joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407de3
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x9c
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x70], eax
mov eax, dword [ebp + 0x7c]
and dword [ebp - 0x20], 0
push ebx
push esi
push edi
push 0x7e
pop esi
mov dword [ebp - 0x24], eax
xor eax, eax
push esi
push eax
mov word [ebp - 0x10], ax
lea eax, [ebp - 0xe]
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x43568c
mov ebx, 0x435d48
push ebx
mov dword [ebp - 0x1c], esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov edi, 0x80000001
push edi
mov dword [ebp - 0x14], 1
call esi
test eax, eax
jne 0x407e59
cmp word [ebp - 0x10], ax
jne 0x407ee1
xor eax, eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 0x18], eax
xor eax, eax
lea ecx, [ebp - 0x28]
push ecx
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
push 0x407d8d
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x493e0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x407ed1
push 0x80
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x43568c
push ebx
push edi
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x1c], 0x7e
call esi
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 0x10], 0
je 0x407efe
lea eax, [ebp - 0x10]
push eax
push 0x435dc0
push HeapFree
push dword [ebp - 0x24]
call fcn.0041fb89
add esp, 0x10
mov dword [ebp - 0x20], 1
mov ecx, dword [ebp + 0x70]
mov eax, dword [ebp - 0x20]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f23c
add ebp, 0x74
leave
ret 4
Function at 0x407f15
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x94
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push esi
xor esi, esi
inc esi
cmp dword [ebp + 0x7c], 0
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], esi
jne 0x407f44
mov eax, esi
jmp 0x407ff4
push ebx
push edi
push 0x7e
pop edi
xor eax, eax
push edi
push eax
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x12]
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
mov dword [ebp - 0x1c], edi
mov ebx, reloc.KERNEL32.dll_SetEndOfFile
push ebx
mov edi, 0x435d48
push edi
mov dword [ebp - 0x18], esi
mov esi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push 0x80000001
call esi
test eax, eax
jne 0x407f92
cmp word [ebp - 0x14], ax
jne 0x407fd8
push 0x80
lea eax, [ebp - 0x14]
push 0
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push ebx
push edi
push 0x80000002
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x1c], 0x7e
call esi
test eax, eax
jne 0x407fd2
cmp word [ebp - 0x14], ax
jne 0x407fd8
and dword [ebp - 0x20], 0
jmp 0x407fef
lea eax, [ebp - 0x14]
push eax
push 0x435dc0
push dword [ebp + 0x7c]
push dword [ebp - 0x24]
call fcn.0041fb89
add esp, 0x10
mov eax, dword [ebp - 0x20]
pop edi
pop ebx
mov ecx, dword [ebp + 0x6c]
xor ecx, ebp
pop esi
call fcn.0041f23c
add ebp, 0x70
leave
ret 8
Function at 0x408006
Capabilities:
Accept command line arguments
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x258]
sub esp, 0x2d8
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x254], eax
mov eax, 0x80000002
mov ecx, 0x436a28
push ebx
xor ebx, ebx
push esi
mov dword [ebp - 0x78], ecx
mov dword [ebp - 0x64], ecx
mov ecx, 0x436b30
mov edx, 0x436cdc
push edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], 0x4369a8
mov dword [ebp - 0x74], ebx
mov byte [ebp - 0x70], 1
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], 0x436a38
mov dword [ebp - 0x60], ebx
mov byte [ebp - 0x5c], 1
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], 0x436ab8
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], 0x436b50
mov byte [ebp - 0x48], 2
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], 0x436b68
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x38], 0x436bdc
mov byte [ebp - 0x34], 4
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], 0x436bf8
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], 0x436c6c
mov byte [ebp - 0x20], 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], 0x436c88
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], ebx
mov byte [ebp - 0xc], 4
mov dword [ebp - 8], eax
mov dword [ebp - 4], 0x436cf0
