joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50fbfb
Capabilities:
Get common file path

Disassembly:
push esi
mov esi, ecx
call fcn.005437dd
call fcn.004235f8
cmp dword [eax + 0x14], 0
jne 0x50fc16
mov ecx, esi
pop esi
jmp fcn.0050ef26
pop esi
ret

Function at 0x511f3b
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
call fcn.00558c72
pop ecx
test eax, eax
jne 0x511f7d
push dword [ebp - 4]
push dword [ebp + 0xc]
push dword [ebp + 8]
push str._s_s_X.tmp
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.00413252
add esp, 0x18
push dword [ebp + 0x10]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x511f43
leave
ret
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
leave
ret

Function at 0x52a9c1
Capabilities:
Get common file path
Get file system object information

Disassembly:
push esi
mov esi, ecx
call fcn.00401f37
call fcn.004235f8
cmp dword [eax + 0x14], 0
jne 0x52a9dc
mov ecx, esi
pop esi
jmp fcn.0052a23d
pop esi
ret

Function at 0x5616bc
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0056137c
Function at 0x1008885
Capabilities:
Clear file content

Disassembly:
push ecx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
xor esi, esi
cmp edi, dword [0x100bb88]
jae 0x10089e1
mov eax, edi
sar eax, 5
mov eax, dword [eax*4 + 0x100bba0]
mov ecx, edi
and ecx, 0x1f
test byte [eax + ecx*8 + 4], 1
je 0x10089e1
push 1
push esi
push edi
call fcn.01007e9b
or ebp, 0xffffffff
add esp, 0xc
cmp eax, ebp
mov dword [esp + 0xc], eax
je 0x10089dd
push 2
push esi
push edi
call fcn.01007e9b
add esp, 0xc
cmp eax, ebp
je 0x10089dd
push ebx
mov ebx, dword [esp + 0x1c]
sub ebx, eax
test ebx, ebx
jle 0x1008989
push 0x1000
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebp, eax
test ebp, ebp
jne 0x1008921
mov dword [0x100b760], 0xc
or esi, 0xffffffff
jmp 0x10089c9
push 0x8000
push edi
call fcn.010089fc
pop ecx
pop ecx
mov dword [esp + 0x18], eax
mov eax, 0x1000
cmp ebx, eax
jge 0x100893d
mov eax, ebx
push eax
push ebp
push edi
call fcn.01007c62
add esp, 0xc
cmp eax, 0xffffffff
je 0x1008955
sub ebx, eax
test ebx, ebx
jg 0x1008932
jmp 0x100896b
cmp dword [0x100b764], 5
jne 0x1008968
mov dword [0x100b760], 0xd
or esi, 0xffffffff
push dword [esp + 0x18]
push edi
call fcn.010089fc
pop ecx
pop ecx
push ebp
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x10089c9
jge 0x10089c9
push 0
push dword [esp + 0x20]
push edi
call fcn.01007e9b
push edi
call fcn.01007c26
add esp, 0x10
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, eax
neg esi
sbb esi, esi
neg esi
dec esi
cmp esi, ebp
jne 0x10089c9
mov dword [0x100b760], 0xd
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [0x100b764], eax
push 0
push dword [esp + 0x14]
push edi
call fcn.01007e9b
add esp, 0xc
mov eax, esi
pop ebx
jmp 0x10089ee
mov eax, ebp
jmp 0x10089ee
mov dword [0x100b760], 9
or eax, 0xffffffff
pop edi
pop esi
pop ebp
pop ecx
ret

Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43000c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x430030
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x401cd0
Capabilities:
Get common file path
Query or enumerate registry value

