joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42a420
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x110], eax
mov byte [esi], 0
mov ecx, dword [0x45aacc]
mov edx, dword [0x45aad0]
mov eax, dword [str.SOFTWARERising_]
push ebp
xor ebp, ebp
push 0xf4
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], eax
mov eax, dword [0x45aad4]
mov dword [esp + 0x14], ecx
mov cl, byte [0x45aad8]
lea edx, [esp + 0x21]
push ebp
push edx
mov dword [esp + 0x10], ebp
mov dword [esp + 0x24], eax
mov byte [esp + 0x28], cl
call fcn.00443400
lea eax, [esp + 0x18]
add esp, 0xc
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a488
sub eax, edx
mov edx, eax
lea eax, [esp + 0xc]
push edi
lea edi, [eax + 1]
jmp 0x42a4a0
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x42a4a0
mov ecx, 0x105
sub ecx, edx
push ecx
sub eax, edi
push ebx
lea edx, [esp + eax + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
lea eax, [esp + 8]
push eax
push 1
push 0
lea ecx, [esp + 0x1c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
test eax, eax
jne 0x42a52f
mov ecx, dword [esp + 4]
lea edx, [esp + 0x11c]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.installpath
push ecx
mov dword [esp + 0x20], 1
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x42a524
push 0x5c
push esi
call fcn.0043e04e
add esp, 8
test eax, eax
je 0x42a51f
cmp byte [eax + 1], 0
jne 0x42a51f
mov byte [eax], 0
mov ebp, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x114]
mov eax, ebp
pop ebp
xor ecx, esp
call fcn.0043defc
add esp, 0x114
ret
Function at 0x42c6d0
Capabilities:
Check os version

Disassembly:
sub esp, 0x134
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x130], eax
push esi
mov esi, dword [0x568c84]
push edi
push 0x98
lea eax, [esp + 0x10]
push 0
push eax
call fcn.00443400
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
mov dword [esp + 0xc], 0x9c
call edi
test eax, eax
je 0x42c73b
movzx edx, word [esp + 0x9c]
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0xc]
mov dword [esi + 4], edx
mov edx, dword [esp + 0x10]
mov dword [esi + 8], eax
mov dword [esi + 0xc], ecx
mov dword [esi + 0x10], edx
jmp 0x42c78c
push 0x90
lea eax, [esp + 0xac]
push 0
push eax
call fcn.00443400
add esp, 0xc
lea ecx, [esp + 0xa4]
push ecx
mov dword [esp + 0xa8], 0x94
call edi
mov edx, dword [esp + 0xb4]
mov eax, dword [esp + 0xa8]
mov ecx, dword [esp + 0xac]
mov dword [esi + 4], 0
mov dword [esi + 8], edx
mov dword [esi + 0xc], eax
mov dword [esi + 0x10], ecx
mov eax, dword [esi + 8]
mov ecx, 1
cmp eax, ecx
jne 0x42c79b
mov dword [esi + 0x14], ecx
cmp eax, 2
jne 0x42c7a9
cmp dword [esi + 0xc], 4
jne 0x42c7a9
mov dword [esi + 0x18], ecx
cmp dword [esi + 0xc], 6
jne 0x42c7bd
cmp dword [esi + 0x10], 0
jne 0x42c7ba
mov dword [esi + 0x1c], ecx
jmp 0x42c7bd
mov dword [esi + 0x20], ecx
push str.IsWow64Process
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x42c7e7
lea edx, [esi + 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call edi
mov eax, dword [esi + 0x24]
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0xc]
push eax
push ecx
push edx
push str.The_System_is__d._d_bIs64_d
push 0x80
call fcn.004025a0
mov ecx, dword [esp + 0x14c]
add esp, 0x14
pop edi
pop esi
xor ecx, esp
call fcn.0043defc
add esp, 0x134
ret
Function at 0x42ef20
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x454357
mov eax, dword fs:[0]
push eax
push esi
push edi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, dword [esp + 0x1c]
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x10], eax
mov dword [esp + 0x14], 0
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x14], eax
mov byte [esp + 0x14], 1
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x18], eax
mov byte [esp + 0x14], 2
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x1c], eax
mov byte [esp + 0x14], 3
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x20], eax
or edi, 0xffffffff
lea eax, [esi + 0x34]
mov byte [esp + 0x14], 4
push eax
mov dword [esi + 0x24], edi
mov dword [esi + 0x28], edi
call fcn.00434220
mov dword [esi + 0x2c], 1
mov dword [esi + 0x30], 1
mov dword [esi], edi
mov dword [esi + 4], edi
mov dword [esi + 8], edi
mov eax, esi
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
add esp, 0xc
ret 4
Function at 0x42fe00
Capabilities:
Check if file exists
Get file attributes
Inspect section memory permissions

