joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c070
Capabilities:
Check if file exists
Delete file
Get common file path

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
push ebp
push esi
push edi
push 0x104
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, 0x41c78c
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
and ecx, 3
lea eax, [esp + 0x10]
rep movsb byte es:[edi], byte [esi]
push eax
call ebp
test eax, eax
je 0x40c0d0
mov ebx, 1
lea ecx, [esp + 0x114]
push 0x104
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov edi, str._systemC0NIME.EXE
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x114]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov edi, edx
mov edx, ecx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
lea eax, [esp + 0x114]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call ebp
test eax, eax
je 0x40c127
mov ebx, 1
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x40c1db
test ebx, ebx
je 0x40c1db
lea ecx, [esp + 0x10]
xor esi, esi
push ecx
call ebp
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40c17f
lea edx, [esp + 0x10]
push edx
call edi
test eax, eax
jne 0x40c17f
lea eax, [esp + 0x10]
push eax
call fcn.00407fc0
add esp, 4
test eax, eax
jne 0x40c17f
lea ecx, [esp + 0x10]
push ecx
call fcn.00406390
add esp, 4
mov esi, 1
lea edx, [esp + 0x114]
push edx
call ebp
test eax, eax
je 0x40c1c4
lea eax, [esp + 0x114]
push eax
call edi
test eax, eax
jne 0x40c1c4
lea ecx, [esp + 0x114]
push ecx
call fcn.00407fc0
add esp, 4
test eax, eax
jne 0x40c1c4
lea edx, [esp + 0x114]
push edx
call fcn.00406390
add esp, 4
mov esi, 1
call fcn.0040c3c0
call fcn.0040c1f0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x40c1f0
Capabilities:
Delete registry key
Delete registry value
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x218
push ebx
push ebp
push esi
lea eax, [esp + 0x14]
push edi
push eax
push 0x2001f
push 0
mov ebx, 0x104
push str.SOFTWAREMicrosoftWindowsCurrentVersionpoliciesExplorerRun
push 0x80000002
mov dword [esp + 0x24], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c2be
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov ebp, dword [sym.imp.MSVCRT.dll__mbslwr]
xor esi, esi
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x30], ebx
call edi
test eax, eax
jne 0x40c2b3
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x124]
push ecx
lea eax, [esp + 0x18]
push edx
mov edx, dword [esp + 0x20]
push eax
lea ecx, [esp + 0x2c]
push 0
push ecx
push edx
mov dword [esp + 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c2b0
lea eax, [esp + 0x124]
push eax
call ebp
push str.ctfm0n.exe
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0xc
test eax, eax
je 0x40c2b0
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc esi
jmp 0x40c235
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push str.Start_Page
push str.SoftwareMicrosoftInternet_ExplorerMain
push 0x80000001
mov dword [esp + 0x28], ebx
call esi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueA]
mov ebp, 1
test eax, eax
jne 0x40c333
lea ecx, [esp + 0x20]
push str.44939
push ecx
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
je 0x40c333
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ebp
push edx
push eax
push str.Start_Page
push str.SOFTWAREMicrosoftInternet_ExplorerMain
push 0x80000001
mov byte [esp + 0x38], 0
mov dword [esp + 0x28], ebp
call edi
