joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41b550
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x120], esi
call fcn.0042acc4
test al, al
je 0x41b5a3
xchg edx, eax
test edi, 0x841a7add
idiv byte [ecx - 0x21]
jecxz 0x41b5bb
call 0xaba5aca
mov ebx, 0x10373609
inc esp
call fcn.0042aa57
test al, al
je 0x41b5c4
jno 0x41b5e9
mov ecx, 0xd8e69886
adc bh, byte [esi + esi*4 + 0x5e]
pop es
push esi
xchg edi, eax
xor dword [edi], ecx
movsd dword es:[edi], dword [esi]
inc ebx
shl byte [eax], 0x9a
stosb byte es:[edi], al
into
mov eax, 0xf518e8
add byte [eax + eax*8 - 0x4deee78c], al
pushal
sbb byte [esi], cl
push esi
shld dword [ebx - 0x40], eax, cl
and byte [edx - 0x17473156], bl
sbb ch, dh
add byte [eax], al
call fcn.0042aae1
test al, al
je 0x41b5e5
adc dword [edx + 0x560e1860], esi
invalid
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jne 0x41b615
invalid
xor eax, eax
inc eax
cmp dword [ebp - 0x118], 0
je 0x41b60f
cmp dword [ebp - 0x118], eax
jne 0x41b615
cmp byte [ebp - 6], 1
je 0x41b674
call fcn.0042ad4e
test al, al
je 0x41b639
add byte [eax + eax*8 - 0x2848e48c], al
mov bh, 0xd7
pop esp
mov byte [0x46d915f8], al
cmc
jle 0x41b62d
out 0x3b, al
jle 0x41b62a
cmp edi, dword [esi - 3]
div byte [eax + 0x54]
or eax, dword ss:[eax + 0x1a]
jae 0x41b6b4
push ds
js 0x41b619
call fcn.0042abb0
test al, al
je 0x41b657
mov esp, esp
dec edi
lahf
loope 0x41b64d
insd dword es:[edi], dx
jnp 0x41b649
cld
mov dh, 0x26
mov ebp, 0x81ce10e4
insb byte es:[edi], dx
ret
call fcn.0042ad09
test al, al
je 0x41b672
aaa
mov ah, 0x42
invalid
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
loopne 0x41b6b4
invalid

Function at 0x41b7a3
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x144
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
lea eax, [ebp - 0x144]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, 0x11c
lea eax, [ebp - 0x120]
push esi
push 0
push eax
call fcn.0056f390
add esp, 0xc
mov dword [ebp - 0x120], esi
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
call fcn.0042ad4e
test al, al
je 0x41b816
outsd dx, dword [esi]
pop ss
daa
add al, 0x43
jl 0x41b87c
cmp dh, byte [edx]
fadd dword [ecx]
nop
sti
dec ebx
pop ebp
dec ecx
leave
ljmp 0x95d5
call fcn.0042ae62
test al, al
je 0x41b83d
mov eax, dword [0x2c85f494]
mov ch, 0xa9
ficom dword [si - 0x80]
hlt
mov edi, dword [ebp - 0x11c]
mov esi, dword [ebp - 0x118]
call fcn.0042aa12
test al, al
je 0x41b871
xlatb
jmp fcn.0041b8aa
cmp edi, 5
jg 0x41b880
cmp esi, 2
jg 0x41b880
xor eax, eax
inc eax
jmp 0x41b882
rol byte [eax - 0x15], 2
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x422eae
Capabilities:
Get common file path

Disassembly:
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov ebx, ecx
push 0
push eax
mov dword [ebp - 0x210], ebx
call fcn.0056f390
add esp, 0xc
call fcn.0042aea7
test al, al
je 0x422f0d
salc
add bl, dh
in eax, 0xec
mov ebx, dword [esi]
jno 0x422ea6
invalid
push 0
push 0x10
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x422f32
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00423126
call fcn.0042af76
test al, al
je 0x422f56
mov edx, 0xd22962dd
mov esi, 0xf6f71da7
push ebp
sbb dl, byte [eax]
cmpsb byte [esi], byte es:[edi]
popfd
mov ebx, 0xe084fd34
jbe 0x422fb4
and ebx, ebp
pushal
test eax, 0x6a006ac2
sbb dword [ebp - 0x20b7b], ecx
call dword [eax + 0x6a]
add bh, bh
adc eax, sym.imp.SHELL32.dll_SHGetSpecialFolderPathW
push 0
push 0x19
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x422f7f
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00423126
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
add byte [eax - 0x77], dl
popfd
invalid

