joyce8/EMBER2024-capa huggingface dataset:
Function at 0x11777530
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x20
call fcn.116d1b60
push ebx
mov ebx, dword [esp + 0x30]
push ebp
push esi
test ebx, ebx
push edi
jle 0x11777684
cmp ebx, 0x80
jg 0x11777684
mov edi, dword [esp + 0x44]
mov eax, edi
mov ecx, dword [eax]
mov dword [esp + 0x10], ecx
mov edx, dword [eax + 4]
mov dword [esp + 0x14], edx
mov ecx, dword [eax + 8]
mov dword [esp + 0x18], ecx
mov edx, dword [eax + 0xc]
mov eax, dword [esp + 0x40]
push eax
push edi
push edi
mov dword [esp + 0x28], edx
call fcn.11777e40
lea eax, [ebx + 7]
add esp, 0xc
cdq
and edx, 7
add eax, edx
mov ebp, eax
mov eax, dword [esp + 0x48]
sar ebp, 3
test eax, eax
je 0x117775c7
test ebp, ebp
jle 0x11777615
mov edx, dword [esp + 0x34]
mov ebx, dword [esp + 0x38]
lea esi, [esp + 0x20]
sub edx, edi
sub esi, edi
mov ecx, edi
sub ebx, edi
mov al, byte [edx + ecx]
xor al, byte [ecx]
inc ecx
dec ebp
mov byte [esi + ecx - 1], al
mov byte [ebx + ecx - 1], al
jne 0x117775b4
jmp 0x11777611
xor esi, esi
test ebp, ebp
jle 0x11777615
mov eax, dword [esp + 0x34]
lea ecx, [esp + 0x20]
mov ebx, edi
lea edx, [esp + 0x20]
sub eax, ecx
mov ecx, dword [esp + 0x38]
sub ebx, edx
lea edx, [esp + 0x20]
sub ecx, edx
mov dword [esp + 0x34], ebx
mov dword [esp + 0x38], ecx
jmp 0x117775f7
mov ebx, dword [esp + 0x34]
lea ecx, [esp + esi + 0x20]
mov dl, byte [eax + ecx]
mov bl, byte [ebx + ecx]
mov byte [ecx], dl
xor bl, dl
mov edx, dword [esp + 0x38]
inc esi
cmp esi, ebp
mov byte [edx + ecx], bl
jl 0x117775f3
mov ebx, dword [esp + 0x3c]
mov ebp, ebx
and ebp, 0x80000007
jns 0x11777624
dec ebp
or ebp, 0xfffffff8
inc ebp
mov eax, ebx
cdq
and edx, 7
add eax, edx
sar eax, 3
test ebp, ebp
jne 0x11777655
lea eax, [esp + eax + 0x10]
mov ecx, dword [eax]
mov dword [edi], ecx
mov edx, dword [eax + 4]
mov dword [edi + 4], edx
mov ecx, dword [eax + 8]
mov dword [edi + 8], ecx
mov edx, dword [eax + 0xc]
mov dword [edi + 0xc], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
mov ecx, 8
xor esi, esi
sub ecx, ebp
lea eax, [esp + eax + 0x10]
mov dword [esp + 0x3c], ecx
jmp 0x1177766c
mov ecx, dword [esp + 0x3c]
mov dl, byte [eax + esi + 1]
mov bl, byte [eax + esi]
shr dl, cl
mov ecx, ebp
shl bl, cl
or dl, bl
mov byte [esi + edi], dl
inc esi
cmp esi, 0x10
jl 0x11777668
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret
Function at 0x40106c
Capabilities:
Delete directory
Delete file

Disassembly:
mov eax, 0x45eba3
call fcn.0043b5c0
sub esp, 0x3c
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x1c], esi
cmp byte [esi + 0x20], 0
push 1
pop ebx
mov dword [ebp - 4], ebx
jne 0x401253
mov edi, dword [esi + 4]
mov eax, dword [esi + 8]
cmp edi, eax
je 0x401162
mov ecx, edi
call fcn.00401f43
push eax
lea eax, [ebp - 0xd]
push ebx
push eax
push str.File_s
lea ecx, [ebp - 0x48]
call fcn.00401717
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00401799
push eax
lea eax, [ebp - 0xe]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
push eax
push str.DeleterDeleteFile
call fcn.00401717
sub esp, 0x28
lea eax, [ebp - 0xf]
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
push eax
push str.ISSetupDLLOp
mov byte [ebp - 4], 3
call fcn.00401717
mov byte [ebp - 4], 2
call fcn.0043288c
add esp, 0x58
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.0040127e
and dword [ebp - 0x18], 0
push 0xc
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
push edi
call fcn.004016ed
call fcn.0042c97a
add esp, 0x2c
test al, al
je 0x401156
mov ecx, edi
call fcn.00401f43
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x401156