Disassembly:
push 0xffffffffffffffff
push 0x4676de
mov eax, dword fs:[0]
push eax
sub esp, 0x428
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x424], eax
push ebx
push esi
push edi
mov eax, dword [0x48807c]
xor eax, esp
push eax
lea eax, [esp + 0x438]
mov dword fs:[0], eax
mov esi, ecx
push 0x934
mov dword [esp + 0x20], esi
call fcn.004534f0
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x440], 0
test eax, eax
je 0x401d39
mov ecx, eax
call fcn.0044e720
jmp 0x401d3b
xor eax, eax
lea edx, [esp + 0x10]
push edx
xor ecx, ecx
push 0x20019
push ecx
mov dword [esi + 4], eax
mov al, byte [eax + 5]
push str.SOFTWAREMicrosoftWindowsCurrentVersionSetup
lea ebx, [esi + 0x20]
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x454], 0xffffffff
mov byte [esi + 0x10], al
mov word [ebx], cx
mov dword [esp + 0x28], ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401dcb
lea eax, [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0x28]
push ecx
lea edx, [esp + 0x28]
push edx
push 0
push str.DriverCachePath
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401dc0
lea eax, [esp + 0x24]
mov edx, ebx
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401db1
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x104
lea eax, [esp + 0x230]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp word [ebx], 0
jne 0x401e1f
lea eax, [esp + 0x22c]
mov edx, ebx
mov ecx, eax
sub edx, ecx
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401df1
mov eax, str.Driver_Cache
mov edx, ebx
sub edx, eax
lea esp, [esp]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401e10
push str._SystemRoot_
push ebx
call fcn.004544d5
add esp, 8
test eax, eax
je 0x401eb3
xor ecx, ecx
jmp 0x401e40
movzx edx, word [esp + ecx + 0x22c]
mov word [esp + ecx + 0x24], dx
add ecx, 2
test dx, dx
jne 0x401e40
add eax, 0x18
mov edx, eax
lea ebx, [ebx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x401e60
lea edi, [esp + 0x24]
sub eax, edx
add edi, 0xfffffffe
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x401e74
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
lea eax, [esp + 0x24]
rep movsb byte es:[edi], byte [esi]
mov edx, ebx
mov ecx, eax
sub edx, ecx
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x401ea0
mov esi, dword [esp + 0x1c]
push ebx
push str.DRIVER_CACHE____s__n
call fcn.004454c0
add esp, 8
lea edx, [esp + 0x18]
push edx
push 0x104
add esi, 0x228
push esi
push 1
push 0
push 0
mov dword [esp + 0x30], 0
call sub.WINSPOOL.DRV_GetPrinterDriverDirectoryW
xor eax, eax
mov ecx, dword [esp + 0x438]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x424]
xor ecx, esp
call fcn.00453432
add esp, 0x434
ret
Function at 0x4035b0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x46c
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x468], eax
push esi
push edi
mov edi, dword [esp + 0x478]
push str._DRVAPI::RemoveDriverPackage__n
mov esi, ecx
call fcn.004454c0
mov ecx, dword [esi + 4]
add esp, 4
push 0
push edi
call fcn.004496a0
test al, al
je 0x403722
push str.____USE_PNPUTIL_to_remove_driver_package_first_n
call fcn.004454c0
xor eax, eax
push 0x206
push eax
lea ecx, [esp + 0x6e]
push ecx
mov word [esp + 0x70], ax
call fcn.00453450
mov esi, dword [esi + 4]
add esp, 0x10
cmp dword [esi], 0x17
jl 0x403661
xor edx, edx
push 0x206
push edx
lea eax, [esp + 0x272]
push eax
mov word [esp + 0x274], dx
call fcn.00453450
add esp, 0xc
lea ecx, [esp + 0x268]
push ecx
push 0
push edi
mov ecx, esi
call fcn.0044a990
lea edx, [esp + 0x268]
push edx
push str.pnputil__f__d__s
lea eax, [esp + 0x68]
push eax
jmp 0x40366c
push edi
push str.pnputil__f__d__s
lea ecx, [esp + 0x68]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea edx, [esp + 0x60]
push edx
push str.____Run___s__n
call fcn.004454c0
xor eax, eax
push 0x44
push eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
lea eax, [esp + 0x2c]
push eax
call fcn.00453450
add esp, 0x14
xor ecx, ecx
lea edx, [esp + 0xc]
push edx
lea eax, [esp + 0x20]
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
mov word [esp + 0x6c], cx
lea ecx, [esp + 0x80]
push ecx
push 0
mov dword [esp + 0x44], 0x44
mov dword [esp + 0x70], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x403714
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov dword [esp + 8], 0
push 0x1f4
call esi
mov eax, dword [esp + 0xc]
lea edx, [esp + 8]
push edx
push eax
call edi
cmp dword [esp + 8], 0x103
je 0x4036f5
jmp 0x403730
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str._CreateProcessW_Error__d__n
jmp 0x403728
push edi
push str.File_does_not_exist:___s__Do_nothing_n
call fcn.004454c0
add esp, 8
mov ecx, dword [esp + 0x470]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.00453432
add esp, 0x46c
ret 4
Function at 0x407990
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 4]
push esi
push 0
push 0x80
push 3
push 0
push 1
mov esi, ecx
push SysReAllocString
push eax
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
jne 0x4079e7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadIniFileA___File_Open_failed____ld_n
call fcn.004453d0
add esp, 8
xor eax, eax
pop esi
ret 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x1e
jae 0x407a1c
push str.LoadIniFileA___File_size_is_too_small_n
call fcn.004453d0
mov ecx, dword [esi + 0x10]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0xffffffff
xor eax, eax
pop esi
ret 4
add eax, 4
push eax
call fcn.00453c61
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
jne 0x407a4d
push str.LoadIniFileA___Memory_allocation_error._n
call fcn.004453d0
mov edx, dword [esi + 0x10]
add esp, 4
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0xffffffff
xor eax, eax
pop esi
ret 4

