joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475ef9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x475f27
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x475f45
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00475e63
jmp 0x475f45
mov eax, dword [esi + 0x14]
test eax, eax
je 0x475f45
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
push eax
mov ecx, esi
call fcn.00475e63
test edi, edi
mov eax, edi
jne 0x475f2f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
mov ecx, dword [0x4c1a7c]
test ecx, ecx
je 0x475ff8
jmp 0x475ef8
ret 8

Function at 0x484600
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0xc2
invalid
sub bh, byte [esi]
push esp
or byte [esp + ecx*4], dl
jle 0x4845a4
cmp dword [eax + ecx*8 + 0x20], eax
insd dword es:[edi], dx
xor esi, dword [edi]
test dword [edi - 0x39d6173e], eax
or dword [ebp + ecx*4 + 0x799f8da7], eax
jmp 0x529e26c3

Function at 0x48d750
Capabilities:
Encode data using xor

Disassembly:
fidiv word [esi]
ror dword [edi - 0x7d], 0x6f
push ecx
jmp 0xd934c143
movzx edi, byte [edi - 1]
and byte [eax - 0xd5ec1f], al
lcall 0x1c52, 0xe90c0d24
jl 0x48d60f
mov esp, 0xebb349b7
mov bh, 0x49
mov bl, 0xeb
leave
xor dword [edx], 0xb064040c
in al, 0xe4
das
inc edi
or al, 0x82
aad 0xf5
xor al, 0xcf
sub bl, byte [ecx]
mov ebp, 0x45b7e4b6
jo 0x48d652
inc ebp
mov byte [0x64a9ba79], al
in eax, 0x61
mov dword [edi - 0x40237794], ecx
add dword [esi], edi
test dword [ebx], esi
into
lcall 0x71df, 0xcd1402b4
xor dword [ecx], ebp
xchg edx, eax
int1
xor dh, bl
jae 0x48d6fc
add al, bh
invalid
mov ebx, 0xc17d727c
mov bl, byte [edi + 0x7d]
clc
xchg edx, eax
push ds
scasd eax, dword es:[edi]
cdq
test byte [esp + edi - 0x191bfc5a], bh
jnp 0x48d640
popal
lodsd eax, dword [esi]
xchg ecx, eax
push ecx
ljmp 0xd9a2
add eax, 0x24d62389
ret 0xacc8
pop ebp
mov ch, 0x2e
push esp
test eax, 0x38ebe2fa
cmp esi, ebp
push esi
push edi
lahf
pop ebx
xor byte [edi], bl
loop 0x48d69d
out dx, eax
pop ss
inc eax
cmpsd dword [esi], dword es:[edi]
lcall 0x94aa, 0x68a9fae1
sbb eax, 0x5dd37bfc
or al, 0x3a
mov byte [ebx], al
das
jl 0x48d7a9
xor byte [eax - 0x6a518a0c], dl
xchg byte [ecx], al
scasd eax, dword es:[edi]
push es
rep movsb byte es:[edi], byte [esi]
jns 0x48d708
dec esi
jno 0x48d78d
sub dl, al
mov bl, 0xfe
and byte [ecx], bh
inc eax
pushfd
push es
salc
pop ss
push esi
and al, 0x7e
mov edi, 0x28f1287a
out 0xf3, eax
pop ds
das
jge 0x48d79a
dec edx
mov edx, 0xa7992f7
movsb byte es:[edi], byte [esi]
out 0xa2, al
inc edx
fldcw word [edi + ebx + 0x3f]
jecxz 0x48d721
dec ebp
mov byte [0x377ee2ad], al
je 0x48d721
call 0x2f6a911
in eax, 0x95
ret
add cl, bl
in eax, dx
xchg esp, eax
mov eax, 0x10a022fe
and ebp, dword [edi + 0x33]
pop ecx
int3
xchg edi, eax
mov ebp, dword [esi + 0x79cda189]
dec ecx
inc ebx
pushfd
push ebx
xor al, 0x85
invalid
Function at 0x409568
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x424
mov eax, 0x41e23f
call fcn.0041d6dc
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ebx, dword [ebp + 8]
mov dword [ebp - 0x42c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x428], eax
mov dword [ebp - 0x20], esi
push 0x404
lea eax, [ebp - 0x424]
mov dword [ebp - 4], esi
push esi
push eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], esi
call fcn.0040c010
add esp, 0xc
mov dword [ebp - 0x424], esi
push 0x60
push esi
push ebx
mov byte [ebp - 4], 1
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], edi
test edi, edi
jne 0x4095f1
push 2
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
mov dword [ebp - 0x430], eax
test edi, edi
jne 0x4095f1
call fcn.00401c76
mov esi, eax
jmp 0x4096f4
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
jne 0x409614
call fcn.00401c76
jmp 0x4096e7
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x40960a
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [ebp - 0x42c], ebx
lea eax, [ebx + 1]
cmp eax, ebx
jae 0x409647
mov esi, 0x8007000e
jmp 0x4096e9
push 2
pop ecx
mul ecx
mov byte [ebp - 4], cl
cmp edx, esi
ja 0x409717
jb 0x409662
cmp eax, 0xffffffff
ja 0x409717
cmp eax, 0x400
jbe 0x409677
push eax
lea ecx, [ebp - 0x424]
call fcn.00407f38
jmp 0x409699
lea eax, [ebp - 0x420]
mov dword [ebp - 0x424], eax
jmp 0x409699
mov dword [ebp - 4], 1
cmp dword [ebp - 0x424], 0
je 0x40963d
push ebx
push dword [ebp - 0x424]
push ebx
push dword [ebp - 0x428]
push esi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, eax
test ecx, ecx
je 0x40960a
mov eax, dword [ebp - 0x424]
xor edx, edx
push dword [ebp + 0x14]
mov word [eax + ecx*2], dx
lea ecx, [ebp - 0x1c]
push dword [ebp - 0x424]
call fcn.00409413
mov esi, eax
test edi, edi
je 0x4096f4
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x420]
cmp dword [ebp - 0x424], eax
je 0x40970d
lea ecx, [ebp - 0x424]
call fcn.00407f23
mov eax, esi
call fcn.0041d629
ret 0x10
push 0x80070216
call fcn.004021d4
int3

