log
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov edi, 0x415960
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x44]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.ltmoh
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x44]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call fcn.00403210
add esp, 8
lea ecx, [esp + 0x40]
push str.ltmoh.exe
push ecx
call fcn.00403210
add esp, 8
lea edx, [esp + 0x40]
push str.mohapi.dll
push edx
call fcn.00403210
add esp, 8
lea eax, [esp + 0x40]
push str.ltmoh.ini
push eax
call fcn.00403210
add esp, 8
lea ecx, [esp + 0x40]
push str.mfc42.dll
push ecx
call fcn.00403210
add esp, 8
lea edx, [esp + 0x40]
push str.mohhelp.chm
push edx
call fcn.00403210
add esp, 8
lea eax, [esp + 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea ecx, [esp + 0xc]
lea edx, [esp + 0x10]
push ecx
push 0xf003f
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409866
mov eax, dword [esp + 0xc]
push str.LtMoh
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLTMOH
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
call fcn.00409ba0
pop edi
pop esi
pop ebx
add esp, 0x138
ret
Function at 0x409890
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 0x60
mov ecx, dword [0x411820]
push esi
push edi
mov dword [esp + 0x1c], ecx
mov ecx, 0xb
mov esi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
lea edi, [esp + 0x38]
mov eax, dword [str.LTWinModem]
rep movsd dword es:[edi], dword [esi]
mov dx, word [0x411824]
mov dword [esp + 0x18], eax
mov al, byte [0x411826]
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLTWinModem
movsw word es:[edi], word [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push 0x80000002
mov word [esp + 0x28], dx
mov byte [esp + 0x2a], al
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLucent_Technologies_Soft_Modem
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallLucent_Technologies_Soft_Modem_AMR
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallToshiba_Soft_Modem
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallToshiba_Soft_Modem_AMR
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallToshiba_Software_Modem
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallToshiba_Software_Modem_AMR
push 0x80000002
call esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstallAgere_Systems_Soft_Modem
push 0x80000002
call esi
lea ecx, [esp + 8]
lea edx, [esp + 0x38]
push ecx
push 0x20006
push 0
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4099e9
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_lstrcatA]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov edi, 1
lea eax, [esp + 0x2c]
push 0x414498
push eax
call esi
lea ecx, [esp + 0x14]
push 0x414498
push ecx
call esi
lea edx, [esp + 0x14]
push 0xa
push edx
push edi
call fcn.0040a600
add esp, 0xc
lea eax, [esp + 0x20]
lea ecx, [esp + 0x2c]
push eax
push ecx
call esi
lea edx, [esp + 0x14]
lea eax, [esp + 0x2c]
push edx
push eax
call ebp
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x2c]
push ecx
push edx
call ebx
inc edi
cmp edi, 0xa
jl 0x409972
mov eax, dword [esp + 0x10]
push str.LTSMMSG
push eax
call ebx
mov ecx, dword [esp + 0x10]
push str.AGRSMMSG
push ecx
call ebx
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ebx
pop ebp
pop edi
pop esi
add esp, 0x60
ret
Function at 0x4099f0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
lea eax, [esp + 4]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409a3b
mov edx, dword [esp + 4]
lea ecx, [esp]
push ecx
push 0x415960
push eax
push eax
push str.ProgramFilesDir
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 8
ret
mov al, byte [0x414a20]
mov cl, byte [0x414a21]
push edi
mov byte [0x415960], al
mov byte [0x415961], cl
mov edi, str.PROGRA1
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push esi
mov esi, edi
mov edx, ecx
mov edi, 0x415960
or ecx, 0xffffffff
mov byte [0x415962], 0
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop esi
pop edi
add esp, 8
ret

Function at 0x409a90
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x84
push ebx
push ebp
push esi
push edi
push 0
push 0x20
push 2
push 0
push 3
push 0xc0000000
push 0x415600
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x409ad3
push 0
push str.Debug
push str.Create_Log_Failed
push 0
call fcn.00404fa0
add esp, 0x10
xor esi, esi
mov ebp, dword [sym.imp.USER32.dll_wsprintfA]
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x14]
push str._ResponseResult_
push eax
call ebp
add esp, 8
lea ecx, [esp + 0x10]
lea edi, [esp + 0x14]
xor eax, eax
push 0
push ecx
or ecx, 0xffffffff
mov ebx, dword [sym.imp.KERNEL32.dll_WriteFile]
repne scasb al, byte es:[edi]
not ecx
dec ecx
lea edx, [esp + 0x1c]
push ecx
push edx
push esi
call ebx
lea eax, [esp + 0x10]
push 0
push eax
push 2
push 0x411890
push esi
call ebx
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x98]
test eax, eax
je 0x409b4e
lea ecx, [esp + 0x14]
push str.ResultCode0
push ecx
jmp 0x409b58
lea edx, [esp + 0x14]
push str.ResultCode1
push edx
call ebp
add esp, 8
lea eax, [esp + 0x10]
lea edi, [esp + 0x14]
or ecx, 0xffffffff
push 0
push eax
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
lea ecx, [esp + 0x20]
push ecx
push esi
call ebx
lea edx, [esp + 0x10]
push 0
push edx
push 2
push 0x411890
push esi
call ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x84
ret
Function at 0x409ba0
Capabilities:
Delete directory
Delete file
Delete registry key
Print debug messages
Query or enumerate registry value
Set file attributes