Function at 0x407a60
Capabilities:
Get file size

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push 0
push 0x80
push 3
push 0
push 1
mov esi, ecx
push SysReAllocString
push ebx
mov dword [esi + 4], 0
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [esi + 0x10], eax
cmp eax, 0xffffffff
jne 0x407aba
push ebx
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LoadIniFileW___File_Open_failed____ld____s__n
call fcn.004454c0
add esp, 0xc
pop esi
xor eax, eax
pop ebx
ret 4
push 0
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [esi + 0x14], eax
cmp eax, 0x1e
jae 0x407af0
push str.LoadIniFileW___File_size_is_too_small_n
call fcn.004454c0
mov eax, dword [esi + 0x10]
add esp, 4
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0xffffffff
pop esi
xor eax, eax
pop ebx
ret 4
add eax, 4
push eax
call fcn.00453c61
add esp, 4
mov dword [esi + 0x18], eax
test eax, eax
jne 0x407b21
push str.LoadIniFileW___Memory_allocation_error._n
call fcn.004454c0
mov ecx, dword [esi + 0x10]
add esp, 4
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x10], 0xffffffff
pop esi
xor eax, eax
pop ebx
ret 4

Function at 0x407b30
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push edi
xor edi, edi
mov dword [esp + 8], edi
cmp eax, 0xffffffff
je 0x407b78
mov edx, dword [esi + 0x14]
push edi
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x18]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 8]
cmp eax, edi
jbe 0x407b6e
mov edx, dword [esi + 0x18]
mov dword [esi + 8], edx
mov dword [esi + 4], eax
mov edi, 1
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret
Function at 0x407b80
Capabilities:
Read file on windows

Disassembly:
push ecx
push esi
mov esi, ecx
mov eax, dword [esi + 0x10]
push edi
xor edi, edi
mov dword [esp + 8], edi
cmp eax, 0xffffffff
je 0x407bca
mov edx, dword [esi + 0x14]
push edi
lea ecx, [esp + 0xc]
push ecx
mov ecx, dword [esi + 0x18]
push edx
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 8]
cmp eax, edi
jbe 0x407bc0
mov edx, dword [esi + 0x18]
shr eax, 1
mov dword [esi + 8], edx
mov dword [esi + 4], eax
mov edi, 1
mov eax, dword [esi + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
pop ecx
ret