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp eax, 0x64
jge 0x401156
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401112
add edi, 0x28
cmp edi, dword [esi + 8]
jne 0x40109f
mov eax, dword [esi + 0x18]
mov dword [ebp - 0x14], eax
cmp eax, dword [esi + 0x14]
je 0x401246
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0x28]
call fcn.00401f43
push eax
lea eax, [ebp - 0xf]
push ebx
push eax
push str.Folder_s
lea ecx, [ebp - 0x48]
call fcn.00401717
mov ecx, eax
mov byte [ebp - 4], 4
call fcn.00401799
push eax
lea eax, [ebp - 0xe]
sub esp, 0x28
mov ecx, esp
mov dword [ebp - 0x20], esp
push ebx
push eax
push str.DeleterDeleteFolder
call fcn.00401717
sub esp, 0x28
lea eax, [ebp - 0xd]
mov ecx, esp
mov dword [ebp - 0x18], esp
push ebx
push eax
push str.ISSetupDLLOp
mov byte [ebp - 4], 5
call fcn.00401717
mov byte [ebp - 4], 4
call fcn.0043288c
add esp, 0x58
lea ecx, [ebp - 0x48]
mov byte [ebp - 4], bl
call fcn.0040127e
and dword [ebp - 0x18], 0
push 0xc
lea ecx, [ebp - 0x14]
sub esp, 0x28
mov edi, esp
mov dword [ebp - 0x20], esp
push ebx
call fcn.00401a9f
push eax
mov ecx, edi
call fcn.004016ed
call fcn.0042c97a
add esp, 0x2c
test al, al
je 0x40123a
mov eax, dword [ebp - 0x14]
lea ecx, [eax - 0x28]
call fcn.00401f43
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
jne 0x40123a
mov eax, dword [ebp - 0x18]
inc dword [ebp - 0x18]
cmp eax, 0x64
jge 0x40123a
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x4011e8
sub dword [ebp - 0x14], 0x28
mov eax, dword [ebp - 0x14]
jmp 0x401168
cmp byte [esi + 0x21], 0
je 0x401253
push ebx
call fcn.004012f8
pop ecx
and byte [ebp - 4], 0
lea ecx, [esi + 0x10]
call fcn.00401a6c
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401a6c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x4046c3
Capabilities:
Delete file
Get common file path

Disassembly:
mov eax, 0x45f222
call fcn.0043b5c0
sub esp, 0x224
push ebx
push esi
lea eax, [ebp - 0x230]
push edi
xor ebx, ebx
push eax
push 0x104
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x404707
lea ecx, [ebp - 0x58]
call fcn.004048a7
lea eax, [ebp - 0x58]
push 0x46a2a8
push eax
call fcn.0043bd2a
push 0x24
xor eax, eax
pop ecx
lea edi, [ebp - 0x128]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x12c]
mov dword [ebp - 0x12c], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
mov edi, 0x467578
mov esi, 0x467570
je 0x404846
cmp dword [ebp - 0x11c], 1
jne 0x404846
lea eax, [ebp - 0xe]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.00405529
push str.123.tmp
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 1
call fcn.00404c8a
push ebx
push 0x80
push 2
push ebx
push ebx
push 0x40000000
lea ecx, [ebp - 0x3c]
call fcn.004058df
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
jne 0x404825
lea eax, [ebp - 0x64]
push ebx
push eax
call fcn.00404a29
pop ecx
pop ecx
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
push ecx
mov ecx, eax
call fcn.00404b66
push dword [0x467558]
mov ecx, eax
add eax, 4
mov byte [ebp - 4], 3
neg ecx
sbb ecx, ecx
push ebx
and ecx, eax
push ecx
lea ecx, [ebp - 0x38]
call fcn.00402392
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 2
call fcn.0040127e
lea ecx, [ebp - 0x64]
mov byte [ebp - 4], 1
call fcn.0040127e
push 0x4763f0
lea ecx, [ebp - 0x3c]
call fcn.00404c8a
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x3c]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b1a
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x3c]
jmp 0x404890
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x3c]
call fcn.004058df