Disassembly:
sub esp, 0x130
mov eax, dword [str.LinkName]
push esi
push edi
mov ecx, 5
mov esi, str.SOFTWARELucentMOH
lea edi, [esp + 0x20]
mov dl, byte [0x4118d8]
mov dword [esp + 0x14], eax
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [0x4118d4]
lea eax, [esp + 0xc]
mov dword [esp + 0x18], ecx
lea ecx, [esp + 0x20]
push eax
push ecx
push 0x80000002
mov byte [esp + 0x28], dl
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x409c8e
lea edx, [esp + 8]
lea eax, [esp + 0x34]
push edx
lea ecx, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push ecx
lea edx, [esp + 0x20]
push 0
push edx
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x20], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409c83
mov esi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [esp + 0x34]
push pe_nt_image_headers32
push ecx
call esi
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 8]
test eax, eax
jle 0x409c83
mov cl, byte [esp + eax + 0x34]
mov byte [esp + eax + 0x34], 0
cmp cl, 0x5c
je 0x409c61
dec eax
test eax, eax
jg 0x409c4c
jmp 0x409c83
lea eax, [esp + 0x34]
push pe_nt_image_headers32
push eax
call esi
lea ecx, [esp + 0x34]
push ecx
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
lea edx, [esp + 0x34]
push edx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [esp + 0x20]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
add esp, 0x130
ret
Function at 0x409d00
Capabilities:
Write file on windows

Disassembly:
mov eax, dword [0x41447c]
sub esp, 0x94
test eax, eax
je 0x409e22
push edi
lea eax, [esp + 8]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov edx, dword [esp + 0x16]
mov ecx, 0x20
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x10]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x1a]
push eax
mov eax, dword [esp + 0x1a]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
lea ecx, [esp + 0x34]
push str._d__d__d__d:_d:_d__
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edi, [esp + 0x3c]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x20
repne scasb al, byte es:[edi]
mov esi, dword [sym.imp.KERNEL32.dll_WriteFile]
lea edx, [esp + 8]
not ecx
push 0
dec ecx
push edx
push ecx
mov ecx, dword [0x41447c]
lea eax, [esp + 0x28]
push eax
push ecx
call esi
lea edx, [esp + 8]
push 0
push edx
mov edx, dword [esp + 0xac]
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
mov eax, dword [0x41447c]
not ecx
dec ecx
push ecx
push edx
push eax
call esi
mov edx, dword [0x41447c]
lea ecx, [esp + 8]
push 0
push ecx
push 2
push 0x41153c
push edx
call esi
mov edx, dword [esp + 0xa0]
lea eax, [esp + 8]
push 0
push eax
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
mov ecx, dword [0x41447c]
push edx
push ecx
call esi
mov eax, dword [0x41447c]
lea edx, [esp + 8]
push 0
push edx
push 2
push 0x411890
push eax
call esi
pop esi
pop edi
add esp, 0x94
ret

Function at 0x409e50
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x409e73
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0040add0
add esp, 4
or eax, 0xffffffff
ret
test al, 1
je 0x409e96
test byte [esp + 8], 2
je 0x409e96
mov dword [0x4144b0], 0xd
mov dword [0x4144b4], 5
or eax, 0xffffffff
ret
xor eax, eax
ret
Function at 0x409ec0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x10c
push ebx
mov ebx, dword [esp + 0x114]
push esi
push edi
test ebx, ebx
je 0x409f31
push ebx
call fcn.00409ff0
add esp, 4
test eax, eax
jne 0x409eff
mov dword [0x4144b4], 0xf
mov dword [0x4144b0], 0xd
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea eax, [esp + 0x10]
lea ecx, [esp + 0x14]
push eax
push ecx
lea edx, [esp + 0x14]
add bl, 0x40
push 0x104
push edx
mov byte [esp + 0x1c], bl
mov byte [esp + 0x1d], 0x3a
mov byte [esp + 0x1e], 0x2e
mov byte [esp + 0x1f], 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameA]
jmp 0x409f41
lea eax, [esp + 0x14]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
test eax, eax
je 0x409fd7
inc eax
cmp eax, 0x104
ja 0x409fd7
mov edx, dword [esp + 0x120]
mov ecx, dword [esp + 0x124]
test edx, edx
jne 0x409f90
cmp eax, ecx
jg 0x409f6d
mov eax, ecx
push eax
call fcn.0040a280
mov edx, eax
add esp, 4
test edx, edx
jne 0x409faa
mov dword [0x4144b0], 0xc
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
cmp eax, ecx
jle 0x409faa
mov dword [0x4144b0], 0x22
xor eax, eax
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
mov eax, edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x10c
ret
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x10c
ret

Function at 0x409ff0
Capabilities:
Get disk information

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x409ffe
mov eax, 1
ret
add al, 0x40
mov byte [esp + 5], 0x3a
mov byte [esp + 4], al
lea eax, [esp + 4]
push eax
mov byte [esp + 0xa], 0x5c
mov byte [esp + 0xb], 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
test eax, eax
je 0x40a02d
cmp eax, 1
je 0x40a02d
mov eax, 1
ret
xor eax, eax
ret