Function at 0x416575
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004161ee

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401940
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret

Function at 0x4039d0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x4039e5
pop ebp
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x403a26
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x403a22
nop word [eax + eax]
cmp esi, edx
jae 0x403a26
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x403a10
cmp esi, edx
jb 0x403a2b
xor eax, eax
pop esi
pop ebp
ret
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4056f0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push dword [ecx + 0x28]
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x405704
pop ebp
ret 4
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
call dword [sym.imp.USER32.dll_CloseClipboard]
mov eax, esi
pop esi
pop ebp
ret 4
Function at 0x40b3a0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d099
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x58cfe0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
lea ecx, [esi + 4]
mov dword [esi], 0x548020
call fcn.0040a420
mov dword [ebp - 4], 0
lea edi, [esi + 0x24]
mov dword [ebp - 0x14], edi
call fcn.004e817d
mov ecx, eax
test ecx, ecx
jne 0x40b3fc
push 0x80004005
call fcn.00403650
mov eax, dword [ecx]
call dword [eax + 0xc]
add eax, 0x10
mov dword [edi], eax
mov byte [ebp - 4], 2
lea ecx, [esi + 0x30]
push 0
mov dword [ecx], 0x547130
call fcn.00406060
mov byte [ebp - 4], 3
mov ecx, esi
push 0
call fcn.004735b0
mov dword [ebp - 4], 0xffffffff
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40b560
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52d179
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
mov eax, dword [0x58cfe0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi], 0x548020
mov dword [ebp - 4], 1
mov dword [esi + 0x30], 0x547130
mov byte [ebp - 4], 0
lea eax, [esi + 0x24]
mov dword [ebp - 0x14], eax
mov byte [ebp - 4], 0
mov edx, dword [eax]
or eax, 0xffffffff
sub edx, 0x10
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x40b5c7
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov dword [ebp - 4], 0xffffffff
lea ecx, [esi + 4]
call fcn.0040a4d0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x410f10
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.004f5de7

Function at 0x414af0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x20c]
push edi
mov edi, dword [ebp + 0xc]
push 0x208
push 0
push eax
call fcn.00509680
add esp, 0xc
test esi, esi
je 0x414b44
cmp word [esi], 0
je 0x414b44
push 0
push esi
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004823d0
add esp, 0x10
jmp 0x414b55
lea eax, [ebp - 0x20c]
push eax
push 0x104
call fcn.004aad60
xor eax, eax
push edi
push eax
mov word [edi], ax
lea eax, [ebp - 0x20c]
push 0x548a7c
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
movzx eax, word [edi]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00507257
mov esp, ebp
pop ebp
ret
Function at 0x414bb0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x108]
push edi
mov edi, dword [ebp + 0xc]
push 0x104
push 0
push eax
call fcn.00509680
add esp, 0xc
test esi, esi
je 0x414c03
cmp byte [esi], 0
je 0x414c03
push 0
push esi
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.004820c0
add esp, 0x10
jmp 0x414c15
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
push 0
push str.FPP
lea eax, [ebp - 0x108]
mov byte [edi], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
movsx eax, byte [edi]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00507257
mov esp, ebp
pop ebp
ret
Function at 0x415610
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
test eax, eax
je 0x415637
cmp word [eax], 0
je 0x415637
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415637
test al, 0x10
je 0x415637
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x415760
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41579d
cmp word [esi], 0
je 0x41579d
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x415789
test al, 0x10
jne 0x415789
mov eax, 1
pop esi
pop ebp
ret
cmp dword [ebp + 0xc], 0
je 0x41579d
push esi
push 0x2f54
call fcn.00489f40
add esp, 8
xor eax, eax
pop esi
pop ebp
ret

Function at 0x415b80
Capabilities:
Check if file exists
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x415cae
cmp word [edi], 0
je 0x415cae
push esi
lea eax, [ebp - 0x28]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push 0
push edi
movups xmmword [ebp - 0x28], xmm0
movups xmmword [ebp - 0x18], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesExW]
test eax, eax
jne 0x415c3f
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
call esi
cmp eax, 2
jne 0x415c6d
push ebx
push 0
push 0x80
push 4
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x415c0f
pop ebx
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret
call esi
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
jne 0x415c29
push 1
push edi
call fcn.00415fb0
add esp, 8
pop ebx
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret
push dword [ebp - 0x28]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x415c6d
push 0
push 0x80
push 3
push 0
push 1
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x415c7f
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop edi
call fcn.00507257
mov esp, ebp
pop ebp
ret
Function at 0x415e80
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
test edi, edi
jne 0x415e9e
push 0
push esi
call fcn.00415760
add esp, 8
test eax, eax
jne 0x415ee3
push 1
push esi
call fcn.00415fb0
add esp, 8
xor eax, eax
test edi, edi
mov edi, dword [ebp + 8]
sete al
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x415ee3
cmp dword [ebp + 0x14], eax
jne 0x415edd
push esi
push edi
call fcn.0048ed30
add esp, 4
push eax
push 0x2f4f
call fcn.00489f40
add esp, 0xc
pop edi
xor eax, eax
pop esi
pop ebp
ret
pop edi
mov eax, 1
pop esi
pop ebp
ret

Function at 0x415ef0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52e9ef
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
test edi, edi
je 0x415f93
cmp word [edi], 0
je 0x415f93
xorps xmm0, xmm0
lea ecx, [ebp - 0x20]
push eax
movups xmmword [ebp - 0x20], xmm0
call fcn.0045ab70
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x20]
call fcn.0045ac40
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
test esi, esi
jne 0x415f7b
cmp eax, 0xb7
je 0x415f7b
cmp dword [ebp + 0xc], esi
jne 0x415f77
push edi
push 0x2f50
call fcn.00489f40
add esp, 8
xor esi, esi
jmp 0x415f80
mov esi, 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.0045abe0
mov eax, esi
jmp 0x415f95
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret

Function at 0x415fb0
Capabilities:
Check if file exists
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x41600b
cmp word [esi], 0
je 0x41600b
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x415ffc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x41600b
cmp dword [ebp + 0xc], 0
jne 0x415ff7
push esi
push 0x2f53
call fcn.00489f40
add esp, 8
xor eax, eax
pop esi
pop ebp
ret
push 0
push esi
call fcn.00415760
add esp, 8
test eax, eax
jmp 0x415fe1
mov eax, 1
pop esi
pop ebp
ret
Function at 0x418600
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x214], eax
xor eax, eax
push esi
xor esi, esi
mov dword [ebp - 0x210], eax
cmp dword [ebx], eax
jle 0x4186a6
push edi
nop
push esi
mov ecx, ebx
call fcn.004188c0
mov edi, eax
test edi, edi
je 0x418698
push 0x104
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
push esi
call fcn.00418940
push eax
push dword [ebp - 0x214]
call fcn.0048f340
mov eax, dword [ebp + 0xc]
add esp, 0x10
sub eax, 0
je 0x4186b8
sub eax, 2
jne 0x4186cd
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.00415760
add esp, 8
test eax, eax
je 0x4186cd
push 0
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.0048e230
add esp, 0xc
test eax, eax
jle 0x4186cd
mov edi, dword [ebp - 0x210]
inc esi
cmp esi, dword [ebx]
jl 0x418630
mov eax, edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00507257
mov esp, ebp
pop ebp
ret 8
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00415760
add esp, 8
test eax, eax
jne 0x418698
lea eax, [ebp - 0x20c]
push 1
push eax
call fcn.00415fb0
add esp, 8
lea eax, [ebp - 0x20c]
push 0
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, dword [ebp - 0x210]
add edi, eax
lea eax, [ebp - 0x20c]
push 0x80
push eax
mov dword [ebp - 0x210], edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
jmp 0x41869e