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea ecx, [ebp - 0x3c]
mov byte [ebp - 4], bl
call fcn.0040127e
lea eax, [ebp - 0xd]
push ebx
push eax
lea eax, [ebp - 0x230]
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00405529
push 0x4763ec
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], 4
call fcn.00404c8a
mov ecx, dword [ebp + 8]
push ebx
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b1a
mov dword [ebp - 0x14], 1
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x64]
call fcn.0040127e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x404a29
Capabilities:
Get common file path

Disassembly:
mov eax, 0x45f28f
call fcn.0043b5c0
sub esp, 0x15c
and dword [ebp - 0x14], 0
push ebx
push esi
push edi
push 1
mov esi, 0x104
pop ebx
cmp dword [ebp + 0xc], ebx
jne 0x404ad4
push str.KERNEL32.DLL
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x404ad4
push str.GetSystemWindowsDirectoryA
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
mov dword [0x47640c], eax
je 0x404ad4
lea ecx, [ebp - 0x168]
push esi
push ecx
call eax
test eax, eax
je 0x404ad4
lea eax, [ebp + 0xf]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x467578
mov esi, 0x467570
push eax
lea ecx, [ebp - 0x64]
mov dword [ebp - 0x64], edi
mov dword [ebp - 0x44], esi
call fcn.00405529
push 0x4763ec
lea ecx, [ebp - 0x64]
mov dword [ebp - 4], ebx
call fcn.00404c8a
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b1a
mov dword [ebp - 0x14], ebx
and byte [ebp - 4], 0
lea ecx, [ebp - 0x64]
jmp 0x404b4f
lea eax, [ebp - 0x168]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x404afc
lea ecx, [ebp - 0x30]
call fcn.004048a7
lea eax, [ebp - 0x30]
push 0x46a2a8
push eax
call fcn.0043bd2a
lea eax, [ebp - 0xd]
push 0
push eax
lea eax, [ebp - 0x168]
mov edi, 0x467578
mov esi, 0x467570
push eax
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x3c], edi
mov dword [ebp - 0x1c], esi
call fcn.00405529
push 0x4763ec
lea ecx, [ebp - 0x3c]
mov dword [ebp - 4], 2
call fcn.00404c8a
mov ecx, dword [ebp + 8]
push 0
push eax
mov dword [ecx], edi
mov dword [ecx + 0x20], esi
call fcn.00401b1a
and byte [ebp - 4], 0
mov dword [ebp - 0x14], ebx
lea ecx, [ebp - 0x3c]
call fcn.0040127e
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x4070a3
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
mov esi, ecx
mov eax, dword [esi]
movzx ecx, word [eax + 0x48]
cmp ecx, dword [ebp + 8]
jne 0x4070c1
mov ax, word [eax + 0x4e]
cmp ax, 0xffff
jne 0x407102
lea eax, [ebp - 0x14]
push 0x14
push eax
push 0x1004
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
test eax, eax
jle 0x4070fc
lea eax, [ebp - 0x14]
push eax
call fcn.0043c5ca
pop ecx
lea ecx, [ebp - 0x34]
push 2
push ecx
push eax
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
test eax, eax
je 0x4070fc
mov eax, dword [esi]
mov cx, word [ebp - 0x34]
mov word [eax + 0x4e], cx
mov eax, dword [esi]
mov ax, word [eax + 0x4e]
pop esi
leave
ret 4
Function at 0x40a1cf
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x45fc6f
call fcn.0043b5c0
mov eax, 0x10a0
call fcn.0043b1a0
push ebx
push esi
xor esi, esi
push edi
lea eax, [ebp - 0x21]
mov ebx, 0x4675b0
mov edi, 0x4675a8
push esi
push eax
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x34], edi
call fcn.0040b2c0
or dword [ebp - 0x20], 0xffffffff
push 1
pop eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
push esi
push 0x80
push 3
push esi
push eax
push SysReAllocStringLen
mov byte [ebp - 4], 2
call fcn.0040bc78
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
mov dword [ebp - 0x28], eax
je 0x40a2ff
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0xac]