Disassembly:
sub esp, 0x14
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x42ff65
call fcn.00438f20
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x24]
mov edi, 1
xor ebx, ebx
mov ebp, edi
cmp eax, 0xffffffff
je 0x42fec0
xor esi, esi
test al, 1
je 0x42fe51
mov esi, SysReAllocString
test al, 2
je 0x42fe5b
or esi, 0x40000000
test al, 4
je 0x42fe65
or esi, 0x20000000
test al, 8
je 0x42fe6f
or esi, 0x10000000
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push 0x221
push 0x20
push 2
lea edx, [esp + 0x24]
push edx
push esi
push eax
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 5
call fcn.00401410
mov edi, eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push edi
push esi
push ecx
push str.Set_File__s_Users_Access_Rights_0x_08X_return:__d
push 0x80
call fcn.004025a0
add esp, 0x2c
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0x28]
cmp eax, 0xffffffff
je 0x42ff43
xor esi, esi
test al, 1
je 0x42fed7
mov esi, SysReAllocString
test al, 2
je 0x42fee1
or esi, 0x40000000
test al, 4
je 0x42feeb
or esi, 0x20000000
test al, 8
je 0x42fef5
or esi, 0x10000000
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebx
push 1
lea ecx, [esp + 0x20]
push ecx
push esi
push eax
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], 1
call fcn.00401410
mov edx, dword [esp + 0x28]
add esp, 0x14
mov ebp, eax
mov eax, dword [edx]
push ebp
push esi
push eax
push str.Set_File__s_Everyone_Access_Rights_0x_08X_return:__d
push 0x80
call fcn.004025a0
add esp, 0x14
cmp edi, ebx
je 0x42ff65
cmp ebp, ebx
je 0x42ff65
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0043defc
add esp, 0x14
ret 8
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043defc
add esp, 0x14
ret 8
Function at 0x4312e0
Capabilities:
Check if file exists
Get file attributes
Inspect section memory permissions

