joyce8/EMBER2024-capa huggingface dataset:
Function at 0x415ae9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push ebx
push esi
push edi
push 0x4021
push 7
lea eax, [ebp - 0x20]
mov esi, edx
push eax
lea eax, [ebp + 8]
mov dword [ebp - 8], esi
push eax
push 0x100001
lea eax, [ebp - 4]
mov ebx, ecx
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jne 0x415c0e
xor edi, edi
mov dword [ebp - 0x10], eax
push edi
push ebx
push 0xff
push 0x25
push 0x270
lea ecx, [ebp - 0x10]
mov dword [ebp + 0x10], ecx
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x298]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp + 0xc], eax
push ecx
push edi
push edi
push edi
push eax
jmp 0x415bf7
test dword [ebp - 0x260], 0x400
jne 0x415bd8
test byte [ebp - 0x260], 0x10
je 0x415bb2
mov esi, dword [ebp - 0x25c]
lea ecx, [ebp - 0x230]
mov edx, esi
call fcn.0044cd96
test al, al
jne 0x415bd5
sub esp, 0x18
mov word [ebp - 0xe], si
mov word [ebp - 0x10], si
lea esi, [ebp + 8]
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
xor ecx, ecx
mov edx, esi
call fcn.00415ae9
add esp, 0x18
xor edi, edi
jmp 0x415bd8
mov eax, dword [ebp - 0x238]
mov ecx, dword [ebp - 0x234]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x14], ecx
push eax
mov ecx, esi
call fcn.00435c44
jmp 0x415bd8
mov esi, dword [ebp - 8]
push edi
push ebx
push 0xff
push 0x25
push 0x270
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
je 0x415b5e
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x415c13
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x288
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, ecx
push 0x2a
mov ebx, edx
push esi
mov dword [ebp - 0x10], ebx
call edi
test eax, eax
je 0x415d1e
push 0x5c
push eax
call edi
mov edi, eax
test edi, edi
je 0x415d1e
mov ecx, edi
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.0043c99e
lea eax, [ebp - 0x284]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x5c
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x415c80
or eax, 0xffffffff
jmp 0x415c85
sub eax, dword [ebp + 8]
sar eax, 1
inc eax
lea ecx, [ebp + 8]
push eax
call fcn.0043d882
cmp ebx, 0xffffffff
je 0x415dbb
test dword [ebp - 0x284], 0x400
je 0x415cb0
test dword [ebp - 0x260], 0x20000000
jne 0x415d00
test byte [ebp - 0x284], 0x10
je 0x415d00
lea ecx, [ebp - 0x258]
call fcn.0044cdbe
test al, al
jne 0x415d00
push ecx
mov esi, esp
lea edx, [ebp + 8]
mov eax, ecx
lea ecx, [ebp - 0x14]
push 0x49a9c0
push eax
call fcn.0043baed
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0043baed
mov edx, dword [ebp - 0x10]
pop ecx
lea ecx, [edi + 2]
call fcn.00415c13
pop ecx
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea eax, [ebp - 0x284]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x415c98
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x415dbb
push esi
lea ecx, [ebp + 8]
call fcn.0043ca2b
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov esi, eax
test esi, esi
je 0x415dbb
movzx edi, word [esi]
xor eax, eax
push eax
push eax
mov word [esi], ax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_RtlDosPathNameToNtPathName_U]
test al, al
je 0x415dbb
mov word [esi], di
xor eax, eax
mov word [ebp - 0xc], ax
sub esp, 0x18
mov eax, dword [ebp + 8]
mov edx, ebx
mov dword [ebp - 8], esi
mov dword [ebp - 0x34], 0x18
push 6
mov ecx, dword [eax - 0xc]
add ecx, ecx
mov dword [ebp - 0x28], 0x40
sub ecx, esi
lea esi, [ebp - 0x34]
add ecx, eax
lea eax, [ebp - 0x1c]
and ecx, 0xfffffffe
mov dword [ebp - 0x2c], eax
mov word [ebp - 0xc], cx
mov word [ebp - 0xa], cx
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [ebp - 0xc]
call fcn.00415ae9
add esp, 0x18
