joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a260
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
mov cl, byte [esi + 0xc]
test cl, 1
je 0x43a27c
mov eax, 5
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x1d], 0xffffffff
push edi
mov edi, dword [ebp + 0xc]
jne 0x43a293
movzx eax, word [edi + 0x14]
add eax, 0x10
jmp 0x43a29d
mov eax, dword [ebp + 0xc]
movzx eax, word [eax + 0x1c]
add eax, 0x18
mov dword [ebp + 0x10], eax
test cl, 2
jne 0x43a33d
lea esp, [esp]
movzx ebx, word [esi + 8]
mov edi, esi
mov dword [ebp - 8], ebx
test ebx, ebx
je 0x43a337
cmp dword [esi], 0
je 0x43a337
mov eax, dword [edi]
mov ecx, dword [ebp + 8]
add esi, ebx
cmp dword [ecx + 5], eax
jne 0x43a32d
xor eax, eax
cmp dword [ecx + 9], eax
jne 0x43a32d
test byte [ecx + 0xd], 4
je 0x43a30e
cmp dword [ecx + 0x19], eax
je 0x43a30e
movzx ebx, byte [edi + 0x50]
lea ecx, [eax + 5]
test ebx, ebx
jle 0x43a303
lea edx, [edi + 0x52]
mov dword [ebp - 4], ebx
movzx ebx, word [edx]
xor ebx, ecx
lea eax, [ebx + eax*4]
xor ecx, eax
add edx, 2
dec dword [ebp - 4]
jne 0x43a2f1
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0x19], eax
je 0x43a32d
mov ebx, dword [ebp - 8]
test byte [edi + 0xc], 1
jne 0x43a375
mov edx, dword [ebp + 0x10]
sub edx, esi
add edx, dword [ebp + 0xc]
push edx
push esi
push edi
call dword [sym.imp.MSVCR100.dll_memmove]
add esp, 0xc
sub dword [ebp + 0x10], ebx
mov esi, edi
test byte [esi + 0xc], 2
je 0x43a2b0
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0x10]
push eax
push esi
push edi
call fcn.0043a200
mov ecx, dword [ebx + 0x1d]
add esp, 0xc
cmp ecx, 0xffffffff
jne 0x43a385
mov ecx, dword [ebp + 0x10]
push ecx
push 0xffffffffffffffff
push edi
push ebx
call fcn.00439fe0
mov edx, dword [ebx + 1]
push edx
call fcn.00439200
add esp, 0x14
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
or dword [ecx + 0xd], 0x10
pop edi
pop ebx
mov eax, 5
pop esi
mov esp, ebp
pop ebp
ret
movzx eax, word [edi + 0x18]
lea eax, [eax + edi + 0x18]
mov al, byte [eax + 0xc]
test al, 2
je 0x43a39c
test al, 1
jne 0x43a39c
or dword [ebx + 0xd], 0x10
mov edx, dword [ebp + 0x10]
push edx
push ecx
push edi
push ebx
call fcn.00439fe0
add esp, 0x10
pop edi
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x43e875
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
xor edi, edi
cmp esi, edi
jne 0x43e885
or eax, 0xffffffff
jmp 0x43e8cd
cmp dword [esi + 0x48], edi
je 0x43e8c8
cmp dword [esi + 0x10], edi
je 0x43e8c8
push edi
push dword [esi + 0x44]
push dword [esi + 0x40]
push dword [esi]
call fcn.0043e831
add esp, 0x10
push edi
lea eax, [ebp - 4]
push eax
push dword [esi + 0x48]
push dword [esi + 0x38]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp ecx, dword [esi + 0x48]
mov dword [esi + 0x14], 1
sete al
dec eax
jmp 0x43e8ca
xor eax, eax
mov dword [esi + 0x10], edi
pop edi
leave
ret
Function at 0x43ecf9
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
xor eax, eax
inc ebx
mov dword [ebp - 4], eax
cmp esi, edi
je 0x43ed68
cmp dword [esi], 0xffffffff
je 0x43ed68
cmp dword [esi + 0x10], edi
je 0x43ed20
call fcn.0043e875
cmp dword [esi + 0x14], edi
je 0x43ed42
push dword [ebp + 0x1c]
push edi
push dword [esi + 0xc]
push dword [esi + 8]
push esi
call fcn.0043ea4a
add esp, 0x14
cmp eax, 0xffffffff
jne 0x43ed42
xor eax, eax
inc eax
jmp 0x43ed72
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x43ed66
mov eax, dword [ebp - 4]
xor ebx, ebx
add dword [esi + 8], eax
adc dword [esi + 0xc], edi
jmp 0x43ed68
xor eax, eax
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x43ed77
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
xor edi, edi
xor eax, eax
inc ebx
mov dword [ebp - 4], eax
cmp esi, edi
je 0x43eddc
cmp dword [esi], 0xffffffff
je 0x43eddc
cmp dword [esi + 0x14], edi
je 0x43edb6
push dword [ebp + 0x1c]
push edi
push dword [esi + 0xc]
push dword [esi + 8]
push esi
call fcn.0043ea4a
add esp, 0x14
cmp eax, 0xffffffff
jne 0x43edb6
xor eax, eax
inc eax
jmp 0x43ede6
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x43edda
mov eax, dword [ebp - 4]
xor ebx, ebx
add dword [esi + 8], eax
adc dword [esi + 0xc], edi
jmp 0x43eddc
xor eax, eax
mov ecx, dword [ebp + 0x18]
mov dword [ecx], eax
mov dword [ecx + 4], edi
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43f7e0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], 0
test esi, esi
jne 0x43f807
push 0xa0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edi
push 0
push 0
call ebx
mov ecx, esi
lea esi, [ecx + 2]
lea ebx, [ebx]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x43f820
sub ecx, esi
sar ecx, 1
lea edi, [eax + ecx + 1]
lea eax, [edi + edi]
push eax
call dword [sym.imp.MSVCR100.dll_malloc]
mov esi, eax
add esp, 4
test esi, esi
je 0x43f8a0
push edi
push esi
call ebx
test eax, eax
je 0x43f88a
cmp eax, edi
jae 0x43f88a
cmp word [esi + eax*2 - 2], 0x5c
mov ebx, dword [sym.imp.MSVCR100.dll_wcsncat_s]
je 0x43f86e
push 0xffffffffffffffff
push 0x46153c
push edi
push esi
call ebx
add esp, 0x10
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push ecx
push edi
push esi
call ebx
add esp, 0x10
push 0
push 0
push 0
push esi
call fcn.0043f680
mov dword [ebp - 4], eax
push esi
call dword [sym.imp.MSVCR100.dll_free]
mov eax, dword [ebp - 4]
add esp, 4
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4
push 0xe
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x440a6d
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
push dword [ebp + 8]
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, esi
jne 0x440abe
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x14]
mov dword [ebp - 8], 4
push esi
push esi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret

Function at 0x440c9f
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push edi
xor edi, edi
cmp dword [0x46baa8], edi
je 0x440cb5
push 9
pop eax
jmp 0x440d51
push esi
push str.GlobalAVARKT_40ECE7C5_7537_4BD7_A55B_2AE816792654
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x46bab0], eax
cmp eax, edi
je 0x440ce3
call esi
cmp eax, 0xb7
je 0x440cea
cmp dword [0x46bab0], edi
jne 0x440d00
call esi
cmp eax, 5
jne 0x440d00
push dword [0x46bab0]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x46bab0], edi
push 9
jmp 0x440d46
mov esi, dword [ebp + 8]
lea eax, [esi + 0x620]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x46baac], eax
cmp eax, edi
jne 0x440d1d
push 7
jmp 0x440d46
push str.ARK4
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x46baa8], eax
cmp eax, edi
jne 0x440d49
push dword [0x46baac]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov dword [0x46baac], edi
push 8
pop eax
jmp 0x440d50
push 0x65
push esi
call eax
pop ecx
pop ecx
pop esi
pop edi
pop ebp
ret
Function at 0x441414
Capabilities:
Read .ini file

Disassembly:
push 0x408
mov eax, 0x456e3e
call fcn.00453845
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
and dword [ebp - 0x414], 0
lea ecx, [ebp - 0x414]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_clas]
and dword [ebp - 4], 0
xor eax, eax
push 0x3fe
push eax
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
push edi
lea ecx, [ebp - 0x414]
call dword [0x4598bc]
push ebx
lea ecx, [ebp - 0x414]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator_1]
push dword [ebp - 0x414]
lea eax, [ebp - 0x410]
push 0x200
push eax
push 0x45f664
push 0x45f674
push str.BUILD
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
lea eax, [ebp - 0x410]
push eax
mov ecx, esi
call dword [0x45968c]
lea ecx, [ebp - 0x414]
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::CStringT_wchar_t_cla]
mov eax, esi
call fcn.004538c8
ret