Function at 0x42305d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
push 0
push eax
call fcn.0056f390
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0
push 0x17
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
call fcn.0042ae1d
test al, al
je 0x4230bb
mov ch, 0x6c
push esp
mov ecx, 0x18275e2e
sub ebp, dword [ebx]
jo 0x4230cf
push edx
das
invalid
call fcn.0042ab6b
test al, al
je 0x4230db
popfd
aas
add ah, byte [eax - 0x79124318]
int3
invalid
call fcn.0042aa57
test al, al
je 0x423103
pop ebx
cmp byte [edx - 0x5940cce7], cl
cmpsd dword [esi], dword es:[edi]
and esp, dword [edi - 0xd]
or byte [eax + 0x51985c90], bl
das
sbb al, ch
lcall 0x8044, 0x81887334
mov dh, 0xda
hlt
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00423126
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
Function at 0x423240
Capabilities:
Delete directory
Get common file path

Disassembly:
push 0x430
mov eax, 0x59dc6f
call fcn.005693c7
mov ebx, ecx
mov dword [ebp - 0x43c], ebx
mov esi, 0x208
lea eax, [ebp - 0x218]
push esi
xor edi, edi
push edi
push eax
call fcn.0056f390
push esi
lea eax, [ebp - 0x420]
push edi
push eax
call fcn.0056f390
add esp, 0x18
call fcn.0042aea7
test al, al
je 0x4232aa
pop esp
cld
mov ecx, 0x6fb62d66
jne 0x4232ad
insd dword es:[edi], dx
mov ch, 0x22
arpl sp, ax
add esp, ebp
sbb byte [ecx - 0xec2f239], bh
rcl dword [ebx + 0x1d8172a8]
mov ebx, dword [ebp - 0x43c]
xor edi, edi
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x218]
push edi
je 0x4232bb
add byte [ebp - 0x2177b], cl
call dword [edi + 0x74]
add al, 0x6a
pop ss
push 0x17
jmp 0x4232bd
push 2
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x423361
xor eax, eax
mov dword [ebp - 0x424], 7
mov esi, 0x5a49e8
mov dword [ebp - 0x428], edi
push esi
mov word [ebp - 0x438], ax
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x438]
call fcn.00403772
cmp dword [ebp - 0x424], 8
lea eax, [ebp - 0x438]
mov dword [ebp - 4], edi
cmovae eax, dword [ebp - 0x438]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x420]
push 0x5a373c
push eax
call fcn.00408d5e
push ecx
push ecx
lea eax, [ebp - 0x420]
mov ecx, esp
push eax
call fcn.00402ac4
mov ecx, ebx
call fcn.00423777
lea eax, [ebp - 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edi
push 1
lea ecx, [ebp - 0x438]
call fcn.00403628
call fcn.00569382
ret 4
Function at 0x423369
Capabilities:
Get common file path

Disassembly:
das
pop edx
invalid
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x62aa54]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x210], ecx
push 0
push eax
call fcn.0056f390
add esp, 0xc
call fcn.0042aae1
test al, al
je 0x4233b5
jns 0x42332b
mov cl, 0x5a
push es
rcl dword [eax + 0x46], cl
push eax
mov byte [ecx + 0x58], bh
mov ch, 0x8c
insd dword es:[edi], dx
xor al, 0x38
mov word [ebp + 0x34], gs
cmp al, ch
popfd
jbe 0x4233b9
call fcn.0042aa57
test al, al
je 0x4233d4
add byte [eax + eax*8 - 0x6c7ee98c], al
aaa
xor ch, byte [edi + 0x62]
push 0x49
mov bl, 0xa2
adc dword [ebx + 0x626f3237], 0xa2b3496a
sbb al, 0xf6
pop ebx
sbb dword [eax + 0x1d], edx
inc edi
jno 0x42344a
jno 0x4233cf
xchg ebx, eax
push 0
push 0xb
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x423422
aaa
call fcn.0042aea7
test al, al
je 0x423410
mov dword [0xf4e849f9], eax
daa
pop eax
jb 0x4233b1
mov al, 0xe2
std
ret
mov ecx, dword [ebp - 0x210]
lea eax, [ebp - 0x20c]
push eax
call fcn.00423126
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0056935c
mov esp, ebp
pop ebp
ret
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
call fcn.0042af76
test al, al
je 0x423459
retf
xor dword [ebx + 0x32], ebx
lcall 0x243f, 0x6348f8cb
aas
das
jae 0x4233ea
in eax, dx
call fcn.0042aeec
test al, al
je 0x42347d
jnp 0x423437
xor ecx, edi
retf 0x5fc0
call fcn.0042aea7
test al, al
je 0x42349f
stosd dword es:[edi], eax
ror byte [edx], cl
xchg esi, eax
xor byte [ecx], al
sbb al, byte [ebx + ebp*8 + 0x5b]
adc byte [edi - 0x34], dh
sar dword [edx + edi*8 - 0x18], 1
mov ebp, 0xbb2e3844
in al, 0xa4
lodsd eax, dword [esi]
mov ebx, dword [ebp - 4]
mov ecx, ebx
push 0
call fcn.00423240
push 1
mov ecx, ebx
call fcn.00423240
call fcn.0042aea7
test al, al
je 0x4234dc
iretd
mov ecx, ebx
call fcn.00422eae
mov ecx, ebx
call fcn.00423369
mov ecx, ebx
call fcn.0042305d
call fcn.0042af76
test al, al
je 0x423518
mov bh, 0x32
out 0xb9, al
push cs
xor ebx, dword [edx]
or byte [ebx], 0x86
pop ss
pop edx
lahf
scasd eax, dword es:[edi]
cmc
mov cl, 0xbd
add ah, bl
pop esi
call 0xe0086267
add eax, dword [ecx - 0x7403a275]
retf
mov ecx, ebx
call fcn.00422f90
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x424a84
Capabilities:
Check if file exists

Disassembly:
push 0xb8
mov eax, 0x59de41
call fcn.005693c7
mov ebx, ecx
mov dword [ebp - 0xc4], ebx
lea eax, [ebp - 0x40]
push eax
call fcn.00421ecd
mov ecx, eax
call fcn.00406f6b
lea esi, [ebx + 0x7c]
push eax
mov ecx, esi
call fcn.00402b42
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00403628
call fcn.00421ecd
mov ecx, eax
call fcn.0040804f
mov byte [ebp - 0xbd], al
call fcn.0042a943
test al, al
je 0x424af7
jmp [edx]
jl 0x424ab5
jbe 0x424b4c
add al, 0x86
jns 0x424b3e
mov bl, 0x5a
invalid
cmp dword [esi + 0x14], 8
jb 0x424aff
mov esi, dword [esi]
push esi
lea ecx, [ebx + 0xac]
call fcn.0040beb5
cmp byte [ebp - 0xbd], 0
add byte [eax], al
add al, ch
stosb byte es:[edi], al
jae 0x424b08
inc dword [eax - 0xbc43]
inc dword [eax]
jne 0x424b25
cmp dword [ebp + 8], 0
jne 0x424b25
mov ecx, ebx
call fcn.004243fb
test eax, eax
je 0x424b2c
mov ecx, ebx
call fcn.00423ff5
call fcn.0042abb0
pushal
add byte [eax], al
test al, al
je 0x424b45
dec edx
ret 0xb2f7
invalid
jb 0x424b2e
call fcn.0042af31
out 0x63, eax
add byte [eax], al
test al, al
je 0x424b74
in eax, dx
pop ebp
or ebp, esp
inc eax
mov dword [ecx + 0x35], ecx
fidiv dword [edx - 0x1f]
cmp al, 0x86
int1
cmp dword [ecx - 0xc4bd1f7], ecx
or edi, ecx
cmp al, 0xe7
pushfd
adc byte [edi], dh
inc ebx
nop
cmpsd dword [esi], dword es:[edi]
cmpsb byte [esi], byte es:[edi]
or ecx, dword [ebx - 0xc363]
invalid
call fcn.0042a943
test al, al
je 0x424b9b
jp 0x424b03
and byte [edx + ecx*8 - 0xfbe9e7d], bl
test dword [eax], ecx
mov edx, 0xf0f0a0c3
fild word [ebx - 0x30a7090b]
shr byte [ecx], 0x9b
js 0x424b44
jecxz 0x424b27
invalid
xor esi, esi
cmp dword [ebx + 0x144], esi
jne 0x424bb7
cmp byte [ebp - 0xbd], 0
jne 0x424bb7
cmp dword [ebp + 8], esi
je 0x424c7a
lea ecx, [ebp - 0xbc]
call fcn.0042688a
lea ecx, [ebp - 0xbc]
mov dword [ebp - 4], esi
call fcn.00427dba
push 0x5a06d8
push str.7681e
lea eax, [ebp - 0x28]
push str.OISet
push eax
call fcn.00421ecd
mov ecx, eax
call fcn.00406faa
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
je 0x424c64
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x424c64
push 1
push 0xffffffffffffffff
lea eax, [ebp - 0xc4]
mov dword [ebp - 0xc4], 0x5c
push eax
lea ecx, [ebp - 0x28]
call fcn.004127e0
test eax, eax
jle 0x424c64
push eax
push esi
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x28]
call fcn.00403a48
push eax
lea ecx, [ebp - 0x28]
call fcn.00402b42
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.00403628
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call fcn.00413e91
pop ecx
push esi
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
lea ecx, [ebp - 0xbc]
call fcn.0042696b
call fcn.00569382
ret 4
Function at 0x424d0f
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424d4b
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
push str.SoftWareMicrosoftWindowsCurrentVersionUninstall
push reloc.WS2_32.dll_accept
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x424d83
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esp, ebp
pop ebp
ret 4

