joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41adfc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x39c], eax
mov eax, dword [ebp + 0x3ac]
push ebx
mov ebx, dword [ebp + 0x3a8]
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
mov dword [ebp - 0x7c], eax
lea eax, [ebp + 0x196]
push edi
push eax
mov word [ebp + 0x194], di
call fcn.0045fa70
push ebx
lea eax, [ebp + 0x194]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00460936
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push 0xf003f
push edi
lea eax, [ebp + 0x194]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41ae7e
xor eax, eax
jmp 0x41aed2
push esi
lea eax, [ebp - 0x72]
push edi
push eax
mov word [ebp - 0x74], di
call fcn.0045fa70
add esp, 0xc
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
push edi
push str.ImagePath
push dword [ebp - 0x78]
mov dword [ebp - 0x80], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x74]
push eax
call fcn.004608cd
push dword [ebp - 0x7c]
push eax
call fcn.004615f0
add esp, 0xc
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp + 0x39c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x3a0
leave
ret 8

Function at 0x41aeec
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
push edi
mov edi, dword [ebp + 0x1a0]
xor esi, esi
push 0x206
lea eax, [ebp - 0x72]
push esi
push eax
mov word [ebp - 0x74], si
call fcn.0045fa70
push edi
lea eax, [ebp - 0x74]
push str.SYSTEMCurrentControlSet_services_s
push eax
call fcn.00460936
add esp, 0x18
lea eax, [ebp - 0x7c]
push eax
push 0xf003f
push esi
lea eax, [ebp - 0x74]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x41af57
xor eax, eax
jmp 0x41af8b
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
push esi
push esi
push str.Start
push dword [ebp - 0x7c]
mov dword [ebp - 0x78], esi
mov dword [ebp - 0x80], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x7c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x78], 2
sete al
mov ecx, dword [ebp + 0x194]
pop edi
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x198
leave
ret 4
Function at 0x41ccde
Capabilities:
Check if file exists

Disassembly:
push ebp
sub esp, 0x618
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x618], eax
push 8
mov eax, 0x4bde4d
call fcn.004603b7
mov edi, ecx
lea ecx, [ebp - 0x14]
call fcn.00402d94
xor ebx, ebx
mov esi, 0x103
push esi
lea eax, [ebp + 0x411]
push ebx
push eax
mov dword [ebp - 4], ebx
mov byte [ebp + 0x410], bl
call fcn.0045fa70
push esi
lea eax, [ebp + 0x515]
push ebx
push eax
mov byte [ebp + 0x514], bl
call fcn.0045fa70
lea eax, [ebp + 0x410]
push eax
lea esi, [edi + 0x488]
push esi
call fcn.0042c364
lea eax, [ebp + 0x514]
add esp, 0x20
push eax
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6ee
push eax
call fcn.0042c364
pop ecx
pop ecx
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41cdab
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402d9d
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x618]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x61c
leave
ret
push 0x40e
lea eax, [ebp + 2]
push ebx
push eax
mov word [ebp], bx
call fcn.0045fa70
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x410]
lea esi, [edi + 4]
push eax
mov ecx, esi
call fcn.004033f9
lea eax, [ebp]
push eax
mov ecx, esi
call fcn.00403287
test al, al
je 0x41cd7a
lea eax, [ebp + 0x514]
push 0x4c8298
push eax
call fcn.0045f530
pop ecx
pop ecx
lea eax, [ebp + 0x514]
push eax
lea eax, [ebp + 0x410]
push eax
lea ecx, [ebp - 0x14]
call fcn.00402fbd
test eax, eax
jne 0x41ce25
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.00402d9d
mov eax, ebx
jmp 0x41cd88
xor ebx, ebx
inc ebx
jmp 0x41ce12

Function at 0x41ce2a
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
and word [ebp - 0x20c], 0
push esi
mov esi, 0x206
push esi
lea eax, [ebp - 0x20a]
push 0
push eax
call fcn.0045fa70
add esp, 0xc
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push str.SCMBManager.exe
push eax
call fcn.0045fd1a
add esp, 0x10
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41cef6
and word [ebp - 0x414], 0
push esi
lea eax, [ebp - 0x412]
push 0
push eax
call fcn.0045fa70
lea eax, [ebp - 0x414]
push 0x4c6d40
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x414]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x414]
push str.__SyncUserMb
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x414]
push eax
call fcn.0042c74a
add esp, 0x28
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0045fa14
leave
ret
Function at 0x41cf03
Capabilities:
Check if file exists

