joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407c51
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
and byte [ebp - 0x210], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20f]
and byte [ebp - 0x10c], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 8]
push eax
call fcn.0040cc1b
push dword [ebp - 8]
call fcn.0040ccf7
mov esi, 0x104
lea eax, [ebp - 0x210]
push esi
push 0
push eax
call fcn.0040c0f0
add esp, 0x14
lea edi, [ebp - 0x210]
mov dword [ebp - 4], 0x10
call fcn.0040cd04
cdq
mov ecx, 0x100
idiv ecx
movzx eax, dl
push eax
push str._02X
push edi
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
inc edi
inc edi
dec dword [ebp - 4]
jne 0x407cbf
push esi
lea eax, [ebp - 0x10c]
push 0
push eax
call fcn.0040c0f0
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 0x210]
push eax
call fcn.00407a0e
add esp, 0x14
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push str.KwUnSelf
push str.Console
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
pop edi
pop esi
leave
ret
Function at 0x408f1d
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
cmp dword [edi + 0x1c], 1
jne 0x408f5f
call fcn.004090ad
push esi
mov dword [edi + 0x20], eax
call fcn.0040cc1b
imul eax, eax, 0x64
push eax
call fcn.0040ccf7
pop ecx
pop ecx
call fcn.0040cd04
cmp eax, 0x3e9
mov dword [edi + 0x1c], eax
jne 0x408f5f
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
push 0x3ed
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov ebx, eax
lea eax, [ebp - 0x1c]
push eax
push ebx
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x4090a8
lea eax, [ebp - 0x1c]
push 1
push eax
push ebx
call dword [sym.imp.USER32.dll_InvalidateRect]
lea eax, [ebp - 0x5c]
push eax
push ebx
call dword [sym.imp.USER32.dll_BeginPaint]
push esi
mov ebx, eax
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
push 7
push ebx
mov dword [0x41e7d0], eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov eax, dword [ebp - 0x10]
push esi
sub eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
push esi
push 0x1e
push 0x1e
push ebx
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
push esi
push esi
push esi
push ebx
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
push esi
push esi
push esi
push ebx
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
push 8
call dword [sym.imp.GDI32.dll_GetStockObject]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [0x41e7d0]
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
cmp dword [edi + 0x20], esi
je 0x409058
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.00408848
mov edi, dword [edi + 0x24]
lea eax, [ebp - 0xc]
push dword [edi + 8]
push dword [edi + 4]
push dword [edi + 0xc]
push esi
push esi
push eax
call fcn.00408848
add esp, 0x30
lea ecx, [ebp - 0xc]
jmp 0x409096
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], esi
push eax
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_GetDC]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
sub eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x1c]
push eax
push esi
push esi
lea eax, [ebp - 0xc]
push esi
push eax
call fcn.00408848
add esp, 0x18
mov ecx, edi
push dword [edi + 0x1c]
push ebx
call fcn.00408eb9
lea ecx, [ebp - 0xc]
call fcn.00403d82
lea eax, [ebp - 0x5c]
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_EndPaint]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40982a
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x416030]
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x9c]
push eax
mov dword [ebp - 0x9c], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [ebp - 0x8c]
xor edx, edx
sub eax, edx
je 0x4099df
dec eax
je 0x409980
dec eax
jne 0x409a02
mov eax, dword [ebp - 0x98]
push 2
pop esi
push 5
mov dword [0x416ea0], esi
pop ecx
cmp eax, ecx
jne 0x4098d0
cmp dword [ebp - 0x94], edx
jne 0x4098af
lea eax, [ebp - 0x88]
mov dword [0x41e7d8], ecx