push eax
call fcn.00436681
pop ecx
lea eax, [ebp + 0xc]
push esi
push eax
lea eax, [ebp - 0x10ac]
push 0x1000
push eax
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x40a28c
push dword [ebp + 0xc]
lea eax, [ebp - 0x10ac]
push eax
lea eax, [ebp - 0xac]
push eax
call fcn.004366a9
add esp, 0xc
cmp dword [ebp + 0xc], esi
ja 0x40a250
lea eax, [ebp - 0xac]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.00436747
movzx eax, byte [ebp - 0xd]
pop ecx
pop ecx
push eax
movzx eax, byte [ebp - 0xe]
push eax
movzx eax, byte [ebp - 0xf]
push eax
movzx eax, byte [ebp - 0x10]
push eax
movzx eax, byte [ebp - 0x11]
push eax
movzx eax, byte [ebp - 0x12]
push eax
movzx eax, byte [ebp - 0x13]
push eax
movzx eax, byte [ebp - 0x14]
push eax
movzx eax, byte [ebp - 0x15]
push eax
movzx eax, byte [ebp - 0x16]
push eax
movzx eax, byte [ebp - 0x17]
push eax
movzx eax, byte [ebp - 0x18]
push eax
movzx eax, byte [ebp - 0x19]
push eax
movzx eax, byte [ebp - 0x1a]
push eax
movzx eax, byte [ebp - 0x1b]
push eax
movzx eax, byte [ebp - 0x1c]
push eax
lea eax, [ebp - 0x54]
push str._02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X_02X
push eax
call fcn.0040aff7
add esp, 0x48
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x54]
push 0
push eax
mov ecx, esi
mov dword [esi], ebx
mov dword [esi + 0x20], edi
call fcn.0040b335
mov dword [ebp - 0x2c], 1
cmp dword [ebp - 0x20], 0xffffffff
je 0x40a32f
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x40a32f
push dword [ebp - 0x20]
call eax
and byte [ebp - 4], 0
lea ecx, [ebp - 0x54]
call fcn.00406320
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 8
Function at 0x419083
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov eax, 0x461c2c
call fcn.0043b5c0
sub esp, 0x4c
push ebx
xor eax, eax
push esi
push edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], eax
mov edi, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov esi, dword [edi + 0xa8]
cmp esi, eax
je 0x41918e
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push 0x1c
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x4190cc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
push edi
push str..debug
call fcn.004191de
pop ecx
test eax, eax
pop ecx
je 0x4190f8
cmp dword [eax + 0xc], esi
jne 0x4190f8
mov ecx, dword [eax + 0x14]
mov edx, dword [edi + 0xac]
mov dword [ebp + 0xc], edx
mov edi, ecx
lea eax, [ecx + ebx]
mov dword [ebp + 0x10], edx
jmp 0x41914b
push edi
push str..rdata
call fcn.004191de
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
jne 0x41911e
push edi
push str..text
call fcn.004191de
pop ecx
pop ecx
mov ecx, eax
test ecx, ecx
je 0x41918e
mov edi, dword [edi + 0xac]
push 0x1c
mov dword [ebp + 0x10], edi
mov eax, edi
xor edx, edx
pop edi
div edi
test eax, eax
mov dword [ebp + 0xc], eax
je 0x41918e
sub esi, dword [ecx + 0xc]
mov eax, dword [ecx + 0x14]
lea ecx, [eax + esi]
mov edi, ecx
lea eax, [ecx + ebx]
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0x10], ecx
mov ecx, eax
sub ecx, ebx
cmp ecx, dword [ebp - 0x18]
jbe 0x419199
cmp dword [ebp + 8], 0
je 0x419199
lea eax, [ebp - 0x58]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, edi
xor edx, edx
div dword [ebp - 0x3c]
xor edx, edx
mov esi, eax
mov eax, edi
div dword [ebp - 0x3c]
imul esi, dword [ebp - 0x3c]
add edx, dword [ebp + 0x10]
push edx
push esi
push 0
push 4
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
test eax, eax
jne 0x419192
xor eax, eax
jmp 0x4191cf
mov dword [ebp - 0x10], eax
sub eax, esi
add eax, edi
mov edx, dword [ebp + 0xc]
test edx, edx
jbe 0x4191b8