lea ecx, [esp + 0x10]
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x18]
push edx
push eax
push str.Start_Page
push str.SoftwareieMain
push 0x80000001
mov dword [esp + 0x28], ebx
call esi
test eax, eax
jne 0x40c397
lea ecx, [esp + 0x20]
push str.44939
push ecx
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 8
test eax, eax
je 0x40c397
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push ebp
push edx
push eax
push str.Start_Page
push str.SOFTWAREieMain
push 0x80000001
mov byte [esp + 0x38], 0
mov dword [esp + 0x28], ebp
call edi
push str.Software_fengzi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
Function at 0x40c3c0
Capabilities:
Delete registry value
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
push ebx
lea eax, [esp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push eax
push 0x2001f
push 0
mov ebx, 0x104
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push 0x80000002
mov dword [esp + 0x1c], ebx
call esi
test eax, eax
jne 0x40c4c0
push ebp
push edi
mov edi, dword [sym.imp.MSVCRT.dll_sprintf]
xor ebp, ebp
mov eax, dword [esp + 0x18]
push 0
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push ebp
push eax
mov dword [esp + 0x30], ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x40c4b3
lea ecx, [esp + 0x20]
lea edx, [esp + 0x124]
push ecx
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_s
push edx
call edi
add esp, 0xc
lea eax, [esp + 0x14]
lea ecx, [esp + 0x124]
push eax
push 0x2001f
push 0
push ecx
push 0x80000002
call esi
test eax, eax
jne 0x40c4ad
lea edx, [esp + 0x10]
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
lea ecx, [esp + 0x20]
push eax
push ecx
push 0
push str.debugger
push edx
mov dword [esp + 0x28], ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c4a2
mov eax, dword [esp + 0x10]
test eax, eax
je 0x40c4a2
mov eax, dword [esp + 0x14]
push str.debugger
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, dword [esp + 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
inc ebp
jmp 0x40c401
mov edx, dword [esp + 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x218
ret
Function at 0x40c4d0
Capabilities:
Get file attributes
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
lea ecx, [esp + 0x18]
push eax
lea edx, [esp + 0x18]
push ecx
push edx
push str.debugger
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_OptionsAppSvc32.exe
push 0x80000002
mov dword [esp + 0x28], 0x104
xor ebp, ebp
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40c5e9
mov eax, dword [esp + 0x10]
test eax, eax
jbe 0x40c5e9
mov edi, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea eax, [esp + 0x18]
push 0x5c
push eax
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c54f
lea ecx, [esp + 0x18]
push 0x2f2f
push ecx
call edi
mov esi, eax
add esp, 8
test esi, esi
jne 0x40c54f
lea esi, [esp + 0x18]
jmp 0x40c550
inc esi
mov edi, str.vista.exe
or ecx, 0xffffffff
xor eax, eax
mov ebx, dword [sym.imp.MSVCRT.dll__mbsnbicmp]
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.vista.exe
push esi
call ebx
add esp, 0xc
test eax, eax
je 0x40c594
mov edi, str.snowfall.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push str.snowfall.exe
push esi
call ebx
add esp, 0xc
test eax, eax
jne 0x40c5e9
lea edx, [esp + 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40c5e9
mov eax, dword [esp + 0x120]
mov esi, 1
test eax, eax
je 0x40c5dc
push 0
push 0