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntdll.dll_RtlFreeUnicodeString]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4161e4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ecx + 0x48]
lea edx, [ebp - 8]
push esi
push edx
push 0x2000000
xor esi, esi
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWOF
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov ecx, dword [eax]
push 0x80000002
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x416248
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 4
push eax
lea eax, [ebp - 4]
push eax
push esi
push esi
push str.ForceAlgorithm
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41623c
cmp dword [ebp - 4], 3
jbe 0x41623f
mov dword [ebp - 4], esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 4]
pop esi
leave
ret
Function at 0x41699b
Capabilities:
Get file size
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa4
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateFileW]
xor ebx, ebx
push ebx
push 0x2000000
push 3
push ebx
push 5
push 0x80000000
push ecx
mov dword [ebp - 0xc], edx
call edi
mov esi, eax
mov dword [ebp - 0x28], esi
cmp esi, 0xffffffff
je 0x416b4c
lea eax, [ebp - 4]
mov dword [ebp - 8], ebx
push eax
push esi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
cmp dword [ebp - 4], ebx
jne 0x416b4c
test eax, eax
je 0x416b4c
add eax, 0xfffff000
cmp eax, 0x31ff000
ja 0x416b4c
push ebx
push 0x2000000
push 3
push ebx
push 5
push 0x80000000
push dword [ebp - 0xc]
call edi
mov edi, eax
mov dword [ebp - 0x24], edi
cmp edi, 0xffffffff
je 0x416b44
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], ebx
push eax
push edi
mov dword [ebp - 0x18], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x18], ebx
jne 0x416b44
test eax, eax
je 0x416b44
cmp dword [ebp - 8], eax
jne 0x416b44
push ebx
push dword [ebp - 8]
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov esi, eax
mov dword [ebp - 0x20], esi
test esi, esi
je 0x416b3c
push ebx
push dword [ebp - 8]
push ebx
push 2
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov edi, eax
mov dword [ebp - 0xc], edi
test edi, edi
je 0x416b34
push dword [ebp - 8]
push ebx
push ebx
push 4
push esi
mov esi, dword [sym.imp.KERNEL32.dll_MapViewOfFile]
call esi
mov dword [ebp - 0x14], eax
test eax, eax
je 0x416b34
lea eax, [ebp - 0x14]
mov dword [ebp - 0x50], 0x49523c
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0xa0]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x2c], eax
call fcn.0043ba54
lea ecx, [ebp - 0x50]
call fcn.0043ba36
push dword [ebp - 8]
push ebx
push ebx
push 4
push edi
call esi
mov dword [ebp - 0x10], eax
test eax, eax
je 0x416b29
lea eax, [ebp - 0x10]
mov dword [ebp - 0x50], 0x49520c
mov dword [ebp - 0x4c], eax
lea ecx, [ebp - 0x78]
lea eax, [ebp - 0x50]
push eax
mov dword [ebp - 0x2c], eax
call fcn.0043ba54
lea ecx, [ebp - 0x50]
call fcn.0043ba36
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call dword [sym.imp.msvcrt.dll_memcmp]
add esp, 0xc
lea ecx, [ebp - 0x78]
neg eax
sbb al, al
lea ebx, [eax + 1]
call fcn.0043ba19
lea ecx, [ebp - 0xa0]
call fcn.0043ba19
lea ecx, [ebp - 0xc]
call fcn.0043bb32
lea ecx, [ebp - 0x20]
call fcn.0043bb32
lea ecx, [ebp - 0x24]
call fcn.0043bb32
lea ecx, [ebp - 0x28]
call fcn.0043bb32
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x418d18
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, ecx
push 0x2a
push esi
call edi
test eax, eax
je 0x418dfd
push 0x5c
push eax
call edi
mov edi, eax
test edi, edi
je 0x418dfd
mov ecx, edi
sub ecx, esi
sar ecx, 1
push ecx
push esi
lea ecx, [ebp + 8]
call fcn.0043c99e
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x5c
