joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d92ee2b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78c]
sub esp, 0x80c
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0x788], eax
push ebx
push esi
xor ebx, ebx
push 0x3ff
lea eax, [ebp + 0x389]
push ebx
push eax
mov esi, ecx
mov byte [ebp + 0x388], bl
call sub.MSVCR100.dll_memset
push esi
push str.SOFTWAREClassesCLSID_sInprocServer32
mov esi, 0x400
lea eax, [ebp + 0x388]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push 0x20019
lea eax, [ebp + 0x388]
push ebx
push eax
cmp dword [ebp + 0x794], ebx
jne 0x6d92eeac
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x6d92eeb3
xor eax, eax
jmp 0x6d92eef4
push SysReAllocString
jmp 0x6d92ee9e
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push 0x6d93dd8e
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
push dword [ebp - 0x7c]
test eax, eax
je 0x6d92eedb
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6d92eea8
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x78]
push eax
push edi
call dword [sym.imp.MSVCR100.dll__mbscmp]
neg eax
pop ecx
sbb eax, eax
pop ecx
neg eax
mov ecx, dword [ebp + 0x788]
pop esi
xor ecx, ebp
pop ebx
call fcn.6d9398d8
add ebp, 0x78c
leave
ret

Function at 0x6d92ef0b
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x8d0]
sub esp, 0x950
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0x8cc], eax
mov eax, dword [ebp + 0x8d8]
push ebx
push esi
push edi
push 0x3ff
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x4cd]
push 0
push eax
mov byte [ebp + 0x4cc], 0
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.MSVCR100.dll_strcat_s]
add esp, 0xc
and dword [ebp - 0x78], 0
mov ebx, 0x6d948378
mov edi, 0x400
cmp dword [ebp - 0x78], 0
jne 0x6d92f025
push dword [ebp - 0x80]
lea eax, [ebp + 0xcc]
push edi
push eax
mov byte [ebp + 0xcc], 0
call esi
push 0x6d93e270
lea eax, [ebp + 0xcc]
push edi
push eax
call esi
push dword [ebx]
lea eax, [ebp + 0xcc]
push edi
push eax
call esi
add esp, 0x24
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp + 0xcc]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x7c], eax
cmp eax, 0xffffffff
je 0x6d92f016
push dword [ebp - 0x80]
lea eax, [ebp + 0x4cc]
push edi
push eax
mov byte [ebp + 0x4cc], 0
call esi
push 0x6d93e274
lea eax, [ebp + 0x4cc]
push edi
push eax
call esi
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp + 0x4cc]
push edi
push eax
call esi
lea eax, [ebp + 0x4cc]
push eax
call fcn.6d9385a9
add esp, 0x28
test eax, eax
je 0x6d92f00f
lea eax, [ebp - 0x74]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x6d92efb8
jmp 0x6d92f016
mov dword [ebp - 0x78], 1
add ebx, 4
cmp ebx, 0x6d948384
jl 0x6d92ef63
push dword [ebp - 0x7c]
call dword [sym.imp.kernel32.dll_FindClose]
mov ecx, dword [ebp + 0x8cc]
mov eax, dword [ebp - 0x78]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d9398d8
add ebp, 0x8d0
leave
ret
Function at 0x6d92f049
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
lea ebp, [esp - 0x944]
sub esp, 0x944
push 0xfffffffffffffffe
push 0x6d9439e8
push 0x6d939877
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x6d948560]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x940], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov eax, dword [ebp + 0x94c]
mov dword [ebp - 0x28], eax
xor ebx, ebx
mov dword [ebp - 0x24], ebx
mov byte [ebp + 0x540], bl
push 0x3ff
push ebx
lea eax, [ebp + 0x541]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
mov dword [ebp - 4], ebx
mov dword [ebp - 0x20], ebx
mov edi, 0x400
mov esi, dword [sym.imp.MSVCR100.dll_strcat_s]
cmp dword [ebp - 0x20], 3
jge 0x6d92f1f1
mov byte [ebp + 0x140], 0
push dword [ebp - 0x28]