Function at 0x407bf0
Capabilities:
Read file on windows

Disassembly:
sub esp, 0x10
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
mov edi, dword [esp + 0x1c]
push str.IsIniUnicodeA_n
call fcn.004453d0
add esp, 4
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x407c5b
push edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.IsIniUnicodeA___File_Open_failed____ld____s__n
call fcn.004453d0
add esp, 0xc
pop edi
xor al, al
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.00453432
add esp, 0x10
ret 4
push 0
lea eax, [esp + 0xc]
push eax
push 2
lea ecx, [esp + 0x18]
push ecx
push esi
mov dword [esp + 0x1c], 0
mov byte [esp + 0x20], 0
mov byte [esp + 0x21], 0
call dword [sym.imp.KERNEL32.dll_ReadFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 0xfd
cmp byte [esp + 0xc], al
jbe 0x407c46
cmp byte [esp + 0xd], al
jbe 0x407c46
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
mov al, 1
call fcn.00453432
add esp, 0x10
ret 4
Function at 0x40a7b0
Capabilities:
Access peb ldr_data
Get ntdll base address
Read file on windows

Disassembly:
push 0xffffffffffffffff
push 0x467c99
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x10], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x48807c]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x38]
mov esi, ecx
lea ecx, [esi + 0x44344]
mov dword [esp + 0x18], esi
call fcn.00407e20
xor ebx, ebx
push 0x934
mov dword [esp + 0x34], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x44030], ebx
mov byte [esi + 0x44340], bl
mov dword [esi], ebx
call fcn.004534f0
add esp, 4
mov dword [esp + 0x14], eax
mov byte [esp + 0x30], 1
cmp eax, ebx
je 0x40a83a
mov ecx, eax
call fcn.0044e720
jmp 0x40a83c
xor eax, eax
mov ecx, dword [esp + 0x40]
mov dword [esi + 0x20], eax
mov al, byte [eax + 5]
mov byte [esi + 0x24], al
mov eax, dword [esp + 0x3c]
mov byte [esp + 0x30], bl
mov dword [esi + 0x28], eax
cmp ecx, ebx
je 0x40a85a
mov eax, ecx
push ebp
mov ecx, esi
mov dword [esi + 0x2c], eax
call fcn.00407a60
mov eax, dword [esi + 0x10]
mov byte [esi + 0x1c], bl
cmp eax, 0xffffffff
je 0x40a8af
push ebx
lea ecx, [esp + 0x18]
push ecx
push 2
lea edx, [esp + 0x28]
push edx
push eax
mov dword [esp + 0x28], ebx
mov byte [esp + 0x30], bl
mov byte [esp + 0x31], bl
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov al, 0xfd
cmp byte [esp + 0x1c], al
jbe 0x40a8a2
cmp byte [esp + 0x1d], al
jbe 0x40a8a2
mov byte [esi + 0x1c], 1
mov eax, dword [esi + 0x10]
push ebx
push ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, esi
cmp byte [esi + 0x1c], bl
je 0x40a8bd
call fcn.00407b80
jmp 0x40a8c2
call fcn.00407b30
push ebx
lea edi, [esi + 0x44138]
xor ecx, ecx
push edi
mov word [edi], cx
mov ecx, dword [esi + 0x20]
push ebp
mov byte [esi + 0x44034], bl
call fcn.0044a990
cmp word [edi], bx
jne 0x40a8ff
mov eax, 0x46abac
sub edi, eax
lea ebx, [ebx]
movzx ecx, word [eax]
mov word [edi + eax], cx
add eax, 2
cmp cx, bx
jne 0x40a8f0
mov ecx, esi
call fcn.00409f90
mov edx, dword [esi + 0x44348]
push edx
push 0x46dae4
call fcn.004454c0
add esp, 8
mov ecx, esi
call fcn.0040aa70
mov eax, esi
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.00453432
add esp, 0x20
ret 0xc
Function at 0x40e380
Capabilities:
Enumerate files on windows
Move file