push dword [ebp + 8]
mov ebx, eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x418d80
or eax, 0xffffffff
jmp 0x418d85
sub eax, dword [ebp + 8]
sar eax, 1
inc eax
lea ecx, [ebp + 8]
push eax
call fcn.0043d882
cmp ebx, 0xffffffff
je 0x418ec8
test byte [ebp - 0x25c], 0x10
je 0x418de5
lea ecx, [ebp - 0x230]
call fcn.0044cdbe
test al, al
jne 0x418de5
push ecx
mov esi, esp
lea edx, [ebp + 8]
mov eax, ecx
lea ecx, [ebp - 8]
push 0x49a9c0
push eax
call fcn.0043baed
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0043baed
pop ecx
lea ecx, [edi + 2]
call fcn.00418d18
pop ecx
mov ecx, dword [ebp - 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea eax, [ebp - 0x25c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x418d98
push ebx
jmp 0x418ec2
push esi
lea ecx, [ebp + 8]
call fcn.0043ca2b
lea eax, [ebp - 0x25c]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
push 0x5c
push dword [ebp + 8]
mov edi, eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
jne 0x418e2e
or eax, 0xffffffff
jmp 0x418e33
sub eax, dword [ebp + 8]
sar eax, 1
inc eax
lea ecx, [ebp + 8]
push eax
call fcn.0043d882
cmp edi, 0xffffffff
je 0x418ec8
test byte [ebp - 0x25c], 0x10
je 0x418e8a
lea ecx, [ebp - 0x230]
call fcn.0044cdbe
test al, al
jne 0x418eaf
push ecx
mov esi, esp
lea edx, [ebp + 8]
mov eax, ecx
lea ecx, [ebp - 8]
push 0x49550c
push eax
call fcn.0043baed
pop ecx
mov edx, eax
mov ecx, esi
call fcn.0043baed
pop ecx
call fcn.0044dbd1
pop ecx
mov ecx, dword [ebp - 8]
jmp 0x418ea7
lea eax, [ebp - 0x230]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.0043baed
pop ecx
mov ecx, dword [eax]
call fcn.0044dadb
mov ecx, dword [ebp - 0xc]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea eax, [ebp - 0x25c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x418e46
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
pop edi
pop esi
pop ebx
leave
ret
Function at 0x418ed8
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov eax, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov esi, edx
mov eax, dword [eax - 0xc]
lea ecx, [ebp + 8]
dec eax
push eax
call fcn.0043b8a7
push 0x5c
pop ecx
cmp ax, cx
je 0x418f0e
push ecx
lea ecx, [ebp + 8]
call fcn.0043c971
push 0x494a54
lea edx, [ebp + 8]
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0xc]
call fcn.0043baed
pop ecx
push ebx
lea edx, [ebp - 0x18]
mov ecx, dword [eax]
call fcn.0044d9a9
pop ecx
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.0043d912
test edi, edi
je 0x418f49
mov ecx, dword [ebp + 8]
mov edx, edi
push esi
call fcn.00415dcb
pop ecx
mov al, bl
mov byte [ebp - 5], al
sub esi, 1
je 0x419066
sub esi, 1
jne 0x418f77
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x14], 0x60004
jb 0x418f6a
mov al, bl
mov byte [ebp - 5], al
test al, al
jne 0x419079
xor ebx, ebx
mov eax, dword [ebp - 0x10]
test al, 1
je 0x418f89
mov ecx, dword [ebp - 0xc]
add ecx, 0xfffffff0
call fcn.0043d912
test bl, bl
setne bl
dec bl
and bl, byte [ebp - 5]
xor edi, edi
mov eax, dword [edi + 0x48b940]
push ecx
mov ecx, dword [ebp + 8]
mov esi, esp
mov dword [ebp - 0xc], eax
lea ecx, [ecx - 0x10]
call fcn.0043cad2
add eax, 0x10
mov dword [esi], eax
mov esi, dword [ebp - 0xc]
mov ecx, esi
call fcn.00418d18
pop ecx
test bl, bl
je 0x418fd0
push str.Boot
push esi
call dword [sym.imp.SHLWAPI.dll_StrCmpW]
test eax, eax
je 0x418fdb
add edi, 4
cmp edi, 0x9c
jne 0x418f95
push 0x48f330
lea edx, [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.0043baed
pop ecx
lea ecx, [ebp - 0x26c]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0xc]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043d912
cmp esi, 0xffffffff
je 0x419054