mov dword [ebp], edx
mov dword [ebp + 4], ebx
mov byte [ebp + 8], 4
mov dword [ebp + 0xc], 0x80000000
mov dword [ebp + 0x10], 0x436d48
mov dword [ebp + 0x14], 0x43568c
mov dword [ebp + 0x18], ebx
mov byte [ebp + 0x1c], 4
mov dword [ebp + 0x20], eax
mov dword [ebp + 0x24], 0x436dc0
mov dword [ebp + 0x28], ecx
mov dword [ebp + 0x2c], 0x436e60
mov byte [ebp + 0x30], 8
mov byte [ebp + 0x47], bl
lea esi, [ebp - 0x7c]
mov dword [ebp + 0x3c], 9
xor eax, eax
push 0x208
mov word [ebp + 0x48], ax
lea eax, [ebp + 0x4a]
push ebx
push eax
mov dword [ebp + 0x38], 0x104
mov dword [ebp + 0x34], 1
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp + 0x38]
push eax
lea eax, [ebp + 0x48]
push eax
lea eax, [ebp + 0x34]
push eax
push dword [esi + 4]
push dword [esi]
push dword [esi - 4]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4081d1
cmp ax, word [ebp + 0x48]
je 0x4081d1
push 0x22
pop eax
cmp ax, word [ebp + 0x48]
jne 0x4081a1
lea eax, [ebp + 0x40]
push eax
lea eax, [ebp + 0x48]
push eax
mov dword [ebp + 0x40], ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov edi, eax
cmp edi, ebx
je 0x4081a1
cmp dword [ebp + 0x40], ebx
je 0x40819a
push dword [edi]
lea eax, [ebp + 0x48]
push 0x435dc0
push 0x104
push eax
call fcn.0041fb89
add esp, 0x10
push edi
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edi, dword [esi + 8]
cmp edi, ebx
je 0x4081bd
lea eax, [ebp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
push edi
lea eax, [ebp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x48]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4081d1
mov al, byte [esi + 0xc]
or byte [ebp + 0x47], al
add esi, 0x14
dec dword [ebp + 0x3c]
jne 0x408113
mov ecx, dword [ebp + 0x254]
mov al, byte [ebp + 0x47]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f23c
add ebp, 0x258
leave
ret
Function at 0x4081f8
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x144
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
push 0x118
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
mov dword [ebp - 0xa8], 0x11c
call fcn.00421bc0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
call esi
test eax, eax
jne 0x40825e
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
test eax, eax
je 0x408303
mov eax, dword [ebp - 0x98]
sub eax, edi
je 0x408303
dec eax
je 0x408303
dec eax
jne 0x408303
cmp dword [ebp - 0xa4], 6
jne 0x4082a6
mov eax, dword [ebp - 0xa0]
cmp eax, 2
je 0x408293
cmp eax, 3
jne 0x408297
mov al, 3
jmp 0x408305
cmp eax, 1
jne 0x4082a0
mov al, 2
jmp 0x408305
cmp eax, edi
jne 0x408303
jmp 0x40829c
cmp dword [ebp - 0xa4], 5
jne 0x408303
cmp dword [ebp - 0xa0], 2
jne 0x4082f8
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0xcc], reloc.GDI32.dll_CreateRectRgn
lea edi, [ebp - 0xc8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x408303
cmp byte [ebp + 0x72], 1
jne 0x408303
cmp word [ebp - 0xcc], 9
jmp 0x4082ff
cmp dword [ebp - 0xa0], 1
mov al, 1
je 0x408305
mov al, 4
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.0041f23c
add ebp, 0x78
leave
ret

Function at 0x4083a1
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x294], eax
xor eax, eax
push 0x208
push eax
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x28e]
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x298]
push eax
push 0x43568c
push 0x436e78
push 0x80000000
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x29c], 0x104
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x4084b7
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4084b7
push esi
push edi
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call fcn.00421bc0
push HeapFree
lea edi, [ebp - 0x84]
lea esi, [ebp - 0x290]
call fcn.0040dfbe
add esp, 0x10
pop edi
pop esi
test eax, eax
je 0x4084b7
lea eax, [ebp - 0x84]
push 0x2e
push eax
call fcn.0041fffb
pop ecx
pop ecx
test eax, eax
je 0x4084b7
add eax, 2
push 0x2e
push eax
call fcn.0041fffb
pop ecx
pop ecx
test eax, eax
je 0x4084b7
xor ecx, ecx
mov word [eax], cx
lea eax, [ebp - 0x84]
push eax
push 0x435dc0
push HeapFree
push dword [ebp - 0x294]
call fcn.0041fb89
xor eax, eax
add esp, 0x10
inc eax
jmp 0x4084b9