push edi
lea eax, [ebp + 0x140]
push eax
call esi
push 0x6d93e278
push edi
lea eax, [ebp + 0x140]
push eax
call esi
mov eax, dword [ebp - 0x20]
push dword [eax*4 + 0x6d948378]
push edi
lea eax, [ebp + 0x140]
push eax
call esi
add esp, 0x24
lea eax, [ebp]
push eax
lea eax, [ebp + 0x140]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov dword [ebp - 0x2c], eax
cmp eax, 0xffffffff
je 0x6d92f1c6
mov byte [ebp + 0x540], 0
push dword [ebp - 0x28]
push edi
lea eax, [ebp + 0x540]
push eax
call esi
push 0x6d93e27c
push edi
lea eax, [ebp + 0x540]
push eax
call esi
lea eax, [ebp + 0x2c]
push eax
push edi
lea eax, [ebp + 0x540]
push eax
call esi
lea eax, [ebp + 0x540]
push eax
call fcn.6d9385a9
add esp, 0x28
test eax, eax
jne 0x6d92f1b1
push 0x404
call sub.MSVCR100.dll_void____cdecl_operator_new_unsigned_int_
pop ecx
mov dword [ebp - 0x1c], eax
test eax, eax
jne 0x6d92f192
push 0xfffffffffffffffe
lea eax, [ebp - 0x10]
push eax
push 0x6d948560
call sub.MSVCR100.dll__local_unwind4
add esp, 0xc
xor eax, eax
jmp 0x6d92f200
mov byte [eax], 0
lea ecx, [ebp + 0x540]
push ecx
push edi
push eax
call esi
add esp, 0xc
mov eax, dword [ebp - 0x1c]
mov dword [eax + 0x400], ebx
mov ebx, eax
mov dword [ebp - 0x24], ebx
lea eax, [ebp]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x6d92f125
test ebx, ebx
je 0x6d92f1e9
push ebx
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov eax, dword [ebx + 0x400]
mov dword [ebp - 0x1c], eax
push ebx
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
jmp 0x6d92f1c6
inc dword [ebp - 0x20]
jmp 0x6d92f0c4
mov dword [ebp - 4], 0xfffffffe
call fcn.6d92f226
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x940]
xor ecx, ebp
call fcn.6d9398d8
add ebp, 0x944
leave
ret
Function at 0x6d92f279
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xb94]
sub esp, 0xc14
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0xb90], eax
mov eax, dword [ebp + 0xb9c]
push ebx
push esi
push edi
mov edi, dword [sym.imp.MSVCR100.dll_sprintf_s]
push eax
push 0x6d93e2b8
push 0x6d93e2e4
mov esi, 0x400
lea eax, [ebp - 0x70]
push esi
xor ebx, ebx
push eax
mov dword [ebp - 0x7c], ebx
call edi
add esp, 0x14
lea eax, [ebp - 0x78]
push eax
push 0x20019
push ebx
lea eax, [ebp - 0x70]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d92f3a9
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0x390]
push eax
push ebx
push ebx
push 0x6d93e2ec
push dword [ebp - 0x78]
mov dword [ebp - 0x80], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x78]
mov dword [ebp - 0x74], eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x74], ebx
jne 0x6d92f3a9
push str.binjava.exe
lea eax, [ebp + 0x390]
push eax
push 0x6d93e308
lea eax, [ebp + 0x790]
push esi
push eax
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
add esp, 0x14
lea eax, [ebp + 0x790]
push eax
call ebx
test eax, eax
je 0x6d92f3a9
push str.binclientjvm.dll
lea eax, [ebp + 0x390]
push eax
push 0x6d93e324
lea eax, [ebp + 0x790]
push esi
push eax
call edi
add esp, 0x14
lea eax, [ebp + 0x790]
push eax
call ebx
mov dword [ebp - 0x74], eax
push str.bin_serverjvm.dll
lea eax, [ebp + 0x390]
push eax
push 0x6d93e340
lea eax, [ebp + 0x790]
push esi
push eax
call edi
add esp, 0x14
lea eax, [ebp + 0x790]
push eax
call ebx
cmp dword [ebp - 0x74], 0
jne 0x6d92f3a2
test eax, eax
je 0x6d92f3a9
mov dword [ebp - 0x7c], 1
mov ecx, dword [ebp + 0xb90]
mov eax, dword [ebp - 0x7c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d9398d8
add ebp, 0xb94
leave
ret
Function at 0x6d92f650
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
xor ebx, ebx
push 0x3ff
lea eax, [ebp - 0x63]
push ebx
push eax
mov dword [ebp - 0x68], ebx
mov byte [ebp - 0x64], bl
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x20019
push 0x6d93e12c
push SysReAllocString
lea ecx, [ebp - 0x80]
mov dword [ebp - 0x80], ebx
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x74], ebx
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
call fcn.6d92aed2
lea ecx, [ebp - 0x74]
test eax, eax
je 0x6d92f6c8
call fcn.6d922c8b
lea ecx, [ebp - 0x80]
call fcn.6d922c8b
jmp 0x6d92f754
push 0x2001f
push str.Classes
push dword [ebp - 0x80]
call fcn.6d92aed2
test eax, eax
je 0x6d92f6e3
lea ecx, [ebp - 0x74]
jmp 0x6d92f6b6
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
mov esi, 0x400
push esi
lea eax, [ebp - 0x64]
push eax
push ebx
jmp 0x6d92f739
push 0xa
lea eax, [ebp - 0x64]
push str.JavaPlugin
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
jne 0x6d92f720
lea eax, [ebp - 0x64]
push eax
lea ecx, [ebp - 0x74]
call fcn.6d9232a5
test eax, eax
je 0x6d92f723
inc dword [ebp - 0x68]
push esi
lea eax, [ebp - 0x64]
push ebx
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push esi
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x68]
push dword [ebp - 0x74]
call edi
test eax, eax
je 0x6d92f6f8
lea ecx, [ebp - 0x74]
call fcn.6d922c8b
lea ecx, [ebp - 0x80]
call fcn.6d922c8b
pop edi
pop esi
mov ecx, dword [ebp + 0x39c]
xor ecx, ebp
pop ebx
call fcn.6d9398d8
add ebp, 0x3a0
leave
ret
Function at 0x6d930277
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0x390], eax
push esi
lea eax, [ebp - 0x78]
push eax
push 0x20019
xor esi, esi
push esi
push 0x6d93e280
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x6d930378
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
mov dword [ebp - 0x7c], esi
push esi
jmp 0x6d93035a
xor ecx, ecx
xor eax, eax
cmp dword [ebp - 0x74], esi
jbe 0x6d930348
cmp byte [ebp + eax - 0x70], 0x2e
jne 0x6d9302e9
inc ecx
cmp ecx, 1
jg 0x6d9302f4
inc eax
cmp eax, dword [ebp - 0x74]
jb 0x6d9302dc
cmp ecx, 1
jle 0x6d930348
push 0x6d93e2ac
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpiA]
test eax, eax
js 0x6d930348
lea eax, [ebp - 0x70]
push eax
call fcn.6d92f279
pop ecx
test eax, eax
je 0x6d930348
mov eax, dword [ebp - 0x74]
inc eax
push eax
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
lea ecx, [ebp - 0x70]
push ecx
mov ecx, dword [ebp - 0x74]
push 0x6d93e2b4
inc ecx
push ecx
push eax
mov dword [ebp - 0x80], eax
call dword [sym.imp.MSVCR100.dll_sprintf_s]
add esp, 0x14
lea eax, [ebp - 0x80]
push eax
mov ecx, 0x6d9486c0
call fcn.6d930abd
inc dword [ebp - 0x7c]
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
push dword [ebp - 0x78]
mov dword [ebp - 0x74], 0x400
call edi
test eax, eax
je 0x6d9302d3
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov ecx, dword [ebp + 0x390]
xor ecx, ebp
pop esi
call fcn.6d9398d8
add ebp, 0x394
leave
ret
Function at 0x6d930c23
Capabilities:
Get geographical location

Disassembly:
push ebp
lea ebp, [esp - 0x3d8]
sub esp, 0x458
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0x3d4], eax
mov eax, dword [ebp + 0x3e4]
push ebx
push esi
mov esi, dword [ebp + 0x3e0]
push edi
push esi
mov dword [ebp - 0x78], eax
call dword [sym.imp.GDI32.dll_SaveDC]
push 2
push esi
mov dword [ebp - 0x74], eax
call dword [sym.imp.GDI32.dll_SetGraphicsMode]
push 1
xor ebx, ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_ModifyWorldTransform]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push ebx
push ebx
push ebx
push esi
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov edi, dword [sym.imp.GDI32.dll_GetDeviceCaps]
push 0x58
push esi
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
push 0x5a
push esi
fstp dword [ebp - 0x70]
call edi
mov dword [ebp - 0x6c], eax