Disassembly:
sub esp, 0x14
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
mov dword [esp + 0x10], eax
mov eax, dword [eax]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x431445
call fcn.00438f20
mov eax, dword [esp + 0x28]
mov eax, dword [eax + 0x3c]
mov edi, 1
xor ebx, ebx
mov ebp, edi
cmp eax, 0xffffffff
je 0x4313a0
xor esi, esi
test al, 1
je 0x431331
mov esi, SysReAllocString
test al, 2
je 0x43133b
or esi, 0x40000000
test al, 4
je 0x431345
or esi, 0x20000000
test al, 8
je 0x43134f
or esi, 0x10000000
mov ecx, dword [esp + 0x14]
mov eax, dword [ecx]
push 0x221
push 0x20
push 2
lea edx, [esp + 0x24]
push edx
push esi
push eax
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
mov byte [esp + 0x32], bl
mov byte [esp + 0x33], bl
mov byte [esp + 0x34], bl
mov byte [esp + 0x35], 5
call fcn.00401410
mov edi, eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
push edi
push esi
push ecx
push str.Set_File__s_Users_Access_Rights_0x_08X_return:__d
push 0x80
call fcn.004025a0
add esp, 0x2c
mov edx, dword [esp + 0x28]
mov eax, dword [edx + 0x40]
cmp eax, 0xffffffff
je 0x431423
xor esi, esi
test al, 1
je 0x4313b7
mov esi, SysReAllocString
test al, 2
je 0x4313c1
or esi, 0x40000000
test al, 4
je 0x4313cb
or esi, 0x20000000
test al, 8
je 0x4313d5
or esi, 0x10000000
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
push ebx
push 1
lea ecx, [esp + 0x20]
push ecx
push esi
push eax
mov byte [esp + 0x2c], bl
mov byte [esp + 0x2d], bl
mov byte [esp + 0x2e], bl
mov byte [esp + 0x2f], bl
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], 1
call fcn.00401410
mov edx, dword [esp + 0x28]
add esp, 0x14
mov ebp, eax
mov eax, dword [edx]
push ebp
push esi
push eax
push str.Set_File__s_Everyone_Access_Rights_0x_08X_return:__d
push 0x80
call fcn.004025a0
add esp, 0x14
cmp edi, ebx
je 0x431445
cmp ebp, ebx
je 0x431445
mov eax, 1
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.0043defc
add esp, 0x14
ret 8
mov ecx, dword [esp + 0x20]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0043defc
add esp, 0x14
ret 8
Function at 0x431e60
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x4541bb
mov eax, dword fs:[0]
push eax
push esi
mov eax, dword [0x4652b0]
xor eax, esp
push eax
lea eax, [esp + 8]
mov dword fs:[0], eax
mov esi, dword [esp + 0x18]
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi], eax
mov dword [esp + 0x10], 0
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 4], eax
mov byte [esp + 0x10], 1
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 8], eax
mov byte [esp + 0x10], 2
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0xc], eax
mov byte [esp + 0x10], 3
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x10], eax
mov byte [esp + 0x10], 4
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x14], eax
mov byte [esp + 0x10], 5
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x18], eax
mov byte [esp + 0x10], 6
mov eax, dword [0x467e80]
mov edx, dword [eax + 0xc]
mov ecx, 0x467e80
call edx
add eax, 0x10
mov dword [esi + 0x1c], eax
lea eax, [esi + 0x40]
push eax
mov byte [esp + 0x14], 7
call fcn.00404280
lea ecx, [esi + 0x5c]
push ecx
mov byte [esp + 0x14], 8
call fcn.00404280
lea edx, [esi + 0x80]
push edx
mov byte [esp + 0x14], 9
call fcn.00434220
or eax, 0xffffffff
mov dword [esi + 0x78], 1
mov dword [esi + 0x7c], 1
mov dword [esi + 0x20], eax
mov dword [esi + 0x24], eax
mov dword [esi + 0x28], eax
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi + 0x34], eax
mov dword [esi + 0x38], eax
mov dword [esi + 0x3c], eax
mov eax, esi
mov ecx, dword [esp + 8]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0xc
ret 4
Function at 0x4364a0
Capabilities:
Create thread

Disassembly:
push ecx
push 0x10
call fcn.0043e9a7
add esp, 4
test eax, eax
jne 0x4364c4
xor al, al
mov byte [esp + 8], al
push 0x45ff24
lea eax, [esp + 0xc]
push eax
call fcn.0044143b
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
mov dword [eax], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 0xc], esi
mov dword [eax + 4], edx
mov dword [eax + 8], ecx
cmp dword [esi + 0x2c], 0
jne 0x4364fa
lea edx, [esp]
push edx
push 0
push eax
push 0x436430
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x2c], eax
pop ecx
ret 0xc

Function at 0x4375f0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0xc
test esi, esi
je 0x437676
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x437654
lea ecx, [esp + 4]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x10]
push str.SystemRoot
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push esi
call edi
test eax, eax
jne 0x43766e
push 0x104
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call edi
pop edi
add esp, 0xc
ret
xor eax, eax
add esp, 0xc
ret