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f23c
leave
ret 4
Function at 0x4098e2
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
and dword [esp], 0
push ebx
push esi
mov esi, eax
lea eax, [esi + 0x8c]
cmp dword [eax + 0x18], 8
push edi
jb 0x409903
mov eax, dword [eax + 4]
jmp 0x409906
add eax, 4
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
test eax, eax
jne 0x409947
push esi
call fcn.00409ac3
test eax, eax
jne 0x409947
push 1
call fcn.0040d5cc
call fcn.004065a1
mov dword [eax + 0xc], 0x68
call fcn.0040c3ac
mov esi, eax
call fcn.0040c4d8
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, esi
call fcn.00409c87
test eax, eax
jne 0x40995b
push 2
call fcn.0040d5cc
jmp 0x409930
mov ecx, esi
call fcn.0040b559
call fcn.004065a1
call fcn.00406d22
push 4
mov dword [esp + 0x10], eax
lea eax, [esp + 0x10]
push eax
push 4
push 0x4370d4
push 0x435d48
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [esi + 0x2c], 0
je 0x4099df
cmp dword [esi + 0xdc], 8
jb 0x4099a5
mov eax, dword [esi + 0xc8]
jmp 0x4099ab
lea eax, [esi + 0xc8]
push eax
call ebx
test eax, eax
je 0x4099df
cmp dword [esi + 0x88], 8
jb 0x4099c0
mov ecx, dword [esi + 0x74]
jmp 0x4099c3
lea ecx, [esi + 0x74]
cmp dword [esi + 0xdc], 8
jb 0x4099d4
mov ebx, dword [esi + 0xc8]
jmp 0x4099da
lea ebx, [esi + 0xc8]
call fcn.0040f0d8
push 3
call fcn.0040d5cc
mov dword [esp + 0xc], 1
jmp 0x40993c

Function at 0x4099f3
Capabilities:
Set registry value

Disassembly:
push ebx
push esi
mov ebx, eax
push edi
mov edi, ebx
call fcn.0040b05f
mov ecx, ebx
call fcn.0040af1e
mov ecx, dword [ebx + 0xbc]
lea eax, [ebx + 0xa8]
cmp dword [eax + 0x18], 8
jb 0x409a1d
mov eax, dword [eax + 4]
jmp 0x409a20
add eax, 4
add ecx, ecx
push ecx
push eax
push 1
push 0x437044
push 0x435d48
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
xor esi, esi
cmp dword [ebx + 0x24], esi
je 0x409a47
call fcn.0040b0d8
call fcn.0040b2f8
call fcn.0040c3ac
cmp dword [eax + 0x24], esi
jne 0x409a84
mov eax, dword [ebx + 0x24]
cmp eax, esi
je 0x409a63
cmp dword [ebx + 0x14], 9
jge 0x409a6c
cmp dword [ebx + 0x28], esi
jne 0x409a6c
cmp eax, esi
je 0x409a84
push esi
push 0x1388
push 2
push esi
push 0x2a
push 0x1a
push reloc.ADVAPI32.dll_RegCloseKey
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
cmp dword [ebx + 0xa0], esi
je 0x409aa7
lea eax, [ebx + 0x8c]
cmp dword [eax + 0x18], 8
jb 0x409a9d
mov eax, dword [eax + 4]
jmp 0x409aa0
add eax, 4
push eax
call fcn.0040e41e
pop ecx
push 4
mov esi, ebx
call fcn.0040d5cc
call fcn.0040c3ac
mov esi, eax
call fcn.0040c4d8
pop edi
xor eax, eax
pop esi
inc eax
pop ebx
ret
Function at 0x409ac3
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, reloc.gdiplus.dll_GdipDisposeImage
mov eax, dword [0x43e030]
xor eax, esp
mov dword [esp + GdipDisposeImage], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
xor eax, eax
mov esi, 0x206
xor edi, edi
push esi
mov word [esp + SetRect], ax
lea eax, [esp + 0x4a6]
push edi
push eax
mov dword [esp + 0x1c], edi
call fcn.00421bc0
add esp, 0xc
lea eax, [esp + 0x4a0]
push eax
mov ebx, 0x103
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x409c70
xor eax, eax
push esi
mov word [esp + 0x94], ax
lea eax, [esp + 0x96]
push edi
push eax
call fcn.00421bc0
mov dword [esp + 0x24], edi
xor eax, eax
lea edi, [esp + 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
lea eax, [esp + 0x18]
push eax
call dword [sym.imp.ole32.dll_CoCreateGuid]
test eax, eax
jne 0x409ba6
push SetEndOfFile
push eax
mov word [esp + 0x30], ax
lea eax, [esp + 0x32]
push eax
call fcn.00421bc0
add esp, 0xc
push 0x32
lea eax, [esp + 0x2c]
push eax
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.ole32.dll_StringFromGUID2]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x4a4]
push eax
lea eax, [esp + 0x98]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
jmp 0x409bc8
lea eax, [esp + 0x90]
push eax
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push 0x435dc8
lea eax, [esp + 0x4ac]
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
lea eax, [esp + 0x90]
push eax
call fcn.0040e36b
pop ecx
test eax, eax
je 0x409c6c
xor eax, eax
push esi
push eax
mov word [esp + reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [esp + 0x2a2]
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [esp + 0x90]
push eax
push 0x437074
lea eax, [esp + 0x2a0]
push ebx
push eax
call fcn.0041fb89
lea eax, [esp + 0x2a8]
push eax
call fcn.0040f94d
add esp, 0x14
test eax, eax
je 0x409c6c
lea edx, [esp + 0x90]
lea ecx, [esp + 0x298]
call fcn.0040fd92
test eax, eax
je 0x409c6c
lea eax, [esp + 0x298]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [esp + 0x14]
add ecx, 0x8c
lea eax, [esp + 0x90]
call fcn.00405e78
mov dword [esp + 0x10], 1
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x6ac]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0041f23c
mov esp, ebp
pop ebp
ret 4
Function at 0x40a866
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 4], eax
test esi, esi
je 0x40a8ec
cmp word [esi], 0
je 0x40a8ec
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jge 0x40a8ec
xor eax, eax
push 0x206
push eax
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x20a]
push eax
call fcn.00421bc0
add esp, 0xc
push 0
push 0x28
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
lea eax, [ebp - 0x20c]
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40a8c6
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x20c]
push esi
push eax
call fcn.0042010b
add esp, 0xc
neg eax
sbb eax, eax
inc eax
jmp 0x40a8ef
xor eax, eax
inc eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041f23c
leave
ret 4

Function at 0x40ac23
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
xor eax, eax
push edi
cmp word [ecx], si
je 0x40ac9c
mov word [ebp - 0x10], ax
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
push 3
stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 0x10]
push eax
call fcn.00420220
xor eax, eax
mov dword [ebp - 0x28], esi
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
add esp, 0xc
mov dword [ebp - 0x18], esi
lea edi, [ebp - 0x14]
stosd dword es:[edi], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x40ac9a
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
shrd eax, ecx, 0x14
shr ecx, 0x14
cmp eax, 0x64
jbe 0x40ac9a
inc esi
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0041f23c
leave
ret
Function at 0x40acaa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x59c
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push edi
xor edi, edi
mov dword [ebp - 0x59c], eax
mov dword [ebp - 0x598], edi
cmp eax, edi
je 0x40ae55
cmp word [eax], di
je 0x40ae55
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 8
jl 0x40ae55
push ebx
push esi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x38a]
push edi
push eax
call fcn.00421bc0
mov ebx, dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
add esp, 0xc
push edi
push reloc.GDI32.dll_CreateRectRgn
lea eax, [ebp - 0x38c]
push eax
push edi
call ebx
xor eax, eax
push 0x7e
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x102]
push edi
push eax
call fcn.00421bc0
movzx eax, word [ebp - reloc.ADVAPI32.dll_RegCloseKey]
push eax
push 0x437280
lea eax, [ebp - 0x104]
push HeapFree
push eax
call fcn.0041fb89
xor eax, eax
push 0x7e
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x182]
push edi
push eax
call fcn.00421bc0
movzx eax, word [ebp - reloc.ADVAPI32.dll_RegCloseKey]
push eax
push 0x4372a4
lea eax, [ebp - 0x184]
push HeapFree
push eax
call fcn.0041fb89
xor eax, eax
push esi
mov word [ebp - reloc.ADVAPI32.dll_RegCloseKey], ax
lea eax, [ebp - 0x592]
push edi
push eax
call fcn.00421bc0
add esp, 0x44
push edi
push 0x28
lea eax, [ebp - 0x594]
push eax
push edi
call ebx
xor eax, eax
push 0x7e
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push edi
push eax
call fcn.00421bc0
lea eax, [ebp - 0x594]
push eax
push 0x435dc0
lea eax, [ebp - 0x84]
push HeapFree
push eax
call fcn.0041fb89
add esp, 0x1c
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecW]
mov esi, dword [ebp - 0x59c]
lea ecx, [ebp - 0x38c]
call fcn.0040ae66
test eax, eax
jne 0x40ae41
lea ecx, [ebp - 0x104]
call fcn.0040ae66
test eax, eax
jne 0x40ae41
lea ecx, [ebp - 0x184]
call fcn.0040ae66
test eax, eax
jne 0x40ae41
lea ecx, [ebp - 0x84]
call fcn.0040ae66