push eax
push str.Windows_2000_With__s
lea eax, [ebp - 4]
push eax
call fcn.00409ba7
add esp, 0xc
jmp 0x40991e
cmp dword [ebp - 0x94], 1
jne 0x409900
lea eax, [ebp - 0x88]
mov dword [0x41e7d8], 6
push eax
push str.Windows_XP__s
jmp 0x4098a1
cmp eax, 4
ja 0x409900
lea ecx, [ebp - 0x88]
mov dword [0x41e7d8], 7
push ecx
push dword [ebp - 0x94]
push eax
lea eax, [ebp - 4]
push str.Windows_NT__d._d_with__s
push eax
call fcn.00409ba7
add esp, 0x14
jmp 0x40991e
push dword [ebp - 0x94]
mov dword [0x41e7d8], edx
push eax
lea eax, [ebp - 4]
push str.Windows__d._d
push eax
call fcn.00409ba7
add esp, 0x10
lea eax, [ebp - 0x88]
test eax, eax
je 0x409a02
lea eax, [ebp - 0x88]
lea ecx, [ebp - 8]
push eax
call fcn.00401de9
push str.Service_Pack_2
push dword [ebp - 8]
call fcn.0040cfdd
pop ecx
test eax, eax
pop ecx
jne 0x409956
mov dword [0x41e7dc], esi
jmp 0x409973
push str.Service_Pack_4
push dword [ebp - 8]
call fcn.0040cfdd
pop ecx
test eax, eax
pop ecx
jne 0x409973
mov dword [0x41e7dc], 4
lea ecx, [ebp - 8]
call fcn.00401dbd
jmp 0x409a02
cmp dword [ebp - 0x94], edx
mov dword [0x416ea0], 1
jne 0x4099a3
mov dword [0x41e7d8], 2
push str.Windows_t95
jmp 0x4099bb
cmp dword [ebp - 0x94], 0xa
jne 0x4099c5
mov dword [0x41e7d8], 3
push str.Windows_t98
lea ecx, [ebp - 4]
call fcn.00401f49
jmp 0x409a02
cmp dword [ebp - 0x94], 0x5a
jne 0x409a02
mov dword [0x41e7d8], 4
push str.Windows_tMe
jmp 0x4099bb
push dword [ebp - 0x94]
lea eax, [ebp - 4]
mov dword [0x416ea0], edx
push dword [ebp - 0x98]
push 0x416eb0
push eax
call fcn.00409ba7
add esp, 0x10
mov esi, dword [0x416ea0]
lea ecx, [ebp - 4]
call fcn.00401dbd
mov eax, esi
pop esi
leave
ret

Function at 0x409a15
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
push esi
mov esi, 0x104
push edi
push esi
mov edi, 0x41e7e0
push 0
push edi
call fcn.0040c0f0
add esp, 0xc
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov byte [eax + 0x41e7e0], 0x5c
inc eax
cmp eax, esi
mov dword [0x416ea4], eax
push esi
jb 0x409a5f
push 0
push edi
call fcn.0040c0f0
add esp, 0xc
xor eax, eax
jmp 0x409a94
lea eax, [ebp - 0x104]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
push esi
push 0
push edi
mov dword [0x416ea4], eax
call fcn.0040c0f0
push dword [0x416ea4]
lea eax, [ebp - 0x104]
push eax
push edi
call fcn.0040c2d0
add esp, 0x18
push 1
pop eax
pop edi
pop esi
leave
ret
Function at 0x409a98
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push 0xf003f
xor edi, edi
push str.SOFTWARECNNICCdnClientInstallInfo
push 0x80000002
lea ecx, [ebp - 4]
mov dword [ebp - 4], edi
call fcn.00401c2d
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, 0x41e8e4
test eax, eax
jne 0x409b17
push 0x416ea8
lea eax, [ebp - 8]
push esi
push eax
push edi
push str.InstallPath
push dword [ebp - 4]
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409b0a
push 0x416058
push esi
call fcn.0040c780
inc dword [0x416ea8]
cmp dword [ebp - 4], edi
pop ecx
pop ecx
je 0x409b56
push dword [ebp - 4]
call ebx
jmp 0x409b56
cmp dword [ebp - 4], edi
je 0x409b17
push dword [ebp - 4]
call ebx
mov dword [ebp - 4], edi
mov edi, 0x41e7e0
push edi
call fcn.0040c620
test eax, eax
pop ecx
je 0x409b5b
push 0x104
push 0
push esi
call fcn.0040c0f0
push 2
push edi
push esi
call fcn.0040c2d0
push str.Progra1CNNICCdn_
push esi
call fcn.0040c780
add esp, 0x20
cmp dword [ebp - 4], 0
je 0x409b56
push dword [ebp - 4]
call ebx
push 1
pop eax
jmp 0x409b68
cmp dword [ebp - 4], 0
je 0x409b66
push dword [ebp - 4]
call ebx
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40a25f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push edi
push 0xb
mov esi, str.SOFTWAREMicrosoftInternet_ExplorerMenuExt
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
and byte [ebp - 0x134], 0
push 0x40
movsb byte es:[edi], byte [esi]
pop ecx
xor eax, eax
lea edi, [ebp - 0x133]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov ax, word [0x41e7d4]