push str.vista.exe
call fcn.00406eb0
push 0
push 0
push str.snowfall.exe
call fcn.00406eb0
lea eax, [esp + 0x30]
push eax
call fcn.004086c0
add esp, 0x1c
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40c600
Capabilities:
Check if file exists
Delete file
Get common file path
Get file attributes

Disassembly:
sub esp, 0x208
lea eax, [esp]
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push 0x104
push eax
xor ebx, ebx
call esi
lea ecx, [esp + 0x114]
push 0x104
push ecx
call esi
mov edi, str.qqrun.exe
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x10]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea edx, [esp + 0x114]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov edi, str.d3d.exe
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebp, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebp
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebp
lea eax, [esp + 0x10]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
mov esi, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
call esi
cmp eax, 0xffffffff
je 0x40c6a5
test al, 0x10
jne 0x40c6a5
mov ebx, 1
lea ecx, [esp + 0x114]
push ecx
call esi
cmp eax, 0xffffffff
je 0x40c6bd
test al, 0x10
jne 0x40c6bd
mov ebx, 1
mov eax, dword [esp + 0x21c]
test eax, eax
je 0x40c76d
test ebx, ebx
je 0x40c76d
mov edi, dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
lea edx, [esp + 0x10]
push edx
xor esi, esi
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
je 0x40c71b
lea eax, [esp + 0x10]
push eax
call ebx
test eax, eax
jne 0x40c71b
lea ecx, [esp + 0x10]
push ecx
call fcn.00407fc0
add esp, 4
test eax, eax
jne 0x40c71b
lea edx, [esp + 0x10]
push edx
call fcn.00406390
add esp, 4
mov esi, 1
lea eax, [esp + 0x114]
push eax
call edi
test eax, eax
je 0x40c760
lea ecx, [esp + 0x114]
push ecx
call ebx
test eax, eax
jne 0x40c760
lea edx, [esp + 0x114]
push edx
call fcn.00407fc0
add esp, 4
test eax, eax
jne 0x40c760
lea eax, [esp + 0x114]
push eax
call fcn.00406390
add esp, 4
mov esi, 1
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x208
ret
pop edi
pop esi
mov eax, ebx
pop ebp
pop ebx
add esp, 0x208
ret
Function at 0x40cac0
Capabilities:
Delete registry value
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x218
lea eax, [esp]
push ebx
push eax
push 0x2001f
push 0
mov ebx, 0x104
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
mov dword [esp + 0x1c], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40cb8d
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
xor esi, esi
mov eax, dword [esp + 0x10]
push 0
push 0
push 0
lea ecx, [esp + 0x20]
push 0
lea edx, [esp + 0x30]
push ecx
push edx
push esi
push eax
mov dword [esp + 0x34], ebx
call edi
test eax, eax
jne 0x40cb7f
lea ecx, [esp + 0x18]
lea edx, [esp + 0x124]
push ecx
lea eax, [esp + 0x20]
push edx
mov edx, dword [esp + 0x18]
push eax
lea ecx, [esp + 0x2c]
push 0
push ecx
push edx
mov dword [esp + 0x30], ebx
call ebp
test eax, eax
jne 0x40cb7c
mov eax, dword [esp + 0x22c]
lea ecx, [esp + 0x124]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40cb7c
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x20]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
inc esi
jmp 0x40cb05
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x218
ret
Function at 0x40cba0
Capabilities:
Get common file path

Disassembly:
sub esp, 0x20c
push ebx
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push 2
mov ecx, 0x41ec90
mov dword [esp + 0x18], 0
call fcn.00413780
mov ebx, eax
test ebx, ebx
je 0x40cc3f
mov esi, dword [sym.imp.MSVCRT.dll__mbsrchr]
lea ecx, [ebx + 0x108]
push 0x5c
push ecx
call esi
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x40cc1f
lea edx, [esp + 0x14]
inc ebp
push edx
push str.__0_F_
push ebp
call dword [sym.imp.MSVCRT.dll_sscanf]
add esp, 0xc
cmp eax, 1
jne 0x40cc1f
lea edi, [esp + 0x14]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
cmp ecx, 8
jne 0x40cc1f
push ebx
mov ecx, 0x41ec90
call fcn.00412be0
test eax, eax
jne 0x40cc4c
mov edi, dword [esp + 0x10]
lea eax, [esp + 0x10]
inc edi
push eax
push 2
mov ecx, 0x41ec90
mov dword [esp + 0x18], edi
call fcn.00413780
mov ebx, eax
test ebx, ebx
jne 0x40cbcf
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x20c
ret
mov eax, dword [esp + 0x220]
test eax, eax
je 0x40cd0e
lea ecx, [esp + 0x14]
push ecx
push str._s.dll
push 0x104
push ebp
call fcn.00406680
lea esi, [ebx + 0x108]
push esi
call fcn.00406390
add esp, 0x14
lea edx, [esp + 0x14]
push edx
push str._s.dat
push 0x104
push ebp
call fcn.00406680
push esi
call fcn.00406390
add esp, 0x14
lea eax, [esp + 0x118]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x14]
lea edi, [esp + eax + 0x118]
push ecx
push str.Help_s.hlp
push 0x104
push edi
call fcn.00406680
push esi
call fcn.00406390
add esp, 0x14
lea edx, [esp + 0x14]
push edx
push str._s.hlp
push 0x104
push edi
call fcn.00406680
push esi
call fcn.00406390
add esp, 0x14
mov ecx, 0x41ec90
mov byte [esi], 0
push 1
push ebx
call fcn.00412c10
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x20c
ret

Function at 0x40cd20
Capabilities:
Check if file exists
Get common file path
Get file attributes
Get program files directory

Disassembly:
sub esp, 0x108
lea eax, [esp + 4]
push esi
push edi
xor edi, edi
push edi
push 0x26
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x40cdd1
mov ecx, 0x104
lea eax, [esp + 0xc]
cmp byte [eax], 0
je 0x40cd55
inc eax
dec ecx
jne 0x40cd4a
jmp 0x40cd99
test ecx, ecx
je 0x40cd99
lea edx, [esp + 8]
test edx, edx
je 0x40cd6a
mov eax, 0x104
sub eax, ecx
jmp 0x40cd6e
mov eax, dword [esp + 8]
mov edx, 0x104
sub edx, eax
lea eax, [esp + eax + 0xc]
je 0x40cd99
mov esi, str.meex.exe
sub esi, eax
mov cl, byte [esi + eax]
test cl, cl
je 0x40cd91
mov byte [eax], cl
inc eax
dec edx
jne 0x40cd82
jmp 0x40cd95
test edx, edx
jne 0x40cd96
dec eax
mov byte [eax], 0
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40cdd1
mov eax, dword [esp + 0x114]
mov esi, 1
test eax, eax
je 0x40cdc6
lea ecx, [esp + 0xc]
push ecx
call fcn.004086c0
add esp, 4
mov eax, esi
pop edi
pop esi
add esp, 0x108
ret
mov eax, edi
pop edi
pop esi
add esp, 0x108
ret
Function at 0x40ce50
Capabilities:
Get file attributes

Disassembly:
sub esp, 0x108
push ebp
lea eax, [esp + 4]
push edi
xor ebp, ebp
push eax
push 1
mov ecx, 0x41ec90
mov dword [esp + 0x10], ebp
call fcn.00413780
mov ecx, dword [esp + 8]
mov edi, eax
inc ecx
cmp edi, ebp
mov dword [esp + 8], ecx
je 0x40cf70
push ebx
mov ebx, dword [sym.imp.MSVCRT.dll__mbsstr]
push esi
mov ecx, edi
lea edx, [esp + 0x14]
sub ecx, edx
mov esi, 0x104
lea eax, [esp + 0x14]
lea edx, [ecx + 0x108]
mov cl, byte [edx + eax]
test cl, cl
je 0x40ceb0
mov byte [eax], cl
inc eax
dec esi
jne 0x40cea1
jmp 0x40ceb4
test esi, esi
jne 0x40ceb5
dec eax
mov byte [eax], 0
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.MSVCRT.dll__mbslwr]
lea ecx, [esp + 0x18]
push str.common_files_system_
push ecx
call ebx
add esp, 0xc
test eax, eax
jne 0x40cee9
lea edx, [esp + 0x14]
push str.microsoft_shared_
push edx
call ebx
add esp, 8
test eax, eax
je 0x40cf3f
lea eax, [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40cf3f
test al, 2
je 0x40cf3f
test al, 4
je 0x40cf3f
mov eax, dword [esp + 0x11c]
mov ebp, 1
test eax, eax
je 0x40cf3f
lea ecx, [esp + 0x14]
push 0x5c
push ecx
call dword [sym.imp.MSVCRT.dll__mbsrchr]
add esp, 8
test eax, eax
je 0x40cf32
push 0
inc eax
push 0
push eax
call fcn.00406eb0
add esp, 0xc
push 1
push edi
mov ecx, 0x41ec90
call fcn.00412c10
lea edx, [esp + 0x10]
mov ecx, 0x41ec90
push edx
push 1
call fcn.00413780
mov ecx, dword [esp + 0x10]
mov edi, eax
inc ecx
test edi, edi
mov dword [esp + 0x10], ecx
jne 0x40ce8a
pop esi
pop ebx
mov eax, ebp
pop edi
pop ebp
add esp, 0x108
ret
mov eax, ebp
pop edi
pop ebp
add esp, 0x108
ret
Function at 0x40cf80
Capabilities:
Get common file path

Disassembly:
sub esp, 0x108
push ebx
push ebp
mov ebp, dword [sym.imp.SHLWAPI.dll_PathAppendA]
xor ebx, ebx
push esi
push edi
mov dword [esp + 0x10], ebx
mov esi, 0x41ca50
mov eax, dword [esi - 0x10]
cmp eax, ebx
jne 0x40d002
mov eax, dword [esi - 0xc]
mov ecx, dword [esi - 4]
push eax
push ecx
mov ecx, 0x41ec90
call fcn.00413e50
mov edi, eax
mov eax, dword [esi]
cmp eax, ebx
je 0x40cfcb
push ebx
push edi
call eax
add esp, 8
test eax, eax
je 0x40d117
cmp edi, ebx
je 0x40d117
mov ecx, dword [esp + 0x11c]
mov eax, 1
cmp ecx, ebx
mov dword [esp + 0x10], eax
je 0x40d137
mov eax, dword [esi]
push 1
cmp eax, ebx
push edi
je 0x40d10d
call eax
add esp, 8
jmp 0x40d117
cmp eax, 1
jne 0x40d117
mov ecx, 0x40
xor eax, eax
lea edi, [esp + 0x15]
mov byte [esp + 0x14], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov eax, dword [esi - 8]
cmp eax, ebx
jne 0x40d059
mov edx, dword [esi - 4]
lea ecx, [esp + 0x14]
mov edi, 0x104
lea eax, [esp + 0x14]
sub edx, ecx
mov cl, byte [edx + eax]
cmp cl, bl
je 0x40d04d
mov byte [eax], cl
inc eax
dec edi
jne 0x40d038
dec eax
mov byte [eax], bl
jmp 0x40d0e0
cmp edi, ebx
jne 0x40d052
dec eax
mov byte [eax], bl
jmp 0x40d0e0
cmp eax, 1
jne 0x40d079
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [esi - 4]
lea ecx, [esp + 0x14]
push eax
push ecx
jmp 0x40d0de
cmp eax, 2
jne 0x40d099
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov eax, dword [esi - 4]
lea ecx, [esp + 0x14]
push eax
push ecx
jmp 0x40d0de
cmp eax, 3
jne 0x40d0bc
lea edx, [esp + 0x14]
push 0x104
push edx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea eax, [esp + 0x14]
push str.drivers
push eax
call ebp
jmp 0x40d0d5
cmp eax, 4
jne 0x40d0e0
lea eax, [esp + 0x14]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov byte [esp + 0x17], bl
mov ecx, dword [esi - 4]
lea edx, [esp + 0x14]
push ecx
push edx
call ebp
mov eax, dword [esi - 0xc]
lea ecx, [esp + 0x14]
push eax
push ecx
mov ecx, 0x41ec90
call fcn.00413de0
cmp eax, ebx
je 0x40d117
mov edx, dword [esp + 0x11c]
mov ecx, 1
cmp edx, ebx
mov dword [esp + 0x10], ecx
je 0x40d135
push ecx
push eax
mov ecx, 0x41ec90
call fcn.00412c10
add esi, 0x14
cmp esi, 0x41ca78
jb 0x40cf9b
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x40d190
Capabilities:
Delete file
Get common file path
Get file attributes
Move file
Set file attributes

Disassembly:
sub esp, 0x108
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x14]
push 0x104
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ebp, [esp + eax + 0x14]
mov ebx, 0x41caf0
mov byte [ebp], 0x5c
inc ebp
mov edi, dword [ebx]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea eax, [esp + 0x14]
mov edx, ecx
mov esi, edi
mov edi, ebp
push eax
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
test al, 0x10
jne 0x40d220
mov eax, dword [esp + 0x11c]
mov dword [esp + 0x10], 1
test eax, eax
je 0x40d220
lea ecx, [esp + 0x14]
push 0x80
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push 4
lea edx, [esp + 0x18]
push 0
push edx
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
add ebx, 4
cmp ebx, 0x41cafc
jb 0x40d1c0
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret

Function at 0x40d240
Capabilities:
Delete file
Move file
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
lea eax, [esp + 4]
push esi
lea ecx, [esp + 0xc]
push eax
lea edx, [esp + 8]
push ecx
push edx
push str.debugger
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_avp.exe
push 0x80000002
xor esi, esi
mov dword [esp + 0x20], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
test eax, eax
jne 0x40d2bf
cmp dword [esp + 4], 1
jne 0x40d2bf
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.MSVCRT.dll__mbslwr]
push str.flower.exe
push eax
call dword [sym.imp.MSVCRT.dll__mbsstr]
add esp, 0xc
test eax, eax
je 0x40d2bf
push 4
lea ecx, [esp + 0x10]
push 0
push ecx
mov esi, 1
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea edx, [esp + 0xc]
push edx
call fcn.00407fc0
add esp, 4
mov eax, esi
pop esi
add esp, 0x10c
ret
Function at 0x40d370
Capabilities:
Get common file path

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x415cfb
push eax
mov dword fs:[0], esp
sub esp, 0x258
push ebx
push ebp
push esi
mov esi, dword [esp + 0x274]
push edi
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll__mbsrchr]
mov ebp, eax
add esp, 8
test ebp, ebp
je 0x40d4aa
push 0x2e
push ebp
call dword [sym.imp.MSVCRT.dll__mbschr]
add esp, 8
test eax, eax
je 0x40d4aa
push 0x41a424
push eax
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40d4aa
lea ecx, [esp + 0x58]
call fcn.00414010
push esi
lea ecx, [esp + 0x5c]
mov dword [esp + 0x274], 0
call fcn.00414080
test eax, eax
jne 0x40d496
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesExA]
lea eax, [esp + 0x34]
push eax
push 0
push esi
call ebx
test eax, eax
je 0x40d496
mov edi, dword [sym.imp.MSVCRT.dll__snprintf]
inc ebp
mov esi, 0x41cafc
mov eax, dword [esi]
push eax
push ebp
call dword [sym.imp.MSVCRT.dll__mbsicmp]
add esp, 8
test eax, eax
jne 0x40d48b
mov al, byte [0x41ee58]
test al, al
jne 0x40d44b
push 0x104
push 0x41ee58
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov ecx, dword [esi]
lea edx, [esp + 0x164]
push ecx
push 0x41ee58
push str._s_s
push 0x104
push edx
call edi
add esp, 0x14
lea eax, [esp + 0x10]
lea ecx, [esp + 0x164]
push eax
push 0
push ecx
call ebx
test eax, eax
je 0x40d48b
mov edx, dword [esp + 0x54]
mov eax, dword [esp + 0x30]
cmp edx, eax
jne 0x40d4c5
add esi, 4
cmp esi, 0x41cb0c
jb 0x40d421
lea ecx, [esp + 0x58]
mov dword [esp + 0x270], 0xffffffff
call fcn.00414050
xor eax, eax
mov ecx, dword [esp + 0x268]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x264
ret
lea ecx, [esp + 0x58]
mov dword [esp + 0x270], 0xffffffff
call fcn.00414050
mov eax, 1
jmp 0x40d4ac