Disassembly:
push 0x24
mov eax, 0x4bde8d
call fcn.004603b7
and dword [ebp - 4], 0
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
jae 0x41cf1f
lea eax, [ebp + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x41cf42
xor esi, esi
push 0
push 1
lea ecx, [ebp + 8]
call fcn.00401330
mov eax, esi
call fcn.0046048f
ret 0x1c
lea ecx, [ebp - 0x20]
call fcn.0044a382
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 1
jae 0x41cf5a
lea eax, [ebp + 0xc]
push 0
push 0
push eax
lea ecx, [ebp - 0x20]
call fcn.0044a7f0
lea ecx, [ebp - 0x20]
call fcn.0044a275
mov edi, eax
push edi
call fcn.00442ee2
push edi
mov esi, eax
push 0
push esi
call fcn.0045fa70
add esp, 0x10
push edi
push esi
lea ecx, [ebp - 0x20]
call fcn.0044a090
push str.GUANGSU
call fcn.0045f620
pop ecx
xor ecx, ecx
xor edx, edx
test edi, edi
mov dword [ebp - 0x10], eax
jle 0x41cfbb
mov al, byte [ecx + str.GUANGSU]
xor byte [edx + esi], al
inc ecx
cmp ecx, dword [ebp - 0x10]
jl 0x41cfb6
xor ecx, ecx
inc edx
cmp edx, edi
jl 0x41cfa5
lea ecx, [ebp - 0x20]
call fcn.0044a320
lea ecx, [ebp - 0x30]
call fcn.0044a382
cmp dword [ebp + 0x20], 8
mov eax, dword [ebp + 0xc]
mov byte [ebp - 4], 2
jae 0x41cfdb
lea eax, [ebp + 0xc]
push 0
push 0x1001
push eax
lea ecx, [ebp - 0x30]
call fcn.0044a7f0
push edi
push esi
lea ecx, [ebp - 0x30]
call fcn.0044a0d0
lea ecx, [ebp - 0x30]
call fcn.0044a320
test esi, esi
je 0x41d008
push esi
call fcn.00402ac9
pop ecx
lea ecx, [ebp - 0x30]
mov byte [ebp - 4], 1
call fcn.0044a47e
lea ecx, [ebp - 0x20]
mov byte [ebp - 4], 0
call fcn.0044a47e
xor esi, esi
inc esi
jmp 0x41cf2c
Function at 0x41d028
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
sub esp, 0x820
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x820], eax
push 0x24
mov eax, 0x4bdeb8
call fcn.004603b7
mov esi, dword [ebp + 0x82c]
mov dword [ebp - 0x14], ecx
lea ecx, [ebp - 0x30]
call fcn.0044ed87
push esi
lea eax, [ebp]
push str._s.
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00460936
add esp, 0xc
push ebx
lea eax, [ebp]
push eax
lea ecx, [ebp - 0x30]
call fcn.0044ee15
cmp eax, ebx
je 0x41d13f
mov edi, 0x4c4b44
lea ecx, [ebp - 0x30]
call fcn.0044eb2f
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], eax
call fcn.0044ed4a
test eax, eax
jne 0x41d136
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x30]
call fcn.0044f0e9
push 0x104
mov ecx, eax
mov byte [ebp - 4], 1
call fcn.0040540a
push eax
lea eax, [ebp + 0x618]
push eax
call fcn.0045fd44
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00404ff6
mov eax, dword [ebp - 0x30]
push 0x10
lea ecx, [ebp - 0x30]
call dword [eax + 0x38]
test eax, eax
lea eax, [ebp + 0x618]
push eax
push esi
push edi
je 0x41d11a
lea eax, [ebp + 0x208]
push eax
call fcn.00460936
mov ecx, dword [ebp - 0x14]
add esp, 0x10
lea eax, [ebp + 0x208]
push eax
call fcn.0041d028
jmp 0x41d136
lea eax, [ebp + 0x410]
push eax
call fcn.00460936
add esp, 0x10
lea eax, [ebp + 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp - 0x18], ebx
jne 0x41d08e
lea ecx, [ebp - 0x30]
call fcn.0044ea5f
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x41d185
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.0044edad
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x820]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x824
leave
ret 4
mov bl, 1
jmp 0x41d152
Function at 0x41e420
Capabilities:
Delete file

Disassembly:
push 0x58
mov eax, 0x4be119
call fcn.00460420
lea eax, [ebp - 0x2c]
push eax
mov esi, ecx
call fcn.0041d360
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0042de9c
pop ecx
pop ecx
push str.http:__
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.004010c0
push str.theuser.znyshurufa.com
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.004057bc
push 0x4c442c
lea ecx, [ebp - 0x48]
call fcn.004057bc
push str.user_mutual_upfile_upusermb.php
lea ecx, [ebp - 0x48]
call fcn.004057bc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.0041dbb1
test eax, eax
mov eax, dword [ebp - 0x28]
setne bl
cmp dword [ebp - 0x14], 8
jae 0x41e4a6
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004012b0
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.004012b0
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401330
movzx eax, bl
call fcn.004604a3
ret

Function at 0x41e4da
Capabilities:
Delete file

Disassembly:
push 0x58
mov eax, 0x4be119
call fcn.00460420
lea eax, [ebp - 0x2c]
push eax
mov esi, ecx
call fcn.0041d717
and dword [ebp - 4], 0
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.0042de9c
pop ecx
pop ecx
push str.http:__
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 1
call fcn.004010c0
push str.theuser.znyshurufa.com
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.004057bc
push 0x4c442c
lea ecx, [ebp - 0x48]
call fcn.004057bc
push str.user_mutual_upfile_upusermb_m.php
lea ecx, [ebp - 0x48]
call fcn.004057bc
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x48]
push eax
mov ecx, esi
call fcn.0041dbb1
test eax, eax
mov eax, dword [ebp - 0x28]
setne bl
cmp dword [ebp - 0x14], 8
jae 0x41e560
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.004012b0
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.004012b0
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00401330
movzx eax, bl
call fcn.004604a3
ret

Function at 0x41e899
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x190], eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x7c]
push eax
mov edi, 0xf003f
push edi
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x41e933
lea eax, [ebp - 0x80]
push eax
push edi
push 0
push 0x4c8c94
push dword [ebp - 0x7c]
call esi
test eax, eax
jne 0x41e923
and word [ebp - 0x78], ax
push 0x206
push eax
lea eax, [ebp - 0x76]
push eax
call fcn.0045fa70
push str.SmartCloud
lea eax, [ebp - 0x78]
push str._sMoniter
push eax
call fcn.00460936
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x80]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x7c]
call esi
mov ecx, dword [ebp + 0x190]
pop edi
xor ecx, ebp
pop esi
call fcn.0045fa14
add ebp, 0x194
leave
ret
Function at 0x41e94a
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x7c]
push eax
xor ebx, ebx
mov edi, 0xf003f
push edi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
call esi
test eax, eax
jne 0x41e9eb
lea eax, [ebp - 0x80]
push eax
push edi
push ebx
push str.RunOnce
push dword [ebp - 0x7c]
call esi
test eax, eax
jne 0x41e9db
push 0x206
lea eax, [ebp - 0x76]
push ebx
push eax
mov word [ebp - 0x78], bx
call fcn.0045fa70
push str.SmartCloud
lea eax, [ebp - 0x78]
push str._sMutualRunOne
push eax
call fcn.00460936
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x80]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x7c]
call esi
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x194
leave
ret
push esi
mov esi, ecx
call fcn.0041ed19
mov ecx, esi
call fcn.0041e899
mov ecx, esi
pop esi
jmp 0x41e94a

Function at 0x41eb9b
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x61c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x61a]
push edi
push eax
mov word [ebp - 0x61c], di
call fcn.0045fa70
push esi
lea eax, [ebp - 0x20a]
push edi
push eax
mov word [ebp - 0x20c], di
call fcn.0045fa70
push esi
lea eax, [ebp - 0x412]
push edi
push eax
mov word [ebp - 0x414], di
call fcn.0045fa70
add esp, 0x24
call fcn.00407611
mov ecx, eax
call fcn.00451a87
mov ecx, eax
call fcn.004070c1
test eax, eax
pop edi
pop esi
je 0x41ec19
push str.SCPower64.exe
jmp 0x41ec1e
push str.SCPower32.exe
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x20c]
push 0x4c3cf0
push eax
call fcn.00460936
add esp, 0x10
push str.znySrf
lea eax, [ebp - 0x414]
push 0x4c8d78
push eax
call fcn.00460936
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x41ecb0
call fcn.00404dc4
mov ecx, eax
call fcn.0042d0a3
test eax, eax
lea eax, [ebp - 0x414]
push eax
lea eax, [ebp - 0x20c]
push eax
je 0x41ec90
call fcn.0042c7fd
pop ecx
pop ecx
jmp 0x41ecb0
lea eax, [ebp - 0x61c]
push str.__s___s
push eax
call fcn.00460936
lea eax, [ebp - 0x61c]
push eax
call fcn.0042c6af
add esp, 0x14
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret

Function at 0x41ecd1
Capabilities:
Delete file

Disassembly:
push 0
mov eax, 0x4bc98d
call fcn.004603b7
mov esi, dword [ebp + 8]
and dword [ebp - 4], 0
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x41ecf4
lea ecx, [esi - 0x10]
jmp 0x41ed09
lea ecx, [ebp + 8]
call fcn.00409974
push eax
call fcn.0042cd0e
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00404ff6
xor eax, eax
inc eax
call fcn.0046048f
ret 4
Function at 0x41ed19
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x4c6890
lea ecx, [ebp - 0x20]
call fcn.00401130
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x24]
push eax
mov edi, 0xf003f
push edi
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
mov ebx, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
jne 0x41ed7c
cmp dword [ebp - 8], 8
mov eax, dword [ebp - 0x1c]
jae 0x41ed6d
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x24]
call ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x24]
push eax
push edi
xor edi, edi
push edi
push 0x4df45c
push closesocket
call esi
test eax, eax
jne 0x41edb1
push str.SmartCloudPYImeDictFile
push dword [ebp - 0x24]
call ebx
push str..zncel
push dword [ebp - 0x24]
call ebx
push dword [ebp - 0x24]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
push 1
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x24], edi
call fcn.00401330
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
leave
ret
Function at 0x41edce
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
sub esp, 0x660
lea ebp, [esp - 4]
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x660], eax
push 0x10
mov eax, 0x4bc9c3
call fcn.004603b7
mov edi, ecx
mov esi, dword [ebp + 0x66c]
push esi
lea eax, [ebp + 0x250]
push 0x4c6ad0
xor ebx, ebx
push eax
mov dword [ebp - 4], ebx
call fcn.00460936
add esp, 0xc
lea eax, [ebp]
push eax
lea eax, [ebp + 0x250]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
mov dword [ebp - 0x18], eax
je 0x41ef32
lea eax, [ebp]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
cmp eax, ebx
je 0x41ef32
cmp word [ebp + 0x2c], 0x2e
je 0x41ee31
cmp word [ebp + 0x2e], bx
je 0x41ee31
cmp word [ebp + 0x2e], 0x2e
jne 0x41ee60
cmp word [ebp + 0x30], bx
je 0x41ee31
call fcn.00449f2e
push eax
lea ecx, [ebp - 0x10]
call fcn.00419547
lea eax, [ebp + 0x2c]
push eax
lea eax, [ebp - 0x10]
push 0x4c3d68
push eax
mov byte [ebp - 4], 1
call fcn.00407eb1
add esp, 0xc
test byte [ebp], 0x10
je 0x41eed8
push 0x206
lea eax, [ebp + 0x45a]
push ebx
push eax
mov word [ebp + 0x458], bx
call fcn.0045fa70
push dword [ebp - 0x10]
lea eax, [ebp + 0x458]
push esi
push 0x4c582c
push eax
call fcn.00460936
add esp, 0x18
lea eax, [ebp + 0x458]
mov ecx, esp
mov dword [ebp - 0x1c], esp
push eax
call fcn.00405839
mov ecx, edi
call fcn.0041edce
jmp 0x41ef1f
call fcn.00449f2e
push eax
lea ecx, [ebp - 0x14]
call fcn.00419547
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push esi
push 0x4c3cf0
push eax
mov byte [ebp - 4], 2
call fcn.00407eb1
add esp, 0xc
lea eax, [ebp - 0x14]
mov dword [ebp - 0x1c], esp
mov ecx, esp
push eax
call fcn.004082f2
mov ecx, edi
call fcn.0041ecd1
mov ecx, dword [ebp - 0x14]
add ecx, 0xfffffff0
call fcn.00404ff6
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov byte [ebp - 4], bl
call fcn.00404ff6
jmp 0x41ee31
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x41ef50
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
lea ecx, [esi - 0x10]
call fcn.00404ff6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x660]
xor ecx, ebp
call fcn.0045fa14
add ebp, 0x664
leave
ret 4
Function at 0x41f2e6
Capabilities:
Delete registry value