test byte [ebp - 0x26c], 0x10
jne 0x41903b
lea eax, [ebp - 0x240]
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 0x10]
call fcn.0043baed
pop ecx
mov ecx, dword [eax]
call fcn.0044dadb
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.0043d912
lea eax, [ebp - 0x26c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x41900d
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0043d912
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
cmp dword [ebp - 0x14], 0x60003
jb 0x418f77
xor ebx, ebx
inc ebx
mov byte [ebp - 5], bl
push str.WindowsSystem32WimBootCompress.ini
lea edx, [ebp + 8]
lea ecx, [ebp - 0xc]
call fcn.0043baed
pop ecx
mov dword [ebp - 0x10], ebx
mov ecx, dword [eax]
call fcn.0044d9e7
test eax, eax
jne 0x418f75
mov eax, ebx
jmp 0x418f7a
Function at 0x419755
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x254
push ebx
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x419922
xor ecx, ecx
cmp word [edi], cx
je 0x419922
mov ebx, dword [ebp + 0x10]
mov edx, 0x6000
mov eax, ebx
and eax, edx
cmp eax, edx
jne 0x419794
mov eax, 0xa0020005
jmp 0x419925
push ecx
push ecx
push ecx
mov ecx, dword [ebp + 8]
mov edx, 0x80000000
push 3
call fcn.00417b10
mov esi, eax
add esp, 0x10
mov dword [esp + 0x1c], esi
test esi, esi
jne 0x4197bf
call fcn.0044cc8a
mov ebx, eax
jmp 0x419915
push edi
lea ecx, [esp + 0x10]
call fcn.0043c2b8
mov edi, dword [esp + 0xc]
lea ecx, [esp + 0xc]
mov eax, dword [edi - 0xc]
dec eax
push eax
call fcn.0043b8a7
push 0x5c
pop ecx
cmp ax, cx
je 0x4197f1
push ecx
lea ecx, [esp + 0x10]
call fcn.0043c971
mov edi, dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [esp + 0x20], eax
mov eax, dword [edi - 0xc]
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [esp + 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [esp + 0x2c], eax
mov eax, 0x41a558
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0xc]
inc eax
push eax
push esi
call dword [sym.imp.WIMGAPI.DLL_WIMLoadImage]
mov dword [esp + 0x14], eax
test eax, eax
jne 0x419839
call fcn.0044cc8a
mov ebx, eax
jmp 0x41990d
test ebx, 0x4000
je 0x41984c
mov eax, 0x418c8d
mov dword [esp + 0x10], eax
jmp 0x419888
test ebx, 0x2000
je 0x419883
push 0x230
lea eax, [esp + 0x34]
push eax
push esi
call dword [sym.imp.WIMGAPI.DLL_WIMGetAttributes]
cmp dword [esp + 0x24c], 3
je 0x419879
cmp dword [esp + 0x24c], 0
jne 0x419841
mov ebx, 0x80004002
jmp 0x419903
mov eax, 0x41a558
lea ecx, [esp + 0x20]
push ecx
push eax
push esi
call dword [sym.imp.WIMGAPI.DLL_WIMRegisterMessageCallback]
mov ecx, dword [esp + 0x14]
mov eax, ebx
and eax, 0xfffffff
mov edx, edi
push eax
call fcn.004196cb
test eax, eax
jne 0x4198b5
call fcn.0044cc8a
mov ebx, eax
jmp 0x4198f7
push str.Windows_bootstat.dat
lea edx, [esp + 0x10]
lea ecx, [esp + 0x1c]
call fcn.0043baed
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x18]
add ecx, 0xfffffff0
call fcn.0043d912
push ecx
lea ecx, [edi - 0x10]
mov ebx, esp
call fcn.0043cad2
mov ecx, dword [ebp + 0x10]
add eax, 0x10
mov dword [ebx], eax
call fcn.004194ea
pop ecx
xor ebx, ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call dword [sym.imp.WIMGAPI.DLL_WIMUnregisterMessageCallback]
push dword [esp + 0x14]
call dword [sym.imp.WIMGAPI.DLL_WIMCloseHandle]
lea ecx, [edi - 0x10]
call fcn.0043d912
lea ecx, [esp + 0x1c]
call fcn.004397f4
mov eax, ebx
jmp 0x419925
push 2
pop eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18
Function at 0x41a3a5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
push ebx
push esi
push edi
push eax
mov ebx, edx
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
lea eax, [ebp - 0x10]
mov ecx, esi
push eax
call fcn.004395c5
pop ecx
call fcn.0043d5bb
push eax
lea ecx, [ebp - 4]
call fcn.0043bbe8
push 4
mov edx, str.WINDOWS
mov ecx, esi
call fcn.00439670
lea ecx, [ebx + 0x218]
mov esi, eax
push ecx
mov edx, str.EDITIONID
mov ecx, esi
call fcn.0043978b
lea ecx, [ebx + 0x418]
mov edx, str.INSTALLATIONTYPE
push ecx
mov ecx, esi
call fcn.0043978b
mov eax, dword [ebx + 0xc]
add esp, 0xc
sub eax, 1
je 0x41a42f
sub eax, 1
je 0x41a428
sub eax, 1
jne 0x41a441
push str.ServerNT
jmp 0x41a434
push str.LanmanNT
jmp 0x41a434
push str.WinNT
mov edx, str.PRODUCTTYPE
mov ecx, esi
call fcn.0043978b
pop ecx
push 0x488134
mov edx, str.PRODUCTSUITE
mov ecx, esi
call fcn.0043978b
push 2
mov edx, str.LANGUAGES
mov ecx, esi
call fcn.00439670
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x41a546
mov eax, 0x104
lea ecx, [ebp - 4]
push eax
push eax
call fcn.0043d810
push eax
push 0x5c
push dword [ebx + 0x46c]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41a4fd
mov esi, dword [ebp - 4]
cmp dword [esi - 4], 1
jle 0x41a4a5
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0043d715
mov esi, dword [ebp - 4]
push esi
mov edx, str.LANGUAGE
mov ecx, edi
call fcn.0043978b
lea eax, [ebx + 0x470]
mov edx, str.FALLBACK
push eax
mov ecx, edi
call fcn.0043978b
mov dword [ebp - 8], eax
pop ecx
pop ecx
test eax, eax
je 0x41a4fd
push ecx
push dword [esi - 0xc]
mov ecx, dword [eax + 0x14]
push dword [esi - 0xc]
add ecx, 0x34
push esi
call fcn.00439737
mov esi, dword [ebp - 8]
push eax
push str.LANGUAGE
mov ecx, dword [esi + 0x14]
add ecx, 0x34
call fcn.00439ea5
push eax
mov ecx, esi
call fcn.004389fd
mov eax, 0x104
lea ecx, [ebp - 4]
push eax
push eax
call fcn.0043d810
push eax
push 0x5c
push dword [ebx + 0x468]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x41a546
mov esi, dword [ebp - 4]
cmp dword [esi - 4], 1
jle 0x41a536
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0043d715
mov esi, dword [ebp - 4]
push esi
mov edx, str.DEFAULT
mov ecx, edi
call fcn.0043978b
pop ecx
jmp 0x41a549
mov esi, dword [ebp - 4]
lea ecx, [esi - 0x10]
call fcn.0043d912
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x41be98
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x20], edi
je 0x41bee0
push edi
push edi
push 0x12
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
push 0x4e20
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, 0x102
cmp eax, ecx
jne 0x41bed1
push ecx
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push dword [esi + 0x20]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x1c], edi
mov dword [esi + 0x20], edi
pop edi
pop esi
ret

Function at 0x41c5e5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push dword [ebp + 8]
mov edi, edx
mov dword [ebp - 4], ecx
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCpyW]
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x200
push eax
lea ebx, [esi + 0x20c]
push ebx
push 0
push 0
push str.DisplayName
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x40
pop ecx
test eax, eax
jne 0x41c646
cmp word [ebx], cx
jne 0x41c63b
mov ecx, dword [ebp - 4]
mov edx, ebx
call fcn.0041c49f
jmp 0x41c646
cmp dword [esi], 0
jne 0x41c646
mov dword [esi], 1
and dword [ebp + 0xc], 0
lea eax, [ebp + 0xc]
push eax
mov edx, str.LaunchProtected
mov ecx, edi
call fcn.0044dcd7
pop ecx
test eax, eax
jne 0x41c664
cmp dword [ebp + 0xc], eax
jne 0x41c66f
mov ecx, edi
call fcn.004140b2
test eax, eax
jne 0x41c673
or dword [esi + 8], 1
xor ecx, ecx
lea eax, [ebp + 8]
push eax
push ecx
push ecx
push ecx
push str.Group
push edi
mov dword [ebp + 8], ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c693
or dword [esi + 8], 2
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x400
