joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c8d0
Capabilities:
Encode data using xor
Set registry value

Disassembly:
sub esp, 0x324
mov al, byte [0x42eb08]
push ebx
push esi
push edi
mov byte [esp + 0x1a0], al
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x1a1]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x11]
mov edx, dword [0x430980]
rep stosd dword es:[edi], eax
mov ecx, dword [0x43097c]
lea ebx, [esp + 0x18]
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [esp + 0x10], ecx
or ecx, 0xffffffff
mov edi, 0x430984
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x14], edx
mov eax, ecx
mov esi, edi
shr ecx, 2
mov edi, ebx
lea ebx, [esp + 0x7b]
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x4309e8
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0xdc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x430a4c
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
lea ebx, [esp + 0x164]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, 0x429d44
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
push edx
push str.guardara_proto_d
push 2
call fcn.0040c720
add esp, 0xc
xor esi, esi
lea ecx, [esp + esi + 0x1a0]
push 0x42fad0
lea edx, [esp + esi + 0x14]
push ecx
push edx
call fcn.00401000
add esi, 0x10
add esp, 0xc
cmp esi, 0x160
jl 0x40c9cc
xor eax, eax
mov bl, byte [esp + eax + 0x1a0]
xor bl, 0x6c
mov byte [esp + eax + 0x1a0], bl
inc eax
cmp eax, 0x168
jl 0x40c9f3
lea eax, [esp + 0xc]
push eax
push 0x2001f
push 0
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
pop edi
pop esi
test eax, eax
pop ebx
je 0x40ca51
lea ecx, [esp]
push ecx
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40ca51
xor eax, eax
add esp, 0x324
ret
mov eax, dword [esp]
lea edx, [esp + 0x194]
push 0x17c
push edx
push 3
push 0
push str.DATACON1
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 0x324
ret
Function at 0x40caa0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x320
mov dl, byte [0x42eb08]
push esi
push edi
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 0x199]
mov byte [esp + 0x198], dl
mov byte [esp + 8], dl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0x63
xor eax, eax
lea edi, [esp + 9]
push str.entra_cargfw
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 2
stosb byte es:[edi], al
call fcn.0040c720
mov ecx, dword [esp + 0x334]
lea eax, [esp + 0x1a0]
push 0x186
push eax
push ecx
call fcn.0040d260
add esp, 0x14
test eax, eax
jne 0x40cb12
pop edi
pop esi
add esp, 0x320
ret
xor eax, eax
mov cl, byte [esp + eax + 0x198]
xor cl, 0x6c
mov byte [esp + eax + 0x198], cl
inc eax
cmp eax, 0x168
jl 0x40cb14
xor esi, esi
lea edx, [esp + esi + 8]
push 0x4303a8
lea eax, [esp + esi + 0x19c]
push edx
push eax
call fcn.00402130
add esi, 0x10
add esp, 0xc
cmp esi, 0x160
jl 0x40cb2f
mov esi, 0x429d44
lea eax, [esp + 0x15c]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40cb84
test cl, cl
je 0x40cb80
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40cb84
add eax, 2
add esi, 2
test cl, cl
jne 0x40cb60
xor eax, eax
jmp 0x40cb89
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40cba7
push str.no_jhg
push 2
call fcn.0040c720
add esp, 8
xor eax, eax
pop edi
pop esi
add esp, 0x320
ret
mov eax, dword [esp + 8]
lea edi, [esp + 0x10]
mov dword [0x43097c], eax
or ecx, 0xffffffff
xor eax, eax
mov byte [esp + 0x72], 0
mov byte [esp + 0xd2], 0
mov byte [esp + 0x134], 0
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, dword [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, 0x430984
push edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
push str.carga_funciono_proto_d
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0x7b]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 2
mov eax, ecx
mov esi, edi
mov edi, 0x4309e8
mov dword [0x430980], edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
xor eax, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea edi, [esp + 0xe0]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x430a4c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040c720
add esp, 0xc
mov eax, 1
pop edi
pop esi
add esp, 0x320
ret
Function at 0x40d0d0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d104
xor eax, eax
pop esi
add esp, 8
ret
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x18]
lea eax, [esp + 4]
mov dword [esp + 4], edx
push eax
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xc]
push ecx
mov ecx, dword [esp + 0x18]
push edx
push esi
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d135
mov esi, 1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x40d150
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
push ebx
push ebp
mov ebp, dword [esp + 0x14]
push esi
lea eax, [esp + 0x18]
push edi
xor ebx, ebx
push eax
push 0x20019
push ebx
push ebp
push closesocket
mov dword [esp + 0x28], ebx
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d1a0
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
mov eax, dword [esp + 0x20]
push ecx
push edx
push eax
push ebp
call fcn.0040d0d0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x24]
mov eax, dword [esp + 0x1c]
mov esi, dword [esp + 0x28]
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x18]
push edi
push edx
push ebx
mov ebx, dword [esp + 0x30]
push ebx
push eax
mov dword [esp + 0x28], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d1e4
mov ecx, dword [esp + 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x1c]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
push ebx
push ebp
call fcn.0040d0d0
add esp, 0x10
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret

Function at 0x40d4b0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0xc]
push eax
push 0x20019
push 0
push ecx
push closesocket
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40d52f
mov edx, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
lea eax, [esp]
mov dword [esp], edx
push eax
mov eax, dword [esp + 0x14]
lea edx, [esp + 8]
push ecx
mov ecx, dword [esp + 0x14]
push edx
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40d524
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
add esp, 8
ret
Function at 0x40d7f0
Capabilities:
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x2001f
push esi
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40d847
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
push edx
push esi
push 0x2001f
push esi
push esi
push esi
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x40d847
xor eax, eax
pop esi
add esp, 8
ret
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push eax
mov eax, dword [esp + 8]
push ecx
push 1
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40d86d
mov esi, 1
mov ecx, dword [esp + 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x40dc00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x19c
lea eax, [esp]
push eax
push 0x20019
push 0
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40dc2f
xor eax, eax
add esp, 0x19c
ret
lea ecx, [esp + 4]
push esi
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0x428b20
push ecx
mov dword [esp + 0x20], 0x12c
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edx, dword [esp + 4]
mov esi, eax
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x40dc92
push edi
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x1a8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
xor eax, eax
pop esi
add esp, 0x19c
ret
Function at 0x40dd40
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
sub esp, 0x468
mov al, byte [0x42eb08]
push ebx
push esi
push edi
mov byte [esp + 0x74], al
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x75]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ecx, 0xb
mov esi, str.http:__www.leverit.com_dallas_ipleverit.txt
lea edi, [esp + 0x10]
xor eax, eax
rep movsd dword es:[edi], dword [esi]
mov ecx, 0xe
lea edi, [esp + 0x3c]
push str.entra_ipl1
push 2
rep stosd dword es:[edi], eax
call fcn.0040c720
mov eax, dword [0x430ab0]
add esp, 8
test eax, eax
je 0x40ddcd
mov edi, 0x42f40c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x478]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebx
add esp, 0x468
ret
mov edi, str.203.22.204.103
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [esp + 0x478]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0
mov eax, ecx
mov esi, edi
mov edi, ebx
push 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push str.InetURL_1.0
call dword [sym.imp.WININET.dll_InternetOpenA]
mov esi, eax
test esi, esi
jne 0x40de19
pop edi
pop esi
pop ebx
add esp, 0x468
ret
push ebp
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
push ecx
push esi
call dword [sym.imp.WININET.dll_InternetOpenUrlA]
mov ebp, dword [sym.imp.WININET.dll_InternetCloseHandle]
mov edi, eax
test edi, edi
je 0x40de5c
lea edx, [esp + 0x10]
lea eax, [esp + 0x78]
push edx
push 0x3ff
push eax
push edi
call dword [sym.imp.WININET.dll_InternetReadFile]
mov ecx, dword [esp + 0x10]
push edi
mov byte [esp + ecx + 0x7c], 0
call ebp
push esi
call ebp
lea edx, [esp + 0x78]
push 7
push edx
push str.IP_LEV
call fcn.0041ae30
add esp, 0xc
test eax, eax
pop ebp
je 0x40de84
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x468
ret
lea eax, [esp + 0x74]
push 0x24
push eax
call fcn.00415c90
add esp, 8
test eax, eax
je 0x40de9a
mov byte [eax], 0
lea edi, [esp + 0x7b]
or ecx, 0xffffffff
xor eax, eax
mov dword [0x430ab0], 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
push str.IPlevact_s
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push 2
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, 0x42f40c
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.0040c720
add esp, 0xc
mov eax, 1
pop edi
pop esi
pop ebx
add esp, 0x468
ret
Function at 0x40e640
Capabilities:
Copy file
Enumerate files on windows