Function at 0x44170f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x410], 0xffffffff
push ebx
lea eax, [ebp - 0x410]
push eax
xor ebx, ebx
push 0x20008
mov dword [ebp - 0x40c], ebx
mov word [ebp - 0x408], 0x500
mov dword [ebp - 0x414], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x44180e
push esi
push ebx
mov esi, 0x400
lea eax, [ebp - 0x404]
push esi
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x41c]
push eax
push esi
lea eax, [ebp - 0x404]
push eax
push 2
push dword [ebp - 0x410]
mov dword [ebp - 0x41c], ebx
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x441801
lea eax, [ebp - 0x418]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x40c]
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x441801
push edi
xor edi, edi
lea esi, [ebp - 0x400]
cmp edi, dword [ebp - 0x404]
jae 0x4417f4
push dword [esi]
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
inc edi
add esi, 8
mov dword [ebp - 0x414], eax
cmp eax, ebx
je 0x4417d0
push dword [ebp - 0x418]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
push dword [ebp - 0x410]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x414]
xor ecx, ebp
pop ebx
call fcn.004534b8
leave
ret
Function at 0x441956
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x5c]
push eax
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x441981
xor eax, eax
jmp 0x4419ee
lea eax, [ebp - 0x64]
push eax
push 0x4c
lea eax, [ebp - 0x50]
push eax
push 1
push dword [ebp - 0x5c]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x5c]
test eax, eax
jne 0x4419a5
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x44197d
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lea ecx, [ebp - 0x60]
push ecx
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x12
mov dword [ebp - 0x58], eax
push 1
lea eax, [ebp - 0x58]
push eax
mov word [ebp - 0x54], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x44197d
push esi
push dword [ebp - 0x60]
push dword [ebp - 0x50]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
push dword [ebp - 0x60]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, esi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004534b8
leave
ret

Function at 0x441a36
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x424
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x18]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 0x420], eax
mov eax, dword [ebp + 0x14]
push edi
mov dword [ebp - 0x414], eax
xor eax, eax
push 0x3fe
push eax
mov dword [ebp - 0x424], eax
mov dword [ebp - 0x418], eax
mov dword [ebp - 0x41c], eax
lea eax, [ebp - 0x40e]
xor ecx, ecx
push eax
mov word [ebp - 0x410], cx
call sub.MSVCR100.dll_memset
xor eax, eax
mov word [ebp - 0x10], ax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 5
stosw word es:[edi], ax
lea eax, [ebp - 0x10]
push esi
push eax
call dword [sym.imp.MSVCR100.dll_wcsncpy]
add esp, 0x18
cmp word [ebp - 0x10], 0x5c
jne 0x441abe
cmp word [ebp - 0xe], 0x5c
je 0x441ad2
push 0x3a
pop eax
mov word [ebp - 0xe], ax
push 0x5c
pop eax
mov word [ebp - 0xc], ax
xor eax, eax
mov word [ebp - 0xa], ax
cmp dword [ebp - 0x414], 0
jne 0x441ae7
lea eax, [ebp - 0x424]
mov dword [ebp - 0x414], eax
test ebx, ebx
jne 0x441af1
lea ebx, [ebp - 0x41c]
push 0x200
lea eax, [ebp - 0x410]
push eax
push ebx
lea eax, [ebp - 0x418]
push eax
push dword [ebp - 0x414]
lea eax, [ebp - 0x10]
push dword [ebp + 0x10]
push dword [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
pop edi
pop esi
pop ebx
test eax, eax
jne 0x441b2b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004534b8
leave
ret
Function at 0x441c19
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x441c38
xor eax, eax
jmp 0x441c6e
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.MSVCR100.dll_wcslen]
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call dword [sym.imp.MSVCR100.dll__wcsnicmp]
add esp, 0x10
neg eax
sbb eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004534b8
leave
ret