add eax, 0x10
mov ecx, dword [eax]
mov esi, dword [eax + 8]
add esi, ecx
cmp esi, dword [ebp + 0x14]
jbe 0x4191b2
add dword [ebp - 0x14], ecx
add eax, 0x1c
dec edx
jne 0x4191a3
cmp dword [ebp - 0x10], 0
je 0x4191cc
mov eax, dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test eax, eax
je 0x4191cc
push dword [ebp - 0x10]
call eax
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x419224
Capabilities:
Create directory

Disassembly:
mov eax, 0x461c48
call fcn.0043b5c0
sub esp, 0x3c
push ebx
push esi
push edi
push 1
lea ecx, [ebp - 0x48]
call fcn.0041a346
mov ecx, dword [ebp + 8]
xor ebx, ebx
lea eax, [ebp - 0x2c]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.004192f3
mov eax, dword [eax + 0x10]
cmp eax, ebx
jne 0x41925b
xor esi, esi
jmp 0x419264
push eax
call dword [sym.imp.OLEAUT32.dll_VariantInit]
mov esi, eax
lea ecx, [ebp - 0x2c]
call fcn.0041a128
push 0x5c
inc esi
pop edi
mov dword [ebp - 0x10], edi
mov ecx, dword [ebp + 8]
push esi
lea eax, [ebp - 0x10]
push 1
push eax
call fcn.0041a9ec
cmp dword [0x467f90], eax
je 0x4192d6
lea esi, [eax + 1]
push ebx
push esi
push ebx
push dword [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x20], 0x467f78
mov dword [ebp - 0x18], 0x467f70
call fcn.00419e74
mov dword [ebp - 0x2c], vtable.zpath.0
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 1
call fcn.0041ac6c
push ebx
push dword [ebp - 0x28]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.0041a128
mov dword [ebp - 0x10], edi
jmp 0x419273
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.0041a3cb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4

Function at 0x41b5f1
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x41b605
push 1
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41b639
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.00437ef7
test al, al
jne 0x41b66c
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413d79
lea eax, [ebp - 0x4c]
push 0x46c7d0
push eax
call fcn.0043bd2a
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b66c
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00413a39
lea eax, [ebp - 0x48]
push 0x46c698
push eax
call fcn.0043bd2a
mov eax, dword [ebp + 8]
pop esi
leave
ret 8

Function at 0x41b674
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [ebp + 0xc]
push esi
cmp eax, 0xffffffff
mov esi, ecx
jne 0x41b688
push 0x26
pop eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x41b6bc
lea edx, [ebp + 8]
push edx
push eax
push dword [ebp + 8]
call fcn.00437ef7
test al, al
jne 0x41b6ef
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x4c]
call fcn.00413d79
lea eax, [ebp - 0x4c]
push 0x46c7d0
push eax
call fcn.0043bd2a
lea ecx, [ebp + 8]
push 0
push ecx
push eax
push dword [ebp + 8]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x41b6ef
add esi, 0xc
push 1
push esi
lea ecx, [ebp - 0x48]
call fcn.00413a39
lea eax, [ebp - 0x48]
push 0x46c698
push eax
call fcn.0043bd2a
mov eax, dword [ebp + 8]
pop esi
leave
ret 8
Function at 0x4212cf
Capabilities:
Persist via run registry key

Disassembly:
mov eax, 0x46295c
call fcn.0043b5c0
sub esp, 0x38
push ebx
push esi
push edi
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
mov edi, ecx
push esi
call fcn.004215a4
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnceEx
push esi
mov ecx, edi
mov ebx, eax
call fcn.004215a4
push str.SYSTEMCurrentControlSetControlSession_ManagerFileRenameOperations
push esi
mov ecx, edi
mov dword [ebp - 0x14], eax
call fcn.004215a4
push 0x478c04
push str.SYSTEMCurrentControlSetControlSession_Manager
push esi
mov ecx, edi
mov dword [ebp - 0x18], eax