Disassembly:
sub esp, 0x370
push ebx
push ebp
push esi
mov esi, dword [esp + 0x380]
mov ebp, 1
push esi
push str.EnvuiarADir__s
push ebp
call fcn.0040c720
push 0x429438
lea eax, [esp + 0x1c]
push str._sgo.
push eax
call fcn.00416129
add esp, 0x18
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x40e724
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CopyFileA]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x10]
push eax
push 0x429438
push str._sgo_s
push ecx
call fcn.00416129
lea edx, [esp + 0x150]
lea eax, [esp + 0x264]
push edx
push esi
push 0x4287f4
push eax
call fcn.00416129
add esp, 0x20
lea ecx, [esp + 0x254]
lea edx, [esp + 0x10]
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x40e6f0
xor ebp, ebp
jmp 0x40e6fd
lea eax, [esp + 0x10]
push eax
call fcn.004105c0
add esp, 4
lea ecx, [esp + 0x114]
push ecx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40e69d
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x370
ret
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x370
ret

Function at 0x40ee00
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov edi, dword [esp + 0x124]
push esi
push edi
xor ebp, ebp
call ebx
test eax, eax
jne 0x40ee38
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret
lea eax, [esp + 0x10]
push eax
push 0x2001f
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40ee5d
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret
mov dword [esp + 0x14], 0
mov eax, dword [esp + 0x14]
push 0
push 0
push 0
lea ecx, [esp + 0x24]
push 0
lea edx, [esp + 0x2c]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push eax
push ecx
mov dword [esp + 0x38], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40eebe
push esi
push edi
call ebx
test eax, eax
je 0x40eeb7
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
push edx
push eax
call fcn.0040ee00
add esp, 8
add ebp, eax
push esi
push edi
call ebx
test eax, eax
jne 0x40eeb8
inc ebp
inc dword [esp + 0x14]
jmp 0x40ee65
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x110
ret
Function at 0x40eee0
Capabilities:
Delete file
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
sub esp, 0x244
push ebp
push esi
mov esi, dword [esp + 0x250]
push edi
push esi
push str.marqueNNborrar__s
push 2
call fcn.0040c720
push esi
lea eax, [esp + 0x1c]
push str._s.
push eax
call fcn.00416129
add esp, 0x18
lea ecx, [esp + 0x110]
lea edx, [esp + 0xc]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edi, eax
cmp edi, 0xffffffff
je 0x40efb4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x10]
push eax
push esi
push 0x4287f4
push ecx
call fcn.00416129
mov eax, dword [esp + 0x124]
add esp, 0x10
and eax, 0x10
je 0x40ef7b
cmp byte [esp + 0x140], 0x2e
je 0x40ef7b
lea edx, [esp + 0x10]
push edx
call fcn.0040eee0
add esp, 4
jmp 0x40ef9d
test eax, eax
jne 0x40ef9d
push 4
push eax
lea eax, [esp + 0x18]
push eax
call ebp
lea ecx, [esp + 0x10]
push ecx
push str.marqueborrarb__s
push 2
call fcn.0040c720
add esp, 0xc
lea edx, [esp + 0x114]
push edx
push edi
call ebx
test eax, eax
jne 0x40ef3b
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
push esi
push str.marqueborrarc__s
push 2
call fcn.0040c720
push esi
call fcn.00410570
add esp, 0x10
test eax, eax
je 0x40efd5
push 4
push 0
push esi
call ebp
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x244
ret

Function at 0x40eff0
Capabilities:
Delete directory
Enumerate files on windows

Disassembly:
sub esp, 0x244
push ebp
push edi
mov edi, dword [esp + 0x250]
push edi
push str.elimvirt__s
push 2
call fcn.0040c720
push edi
lea eax, [esp + 0x18]
push str._s.
push eax
call fcn.00416129
add esp, 0x18
lea ecx, [esp + 0x10c]
lea edx, [esp + 8]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebp, eax
cmp ebp, 0xffffffff
je 0x40f114
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_FindNextFileA]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
lea eax, [esp + 0x140]
lea ecx, [esp + 0x10]
push eax
push edi
push str._s_sAppDataLocalVirtualStoreProgram_FilesLeveritAgent
push ecx
call fcn.00416129
mov al, byte [esp + 0x124]
add esp, 0x10
test al, 0x10
je 0x40f0ed
cmp byte [esp + 0x140], 0x2e
je 0x40f0ed
lea edx, [esp + 0x10]
push edx
push str.encot__s
push 2
call fcn.0040c720
lea eax, [esp + 0x1c]
push 0x42a24c
push eax
call fcn.00410600
add esp, 0x14
lea ecx, [esp + 0x10]
push ecx
call esi
lea edx, [esp + 0x10]
push edx
call fcn.0040eee0
lea eax, [esp + 0x144]
lea ecx, [esp + 0x14]
push eax
push edi
push str._s_sAppDataLocalVirtualStoreProgram_FilesLevtemp
push ecx
call fcn.00416129
lea edx, [esp + 0x24]
push 0x42a24c
push edx
call fcn.00410600
add esp, 0x1c
lea eax, [esp + 0x10]
push eax
call esi
lea ecx, [esp + 0x10]
push ecx
call fcn.0040eee0
add esp, 4
lea edx, [esp + 0x114]
push edx
push ebp
call ebx
test eax, eax
jne 0x40f04b
push ebp
call dword [sym.imp.KERNEL32.dll_FindClose]
pop esi
pop ebx
pop edi
xor eax, eax
pop ebp
add esp, 0x244
ret
pop edi
xor eax, eax
pop ebp
add esp, 0x244
ret
Function at 0x40f730
Capabilities:
Set registry value

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, str.C:WINDOWSLEVTEMP
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
push 0
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f794
lea edx, [esp + 0xc]
push edx
push str.SoftwareLeverITAgent
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x40f794
pop edi
xor eax, eax
pop esi
ret
mov edi, str.C:WINDOWSLEVTEMP
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.C:WINDOWSLEVTEMP
push 1
push eax
mov eax, dword [esp + 0x1c]
push str.TempDir
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
ret
Function at 0x40f7e0
Capabilities:
Create directory

Disassembly:
sub esp, 0x190
lea eax, [esp]
push esi
push edi
push 0x186
push eax
push str.TempDir
call fcn.0040d260
add esp, 0xc
test eax, eax
je 0x40f846
lea ecx, [esp + 8]
push ecx
call fcn.0040f6c0
add esp, 4
test eax, eax
je 0x40f846
lea edi, [esp + 8]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, 1
mov edx, ecx
mov esi, edi
mov edi, str.C:WINDOWSLEVTEMP
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
add esp, 0x190
ret
lea eax, [esp + 8]
push eax
call fcn.0040bcd0
add esp, 4
test eax, eax
je 0x40f8bf
mov edi, str.LEVTEMP
or ecx, 0xffffffff
xor eax, eax
push ebx
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
push eax
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [esp + 0xc]
push ecx
call fcn.0040f6c0
add esp, 4
test eax, eax
pop ebx
je 0x40f8bf
lea edx, [esp + 8]
push edx
call fcn.0040f730
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x190
ret
mov eax, dword [0x429c54]
xor edi, edi
test eax, eax
jle 0x40f926
mov esi, 0x429c2c
mov eax, dword [esi]
lea ecx, [esp + 8]
push eax
push str._sLEVTEMP.
push ecx
call fcn.00416129
lea edx, [esp + 0x14]
push edx
call fcn.00410570
add esp, 0x10
test eax, eax
je 0x40f919
mov eax, dword [esi]
lea ecx, [esp + 8]
push eax
push str._sLEVTEMP
push ecx
call fcn.00416129
lea edx, [esp + 0x14]
push edx
call fcn.0040f6c0
add esp, 0x10
test eax, eax
jne 0x40f99d
mov eax, dword [0x429c54]
inc edi
add esi, 4
cmp edi, eax
jl 0x40f8cf
xor edi, edi
test eax, eax
jle 0x40f992
mov esi, 0x429c2c
mov ecx, dword [esi]
lea edx, [esp + 8]
push ecx
push str._s.
push edx
call fcn.00416129
lea eax, [esp + 0x14]
push eax
call fcn.00410570
add esp, 0x10
test eax, eax
je 0x40f985
mov ecx, dword [esi]
lea edx, [esp + 8]
push ecx
push str._sLEVTEMP
push edx
call fcn.00416129
lea eax, [esp + 0x14]
push eax
call fcn.004103a0
lea ecx, [esp + 0x18]
push ecx
call fcn.0040f6c0
add esp, 0x14
test eax, eax
jne 0x40f8a4
mov eax, dword [0x429c54]
inc edi
add esi, 4
cmp edi, eax
jl 0x40f931
pop edi
xor eax, eax
pop esi
add esp, 0x190
ret
lea eax, [esp + 8]
push eax
call fcn.0040f730
add esp, 4
mov eax, 1
pop edi
pop esi
add esp, 0x190
ret