Function at 0x441c7b
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
call fcn.0044e361
xor esi, esi
test eax, eax
je 0x441ce2
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.004534b8
leave
ret
Function at 0x445610
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x25c
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x25c], 0
push ebx
push esi
push edi
mov edi, ecx
call fcn.0044811a
mov ebx, dword [sym.imp.MSVCR100.dll_wcscpy]
push eax
mov eax, dword [edi + 0x99c]
mov esi, 0x40000
add eax, esi
push eax
call ebx
mov eax, dword [edi + 0x99c]
add eax, esi
push 0x460f70
push eax
call dword [sym.imp.MSVCR100.dll_wcscat]
add esp, 0x10
lea eax, [ebp - 0x254]
push eax
mov eax, dword [edi + 0x99c]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x258], eax
cmp eax, 0xffffffff
je 0x445751
test byte [ebp - 0x254], 0x10
je 0x44572a
lea eax, [ebp - 0x228]
push str.AVSCAN_
push eax
call fcn.0044d169
pop ecx
pop ecx
test eax, eax
je 0x44572a
mov ecx, edi
call fcn.0044811a
push eax
mov eax, dword [edi + 0x99c]
add eax, esi
push eax
call ebx
lea eax, [ebp - 0x228]
push eax
mov eax, dword [edi + 0x99c]
add eax, esi
push eax
call dword [sym.imp.MSVCR100.dll_wcscat]
mov eax, dword [edi + 0x99c]
add eax, esi
push eax
call fcn.0044cda5
mov ecx, dword [edi + 0x99c]
mov eax, dword [edi + 0xa04]
add ecx, esi
push ecx
push eax
call fcn.0044d169
add esp, 0x1c
test eax, eax
jne 0x44572a
mov eax, dword [edi + 0x99c]
add eax, esi
push eax
call fcn.0044cdd2
push 0
push 0
lea eax, [ebp - 0x25c]
push eax
mov eax, dword [edi + 0x99c]
add eax, esi
push 1
push eax
call fcn.0044d6bb
add esp, 0x18
lea eax, [ebp - 0x254]
push eax
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x445687
push dword [ebp - 0x258]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004534b8
leave
ret

Function at 0x446f41
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x46af24]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
push 0x41
pop eax
push 0x3a
mov word [ebp - 0xc], ax
pop eax
push 0x5c
mov word [ebp - 0xa], ax
pop eax
mov word [ebp - 8], ax
xor eax, eax
push 0x1a
mov word [ebp - 6], ax
pop edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, dword [ebp + 0xc]
jne 0x446f98
push 0
push 0
push 3
push 1
lea eax, [ebp - 0xc]
push eax
push esi
call fcn.00446de7
add esp, 0x18
inc word [ebp - 0xc]
dec edi
jne 0x446f74
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.004534b8
leave
ret
Function at 0x447ab9
Capabilities:
Get common file path

Disassembly:
push edi
lea edi, [ecx + 0x9f8]
mov eax, dword [edi]
cmp dword [eax - 0xc], 0
jne 0x447af6
push ebx
push esi
lea esi, [ecx + 0x99c]
mov eax, dword [esi]
mov ebx, 0x40000
add eax, ebx
push eax
push 0x8000
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [esi]
add eax, ebx
push eax
mov ecx, edi
call dword [0x4598bc]
mov eax, dword [edi]
pop esi
pop ebx
pop edi
ret

Function at 0x447ba0
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, ecx
mov eax, dword [esi + 0x99c]
mov edi, 0x40000
add eax, edi
push eax
mov dword [ebp - 4], pe_nt_image_headers32
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea ecx, [esi + 0xa4c]
test eax, eax
jne 0x447bd8
push 0x45c4fc
jmp 0x447be1
mov eax, dword [esi + 0x99c]
add eax, edi
push eax
call dword [0x4598bc]
pop edi
pop esi
leave
ret

Function at 0x447beb
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
mov esi, ecx
mov eax, dword [esi + 0x99c]
mov edi, 0x40000
add eax, edi
push eax
mov dword [ebp - 4], 0x8000
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
lea ecx, [esi + 0xa48]
test eax, eax
jne 0x447c23
push 0x45c4fc
jmp 0x447c2c
mov eax, dword [esi + 0x99c]
add eax, edi
push eax
call dword [0x4598bc]
pop edi
pop esi
leave
ret

Function at 0x447e3f
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x9e8]
mov eax, dword [edi]
mov dword [ebp - 4], 0x8000
cmp dword [eax - 0xc], 0
jne 0x447ecf
push ebx
lea eax, [ebp - 4]
push eax
mov eax, dword [esi + 0x99c]
mov ebx, 0x40000
add eax, ebx
push eax
push str.Common_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call fcn.0044ead9
add esp, 0x14
mov ecx, edi
test eax, eax
jne 0x447eba
mov eax, dword [esi + 0x99c]
add eax, ebx
push eax
call dword [0x4598bc]
push edi
call fcn.0044ca5a
pop ecx
add esi, 0xa1c
push esi
mov ecx, edi
call dword [0x459688]
push edi
call fcn.0044ca5a
pop ecx
jmp 0x447ec7
add esi, 0x9fc
push esi
call dword [sym.imp.mfc100u.dll_ATL::CStringT_wchar_t_class_StrTraitMFC_DLL_wchar_t_class_ATL::ChTraitsCRT_wchar_t_____::operator]
push edi
call fcn.0044ca5a
pop ecx
pop ebx
mov eax, dword [edi]
pop edi
pop esi
leave
ret
Function at 0x448232
Capabilities:
Check os version
Get common file path