Disassembly:
sub esp, 0x870
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x86c], eax
push ebx
push ebp
push esi
mov esi, dword [esp + 0x880]
mov ebp, ecx
cmp byte [ebp + 0xe64], 0
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [esp + 0x888]
push 0
je 0x40e3c6
push 1
push 0
push edi
push esi
call fcn.0040e0e0
jmp 0x40e505
mov ecx, dword [ebp + 4]
push edi
call fcn.00449880
test ebx, ebx
je 0x40e3e1
push 0
push 1
push edi
push 6
mov ecx, ebx
call fcn.00451cc0
push 0
push 1
push 0
push edi
push esi
mov ecx, ebp
call fcn.0040e0e0
push str..in2
push edi
lea eax, [esp + 0x67c]
push 0x46ab98
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x678]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [esp + 0x10], eax
cmp eax, 0xffffffff
je 0x40e505
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileW]
cmp dword [esp + 0x14], 0x10
je 0x40e4e2
lea eax, [esp + 0x40]
push eax
push edi
lea ecx, [esp + 0x474]
push 0x46ab98
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
xor eax, eax
jmp 0x40e460
movzx ecx, word [esp + eax + 0x46c]
mov word [esp + eax + 0x264], cx
add eax, 2
test cx, cx
jne 0x40e460
lea eax, [esp + 0x264]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40e482
sub eax, edx
sar eax, 1
mov edx, 0x66
mov word [esp + eax*2 + 0x262], dx
lea eax, [esp + 0x264]
push eax
lea ecx, [esp + 0x470]
push ecx
call esi
test ebx, ebx
je 0x40e4c9
push 0
push 0
lea edx, [esp + 0x26c]
push edx
push 1
mov ecx, ebx
call fcn.00451cc0
cmp dword [esp + 0x88c], 0
je 0x40e4e2
lea eax, [esp + 0x264]
push eax
mov ecx, ebp
call fcn.0040e010
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x14]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40e432
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [esp + 0x87c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.00453432
add esp, 0x870
ret 0xc
Function at 0x40e530
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
sub esp, 0x874
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x870], eax
mov eax, dword [esp + 0x87c]
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x888]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x14], eax
test edi, edi
je 0x40e579
cmp word [edi], 0
je 0x40e579
push eax
push edi
push str.CopyInfFileToSystem_____s___s__n
call fcn.004454c0
add esp, 0xc
jmp 0x40e587
push eax
push str.CopyInfFileToSystem_____s__n
call fcn.004454c0
add esp, 8
mov ebp, dword [sym.imp.USER32.dll_wsprintfW]
test edi, edi
je 0x40e5ac
cmp word [edi], 0
je 0x40e5ac
push edi
lea eax, [esp + 0x26c]
push str._s_admin_
push eax
call ebp
add esp, 0xc
jmp 0x40e5bf
push 0x104
lea ecx, [esp + 0x26c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea edx, [esp + 0x268]
push edx
lea eax, [esp + 0x67c]
push str._sinfoem.inf
push eax
call ebp
add esp, 0xc
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x67c]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
xor bl, bl
cmp esi, 0xffffffff
je 0x40e65d
jmp 0x40e600
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x26c]
push ecx
lea edx, [esp + 0x680]
push str._sinf_s
push edx
call ebp
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x20]
add esp, 0x10
push eax
lea ecx, [esp + 0x67c]
push ecx
mov ecx, dword [edx + 4]
call fcn.0044b3d0
test eax, eax
je 0x40e63e
mov bl, 1
lea eax, [esp + 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x40e600
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test bl, bl
jne 0x40e6ee
xor esi, esi
mov bl, 1
test edi, edi
je 0x40e67c
cmp word [edi], 0
je 0x40e67c
push esi
push edi
push str._s_admin_Infoem_d.inf
lea ecx, [esp + 0x47c]
push ecx
jmp 0x40e692
push esi
lea edx, [esp + 0x26c]
push edx
push str._sInfoem_d.inf
lea eax, [esp + 0x47c]
push eax
call ebp
add esp, 0x10
lea ecx, [esp + 0x470]
push ecx
push str.wszOemInfFile__s_n
call fcn.004454c0
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + 4]
add esp, 8
push 0
lea edx, [esp + 0x474]
push edx
call fcn.004496a0
test al, al
jne 0x40e6e5
mov edx, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
push 0
push 0
lea ecx, [esp + 0x478]
push ecx
mov ecx, dword [eax + 4]
push edx
call fcn.0044bf30
xor bl, bl
inc esi
test bl, bl
jne 0x40e661
mov ecx, dword [esp + 0x880]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.00453432
add esp, 0x874
ret 8