pop edi
test ax, ax
pop esi
jne 0x40a2a7
lea eax, [ebp - 0x30]
push eax
push 0x41d12c
jmp 0x40a2bd
cmp ax, 1
lea eax, [ebp - 0x30]
push eax
jne 0x40a2b8
push 0x41d11c
jmp 0x40a2bd
push str._s_access_Internet_Keyword
lea eax, [ebp - 0x134]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
lea eax, [ebp - 0x134]
push eax
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
neg eax
sbb eax, eax
inc eax
leave
ret
Function at 0x40b02c
Capabilities:
Get common file path
Persist via run registry key
Set registry value
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
push ebx
push esi
push edi
push 0x40
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x20f]
mov byte [ebp - 0x210], bl
push 0x40
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x313]
mov byte [ebp - 0x314], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x10b]
mov byte [ebp - 0x10c], bl
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40b195
lea eax, [ebp - 0x314]
push esi
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40b195
lea eax, [ebp - 0x314]
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0040c770
lea eax, [ebp - 0x10c]
push str.uninrest.exe
push eax
call fcn.0040c780
add esp, 0x10
lea eax, [ebp - 0x10c]
push ebx
push 0x80
push 2
push ebx
push 1
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x40b195
lea eax, [ebp - 8]
push ebx
push eax
push 0x6000
push 0x416ff8
push esi
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
push esi
jne 0x40b129
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x40b195
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xf003f
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push 0x80000002
lea ecx, [ebp - 4]
mov dword [ebp - 4], ebx
call fcn.00401c2d
test eax, eax
jne 0x40b187
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
lea eax, [ebp - 0x10c]
push eax
push 1
push ebx
push str.uninsrest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 4], ebx
je 0x40b182
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x40b197
cmp dword [ebp - 4], ebx
je 0x40b195
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b19c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push ebx
push ebx
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40b296
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x416030]
push 0xeff0
lea ecx, [ebp - 8]
mov dword [ebp - 8], eax
call fcn.00401f8e
push dword [ebp + 8]
mov eax, dword [0x416030]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push dword [ebp - 8]
push str._s_s
push eax
call fcn.00409ba7
mov eax, dword [0x41e9e8]
add esp, 0x10
cmp eax, ebx
je 0x40b235
mov ecx, dword [0x41cff8]
inc dword [0x41cff8]
push esi
mov esi, dword [sym.imp.USER32.dll_PostMessageA]
push edi
push ecx
mov edi, 0x52c
push 3
push edi
push eax
call esi
push dword [ebp - 4]
push 2
push edi
push dword [0x41e9e8]
call esi
pop edi
pop esi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40b286
push dword [ebp + 8]
call fcn.0040b99b
pop ecx
lea eax, [ebp + 8]
push ebx
push ebx
push eax
push 0x400
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LocalFree]
lea ecx, [ebp - 4]
call fcn.00401dbd
lea ecx, [ebp - 8]
call fcn.00401dbd
xor eax, eax
jmp 0x40b299
lea ecx, [ebp - 4]
call fcn.00401dbd
lea ecx, [ebp - 8]
call fcn.00401dbd
push 1
pop eax
pop ebx
leave
ret

Function at 0x40b378
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
push ebx
push edi
push 0x7f
xor ebx, ebx
pop ecx
xor eax, eax
lea edi, [ebp - 0x20b]
mov byte [ebp - 0x20c], bl
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push 0xf003f
push str.SOFTWARECNNICCdnClientInstallInfo
push 0x80000002
lea ecx, [ebp - 4]
stosb byte es:[edi], al
mov dword [ebp - 8], 0x200
mov dword [ebp - 4], ebx
call fcn.00401c2d
test eax, eax
jne 0x40b43b
lea eax, [ebp - 8]
mov dword [ebp - 0xc], ebx
push eax