Function at 0x425149
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
push edi
lea eax, [ebp - 4]
xor esi, esi
push eax
mov edi, 0xf013f
mov dword [ebp - 4], esi
push edi
push esi
push 0x5a3ce0
push reloc.WS2_32.dll_bind
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4251bc
push esi
lea eax, [ebp - 8]
push eax
push esi
push edi
push esi
push esi
push esi
push 0x5a0a54
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x42519e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x4251bc
push str.AppInfo
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
push dword [ebp - 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 4]
call esi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4251c2
Capabilities:
Delete registry value

Disassembly:
push 0x24
mov eax, 0x59e1c8
call fcn.005693c7
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x30]
push eax
mov edi, 0xf003f
xor ebx, ebx
push edi
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
call esi
test eax, eax
jne 0x425278
lea eax, [ebp - 0x2c]
push eax
push edi
push ebx
push 0x5a3cd4
push dword [ebp - 0x30]
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x425273
xor eax, eax
mov dword [ebp - 0x14], 7
mov edi, 0x5a4cc8
mov dword [ebp - 0x18], ebx
push edi
mov word [ebp - 0x28], ax
call fcn.00578706
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00403772
mov edi, 0x5a4cd0
mov dword [ebp - 4], ebx
push edi
call fcn.00578706
pop ecx
push eax
push edi
lea ecx, [ebp - 0x28]
call fcn.00408c34
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x2c]
call esi
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
push dword [ebp - 0x30]
call esi
call fcn.00569382
ret
Function at 0x425671
Capabilities:
Check if file exists

Disassembly:
push 0x3c
mov eax, 0x59df49
call fcn.005693c7
mov ebx, ecx
mov dword [ebp - 0x44], ebx
call fcn.00421ecd
mov ecx, eax
call fcn.00406e69
push eax
lea ecx, [ebp - 0x40]
call fcn.00402ac4
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0
je 0x4256d4
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4256d4
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
cmovae eax, dword [ebp - 0x40]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402ac4
mov ecx, ebx
call fcn.00425e82
call fcn.0042aea7
test al, al
je 0x4256fc
fcom st(0)
sbb byte [eax + 0x77], dl
mov ecx, 0xea965da6
dec eax
pop es
nop
or dword [ebp - 0xd], 0x142ee95d
wait
lahf
pop es
invalid
call fcn.00421ecd
mov ecx, eax
call fcn.00406e75
push eax
lea ecx, [ebp - 0x28]
call fcn.00402ac4
cmp dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
je 0x42574e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x42574e
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x18
mov ecx, esp
push eax
call fcn.00402ac4
mov ecx, ebx
call fcn.00425e82
call fcn.00425cc8
test eax, eax
je 0x425761
mov edx, dword [eax]
mov ecx, eax
call dword [edx + 0x134]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.00403628
call fcn.00569382
ret

Function at 0x42580a
Capabilities:
Delete registry key

Disassembly:
push 0x24
mov eax, 0x59e1c8
call fcn.005693c7
xor eax, eax
mov dword [ebp - 0x14], 7
mov esi, 0x5a0a54
mov word [ebp - 0x28], ax
xor edi, edi
push esi
mov dword [ebp - 0x18], edi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
mov esi, str.RunOne
mov dword [ebp - 4], edi
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00408c34
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea eax, [ebp - 0x2c]
push eax
mov ebx, 0xf003f
mov dword [ebp - 0x2c], edi
push ebx
push edi
push str.SOFTWAREMicrosoftWindowsCurrentVersion
push reloc.WS2_32.dll_bind
mov dword [ebp - 0x30], edi
call esi
test eax, eax
jne 0x4258d3
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
push 0x5a3cd4
push dword [ebp - 0x2c]
call esi
test eax, eax
je 0x4258ae
push edi
lea eax, [ebp - 0x30]
push eax
push edi
push ebx
push edi
push edi
push edi
push 0x5a3cdc
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4258d3
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
push dword [ebp - 0x2c]
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
push dword [ebp - 0x30]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call esi
push dword [ebp - 0x2c]
call esi
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret
Function at 0x425c72
Capabilities:
Terminate process