Disassembly:
push ebp
lea ebp, [esp - 0x194]
sub esp, 0x214
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp + 0x190], eax
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push edi
lea eax, [ebp - 0x7c]
push eax
xor ebx, ebx
mov edi, 0xf003f
push edi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x80], ebx
call esi
test eax, eax
jne 0x41e9eb
lea eax, [ebp - 0x80]
push eax
push edi
push ebx
push str.RunOnce
push dword [ebp - 0x7c]
call esi
test eax, eax
jne 0x41e9db
push 0x206
lea eax, [ebp - 0x76]
push ebx
push eax
mov word [ebp - 0x78], bx
call fcn.0045fa70
push str.SmartCloud
lea eax, [ebp - 0x78]
push str._sMutualRunOne
push eax
call fcn.00460936
add esp, 0x18
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x80]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x80]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x7c]
call esi
mov ecx, dword [ebp + 0x190]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0045fa14
add ebp, 0x194
leave
ret
push esi
mov esi, ecx
call fcn.0041ed19
mov ecx, esi
call fcn.0041e899
mov ecx, esi
pop esi
jmp 0x41e94a
Function at 0x420faf
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00406689
mov edx, dword [eax]
push 0x32
mov ecx, eax
call dword [edx]
test eax, eax
je 0x421110
call fcn.00404dc4
mov ecx, eax
call fcn.0042a71e
push eax
mov dword [ebp - 0x42c], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421110
push ebx
push esi
push edi
push dword [ebp - 0x42c]
mov ebx, str.SrfUpLoadUserTypeDay
push 0xffffffffffffffff
push ebx
mov esi, str.Setting
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
call fcn.0042d724
mov ecx, eax
cmp ecx, edi
je 0x42110d
and word [ebp - 0x18], 0
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push 0x4c4cf4
push eax
call fcn.00460936
add esp, 0xc
push dword [ebp - 0x42c]
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x426]
push edi
push eax
mov word [ebp - 0x428], di
call fcn.0045fa70
push esi
lea eax, [ebp - 0x21e]
push edi
push eax
mov word [ebp - 0x220], di
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x220]
push str.SCMBManager.exe
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x428]
push 0x4c6d40
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x428]
push str.__UpLoadUserTypeInfo
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x220]
push eax
call fcn.0042cf83
add esp, 0x2c
test eax, eax
je 0x42110d
lea eax, [ebp - 0x428]
push eax
call fcn.0042c6af
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret
Function at 0x42111c
Capabilities:
Check if file exists
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x42c
mov eax, dword [0x4f2720]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00404dc4
mov ecx, eax
call fcn.0042a71e
push eax
mov dword [ebp - 0x42c], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x421257
push ebx
push esi
push edi
push dword [ebp - 0x42c]
mov ebx, str.PushMessageLocalDate
push 0xffffffffffffffff
push ebx
mov esi, str.Setting
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
call fcn.0042d724
mov ecx, eax
cmp ecx, edi
je 0x421254
and word [ebp - 0x18], 0
xor eax, eax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ecx
stosw word es:[edi], ax
lea eax, [ebp - 0x18]
push 0x4c4cf4
push eax
call fcn.00460936
add esp, 0xc
push dword [ebp - 0x42c]
lea eax, [ebp - 0x18]
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov esi, 0x206
xor edi, edi
push esi
lea eax, [ebp - 0x21e]
push edi
push eax
mov word [ebp - 0x220], di
call fcn.0045fa70
push esi
lea eax, [ebp - 0x426]
push edi
push eax
mov word [ebp - 0x428], di
call fcn.0045fa70
add esp, 0x18
call fcn.00404dc4
mov ecx, eax
call fcn.0042a6b8
push eax
lea eax, [ebp - 0x428]
push eax
call fcn.0045fd44
lea eax, [ebp - 0x428]
push str.SCTool.exe
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x220]
push 0x4c6d40
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x428]
push eax
lea eax, [ebp - 0x220]
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x220]
push str.__RunPushMessageBySrfAuto
push eax
call fcn.0045fd1a
lea eax, [ebp - 0x220]
push eax
call fcn.0042c6af
add esp, 0x2c
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0045fa14
leave
ret