test eax, eax
je 0x40ae4b
lea ecx, [ebp - 0x594]
call fcn.0040ae66
test eax, eax
jne 0x40ae4b
mov dword [ebp - 0x598], 1
mov eax, dword [ebp - 0x598]
pop esi
pop ebx
jmp 0x40ae57
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.0041f23c
leave
ret 8
Function at 0x40af1e
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x18c], eax
push ebx
push esi
push edi
mov ebx, ecx
mov edi, dword [ebx + 0x20]
neg edi
sbb edi, edi
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
add edi, 0x80000002
push eax
mov dword [ebp - 0x80], edi
call fcn.00421bc0
lea eax, [ebx + 0xa8]
add esp, 0xc
cmp dword [eax + 0x18], 8
jb 0x40af77
mov eax, dword [eax + 4]
jmp 0x40af7a
add eax, 4
push 0x436efc
push eax
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
mov esi, 0x4372d8
push esi
push edi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push 8
push 0x436f58
push 1
push 0x437390
push esi
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
call edi
mov ecx, dword [ebx + 0xd8]
lea eax, [ebx + 0xc4]
cmp dword [eax + 0x18], 8
jb 0x40afc6
mov eax, dword [eax + 4]
jmp 0x40afc9
add eax, 4
add ecx, ecx
push ecx
push eax
push 1
push 0x4373a8
push esi
push dword [ebp - 0x80]
call edi
cmp dword [ebx + 0x6c], 8
mov eax, dword [ebx + 0x68]
jb 0x40afe8
mov ebx, dword [ebx + 0x58]
jmp 0x40afeb
add ebx, 0x58
add eax, eax
push eax
push ebx
mov ebx, dword [ebp - 0x80]
push 1
push 0x4373c0
push esi
push ebx
call edi
push 0x14
push 0x4373e0
push 1
push 0x4373f8
push esi
push ebx
call edi
push 0x2c
push 0x43740c
push 1
push 0x43743c
push esi
push ebx
call edi
lea eax, [ebp - 0x7c]
lea ecx, [eax + 2]
mov dx, word [eax]
inc eax
inc eax
test dx, dx
jne 0x40b027
sub eax, ecx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp - 0x7c]
push eax
push 1
push 0x436b30
push esi
push ebx
call edi
mov ecx, dword [ebp + 0x18c]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f23c
add ebp, 0x190
leave
ret

Function at 0x40b05f
Capabilities:
Delete registry key
Persist via app paths registry key
Set registry value

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [edi + 0x20]
neg esi
sbb esi, esi
mov ebx, 0x436fc0
push ebx
add esi, 0x80000002
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
mov ecx, dword [edi + 0xd8]
lea eax, [edi + 0xc4]
cmp dword [eax + 0x18], 8
jb 0x40b093
mov eax, dword [eax + 4]
jmp 0x40b096
add eax, 4
mov ebp, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
add ecx, ecx
push ecx
push eax
push 1
push 0x43568c
push ebx
push esi
call ebp
mov ecx, dword [edi + 0xbc]
lea eax, [edi + 0xa8]
cmp dword [eax + 0x18], 8
jb 0x40b0c2
mov eax, dword [eax + 4]
jmp 0x40b0c5
add eax, 4
add ecx, ecx
push ecx
push eax
push 1
push 0x436a28
push ebx
push esi
call ebp
pop esi
pop ebp
pop ebx
ret
Function at 0x40b559
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x8c
mov eax, dword [0x43e030]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
push 0x7e
pop esi
xor eax, eax
push esi
push eax
mov word [ebp - 0xc], ax
lea eax, [ebp - 0xa]
push eax
mov ebx, ecx
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x14], esi
mov edi, reloc.KERNEL32.dll_SetEndOfFile
push edi
mov esi, 0x435d48
push esi
push 0x80000001
mov dword [ebp - 0x10], 1
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40b5c5
cmp word [ebp - 0xc], ax
jne 0x40b651
push 0x80
lea eax, [ebp - 0xc]
push 0
push eax
call fcn.00421bc0
add esp, 0xc
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push edi
push esi
push 0x80000002
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x14], 0x7e
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40b609
cmp word [ebp - 0xc], ax
jne 0x40b651
cmp dword [ebx + 0x50], 8
mov eax, dword [ebx + 0x4c]
jb 0x40b617
mov ecx, dword [ebx + 0x3c]
jmp 0x40b61a
lea ecx, [ebx + 0x3c]
add eax, eax
push eax
push ecx
push 1
push edi
push esi
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
cmp dword [ebx + 0x50], 8
mov eax, dword [ebx + 0x4c]
jb 0x40b63b
mov ebx, dword [ebx + 0x3c]
jmp 0x40b63e
add ebx, 0x3c
add eax, eax
push eax
push ebx
push 1
push edi
push esi
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0041f23c
add ebp, 0x78
leave
ret