Function at 0x40f920
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0x414
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0x410], eax
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
xor esi, esi
mov edi, edi
inc esi
push esi
lea eax, [esp + 0xc]
push str.SetPrnt_d
push eax
call edi
push 0x20019
lea ecx, [esp + 0x220]
push ecx
lea edx, [esp + 0x1c]
push edx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00451b90
add esp, 0x20
test eax, eax
jne 0x40f940
mov ecx, dword [esp + 0x418]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.00453432
add esp, 0x414
ret
Function at 0x40f990
Capabilities:
Persist via run registry key

Disassembly:
sub esp, 0xc40
mov eax, dword [0x48807c]
xor eax, esp
mov dword [esp + 0xc3c], eax
push ebx
push ebp
mov ebp, dword [esp + 0xc4c]
push esi
push edi
push ebp
push str.RemoveUserDevMode_____s__n
mov dword [esp + 0x20], ecx
mov dword [esp + 0x1c], 0
mov byte [esp + 0x1b], 0
call fcn.004454c0
push 0x20019
push 0
push str.delDM
push str.SOFTWAREKyocera_MitaRemoteInstall
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00451ad0
add esp, 0x1c
cmp eax, 1
jne 0x40fa14
push 0x20006
push 0
push str.delDM
push str.SOFTWAREKyocera_MitaRemoteInstall
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00451aa0
add esp, 0x14
mov dword [esp + 0x14], 0x64
push 0x20019
push 0x46b804
push SysStringLen
call fcn.00451c10
mov esi, eax
imul eax, eax, 0x104
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00453c61
push 0x20019
push esi
mov edi, eax
push edi
push 0x46b804
push SysStringLen
call fcn.00451c30
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x24
test eax, eax
jbe 0x40fae5
jle 0x40fac9
mov esi, eax
nop
push edi
lea eax, [esp + 0x20]
push str._sPrintersDevModePerUser
push eax
call ebx
mov eax, edi
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fa85
sub eax, edx
sar eax, 1
cmp eax, 0x14
jbe 0x40fa9e
mov byte [esp + 0x13], 1
push 0xf003f
push ebp
lea ecx, [esp + 0x24]
push ecx
push SysStringLen
call fcn.00451c60
add esp, 0x10
test eax, eax
je 0x40fabe
inc dword [esp + 0x14]
add edi, 0x208
sub esi, 1
jne 0x40fa70
push 0
push 0
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendNotifyMessageW]
cmp byte [esp + 0x13], 0
jne 0x40fb86
push 0x30c
lea edx, [esp + 0x638]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push ebp
lea eax, [esp + 0x430]
push str._delDM___s_
push eax
call ebx
lea eax, [esp + 0x438]
add esp, 0xc
mov edx, eax
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x40fb16
lea edi, [esp + 0x634]
sub eax, edx
add edi, 0xfffffffe
lea ecx, [ecx]
mov cx, word [edi + 2]
add edi, 2
test cx, cx
jne 0x40fb30
mov ecx, eax
shr ecx, 2
mov esi, edx
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x18]
call fcn.0040f920
push eax
lea ecx, [esp + 0x20]
push str.SetPrnt_d
push ecx
call ebx
push 0x20006
lea edx, [esp + 0x644]
push edx
lea eax, [esp + 0x30]
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.00451b60
add esp, 0x20
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jg 0x40fb95
or eax, 0xffffffff
mov ecx, dword [esp + 0xc3c]
xor ecx, esp
call fcn.00453432
add esp, 0xc40
ret 4