fild dword [ebp - 0x6c]
fstp dword [ebp - 0x6c]
fld dword [ebp - 0x70]
fmul qword [0x6d93e5f0]
fld qword [0x6d93e5e8]
fdiv st(1), st(0)
fxch st(1)
call fcn.6d939b30
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x3e8]
imul eax, eax, 0xa
mov dword [ebp - 0x70], eax
fild dword [ebp - 0x70]
fmul dword [ebp - 0x6c]
fdivrp st(1)
call fcn.6d939b30
mov dword [ebp - 0x7c], eax
push 1
lea eax, [ebp - 0x80]
push eax
push esi
call dword [sym.imp.GDI32.dll_DPtoLP]
fild dword [ebp - 0x7c]
fabs
fdiv qword [0x6d93e5e0]
fadd qword [0x6d93e5d8]
call fcn.6d939b30
neg eax
cmp dword [ebp + 0x3ec], ebx
mov dword [ebp - 0x68], eax
setne al
mov byte [ebp - 0x53], al
mov eax, dword [ebp + 0x3f0]
neg eax
sbb eax, eax
and eax, 0x2bc
mov dword [ebp - 0x64], ebx
mov dword [ebp - 0x60], ebx
mov dword [ebp - 0x5c], ebx
mov byte [ebp - 0x54], bl
mov dword [ebp - 0x52], ebx
mov word [ebp - 0x4e], bx
mov dword [ebp - 0x58], eax
push 0x400
lea eax, [ebp - 0x2c]
push eax
push 0x1002
push 0x800
call dword [sym.imp.kernel32.dll_GetLocaleInfoA]
push 5
lea eax, [ebp - 0x2c]
push 0x6d93e5c0
push eax
call dword [sym.imp.MSVCR100.dll_strncmp]
add esp, 0xc
test eax, eax
lea eax, [ebp - 0x4c]
je 0x6d930d6e
push dword [ebp - 0x78]
jmp 0x6d930d73
push 0x6d93e5c8
push 0x20
push eax
call dword [sym.imp.MSVCR100.dll_strcpy_s]
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
push dword [ebp - 0x74]
mov edi, eax
push esi
call dword [sym.imp.GDI32.dll_RestoreDC]
mov ecx, dword [ebp + 0x3d4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d9398d8
add ebp, 0x3d8
leave
ret 0x14
Function at 0x6d93256f
Capabilities:
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
shr eax, 4
and eax, 1
ret
Function at 0x6d9345cf
Capabilities:
Create process on windows

Disassembly:
push ebp
lea ebp, [esp - 0x17e0]
mov eax, 0x1860
call fcn.6d9399b0
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0x17dc], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x17e8]
mov esi, 0x7ff
xor ebx, ebx
push esi
lea eax, [ebp + 0x7dd]
push ebx
push eax
mov byte [ebp + 0x7dc], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp - 0x23]
push ebx
push eax
mov byte [ebp - 0x24], bl
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp + 0xfdd]
push ebx
push eax
mov byte [ebp + 0xfdc], bl
call sub.MSVCR100.dll_memset
push ebx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp + 0xfdc]
push eax
push edi
mov dword [ebp - 0x28], 0x800
call fcn.6d9338c4
add esp, 0x34
test eax, eax
jne 0x6d93465b
xor eax, eax
jmp 0x6d93475f
lea eax, [ebp + 0xfdc]
push eax
call dword [sym.imp.kernel32.dll_lstrlenA]
cmp byte [ebp + eax + 0xfdb], 0x5c
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
je 0x6d93468a
lea eax, [ebp + 0xfdc]
push eax
push 0x6d93f210
push eax
call esi
add esp, 0xc
push str.jqs.exe
lea eax, [ebp + 0xfdc]
push eax
lea eax, [ebp + 0x7dc]
push str._sbin_s
push eax
call esi
lea eax, [ebp + 0x7dc]
push eax
call fcn.6d92aed2
add esp, 0x14
test eax, eax
je 0x6d934654
call fcn.6d92aed2
push 0x44
lea eax, [ebp - 0x80]
push ebx
push eax
call sub.MSVCR100.dll_memset
xor eax, eax
lea edi, [ebp - 0x3c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
xor eax, eax
mov word [ebp - 0x50], ax
lea eax, [ebp + 0x7dc]
push eax
xor edi, edi
lea eax, [ebp - 0x24]
push str.__s___unregister
inc edi
push eax
mov dword [ebp - 0x80], 0x44
mov dword [ebp - 0x54], edi
call esi
add esp, 0x18
lea eax, [ebp - 0x2c]
push eax
push 0x2000000
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x6d934654
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x80]
push eax
push ebx
push ebx
push 0x8000008
push ebx
push ebx
push ebx
lea eax, [ebp - 0x24]
push eax
push ebx
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserA]
cmp eax, ebx
je 0x6d934654
push 0x7530
push dword [ebp - 0x3c]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
push dword [ebp - 0x3c]
mov esi, dword [sym.imp.kernel32.dll_CloseHandle]
call esi
push dword [ebp - 0x38]
call esi
mov eax, edi
mov ecx, dword [ebp + 0x17dc]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d9398d8
add ebp, 0x17e0
leave
ret
Function at 0x6d9357d2
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0xb0]
sub esp, 0x130
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0xac], eax
mov eax, dword [ebp + 0xb8]
push esi
mov esi, dword [ebp + 0xbc]
push 0x6d93f3e0
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x7c], eax
test eax, eax
je 0x6d93593d
push esi
call dword [sym.imp.MSVCR100.dll__chdir]
pop ecx
test eax, eax
jne 0x6d93593d
mov esi, dword [sym.imp.MSVCR100.dll_fread]
push ebx
push dword [ebp - 0x7c]
xor ebx, ebx
inc ebx
push ebx
lea eax, [ebp - 0x78]
push 0x1e
push eax
call esi
add esp, 0x10
cmp eax, ebx
jne 0x6d935932
push edi
cmp dword [ebp - 0x78], 0x4034b50
jne 0x6d935931
cmp word [ebp - 0x70], 0
jne 0x6d935931
movzx eax, word [ebp - 0x5e]
push dword [ebp - 0x7c]
movzx edi, word [ebp - 0x5e]
push eax
lea eax, [ebp - 0x58]
push ebx
push eax
call esi
add esp, 0x10
cmp eax, edi
jne 0x6d935931
lea eax, [ebp - 0x58]
push eax
mov byte [ebp + edi - 0x58], 0
call fcn.6d92aed2
cmp word [ebp - 0x5c], 0
pop ecx
jbe 0x6d9358ab
movzx eax, word [ebp - 0x5c]
push ebx
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR100.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x6d935931
movzx eax, word [ebp - 0x5e]
cmp byte [ebp + eax - 0x59], 0x2f
je 0x6d935911
lea eax, [ebp - 0x58]
push 0x6d93f3e4
push eax
call dword [sym.imp.MSVCR100.dll_fopen]
pop ecx
pop ecx
mov dword [ebp - 0x80], eax
test eax, eax
je 0x6d935931
push dword [ebp - 0x62]
call sub.MSVCR100.dll_void____cdecl_operator_new___unsigned_int_
push dword [ebp - 0x7c]
mov edi, eax
push dword [ebp - 0x62]
push ebx
push edi
call esi
add esp, 0x14
cmp eax, dword [ebp - 0x62]
jne 0x6d93592a
push dword [ebp - 0x80]
push dword [ebp - 0x62]
push ebx
push edi
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
push edi
cmp eax, dword [ebp - 0x62]
jne 0x6d93592b
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
push dword [ebp - 0x80]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
pop ecx
push dword [ebp - 0x7c]
lea eax, [ebp - 0x78]
push ebx
push 0x1e
push eax
call esi
add esp, 0x10
cmp eax, ebx
je 0x6d935845
jmp 0x6d935931
push edi
call sub.MSVCR100.dll_void___cdecl_operator_delete_void__
pop ecx
pop edi
push dword [ebp - 0x7c]
call dword [sym.imp.MSVCR100.dll_fclose]
pop ecx
pop ebx
mov ecx, dword [ebp + 0xac]
xor ecx, ebp
pop esi
call fcn.6d9398d8
add ebp, 0xb0
leave
ret
Function at 0x6d935953
Capabilities:
Create directory
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x10cc]
mov eax, 0x114c
call fcn.6d9399b0
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0x10c8], eax
push ebx
mov ebx, dword [ebp + 0x10d4]
push esi
push edi
mov esi, 0x7ff
xor edi, edi
push esi
lea eax, [ebp + 0x8c9]
push edi
push eax
mov dword [ebp - 0x7c], edi
call sub.MSVCR100.dll_memset
push esi
lea eax, [ebp + 0xc9]
push edi
push eax
mov byte [ebp + 0xc8], 0
call sub.MSVCR100.dll_memset
add esp, 0x18
push 8
pop ecx
mov esi, str.SOFTWAREMozillaMozilla_Firefox
lea edi, [ebp + 0x8c8]
rep movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x7c]
push eax
movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
lea eax, [ebp + 0x8c8]
push eax
mov edi, reloc.OLEAUT32.dll_SysReAllocString
push edi
mov dword [ebp - 0x80], 0x800
call esi