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0xc]
push eax
push ebx
push str.KeywordBak
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40b43b
lea eax, [ebp - 0x20c]
push eax
call fcn.0040c620
test eax, eax
pop ecx
je 0x40b43b
cmp dword [ebp + 8], ebx
push esi
je 0x40b427
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
cmp dword [ebp - 8], eax
jae 0x40b427
push eax
push ebx
push dword [ebp + 8]
call fcn.0040c0f0
lea eax, [ebp - 0x20c]
push eax
push dword [ebp + 8]
call fcn.0040c780
mov eax, dword [ebp - 8]
add esp, 0x14
mov dword [esi], eax
cmp dword [ebp - 4], ebx
pop esi
je 0x40b436
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x40b44b
cmp dword [ebp - 4], ebx
je 0x40b449
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop ebx
leave
ret
Function at 0x40b58e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
xor edi, edi
cmp dword [ebp + 8], edi
jne 0x40b63c
push 0xf003f
mov esi, 0x80000001
push str.SOFTWAREMicrosoftInternet_Explorer
push esi
lea ecx, [ebp + 8]
mov dword [ebp + 8], edi
call fcn.00401c2d
test eax, eax
jne 0x40b652
push str.URLSearchHooks
lea ecx, [ebp + 8]
call fcn.00401c6b
cmp dword [ebp + 8], edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
je 0x40b5e4
push dword [ebp + 8]
call ebx
mov dword [ebp + 8], edi
lea eax, [ebp - 8]
mov dword [ebp - 4], edi
push eax
lea eax, [ebp - 4]
push eax
push edi
push 0xf003f
push edi
push edi
push edi
push str.SoftwareMicrosoftInternet_ExplorerURLSearchHooks
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
cmp eax, edi
jne 0x40b644
mov esi, 0x41d5e4
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push esi
push 1
push edi
push str.CFBFAE00_17A6_11D0_99CB_00C04FD64497
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp dword [ebp - 4], edi
je 0x40b632
push dword [ebp - 4]
call ebx
cmp dword [ebp + 8], edi
je 0x40b63c
push dword [ebp + 8]
call ebx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret
cmp dword [ebp + 8], edi
je 0x40b64e
push dword [ebp + 8]
call ebx
xor eax, eax
jmp 0x40b63f
cmp dword [ebp + 8], edi
je 0x40b64e
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40b64e

Function at 0x40b831
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push edi
push eax
push 0xf003f
mov edi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallCdnClient
push 0
mov esi, 0x80000002
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b86e
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 1
pop eax
jmp 0x40b870
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40b874
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
and byte [ebp - 0x210], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20f]
and byte [ebp - 0x314], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
and byte [ebp - 0x10c], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40b995
lea eax, [ebp - 0x314]
push esi
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40b995
lea eax, [ebp - 0x314]
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0040c770
lea eax, [ebp - 0x10c]
push str.uninrest.ini
push eax
call fcn.0040c780
add esp, 0x10
lea eax, [ebp - 0x10c]
mov ebx, 0x41d6dc
mov esi, str.RmDir
push eax
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
and byte [ebp - 8], 0
mov ecx, eax
xor eax, eax
lea edi, [ebp - 7]
inc ecx
stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 8]
push 0x41d6d0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
call edi
mov ebx, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push dword [ebp + 8]
push eax
push esi
call edi
test ebx, ebx
pop ebx
je 0x40b995
test eax, eax
je 0x40b995
push 1
pop eax
jmp 0x40b997
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40b99b
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
and byte [ebp - 0x210], 0
push esi
push edi
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x20f]
and byte [ebp - 0x314], 0