Disassembly:
push 0x1c
mov eax, 0x59b93e
call fcn.005693c7
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x28]
push esi
call fcn.00402ac4
xor edi, edi
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], edi
je 0x425cb5
push esi
call fcn.00415ade
pop ecx
test eax, eax
jle 0x425cb5
push eax
push edi
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x425cb5
push edi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret 4

Function at 0x425e82
Capabilities:
Delete directory
Enumerate files on windows
Enumerate files recursively
Move file

Disassembly:
push 0x2a0
mov eax, 0x59e03b
call fcn.005693c7
mov edi, ecx
lea eax, [ebp + 8]
xor ebx, ebx
push eax
lea ecx, [ebp - 0x58]
mov dword [ebp - 4], ebx
call fcn.00402a71
mov esi, 0x5a3400
mov byte [ebp - 4], 1
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x58]
call fcn.00408c34
cmp dword [ebp - 0x44], 8
lea ecx, [ebp - 0x2a8]
lea eax, [ebp - 0x58]
cmovae eax, dword [ebp - 0x58]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x426003
lea eax, [ebp - 0x2a8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x426003
push 0x2e
pop eax
cmp word [ebp - 0x27c], ax
je 0x425ee2
cmp word [ebp - 0x27a], 0
je 0x425ee2
cmp word [ebp - 0x27a], ax
jne 0x425f21
cmp word [ebp - 0x278], 0
je 0x425ee2
xor eax, eax
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], ebx
mov word [ebp - 0x40], ax
cmp word [ebp - 0x27c], ax
jne 0x425f3e
mov eax, ebx
jmp 0x425f4b
lea eax, [ebp - 0x27c]
push eax
call fcn.00578706
pop ecx
push eax
lea eax, [ebp - 0x27c]
push eax
lea ecx, [ebp - 0x40]
call fcn.00403772
test byte [ebp - 0x2a8], 0x10
lea eax, [ebp + 8]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x28]
push eax
je 0x425fb7
call fcn.00402a71
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x28]
call fcn.00408b95
push 0x5a0a50
call fcn.00578706
pop ecx
push eax
push 0x5a0a50
lea ecx, [ebp - 0x28]
call fcn.00408c34
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00402a71
mov ecx, edi
call fcn.00425e82
jmp 0x425fe4
call fcn.00402a71
push 0xffffffffffffffff
push ebx
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 4
push eax
lea ecx, [ebp - 0x28]
call fcn.00408b95
sub esp, 0x18
lea eax, [ebp - 0x28]
mov ecx, esp
push eax
call fcn.00402a71
mov ecx, edi
call fcn.00426053
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
push ebx
push 1
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.00403628
jmp 0x425ee2
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
cmovae eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x426035
cmp dword [ebp + 0x1c], 8
lea eax, [ebp + 8]
push 4
cmovae eax, dword [ebp + 8]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
push ebx
push 1
lea ecx, [ebp - 0x58]
call fcn.00403628
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.00403628
call fcn.00569382
ret 0x18
Function at 0x4260a2
Capabilities:
Delete registry key

Disassembly:
push esi
mov esi, ecx
call fcn.0042580a
mov ecx, esi
call fcn.004260ce
mov ecx, esi
call fcn.004260e9
mov ecx, esi
call fcn.004251c2
mov ecx, esi
call fcn.00425149
mov ecx, esi
pop esi
jmp fcn.00424d89

Function at 0x42699f
Capabilities:
Delete registry value

Disassembly:
push 0x20
mov eax, 0x59f035
call fcn.005693c7
and dword [ebp - 0x2c], 0
xor eax, eax
and dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
and dword [ebp - 4], eax
call fcn.0042aeec
test al, al
je 0x4269e2
cwde
inc ebp
ret
fbld tbyte [ecx]
add al, 1
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionShell_ExtensionsApproved
push esi
call fcn.00578706
pop ecx
push eax
push esi
lea ecx, [ebp - 0x28]
call fcn.00403772
cmp dword [ebp - 0x14], 8
lea ecx, [ebp - 0x2c]
push ecx
push 0xf013f
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push 0
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
call fcn.0042ad4e
test al, al
je 0x426a35
pushfd
cmp eax, 0x7947d64f
sti
mov bh, al
mov dl, byte [ebp + 0x17]
inc ecx
push ds
jg 0x4269de
test esi, esi
jne 0x426a50
push str.B2A6906E_67AA_4613_B7ED_1CEB63834F37
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x2c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.00403628
call fcn.00569382
ret