Disassembly:
inc dword [0x46d0d4]
push ebx
push esi
push edi
mov esi, ecx
call sub.mfc100u.dll_AfxGetModuleState
mov ecx, dword [esi + 0x99c]
mov eax, dword [eax + 8]
mov ebx, 0x8000
push ebx
mov edi, 0x40000
add ecx, edi
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
inc dword [0x46d0d4]
mov eax, dword [esi + 0x99c]
add eax, edi
lea ecx, [esi + 0xa50]
push eax
call dword [0x4598bc]
inc dword [0x46d0d4]
mov eax, dword [esi + 0x99c]
add eax, edi
push 0x5c
push eax
call dword [sym.imp.MSVCR100.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x44829e
xor ecx, ecx
mov word [eax + 2], cx
inc dword [0x46d0d4]
mov eax, dword [esi + 0x99c]
add eax, edi
push eax
lea ecx, [esi + 0x9fc]
call dword [0x4598bc]
add dword [0x46d0d4], 2
push dword [esi + 0xa50]
mov ecx, esi
call fcn.00445e59
test eax, eax
jne 0x448449
mov dword [0x46d0d4], 0xa
mov eax, dword [esi + 0x99c]
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
inc dword [0x46d0d4]
mov eax, dword [esi + 0x99c]
add eax, edi
push eax
call fcn.0044cda5
mov eax, dword [esi + 0x99c]
pop ecx
add eax, edi
push eax
lea ecx, [esi + 0x9f0]
call dword [0x4598bc]
add dword [0x46d0d4], 2
mov eax, dword [esi + 0x99c]
push ebx
add eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
inc dword [0x46d0d4]
mov eax, dword [esi + 0x99c]
add eax, edi
push eax
call fcn.0044cda5
mov eax, dword [esi + 0x99c]
pop ecx
add eax, edi
push eax
lea ecx, [esi + 0x9ec]
call dword [0x4598bc]
inc dword [0x46d0d4]
xor edi, edi
inc edi
lea eax, [esi + 0xc20]
mov dword [esi + 0xbec], 0x3000003e
mov dword [esi + 0xbf0], edi
mov dword [esi + 0xbd8], 0x10
inc dword [0x46d0d4]
mov dword [eax], 0x114
inc dword [0x46d0d4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
xor eax, eax
cmp dword [esi + 0xc30], 2
sete al
mov dword [esi + 0xd34], eax
test eax, eax
je 0x448400
mov ecx, dword [esi + 0xc24]
xor eax, eax
cmp ecx, 4
sete al
mov dword [esi + 0xd38], eax
cmp ecx, 5
jne 0x4483d8
cmp dword [esi + 0xc28], 0
jne 0x4483d8
mov eax, edi
jmp 0x4483da
xor eax, eax
mov dword [esi + 0xd3c], eax
cmp ecx, 5
jne 0x4483ed
cmp dword [esi + 0xc28], edi
je 0x4483ef
xor edi, edi
mov dword [esi + 0xd40], edi
call fcn.0044170f
mov dword [esi + 0xd48], eax
inc dword [0x46d0d4]
call fcn.0043baec
mov ecx, esi
mov dword [0x46d0d4], 0x14
call fcn.00447ba0
inc dword [0x46d0d4]
mov ecx, esi
call fcn.00447beb
inc dword [0x46d0d4]
cmp dword [esi + 0xd34], 0
je 0x448443
call fcn.00441956
mov dword [esi + 0xd44], eax
inc dword [0x46d0d4]
mov eax, dword [esi + 0xd60]
pop edi
pop esi
pop ebx
ret
Function at 0x449418
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0
mov esi, ecx
push 0
push dword [esi + 0x14]
mov dword [ebp - 4], 0x410
call fcn.004495c4
mov dword [esi + 0x14], eax
test eax, eax
je 0x44948e
cmp word [eax], 0
jne 0x44948e
lea ecx, [ebp - 4]
push ecx
push eax
push str.Common_AppData
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders
push 0x80000002
call fcn.0044ead9
add esp, 0x14
test eax, eax
jne 0x44948b
push dword [esi + 0x14]
call fcn.0044cda5
pop ecx
push 0x4a
mov ecx, esi
call fcn.0044987f
push eax
push dword [esi + 0x14]
call dword [sym.imp.MSVCR100.dll_wcscat]
push dword [esi + 0x14]
call fcn.0044cda5
mov eax, dword [esi + 0x14]
add esp, 0xc
jmp 0x44948e
mov eax, dword [esi + 8]
pop esi
leave
ret