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 0x40
xor eax, eax
pop ecx
lea edi, [ebp - 0x313]
rep stosd dword es:[edi], eax
and byte [ebp - 0x10c], 0
push 0x40
stosw word es:[edi], ax
stosb byte es:[edi], al
pop ecx
xor eax, eax
lea edi, [ebp - 0x10b]
mov esi, 0x104
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x210]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x40babc
lea eax, [ebp - 0x314]
push esi
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x40babc
lea eax, [ebp - 0x314]
push ebx
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.0040c770
lea eax, [ebp - 0x10c]
push str.uninrest.ini
push eax
call fcn.0040c780
add esp, 0x10
lea eax, [ebp - 0x10c]
mov ebx, 0x41d6dc
mov esi, str.RmFile
push eax
push 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntA]
and byte [ebp - 8], 0
mov ecx, eax
xor eax, eax
lea edi, [ebp - 7]
inc ecx
stosd dword es:[edi], eax
push ecx
lea eax, [ebp - 8]
push 0x41d6d0
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
mov edi, dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push eax
push ebx
push esi
call edi
mov ebx, eax
lea eax, [ebp - 0x10c]
push eax
lea eax, [ebp - 8]
push dword [ebp + 8]
push eax
push esi
call edi
test ebx, ebx
pop ebx
je 0x40babc
test eax, eax
je 0x40babc
push 1
pop eax
jmp 0x40babe
xor eax, eax
pop edi
pop esi
leave
ret
Function at 0x40bac2
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
push ebx
push esi
mov esi, 0x104
lea eax, [ebp - 0x44c]
push esi
push 0
push eax
call fcn.0040c0f0
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x44c]
push ebx
push eax
call fcn.0040c770
lea eax, [ebp - 0x44c]
push str..
push eax
call fcn.0040c780
add esp, 0x1c
lea eax, [ebp - 0x140]
push eax
lea eax, [ebp - 0x44c]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
jne 0x40bb28
xor eax, eax
jmp 0x40bc48
lea ecx, [ebp - 0x140]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x40bc32
push edi
mov edi, 0x416058
lea eax, [ebp - 0x114]
push 0x41d6fc
push eax
call fcn.0040d140
pop ecx
test eax, eax
pop ecx
je 0x40bc19
lea eax, [ebp - 0x114]
push 0x41d6f8
push eax
call fcn.0040d140
pop ecx
test eax, eax
pop ecx
je 0x40bc19
cmp dword [ebp - 0x140], 0x10
push esi
push 0
jne 0x40bbd0
lea eax, [ebp - 0x348]
push eax
call fcn.0040c0f0
lea eax, [ebp - 0x348]
push ebx
push eax
call fcn.0040c770
lea eax, [ebp - 0x348]
push edi
push eax
call fcn.0040c780
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x348]
push eax
call fcn.0040c780
lea eax, [ebp - 0x348]
push eax
call fcn.0040bac2
add esp, 0x28
jmp 0x40bc19
lea eax, [ebp - 0x244]
push eax
call fcn.0040c0f0
lea eax, [ebp - 0x244]
push ebx
push eax
call fcn.0040c770
lea eax, [ebp - 0x244]
push edi
push eax
call fcn.0040c780
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x244]
push eax
call fcn.0040c780
add esp, 0x24
lea eax, [ebp - 0x244]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x140]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x40bb44
pop edi
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_FindClose]
push ebx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
neg eax
sbb eax, eax
neg eax
pop esi
pop ebx
leave
ret

Function at 0x40bc4c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
push 9
pop ecx
mov esi, str.SOFTWAREMicrosoftInternet_Explorer
lea edi, [ebp - 0x30]
lea eax, [ebp - 4]
rep movsd dword es:[edi], dword [esi]
push eax
xor ebx, ebx
push 1
lea eax, [ebp - 0x30]
push ebx
push eax
push 0x80000002
mov dword [ebp - 8], 0x1e
movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40bca6
mov esi, dword [ebp + 8]
lea eax, [ebp - 8]
push eax
push esi
push ebx
push ebx
push str.Version
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40bcab
mov byte [esi], bl
jmp 0x40bcab
mov eax, dword [ebp + 8]
mov byte [eax], bl
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebx
leave
ret