Function at 0x437680
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
mov edi, eax
test edi, edi
je 0x437728
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0
mov dword [esp + 0x20], 1
mov dword [esp + 0x1c], 0x105
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4376ed
lea ecx, [esp + 8]
push ecx
push edi
lea edx, [esp + 0x14]
push edx
push eax
mov eax, dword [esp + 0x14]
push str.SystemRoot
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
test eax, eax
jne 0x437710
push 0x105
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
call esi
pop esi
pop edi
add esp, 0xc
ret
push str._system32
mov ecx, 0x105
call fcn.00402040
push edi
call esi
pop esi
pop edi
add esp, 0xc
ret
xor eax, eax
pop edi
add esp, 0xc
ret
Function at 0x437730
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x14], 0
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x437790
lea ecx, [esp + 4]
push ecx
push esi
lea edx, [esp + 0x10]
push edx
push eax
mov eax, dword [esp + 0x10]
push str.CommonFilesDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
xor eax, eax
add esp, 0xc
ret

Function at 0x4377a0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push edi
mov edi, eax
lea eax, [esp + 4]
push eax
push 0x20019
push 0
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov byte [edi], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x437820
push esi
lea ecx, [esp + 0xc]
push ecx
push edi
lea edx, [esp + 0x18]
push edx
push eax
mov eax, dword [esp + 0x18]
push str.ProgramFilesDir
push eax
mov dword [esp + 0x28], 1
mov dword [esp + 0x24], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [esp + 8]
push ecx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
pop esi
jne 0x437820
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x437815
sub eax, edx
jne 0x43783f
push 0x104
push edi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Program_Files
mov ecx, 0x104
mov byte [edi + 2], 0
call fcn.00402040
xor eax, eax
pop edi
add esp, 0xc
ret

Function at 0x437ae0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x114
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x110], eax
push esi
push 0x104
lea eax, [esp + 0x11]
push 0
push eax
mov esi, ecx
mov dword [esp + 0x10], 1
mov dword [esp + 0x14], 0x104
mov byte [esp + 0x18], 0
call fcn.00443400
mov esi, dword [esi]
add esp, 0xc
lea ecx, [esp + 8]
push ecx
lea edx, [esp + 0x10]
push edx
lea eax, [esp + 0xc]
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
test eax, eax
je 0x437b60
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.0043defc
add esp, 0x114
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x437b46
mov ecx, dword [esp + 0x11c]
push ecx
lea edx, [esp + 0x10]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x114]
pop esi
xor ecx, esp
call fcn.0043defc
add esp, 0x114
ret 4
Function at 0x437bf0
Capabilities:
Delete file
Get disk information
Read .ini file

Disassembly:
sub esp, 0x220
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x21c], eax
mov eax, dword [esp + 0x224]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x14], eax
xor eax, eax
push 0x104
push eax
lea ecx, [esp + 0x12d]
push ecx
mov byte [esp + 0x1c], 0
mov word [esp + 0x1d], ax
mov byte [esp + 0x1f], al
mov byte [esp + 0x130], al
call fcn.00443400
add esp, 0xc
lea edx, [esp + 0x124]
push edx
push 0x105
xor esi, esi
xor ebp, ebp
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov ebx, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [esp + 0x18], eax
cmp ebp, dword [esp + 0x18]
jge 0x437d25
cmp byte [esp + ebp + 0x124], 0
jne 0x437d1b
push 3
lea eax, [esp + ebp + 0x125]
push eax
lea ecx, [esp + 0x18]
push ecx
call fcn.00440f90
add esp, 0xc
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov esi, eax
cmp esi, 3
jne 0x437d1b
push 0x104
lea eax, [esp + 0x21]
push 0
push eax
mov byte [esp + 0x28], 0
call fcn.00443400
lea ecx, [esp + 0x1c]
push ecx
push str._sRsTest.ini
mov eax, 0x105
lea edi, [esp + 0x30]
call fcn.00401e00
add esp, 0x14
mov edx, edi
push edx
push 0x45b4b4
push 0x45b4b8
push 0x45b4bc
call ebx
mov eax, edi
push eax
push 0
push 0x45b4b8
push 0x45b4bc
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
test eax, eax
jne 0x437d03
lea esi, [eax + 5]
lea ecx, [esp + 0x1c]
push ecx
push 0
push 0
push 0
call ebx
lea edx, [esp + 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
inc ebp
cmp esi, 3
jne 0x437c61
mov eax, dword [esp + 0x14]
test eax, eax
je 0x437d47
cmp esi, 3
jne 0x437d47
push 0x103
lea ecx, [esp + 0x14]
push ecx
push eax
call fcn.00440f90
add esp, 0xc
jmp 0x437d4c
mov byte [esp + 0x10], 0
lea edx, [esp + 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov ecx, dword [esp + 0x22c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043defc
add esp, 0x220
ret 4
Function at 0x437d80
Capabilities:
Create directory
Delete file