call fcn.00421640
push str.rename
push str._WindowsFolder_Wininit.ini
mov ecx, edi
mov esi, eax
call fcn.004213f6
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0xd]
push 0
push eax
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x44], 0x4675b0
mov dword [ebp - 0x24], 0x4675a8
call fcn.0040b2c0
and dword [ebp - 4], 0
cmp ebx, dword [edi + 0x2f0]
jle 0x42136a
push str.RunOnce
jmp 0x4213ad
mov eax, dword [ebp - 0x14]
cmp eax, dword [edi + 0x2f4]
jle 0x42137c
push str.RunOnceEx
jmp 0x4213ad
cmp esi, dword [edi + 0x2f8]
jle 0x42138b
push str.PendingFileRenameOperations
jmp 0x4213ad
mov eax, dword [ebp - 0x18]
cmp eax, dword [edi + 0x2fc]
jle 0x42139d
push str.FileRenameOperations
jmp 0x4213ad
mov eax, dword [ebp - 0x1c]
cmp eax, dword [edi + 0x300]
jle 0x4213be
push str.Wininit.ini_rename
lea eax, [ebp - 0x44]
push str.Reboot_required____s_key_added
push eax
call fcn.0040aff7
add esp, 0xc
cmp dword [ebp - 0x38], 0
je 0x4213d7
push 0
push 1
pop ebx
lea eax, [ebp - 0x44]
push ebx
push eax
mov ecx, edi
call fcn.004217ba
jmp 0x4213d9
xor bl, bl
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.00406320
mov ecx, dword [ebp - 0xc]
pop edi
mov al, bl
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x4243e5
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x462f73
call fcn.0043b5c0
sub esp, 0x138
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
and byte [ebp - 0x144], bl
xor eax, eax
lea edi, [ebp - 0x143]
mov dword [ebp - 0x14], ebx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x10], ebx
test byte [ebp + 0xf], 0x80
push 1
mov eax, 0x20019
pop esi
mov dword [ebp - 4], esi
je 0x424430
and byte [ebp + 0xf], 0x7f
mov eax, 0x20119
lea ecx, [ebp - 0x10]
push ecx
push eax
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x424477
cmp dword [ebp + 0xc], esi
mov dword [ebp - 0x18], 0x104
mov eax, str.CommonFilesDir
je 0x424460
mov eax, str.ProgramFilesDir
lea ecx, [ebp - 0x18]
push ecx
lea ecx, [ebp - 0x144]
push ecx
push ebx
push ebx
push eax
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp + 0xf]
push ebx
push eax
lea eax, [ebp - 0x144]
mov edi, 0x4680a4
mov esi, 0x46809c
push eax
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x20], esi
call fcn.00401717
push 0x4763ec
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.004244f6
mov ebx, dword [ebp + 8]
push 0
push eax
mov ecx, ebx
mov dword [ebx], edi
mov dword [ebx + 0x20], esi
call fcn.00401b1a
mov dword [ebp - 0x14], 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.0040127e
cmp dword [ebp - 0x10], 0
je 0x4244e5
mov eax, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x4244e5
push dword [ebp - 0x10]
call eax
mov ecx, dword [ebp - 0xc]
pop edi
mov eax, ebx
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x424b1d
Capabilities:
Delete file
Get file attributes
Set file attributes

Disassembly:
mov eax, 0x46308c
call fcn.0043b5c0
sub esp, 0x144
push esi
mov esi, ecx
push edi
cmp dword [esi + 0xc], 0
je 0x424b99
or dword [ebp - 0x10], 0xffffffff
and dword [ebp - 4], 0
lea eax, [ebp - 0x150]
push eax
call fcn.0040bc78
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x424b99
push ebx
mov ecx, esi
mov dword [ebp - 0x10], edi
call fcn.0040bc78
mov ecx, esi
mov ebx, eax
call fcn.0040bc78
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
and al, 0xfe
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ecx, esi
call fcn.0040bc78
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [sym.imp.KERNEL32.dll_FindClose]
pop ebx
test eax, eax
je 0x424b99
push edi
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret