joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401018
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x167c
call fcn.0044b290
push ebx
push esi
push edi
push 0x40
xor esi, esi
lea eax, [ebp - 0x54]
push esi
push eax
call fcn.004451c0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
xor eax, eax
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [0x46d5b8]
xor ecx, ecx
inc ecx
add esp, 0xc
mov dword [ebp - 0x58], 0x44
mov edi, 0x206
test byte [eax + 0x904e], cl
je 0x4010e1
push eax
lea eax, [ebp - 0x1678]
mov dword [ebp - 0x268], ecx
call fcn.00406b85
xor eax, eax
push edi
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x25e]
push esi
push eax
call fcn.004451c0
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x786]
mov word [ebp + eax - 0x260], cx
inc eax
inc eax
cmp cx, si
jne 0x401094
push 0x454a20
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x786]
push eax
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [0x46d5b8]
test byte [eax + 0x904e], 2
je 0x401164
push eax
lea eax, [ebp - 0x1678]
mov dword [ebp - 0x268], 2
call fcn.00406b85
xor eax, eax
push edi
mov word [ebp - 0x260], ax
lea eax, [ebp - 0x25e]
push esi
push eax
call fcn.004451c0
add esp, 0xc
xor eax, eax
movzx ecx, word [ebp + eax - 0x786]
mov word [ebp + eax - 0x260], cx
inc eax
inc eax
cmp cx, si
jne 0x40111c
push 0x454a40
lea eax, [ebp - 0x260]
push eax
call ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x786]
push eax
push esi
push 0x20
push esi
push esi
push esi
lea eax, [ebp - 0x260]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4014e8
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x190
call fcn.00403ae0
test eax, eax
jne 0x401514
push 0x30
push str.Cannot_start_install
push str.There_is_a_problem_with_the_install_program.
push eax
call dword [sym.imp.USER32.dll_MessageBoxA]
xor eax, eax
jmp 0x401543
push 0
call dword [sym.imp.ole32.dll_OleInitialize]
call fcn.00401db2
lea eax, [esp]
push eax
push 0x101
call sub.WSOCK32.dll_WSAStartup
mov eax, dword [0x46d5b8]
add eax, 0xafaa
push eax
call fcn.0041417d
xor eax, eax
pop ecx
inc eax
mov esp, ebp
pop ebp
ret
Function at 0x4015f1
Capabilities:
Copy file
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x564
push ebx
push esi
push edi
mov edi, 0x104
push edi
lea eax, [ebp - 0x260]
push eax
xor esi, esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x364]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov eax, dword [0x46d5b8]
test byte [eax + 0x904e], 1
mov edi, dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
je 0x401651
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x915d
push eax
lea eax, [ebp - 0x364]
push eax
call edi
mov eax, dword [0x46d5b8]
test byte [eax + 0x904e], 2
je 0x401671
lea ecx, [ebp - 0x15c]
push ecx
push esi
add eax, 0x89c4
push eax
lea eax, [ebp - 0x364]
push eax
call edi
push esi
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x260]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
push esi
push 0x4000000
push 3
push esi
push 1
push esi
lea eax, [ebp - 0x15c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 1
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
lea eax, [ebp - 0x260]
push eax
push ebx
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x564]
push str._s__cleanup__d___s_
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x44
pop edi
push edi
lea eax, [ebp - 0x58]
push esi
push eax
call fcn.004451c0
add esp, 0x20
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x58]
push eax
push esi
push esi
push esi
push 1
push esi
push esi
lea eax, [ebp - 0x564]
push eax
push esi
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push 0x1f4
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401728
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x5c
push dword [ebp + 0xc]
call fcn.0043b4e0
pop ecx
pop ecx
test eax, eax
je 0x40175b
mov byte [eax], 0
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
pop ebp
ret
Function at 0x401db2
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x94
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push str.kernel32
call edi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x454be0
push eax
mov dword [0x46d5c0], eax
call esi
push str.user32
mov dword [0x46d5c4], eax
call edi
push str.SetWindowTextW
push eax
mov dword [0x46d5c8], eax
call esi
push str.GetWindowTextW
push dword [0x46d5c8]
mov dword [0x46d5cc], eax
call esi
mov dword [0x46d5d0], eax
xor eax, eax
pop edi
pop esi
cmp dword [0x46d5c4], eax
je 0x401e28
mov byte [0x46d5b7], 1
cmp dword [0x46d5cc], eax
jne 0x401e2d
mov byte [0x46d5b7], al
push 0x90
push eax
lea eax, [ebp - 0x90]
push eax
mov dword [ebp - 0x94], 0x94
call fcn.004451c0
add esp, 0xc
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x90], 5
sbb al, al
inc al
mov byte [0x46d5b7], al
leave
ret

Function at 0x402556
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
cmp dword [ebp + 0x1c], esi
je 0x402575
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push str.BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho
call fcn.0041ba42
add esp, 0xc
push esi
lea eax, [ebp + 0x1c]
push eax
push esi
push 0x2001f
push esi
push esi
push esi
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4025ab
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push esi
push dword [ebp + 0xc]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp + 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ecx
pop ebp
ret

Function at 0x4025b8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
push eax
push 0x2001f
xor edi, edi
push edi
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40261d
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push ebx
push edi
push dword [ebp + 0x10]
push edi
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
mov eax, dword [ebx]
inc eax
push eax
call fcn.0043b018
pop ecx
push ebx
mov edi, eax
push edi
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
push dword [ebp - 4]
call esi
test eax, eax
je 0x40261d
test edi, edi
je 0x40261b
push edi
call fcn.0043bb04
pop ecx
xor edi, edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 0x14], 0
je 0x402640
test edi, edi
je 0x40264a
push dword [ebx]
push edi
push str.BlindCaffineSubstituteFamousCurtainTrickKingTinHalcyonDaysArapaho
call fcn.0041ba42
add esp, 0xc
test edi, edi
je 0x40264a
mov eax, dword [ebx]
mov byte [edi + eax], 0
mov eax, edi
pop edi
pop esi
leave
ret
Function at 0x4028b5
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
mov dword [eax], ebx
mov eax, dword [ebp + 0xc]
push edi
push 0x103
mov dword [eax], ebx
lea eax, [ebp - 0x133]
push ebx
push eax
mov byte [ebp - 0x134], bl
call fcn.004451c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x134]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push ebx
push ebx
push 3
push ebx
push 5
push SysReAllocString
lea eax, [ebp - 0x134]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
mov dword [ebp - 4], edi
cmp edi, 0xffffffff
jne 0x40292a
xor eax, eax
jmp 0x402a79
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
push ebx
push 0x3c
push edi
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x14]
push eax
push edi
mov edi, dword [sym.imp.KERNEL32.dll_ReadFile]
call edi
push ebx
push ebx
push dword [ebp - 0x14]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x20]
push eax
push dword [ebp - 4]
call edi
cmp dword [ebp - 0x20], 0x4550
jne 0x402a65
mov eax, dword [ebp - 0x14]
push ebx
add eax, 0x18
push ebx
push eax
push dword [ebp - 4]
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], ebx
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 2
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 4]
call edi
mov eax, 0x10b
cmp word [ebp - 0x10], ax
jne 0x4029a8
sub dword [ebp - 8], 0xffffff80
jmp 0x4029bf
mov eax, 0x20b
cmp word [ebp - 0x10], ax
jne 0x4029bc
add dword [ebp - 8], 0x90
jmp 0x4029bf
mov dword [ebp - 8], ebx
cmp dword [ebp - 8], ebx
je 0x402a65
push ebx
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 0xc]
push eax
push 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call edi
xor eax, eax
mov dword [ebp - 0x30], ebx
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], ebx
mov dword [ebp - 0x1c], eax
cmp eax, ebx
je 0x402a65
push ebx
push ebx
add eax, 0xfffffff0
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push 0x10
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x30], ebx
jne 0x402a65
cmp dword [ebp - 0x2c], ebx
jne 0x402a65
cmp dword [ebp - 0x28], ebx
jne 0x402a65
mov eax, dword [ebp - 0x24]
cmp eax, ebx
je 0x402a65
mov edi, dword [ebp + 0xc]
push eax
mov dword [edi], eax
call fcn.0043b018
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
sub eax, dword [edi]
push ebx
push ebx
sub eax, 0x10
push eax
push dword [ebp - 4]
call esi
push ebx
lea eax, [ebp - 8]
push eax
push dword [edi]
mov eax, dword [ebp + 8]
push dword [eax]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp + 8]
xor eax, eax
cmp dword [ecx], ebx
pop esi
setne al
pop edi
pop ebx
leave
ret
Function at 0x403ae0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push ebx
push esi
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
xor esi, esi
push eax
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
call fcn.00402a7d
pop ecx
pop ecx
mov edi, 0xafba
push edi
test eax, eax
je 0x403b89
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
lea eax, [eax + ecx - 0xe1c]
mov dword [ebp - 8], eax
call fcn.0043b528
pop ecx
push edi
mov ebx, eax
push esi
push ebx
call fcn.004451c0
mov eax, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov dword [ebx + 0xafaa], eax
mov eax, dword [esi]
mov dword [ebx + 0xafae], eax
add esp, 0xc
lea eax, [ebx + 0xafb6]
push eax
lea eax, [ebx + 0xafb2]
push eax
call fcn.004028b5
mov eax, dword [ebp - 8]
pop ecx
mov edi, ebx
pop ecx
mov ecx, 0x387
rep movsd dword es:[edi], dword [esi]
mov dword [0x46d5b8], ebx
add eax, 8
add ebx, 0xf28
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
inc eax
inc eax
test cx, cx
jne 0x403b76
jmp 0x403caf
call fcn.0043b528
pop ecx
push edi
mov ebx, eax
push 0x45fdf8
push ebx
call fcn.00442a00
add esp, 0xc
push 0x103
lea eax, [ebp - 0x10f]
push esi
push eax
mov byte [ebp - 0x110], 0
call fcn.004451c0
add esp, 0xc
push str.data.cab
mov eax, 0x104
lea edi, [ebp - 0x110]
call fcn.0040e697
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403c25
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea edi, [ebx + 0xafae]
push eax
mov dword [edi], eax
call fcn.0043b018
pop ecx
push esi
lea ecx, [ebp - 8]
push ecx
push dword [edi]
mov dword [ebx + 0xafaa], eax
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.theme.cab
mov eax, 0x104
lea edi, [ebp - 0x110]
call fcn.0040e697
push esi
push esi
push 3
push esi
push 1
push SysReAllocString
mov eax, edi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x403c8e
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
lea edi, [ebx + 0xafb6]
push eax
mov dword [edi], eax
call fcn.0043b018
pop ecx
push esi
lea ecx, [ebp - 8]
push ecx
push dword [edi]
mov dword [ebx + 0xafb2], eax
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x46d5b8], ebx
mov eax, 0x45fe00
add ebx, 0xf28
sub ebx, eax
movzx ecx, word [eax]
mov word [ebx + eax], cx
inc eax
inc eax
cmp cx, si
jne 0x403ca1
push dword [0x46d5b8]
call fcn.00402e9e
pop ecx
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret
Function at 0x404bd4
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push ebx
push esi
xor ebx, ebx
push edi
mov esi, eax
cmp dword [ebp + 0xc], ebx
je 0x404d57
cmp dword [ebp + 0x10], ebx
je 0x404d57
cmp esi, ebx
je 0x404c3a
cmp dword [esi + 4], ebx
je 0x404c3a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404b8a
add esp, 0xc
cmp eax, ebx
jne 0x404d59
add esi, 8
cmp dword [esi + 4], ebx
je 0x404d59
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00404b8a
add esp, 0xc
jmp 0x404d59
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.004451c0
add esp, 0xc
push str.theme_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.0040e697
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404c6f
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x404c7f
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocString
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x404d15
push str.data_
mov eax, 0x104
lea edi, [ebp - 0x108]
call fcn.0040e697
mov eax, dword [ebp + 8]
mov esi, eax
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x404ccf
lea edi, [ebp - 0x108]
sub eax, esi
dec edi
mov cl, byte [edi + 1]
inc edi
cmp cl, bl
jne 0x404cdf
mov ecx, eax
shr ecx, 2
push ebx
rep movsd dword es:[edi], dword [esi]
push ebx
push 3
push ebx
push 1
mov ecx, eax
push SysReAllocString
lea eax, [ebp - 0x108]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x404d57
push ebx
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
inc eax
push eax
call fcn.0043b018
pop ecx
mov ecx, dword [ebp + 0xc]
push ebx
mov dword [ecx], eax
lea ecx, [ebp - 4]
push ecx
push dword [esi]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [esi]
push edi
mov byte [eax + ecx], bl
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
inc eax
jmp 0x404d59
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40500e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x46d5b8]
sub esp, 0x10c
push ebx
xor ebx, ebx
cmp byte [eax + 0xa477], bl
je 0x405127
lea ecx, [eax + 0xa478]
cmp ecx, ebx
je 0x405127
push esi
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40503d
sub ecx, esi
je 0x405126
lea ecx, [eax + 0xad7c]
cmp ecx, ebx
je 0x405126
lea esi, [ecx + 1]
mov dl, byte [ecx]
inc ecx
cmp dl, bl
jne 0x40505d
sub ecx, esi
je 0x405126
add eax, 0xae80
push eax
push SysReAllocString
call fcn.0040283e
pop ecx
pop ecx
test al, al
jne 0x405126
mov eax, dword [0x46d5b8]
add eax, 0xae80
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.0040283e
pop ecx
pop ecx
test al, al
jne 0x405126
call fcn.0040512a
push 0x103
mov esi, eax
lea eax, [ebp - 0x10b]
push ebx
push eax
mov byte [ebp - 0x10c], bl
call fcn.004451c0
mov eax, dword [0x46d5b8]
push eax
push fcn.00403ecd
lea ecx, [ebp - 8]
push ecx
lea ecx, [ebp - 4]
push ecx
lea ecx, [eax + 0xac78]
push 0x104
lea eax, [ebp - 0x10c]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.00404367
add esp, 0x20
cmp esi, ebx
je 0x40511f
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x4050ff
sub eax, edx
je 0x40511f
push 5
push ebx
lea eax, [ebp - 0x10c]
push eax
push esi
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push esi
call fcn.0043bb04
pop ecx
pop esi
pop ebx
leave
ret
Function at 0x405353
Capabilities:
Delete directory
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x410
push esi
xor eax, eax
mov esi, 0x206
push esi
push eax
mov word [ebp - 0x410], ax
lea eax, [ebp - 0x40e]
push eax
call fcn.004451c0
xor eax, eax
push esi
push eax
mov word [ebp - 0x208], ax
lea eax, [ebp - 0x206]
push eax
call fcn.004451c0
lea eax, [ebp - 0x208]
push eax
push dword [ebp + 0x10]
call fcn.0040e09b
add esp, 0x20
test eax, eax
je 0x405421
cmp dword [ebp + 0xc], 0
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
je 0x4053d7
push dword [ebp + 0xc]
lea eax, [ebp - 0x208]
push eax
call esi
xor eax, eax
movzx ecx, word [ebp + eax - 0x208]
mov word [ebp + eax - 0x410], cx
inc eax
inc eax
test cx, cx
jne 0x4053c0
push edi
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push eax
call esi
lea edi, [ebp - 0x208]
dec edi
dec edi
mov ax, word [edi + 2]
inc edi
inc edi
test ax, ax
jne 0x4053ec
mov esi, 0x455524
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x208]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
cmp dword [ebp + 0xc], 0
pop edi
je 0x405421
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
pop esi
leave
ret
Function at 0x406626
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x1408
call fcn.0043b528
pop ecx
test eax, eax
je 0x40664c
push SysReAllocString
mov ecx, str.SoftwareMicrosoftInternet_ExplorerExtensions
call fcn.0040cdba
mov esi, eax
jmp 0x40664e
xor esi, esi
mov ecx, dword [ebp + 8]
add ecx, 0x424
mov eax, ecx
push edi
lea edi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x40665d
sub eax, edi
pop edi
je 0x40667d
push ecx
push esi
call fcn.0040d0da
lea eax, [esi + 8]
push eax
push dword [esi + 4]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
test esi, esi
je 0x406689
mov eax, dword [esi]
push 1
mov ecx, esi
call dword [eax]
pop esi
pop ebp
ret 4

Function at 0x40668e
Capabilities:
Delete registry key

Disassembly:
push ecx
mov ecx, dword [eax + 0x924]
dec ecx
je 0x4066bb
dec ecx
jne 0x4066c0
lea ecx, [eax + 0x208]
push ecx
add eax, 0x30c
call fcn.00401c2e
pop ecx
push eax
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
pop ecx
ret
call fcn.004066c2
pop ecx
ret

Function at 0x4066c2
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
lea ecx, [eax + 0x208]
push edi
push ecx
add eax, 0x30c
call fcn.00401c2e
pop ecx
xor edi, edi
push edi
mov esi, eax
push 0x455254
push esi
call fcn.00402650
add esp, 0xc
push 1
push 0x455730
push esi
mov dword [ebp - 8], eax
call fcn.00402650
add esp, 0xc
push edi
push 0x455734
push esi
mov dword [ebp - 0xc], eax
call fcn.00402650
add esp, 0xc
push 0x454c54
push esi
mov dword [ebp - 0x1c], eax
call fcn.004027e4
push 0x455738
push esi
mov dword [ebp - 0x18], eax
call fcn.004027e4
push edi
mov ebx, 0x455740
push ebx
push esi
mov dword [ebp - 4], eax
call fcn.00402650
add esp, 0x1c
push 1
mov edi, 0x45574c
push edi
push esi
mov dword [ebp - 0x10], eax
call fcn.00402650
add esp, 0xc
push esi
push SysReAllocString
mov dword [ebp - 0x14], eax
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
push 0
push dword [ebp - 0x10]
push ebx
push esi
call fcn.0040279c
push 1
push dword [ebp - 0x14]
push edi
push esi
call fcn.0040279c
mov eax, dword [0x46d5b8]
add esp, 0x20
test dword [eax + 0xa46f], 2
jne 0x4067a6
push 0
push dword [ebp - 8]
push 0x455254
push esi
call fcn.0040279c
add esp, 0x10
mov eax, dword [0x46d5b8]
test dword [eax + 0xa46f], 1
jne 0x4067c8
push dword [ebp - 0x18]
push 0x454c54
push esi
call fcn.00402822
add esp, 0xc
mov eax, dword [0x46d5b8]
test dword [eax + 0xa46f], 4
jne 0x406803
cmp dword [ebp - 4], 0
je 0x406803
push dword [ebp - 4]
push 0x455738
push esi
call fcn.00402822
add esp, 0xc
push 1
push dword [ebp - 0xc]
push 0x455730
push esi
call fcn.0040279c
add esp, 0x10
mov edi, dword [ebp - 0x1c]
test edi, edi
je 0x40682b
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x40680f
sub eax, edx
je 0x40682b
push 0
push edi
push 0x455734
push esi
call fcn.0040279c
add esp, 0x10
push esi
call fcn.0043bb04
pop ecx
push dword [ebp - 8]
call fcn.0043bb04
pop ecx
push dword [ebp - 0xc]
call fcn.0043bb04
pop ecx
push edi
call fcn.0043bb04
pop ecx
pop edi
pop esi
pop ebx
leave
ret