Disassembly:
sub esp, 0x158
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x154], eax
mov eax, dword [esp + 0x15c]
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x18], eax
mov edi, ecx
test eax, eax
je 0x437ea5
test edi, edi
je 0x437ea5
push 0x458650
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
mov dword [esp + 0x14], ebx
test ebx, ebx
je 0x437f24
mov ebp, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x45865c
push ebx
call ebp
mov esi, eax
test esi, esi
jne 0x437e12
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push str.SHFolder.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esp + 0x14], eax
test eax, eax
je 0x437e06
push 0x45865c
push eax
call ebp
mov esi, eax
mov ebx, dword [esp + 0x14]
test esi, esi
je 0x437f19
push edi
push 1
push 0
push 0x23
push 0
call esi
test eax, eax
jl 0x437f19
mov eax, edi
lea edx, [eax + 1]
lea ebx, [ebx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x437e30
sub eax, edx
je 0x437f19
push str.Rising
mov ecx, 0x104
mov ebx, 1
call fcn.00402040
mov ebp, dword [sym.imp.KERNEL32.dll_FindFirstFileA]
lea eax, [esp + 0x20]
push eax
push edi
call ebp
mov esi, eax
mov al, byte [esp + 0x20]
cmp esi, 0xffffffff
je 0x437e70
test al, 0x10
jne 0x437e86
test al, 0x10
jne 0x437e7b
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov ebx, eax
cmp esi, 0xffffffff
je 0x437e92
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test ebx, ebx
jne 0x437ec0
mov eax, dword [esp + 0x14]
test eax, eax
je 0x437ea5
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
mov ecx, dword [esp + 0x164]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0043defc
add esp, 0x158
ret
push 0x4581b8
mov ecx, 0x104
call fcn.00402040
mov ecx, dword [esp + 0x18]
push ecx
mov ecx, 0x104
call fcn.00402040
lea edx, [esp + 0x20]
push edx
push edi
call ebp
mov esi, eax
mov al, byte [esp + 0x20]
cmp esi, 0xffffffff
je 0x437ef5
test al, 0x10
jne 0x437f09
test al, 0x10
jne 0x437f00
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
cmp esi, 0xffffffff
je 0x437f15
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ebx, dword [esp + 0x14]
test ebx, ebx
je 0x437f24
push ebx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea ecx, [edi + 1]
mov al, byte [edi]
inc edi
test al, al
jne 0x437f27
sub edi, ecx
mov eax, edi
jmp 0x437ea7
Function at 0x437ff0
Capabilities:
Get common file path
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0xa0
mov eax, dword [0x4652b0]
xor eax, esp
mov dword [esp + 0x9c], eax
push esi
lea eax, [esp + 0xc]
push eax
mov esi, ecx
mov dword [esp + 0xc], 1
mov dword [esp + 0x10], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [esp + 0x1c], 2
jne 0x43804b
mov eax, dword [esp + 0xa8]
call fcn.00438540
pop esi
mov ecx, dword [esp + 0x9c]
xor ecx, esp
call fcn.0043defc
add esp, 0xa0
ret
lea ecx, [esp + 4]
push ecx
push 0x2001f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x438096
mov ecx, dword [esp + 4]
lea edx, [esp + 0xa8]
push edx
push esi
lea eax, [esp + 0x10]
push eax
push 0
push str.Programs
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4380cd
mov eax, dword [esp + 0xa8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 0xa8]
cmp ecx, 0x7fffffff
ja 0x4380cd
push edi
push str.Start_MenuPrograms
mov edi, esi
call fcn.00402040
pop edi
mov ecx, dword [esp + 0xa0]
pop esi
xor ecx, esp
mov eax, 1
call fcn.0043defc
add esp, 0xa0
ret