Function at 0x418710
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, ecx
xor esi, esi
push edi
xor edi, edi
cmp dword [ebx], esi
jle 0x41874d
push esi
mov ecx, ebx
call fcn.004188c0
test eax, eax
je 0x418748
cmp dword [ebp + 8], 0
je 0x41873f
push 1
push eax
call fcn.00415fb0
add esp, 8
jmp 0x418746
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
add edi, eax
inc esi
cmp esi, dword [ebx]
jl 0x418720
mov ecx, ebx
call fcn.00418f50
mov eax, edi
pop edi
pop esi
pop ebx
pop ebp
ret 4
Function at 0x41c680
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f59c
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
test esi, esi
je 0x41c799
cmp word [esi], 0
je 0x41c799
push 0x38
lea eax, [ebp - 0x48]
push 0
push eax
call fcn.00509680
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.00467c80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00468ed0
test eax, eax
je 0x41c72f
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00468760
test eax, eax
je 0x41c727
push dword [ebp - 0x4c]
push esi
call fcn.0050d5a0
add esp, 8
test eax, eax
je 0x41c792
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00468a10
test eax, eax
jne 0x41c703
lea ecx, [ebp - 0x48]
call fcn.00467da0
push 0x549060
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x48]
call fcn.00468ed0
test eax, eax
je 0x41c77d
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00468760
test eax, eax
je 0x41c775
push dword [ebp - 0x4c]
push esi
call fcn.0050d5a0
add esp, 8
test eax, eax
je 0x41c792
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x48]
call fcn.00468a10
test eax, eax
jne 0x41c755
lea ecx, [ebp - 0x48]
call fcn.00467da0
xor esi, esi
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00467ce0
mov eax, esi
jmp 0x41c79b
mov esi, 1
jmp 0x41c77f
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret
Function at 0x41ca00
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x52f5f6
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x58cfe0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
xor eax, eax
mov esi, dword [ebp + 8]
test edi, edi
je 0x41cafb
mov word [edi], ax
test esi, esi
je 0x41caf9
cmp word [esi], ax
je 0x41caf9
push 0x38
push eax
lea eax, [ebp - 0x48]
push eax
call fcn.00509680
add esp, 0xc
lea ecx, [ebp - 0x48]
call fcn.00467c80
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
push str.SoftwareMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00468ed0
test eax, eax
je 0x41ca9c
push 0
push 0
push esi
lea ecx, [ebp - 0x48]
call fcn.00469a70
lea ecx, [ebp - 0x48]
test eax, eax
jne 0x41cac6
call fcn.00467da0
push 0x549060
push reloc.OLEAUT32.dll_SysReAllocString
lea ecx, [ebp - 0x48]
call fcn.00468ed0
test eax, eax
je 0x41cae4
push 0
push 0
push esi
lea ecx, [ebp - 0x48]
call fcn.00469a70
lea ecx, [ebp - 0x48]
test eax, eax
je 0x41cadf
push dword [ebp + 0x10]
push 0x104
push edi
push esi
call fcn.00468be0
xor ebx, ebx
cmp word [edi], bx
setne bl
jmp 0x41cae6
call fcn.00467da0
xor ebx, ebx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.00467ce0
mov eax, ebx
jmp 0x41cafb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00507257
mov esp, ebp
pop ebp
ret

Function at 0x41e7d0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, 0x104
xor ecx, ecx
push edi
mov edi, 2
mul edi
mov dword [esi], 0x549da4
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e6b5b
add esp, 4
mov dword [esi + 4], eax
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor ecx, ecx
mov eax, 0x104
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e6b5b
xor ecx, ecx
mov dword [esi + 8], eax
mov word [eax], cx
mov eax, 0x104
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e6b5b
xor ecx, ecx
mov dword [esi + 0xc], eax
mov word [eax], cx
mov eax, 0x104
mul edi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004e6b5b
mov dword [esi + 0x10], eax
xor ecx, ecx
push 0x104
mov word [eax], cx
push dword [esi + 8]
push 0x549db0
push dword [0x55075c]
call fcn.0047da40
push 0x104
push dword [esi + 0xc]
push 0x549db4
push dword [0x55075c]
call fcn.0047da40
push 0x104
push dword [esi + 0x10]
push 0x549db4
push dword [0x550760]
call fcn.0047da40
mov eax, dword [ebp + 8]
add esp, 0x3c
mov dword [esi + 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x18], eax
mov eax, esi
pop edi
pop esi
pop ebp
ret 8