test eax, eax
je 0x6d9359e7
xor eax, eax
jmp 0x6d935ad2
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xc8]
push eax
push 0
push 0
push str.CurrentVersion
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
test eax, eax
je 0x6d935a13
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x6d9359e0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp + 0xc8]
push eax
lea eax, [ebp + 0x8c8]
push str.SOFTWAREMozillaMozilla_Firefox_sMain
push eax
call dword [sym.imp.MSVCR100.dll_sprintf]
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp + 0x8c8]
push eax
push edi
call esi
test eax, eax
jne 0x6d9359e0
lea eax, [ebp - 0x80]
push eax
push ebx
push 0
push 0
push str.Install_Directory
push dword [ebp - 0x7c]
mov dword [ebp - 0x80], 0x800
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0x7c]
test eax, eax
jne 0x6d935a0b
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
lea esi, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x6d935a77
sub eax, esi
cmp byte [eax + ebx - 1], 0x5c
je 0x6d935a99
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x6d935a8a
mov esi, 0x6d93f45c
movsw word es:[edi], word [esi]
lea edi, [ebx - 1]
mov al, byte [edi + 1]
inc edi
test al, al
jne 0x6d935a9c
mov esi, str.extensions
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
lea eax, [ebp - 0x78]
push eax
push ebx
movsb byte es:[edi], byte [esi]
call dword [sym.imp.kernel32.dll_FindFirstFileA]
cmp eax, 0xffffffff
jne 0x6d935aea
push 0
push ebx
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
je 0x6d9359e0
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10c8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d9398d8
add ebp, 0x10cc
leave
ret
push eax
call dword [sym.imp.kernel32.dll_FindClose]
test byte [ebp - 0x78], 0x10
jmp 0x6d935ac9
Function at 0x6d935bc0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Set file attributes

Disassembly:
push ebp
lea ebp, [esp - 0x10c4]
mov eax, 0x1144
call fcn.6d9399b0
mov eax, dword [0x6d948560]
xor eax, ebp
mov dword [ebp + 0x10c0], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10cc]
push 0x140
lea eax, [ebp - 0x80]
push 0
push eax
call sub.MSVCR100.dll_memset
mov esi, dword [sym.imp.USER32.dll_wsprintfA]
push edi
lea eax, [ebp + 0xc0]
push str._s.
push eax
call esi
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp + 0xc0]
push eax
call dword [sym.imp.kernel32.dll_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x6d935cdd
push 0x6d93f48c
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
je 0x6d935ca9
push 0x6d93f490
lea eax, [ebp - 0x54]
push eax
call dword [sym.imp.kernel32.dll_lstrcmpA]
test eax, eax
je 0x6d935ca9
lea eax, [ebp - 0x54]
push eax
push edi
lea eax, [ebp + 0x8c0]
push 0x6d93f494
push eax
call esi
mov eax, dword [ebp - 0x80]
add esp, 0x10
and eax, 0xfffffffe
push eax
lea eax, [ebp + 0x8c0]
push eax
call dword [sym.imp.kernel32.dll_SetFileAttributesA]
test byte [ebp - 0x80], 0x10
lea eax, [ebp + 0x8c0]
push eax
jne 0x6d935ca3
call dword [sym.imp.kernel32.dll_DeleteFileA]
test eax, eax
jne 0x6d935ca9
push eax
lea eax, [ebp + 0x8c0]
push eax
call fcn.6d93314b
pop ecx
jmp 0x6d935ca8
call fcn.6d935bc0
pop ecx
lea eax, [ebp - 0x80]
push eax
push ebx
call dword [sym.imp.kernel32.dll_FindNextFileA]
test eax, eax
jne 0x6d935c2c
push ebx
call dword [sym.imp.kernel32.dll_FindClose]
push edi
call dword [sym.imp.kernel32.dll_RemoveDirectoryA]
mov esi, eax
test esi, esi
jne 0x6d935cd9
push eax
push edi
call fcn.6d93314b
pop ecx
pop ecx
mov eax, esi
jmp 0x6d935ce0
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x10c0]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.6d9398d8
add ebp, 0x10c4
leave
ret