joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c0f0
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
push 0x2001f
push 0
mov ebx, 0x104
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c1be
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebp, dword [sym.imp.MSVCRT.dll__mbslwr]
xor esi, esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x30], ebx
call edi
test eax, eax
jne 0x40c1b3
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x124]
push ecx
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push 0
push ecx
push edx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c1b0
lea eax, [esp + 0x124]
push eax
call ebp
push str.ctfm0n.exe
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0xc
test eax, eax
je 0x40c1b0
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc esi
jmp 0x40c135
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push str.Start_Page
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
mov dword [esp + 0x28], ebx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebp, 1
test eax, eax
jne 0x40c233
lea ecx, [esp + 0x20]
push str.44939
push ecx
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
je 0x40c233
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ebp
push edx
push eax
push str.Start_Page
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push 0x80000001
mov byte [esp + 0x38], 0
mov dword [esp + 0x28], ebp
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push str.Start_Page
push str.SoftwareieMain
push 0x80000001
mov dword [esp + 0x28], ebx
call esi
test eax, eax
jne 0x40c297
lea ecx, [esp + 0x20]
push str.44939
push ecx
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
je 0x40c297
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ebp
push edx
push eax
push str.Start_Page
push str.SOFTWAREieMain
push 0x80000001
mov byte [esp + 0x38], 0
mov dword [esp + 0x28], ebp
call edi
push str.Software_fengzi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
Function at 0x40c2c0
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
push ebx
lea eax, [esp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x2001f
push 0
mov ebx, 0x104
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push 0x80000002
mov dword [esp + 0x1c], ebx
call esi
test eax, eax
jne 0x40c3c0
push ebp
push edi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
xor ebp, ebp
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push ebp
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40c3b3
lea ecx, [esp + 0x20]
lea edx, [esp + 0x124]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_s
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x124]
push eax
push 0x2001f
push 0
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x40c3ad
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push str.debugger
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c3a2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40c3a2
mov eax, dword [esp + 0x14]
push str.debugger
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebp
jmp 0x40c301
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x218
ret
Function at 0x40c3d0
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push 0x104
push eax
xor ebx, ebx
call esi
lea ecx, [esp + 0x114]
push 0x104
push ecx
call esi
mov edi, str.qqrun.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x114]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.d3d.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call esi
cmp eax, 0xffffffff
je 0x40c475
test al, 0x10
jne 0x40c475
mov ebx, 1
lea ecx, [esp + 0x114]
push ecx
call esi
cmp eax, 0xffffffff
je 0x40c48d
test al, 0x10
jne 0x40c48d
mov ebx, 1
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x40c53d
test ebx, ebx
je 0x40c53d
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea edx, [esp + 0x10]
push edx
xor esi, esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40c4eb
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
jne 0x40c4eb
lea ecx, [esp + 0x10]
push ecx
call fcn.00407de0
add esp, 4
test eax, eax
jne 0x40c4eb
lea edx, [esp + 0x10]
push edx
call fcn.00406260
add esp, 4
mov esi, 1
lea eax, [esp + 0x114]
push eax
call edi
test eax, eax
je 0x40c530
lea ecx, [esp + 0x114]
push ecx
call ebx
test eax, eax
jne 0x40c530
lea edx, [esp + 0x114]
push edx
call fcn.00407de0
add esp, 4
test eax, eax
jne 0x40c530
lea eax, [esp + 0x114]
push eax
call fcn.00406260
add esp, 4
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x40c890
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
lea eax, [esp]
push ebx
push eax
push 0x2001f
push 0
mov ebx, 0x104
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c95d
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor esi, esi
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x34], ebx
call edi
test eax, eax
jne 0x40c94f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x124]
push ecx
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push 0
push ecx
push edx
mov dword [esp + 0x30], ebx
call ebp
test eax, eax
jne 0x40c94c
mov eax, dword [esp + 0x22c]
lea ecx, [esp + 0x124]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40c94c
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc esi
jmp 0x40c8d5
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
Function at 0x40c970
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 2
mov ecx, 0x41d8a8
mov dword [esp + 0x18], 0
call fcn.00412080
mov ebx, eax
test ebx, ebx
je 0x40ca0f
mov esi, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea ecx, [ebx + 0x108]
push 0x5c
push ecx
call esi
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x40c9ef
lea edx, [esp + 0x14]
inc ebp
push edx
push str.__0_F_
push ebp
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
jne 0x40c9ef
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
jne 0x40c9ef
push ebx
mov ecx, 0x41d8a8
call fcn.004116f0
test eax, eax
jne 0x40ca1c
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
inc edi
push eax
push 2
mov ecx, 0x41d8a8
mov dword [esp + 0x18], edi
call fcn.00412080
mov ebx, eax
test ebx, ebx
jne 0x40c99f
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret
mov eax, dword [esp + 0x220]
test eax, eax
je 0x40cade
lea ecx, [esp + 0x14]
push ecx
push str._s.dll
push 0x104
push ebp
call fcn.00409880
lea esi, [ebx + 0x108]
push esi
call fcn.00406260
add esp, 0x14
lea edx, [esp + 0x14]
push edx
push str._s.dat
push 0x104
push ebp
call fcn.00409880
push esi
call fcn.00406260
add esp, 0x14
lea eax, [esp + 0x118]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x14]
lea edi, [esp + eax + 0x118]
push ecx
push str.Help_s.hlp
push 0x104
push edi
call fcn.00409880
push esi
call fcn.00406260
add esp, 0x14
lea edx, [esp + 0x14]
push edx
push str._s.hlp
push 0x104
push edi
call fcn.00409880
push esi
call fcn.00406260
add esp, 0x14
mov ecx, 0x41d8a8
mov byte [esi], 0
push 1
push ebx
call fcn.00411720
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret
Function at 0x40caf0
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
xor ebx, ebx
push eax
push 1
mov ecx, 0x41d8a8
mov dword [esp + 0x18], ebx
call fcn.00412080
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp esi, ebx
je 0x40cb74
lea edi, [esi + 0x108]
push edi
call ebp
cmp eax, 0xffffffff
je 0x40cb54
test al, 6
je 0x40cb54
mov eax, dword [esp + 0x11c]
test eax, eax
je 0x40cba1
push edi
mov ebx, 1
call fcn.00406260
add esp, 4
mov ecx, 0x41d8a8
push ebx
push esi
call fcn.00411720
mov esi, dword [esp + 0x10]
lea ecx, [esp + 0x10]
inc esi
push ecx
push 1
mov ecx, 0x41d8a8
mov dword [esp + 0x18], esi
call fcn.00412080
mov esi, eax
test esi, esi
jne 0x40cb1d
push 0
lea edx, [esp + 0x18]
push 0x26
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40cc1e
mov ecx, 0x104
lea eax, [esp + 0x14]
cmp byte [eax], 0
je 0x40cbb1
inc eax
dec ecx
jne 0x40cb96
jmp 0x40cbf5
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x108
ret
test ecx, ecx
je 0x40cbf5
lea eax, [esp + 0x10]
test eax, eax
je 0x40cbc6
mov eax, 0x104
sub eax, ecx
jmp 0x40cbca
mov eax, dword [esp + 0x10]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0x14]
je 0x40cbf5
mov esi, str.meex.exe
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x40cbed
mov byte [eax], cl
inc eax
dec edx
jne 0x40cbde
jmp 0x40cbf1
test edx, edx
jne 0x40cbf2
dec eax
mov byte [eax], 0
lea ecx, [esp + 0x14]
push ecx
call ebp
cmp eax, 0xffffffff
je 0x40cc1e
mov eax, dword [esp + 0x11c]
mov ebx, 1
test eax, eax
je 0x40cc1e
lea edx, [esp + 0x14]
push edx
call fcn.004084e0
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x40cc90
Capabilities:
Delete file
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ebp, [esp + eax + 0x14]
mov ebx, 0x41b8fc
mov byte [ebp], 0x5c
inc ebp
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40cd20
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x10], 1
test eax, eax
je 0x40cd20
lea ecx, [esp + 0x14]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 4
lea edx, [esp + 0x18]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
add ebx, 4
cmp ebx, 0x41b908
jb 0x40ccc0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40cd40
Capabilities:
Delete file
Move file
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp + 4]
push esi
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 8]
push ecx
push edx
push str.debugger
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_avp.exe
push 0x80000002
xor esi, esi
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40cdbf
cmp dword [esp + 4], 1
jne 0x40cdbf
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll__mbslwr]
push str.flower.exe
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0xc
test eax, eax
je 0x40cdbf
push 4
lea ecx, [esp + 0x10]
push 0
push ecx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea edx, [esp + 0xc]
push edx
call fcn.00407de0
add esp, 4
mov eax, esi
pop esi
add esp, 0x10c
ret

Function at 0x40ce70
Capabilities:
Get common file path

Disassembly:
sub esp, 0x14c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x15c]
push edi
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x40cf51
push 0x2e
push ebp
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
test eax, eax
je 0x40cf51
push 0x419444
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40cf51
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
lea eax, [esp + 0x34]
push eax
push 0
push esi
call ebx
test eax, eax
je 0x40cf51
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
inc ebp
mov esi, 0x41b908
mov eax, dword [esi]
push eax
push ebp
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40cf46
mov al, byte [0x41da60]
test al, al
jne 0x40cf0c
push 0x104
push 0x41da60
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [esi]
lea edx, [esp + 0x58]
push ecx
push 0x41da60
push str._s_s
push 0x104
push edx
call edi
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x58]
push eax
push 0
push ecx
call ebx
test eax, eax
je 0x40cf46
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x30]
cmp edx, eax
jne 0x40cf5e
add esi, 4
cmp esi, str.scvhost.exe
jb 0x40cee2
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14c
ret
Function at 0x40cf70
Capabilities:
Check if file exists
Copy file
Delete file
Get common file path
Set file attributes

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push 0x104
push eax
xor ebp, ebp
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_PathAppendA]
lea ecx, [esp + 0x10]
push str.explorer.exe
push ecx
call edi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea edx, [esp + 0x10]
push edx
call ebx
test eax, eax
je 0x40d05f
lea eax, [esp + 0x10]
mov ecx, 0x41db68
push eax
call fcn.00405ff0
test eax, eax
jne 0x40d05f
lea ecx, [esp + 0x114]
push 0x104
push ecx
call esi
lea edx, [esp + 0x114]
push str.system32dllcacheexplorer.exe
push edx
call edi
lea eax, [esp + 0x114]
push eax
call ebx
test eax, eax
je 0x40d05f
lea ecx, [esp + 0x114]
push ecx
mov ecx, 0x41db68
call fcn.00405ff0
test eax, eax
je 0x40d05f
mov eax, dword [esp + 0x21c]
mov esi, 1
test eax, eax
je 0x40d052
call fcn.00407020
lea edx, [esp + 0x10]
push 0x80
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [esp + 0x10]
push ebp
lea edx, [esp + 0x118]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x208
ret

Function at 0x40d070
Capabilities:
Get common file path
Get file attributes

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x18]
push 0x104
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea ecx, [esp + eax + 0x18]
mov dword [esp + 0x14], ecx
mov ebx, 0x4156dc
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x18]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x14]
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call ebp
test al, 0x10
jne 0x40d0f2
mov ecx, dword [esp + 0x120]
mov eax, 1
test ecx, ecx
mov dword [esp + 0x10], eax
je 0x40d101
lea ecx, [esp + 0x18]
push ecx
call fcn.004084e0
add esp, 4
add ebx, 4
cmp ebx, 0x4156e8
jb 0x40d0a5
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40d110
Capabilities:
Check if file exists
Delete file
Delete registry value
Get common file path
Get file attributes
Move file

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, str.TxHMoU.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [esp + 0x10], ebx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push 1
mov ecx, 0x41d8a8
call fcn.00412080
mov ebp, dword [esp + 0x11c]
mov edi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
mov esi, eax
cmp esi, ebx
je 0x40d1de
lea ecx, [esi + 4]
push str.crsss
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40d1be
test ebp, ebp
mov ebx, 1
je 0x40d1be
push ebx
push esi
mov ecx, 0x41d8a8
call fcn.00411720
push str.DisableTaskMgr
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call edi
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
inc eax
push edx
push 1
mov ecx, 0x41d8a8
mov dword [esp + 0x18], eax
call fcn.00412080
mov esi, eax
test esi, esi
jne 0x40d182
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40d242
test al, 0x10
jne 0x40d242
test ebp, ebp
mov eax, 1
je 0x40d244
lea ecx, [esp + 0x14]
push ecx
call fcn.00407de0
add esp, 4
test eax, eax
je 0x40d210
xor esi, esi
jmp 0x40d224
push 4
lea edx, [esp + 0x18]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov esi, 1
push str.DisableTaskMgr
push str.SoftwareMicrosoftWindowsCurrentVersionPoliciesSystem
push 0x80000001
call edi
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40d250
Capabilities:
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._system32HDDGuard.dll
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, dword [esp + 0x11c]
test al, 0x10
jne 0x40d2d3
test edi, edi
mov ebx, 1
je 0x40d2d3
lea ecx, [esp + 0x14]
push ecx
call fcn.004084e0
add esp, 4
lea edx, [esp + 0x14]
push edx
call ebp
lea eax, [esp + 0x10]
mov ecx, 0x41d8a8
push eax
push 0x20
mov dword [esp + 0x18], 0
call fcn.00412080
mov esi, eax
test esi, esi
je 0x40d34f
lea ecx, [esi + 4]
push str.ATI2HDDSRV
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40d32f
test edi, edi
mov ebx, 1
je 0x40d32f
push eax
push esi
mov ecx, 0x41d8a8
call fcn.00411720
add esi, 0x108
push esi
call fcn.004084e0
add esp, 4
push esi
call ebp
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x10]
inc eax
push edx
push 0x20
mov ecx, 0x41d8a8
mov dword [esp + 0x18], eax
call fcn.00412080
mov esi, eax
test esi, esi
jne 0x40d2f2
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40d7e0
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Move file

Disassembly:
sub esp, 0x248
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ebp, [esp + eax + 0x14]
push str._fonts_system_
push ebp
call dword [sym.imp.MSVCRT.dll_sprintf]
add ebp, eax
mov edi, 0x41bbd0
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x118]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0x10], eax
je 0x40d8c9
test byte [esp + 0x118], 0x10
jne 0x40d8a7
lea edi, [esp + 0x144]
or ecx, 0xffffffff
xor eax, eax
mov ebx, 1
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 0x25c]
mov edx, ecx
mov esi, edi
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
test eax, eax
rep movsb byte es:[edi], byte [esi]
je 0x40d8be
push 4
lea eax, [esp + 0x18]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea ecx, [esp + 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x118]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40d84f
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x248
ret