push eax
lea ebx, [esi + 0x40c]
push ebx
push 0
push 0
push str.Description
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41c6cf
push 0x40
pop eax
cmp word [ebx], ax
jne 0x41c6cf
mov ecx, dword [ebp - 4]
mov edx, ebx
or dword [esi + 8], 4
call fcn.0041c49f
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp + 8]
push eax
lea eax, [esi + 0x80c]
mov dword [ebp + 8], 0x208
push eax
push 0
push 0
push str.ImagePath
push edi
call ebx
lea eax, [ebp + 8]
mov dword [ebp + 8], 0x200
push eax
lea eax, [esi + 0xa14]
push eax
push 0
push 0
push str.ObjectName
push edi
call ebx
add esi, 4
mov edx, str.Start
push esi
mov ecx, edi
and dword [esi], 0
call fcn.0044dcd7
cmp dword [esi], 2
pop ecx
jne 0x41c74a
lea eax, [ebp - 4]
mov edx, str.DelayedAutoStart
push eax
mov ecx, edi
call fcn.0044dcd7
pop ecx
test eax, eax
jne 0x41c74a
cmp dword [ebp - 4], eax
je 0x41c74a
mov dword [esi], 5
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret 8
Function at 0x41ef6d
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
push esi
push str.WindowsSystem32OEMDefaultAssociations.xml
lea edx, [edx + 4]
call fcn.0043baed
pop ecx
push 0
push dword [ebp + 0xc]
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov ecx, dword [ebp + 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043d912
test esi, esi
pop esi
je 0x41efa8
xor eax, eax
jmp 0x41efb9
call fcn.0044cc8a
cmp eax, 0x80070002
jne 0x41efb9
mov eax, 0x20020001
pop ebp
ret 8

Function at 0x41efbd
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
push esi
push str.WindowsSystem32OEMDefaultAssociations.xml
lea edx, [edx + 4]
call fcn.0043baed
pop ecx
xor esi, esi
push esi
push dword [eax]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_CopyFileW]
test eax, eax
jne 0x41efee
call fcn.0044cc8a
mov esi, eax
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0043d912
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x41f000
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
lea ecx, [ebp + 8]
push esi
push str.WindowsSystem32OEMDefaultAssociations.xml
lea edx, [edx + 4]
call fcn.0043baed
pop ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp + 8]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043d912
test esi, esi
pop esi
je 0x41f036
xor eax, eax
jmp 0x41f047
call fcn.0044cc8a
lea ecx, [eax + 0x7ff8fffe]
neg ecx
sbb ecx, ecx
and eax, ecx
pop ebp
ret 4

Function at 0x41f4d0
Capabilities:
Get file size
Read file via mapping
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
xor ebx, ebx
mov edi, edx
push ebx
push 0x2000000
neg eax
mov dword [ebp - 8], edi
push 3
sbb eax, eax
push ebx
and eax, 0x100
push 5
add eax, 0x80000000
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0xc], esi
cmp esi, 0xffffffff
jne 0x41f517
call fcn.0044cc8a
mov ebx, eax
jmp 0x41f587
cmp dword [ebp + 8], ebx
je 0x41f546
push 0xa
pop ecx
xor eax, eax
lea edi, [ebp - 0x3c]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x34]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 4
push 0x28
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.ntdll.dll_NtSetInformationFile]
mov edi, dword [ebp - 8]
push ebx
push ebx
push ebx
push 2
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push ebx
push ebx
push ebx
push 4
push eax
mov dword [ebp + 8], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x41f56f
call fcn.0044cc8a
mov ebx, eax
jmp 0x41f57f
push ebx
push esi
mov dword [edi], eax
mov dword [edi + 8], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [edi + 4], eax
lea ecx, [ebp + 8]
call fcn.00439864
lea ecx, [ebp - 0xc]
call fcn.0043bb32
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 4