joyce8/EMBER2024-capa huggingface dataset:
Function at 0x419230
Capabilities:
Create process on windows
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x268
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
mov dword [ebp - 0x268], ecx
push 0x42ec18
push 0x400
push 0
push 4
push 0
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x419272
xor eax, eax
jmp 0x41943b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x419290
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41943b
push 0
push 0
push 0
push 6
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4192bc
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x41943b
push 0x400
push 0
mov eax, dword [ebp - 0x10]
push eax
call fcn.0041c220
add esp, 0xc
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x268]
add edx, 0x58
mov dword [ebp - 0x260], edx
mov eax, dword [ebp - 0x268]
add eax, 0x88
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x264], 0
jmp 0x41930d
mov ecx, dword [ebp - 0x264]
add ecx, 1
mov dword [ebp - 0x264], ecx
cmp dword [ebp - 0x264], 0xc
jge 0x41936b
mov edx, dword [ebp - 0x264]
mov eax, dword [ebp - 0x260]
mov ecx, dword [ebp - 0x264]
mov esi, dword [ebp - 0xc]
mov edx, dword [eax + edx*4]
xor edx, dword [esi + ecx*4]
je 0x419369
mov eax, dword [ebp - 0x264]
mov ecx, dword [eax*4 + 0x436a24]
push ecx
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x264]
mov edx, dword [ebp - 0x260]
mov ecx, dword [edx + ecx*4]
mov dword [eax + 0x10], ecx
mov edx, dword [ebp - 4]
add edx, 0x14
mov dword [ebp - 4], edx
jmp 0x4192fe
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor ecx, ecx
mov word [ebp - 0x220], cx
push 0x206
push 0
lea edx, [ebp - 0x21e]
push edx
call fcn.0041c220
add esp, 0xc
push 0x104
lea eax, [ebp - 0x220]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push 0x3c
push 0
lea ecx, [ebp - 0x25c]
push ecx
call fcn.0041c220
add esp, 0xc
mov dword [ebp - 0x25c], 0x3c
mov dword [ebp - 0x258], 0x40
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x250], str.runas
lea edx, [ebp - 0x220]
mov dword [ebp - 0x24c], edx
mov dword [ebp - 0x248], str._SetFileAssoc
mov dword [ebp - 0x244], 0
mov dword [ebp - 0x240], 5
lea eax, [ebp - 0x25c]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
push 0x1388
mov ecx, dword [ebp - 0x224]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret
Function at 0x41a700
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1020
call fcn.0041d440
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x1020], ecx
mov eax, dword [ebp - 0x1020]
cmp dword [eax], 0
jne 0x41a72f
xor eax, eax
jmp 0x41a88f
mov dword [ebp - 0x101c], 0x800
lea ecx, [ebp - 0x101c]
push ecx
lea edx, [ebp - 0x1018]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x1020]
mov edx, dword [ecx]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
jne 0x41a789
push 0x42ed90
lea eax, [ebp - 0x1018]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x41a789
mov eax, 1
jmp 0x41a88f
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp + 8]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x41a7ef
push 0x42edc4
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
push 0x42edf8
push 1
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x1020]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x814], eax
xor eax, eax
cmp dword [ebp - 0x814], 0
sete al
jmp 0x41a88f
mov dword [ebp - 0x101c], 0x800
lea ecx, [ebp - 0x101c]
push ecx
lea edx, [ebp - 0x808]
push edx
push 0
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x42ee2c
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
mov dword [ebp - 0x80c], eax
mov eax, dword [ebp - 0x80c]
lea ecx, [ebp - 0x808]
cmp eax, ecx
jne 0x41a84f
xor eax, eax
jmp 0x41a88f
lea edx, [ebp - 0x808]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x808]
push ecx
push 1
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x1020]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 0x814], eax
xor eax, eax
cmp dword [ebp - 0x814], 0
sete al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 4
Function at 0x41a9f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x122c
call fcn.0041d440
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 8], eax
mov dword [ebp - 0x122c], ecx
mov eax, dword [ebp + 8]
push eax
push 0x42eee8
push 0x42ef04
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x810]
push edx
mov eax, dword [ebp + 8]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x41aa71
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp + 8]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x41aa71
xor eax, eax
jmp 0x41abf7
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x808]
push edx
push 1
push 0
mov eax, dword [ebp - 0x810]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp - 0x810]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x80c]
push edx
lea eax, [ebp - 0x808]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
je 0x41aad7
xor eax, eax
jmp 0x41abf7
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x80c]
push edx
call fcn.0041a8a0
add esp, 8
mov eax, dword [ebp - 0x80c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp + 8]
push ecx
call fcn.0041a690
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x41abe1
push str.DefaultIcon
lea edx, [ebp - 0x808]
push edx
push 0x42ef2c
lea eax, [ebp - 0x1018]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea ecx, [ebp - 0x101c]
push ecx
lea edx, [ebp - 0x1018]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 0x814], eax
cmp dword [ebp - 0x814], 0
jne 0x41abe1
cmp dword [ebp + 0xc], 0
je 0x41ab76
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1228]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41ab8a
push 0x104
lea edx, [ebp - 0x1228]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov eax, dword [ebp - 4]
push eax
lea ecx, [ebp - 0x1228]
push ecx
push str._s__d
lea edx, [ebp - 0x1228]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x1228]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x1228]
push edx
push 1
push 0
mov eax, dword [ebp - 0x101c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp - 0x101c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 0xc]
push edx
lea eax, [ebp - 0x808]
push eax
mov ecx, dword [ebp - 0x122c]
call fcn.0041ac50
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 8
Function at 0x41ac50
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0xa1c], ecx
push 0x42ef44
mov eax, dword [ebp + 8]
push eax
push 0x42ef6c
lea ecx, [ebp - 0x810]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 4]
push edx
lea eax, [ebp - 0x810]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41ad19
cmp dword [ebp + 0xc], 0
je 0x41acbf
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0xa18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x41acd3
push 0x104
lea eax, [ebp - 0xa18]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str.__NewDriver___1_
lea ecx, [ebp - 0xa18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea edx, [ebp - 0xa18]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0xa18]
push ecx
push 1
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 8], 0
sete al
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 8

Function at 0x41ad60
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cd88
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x436a98]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x14]
push ecx
push 0
push 0x20006
push 0
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x1c], 0
je 0x41ae3d
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x20]
call fcn.0040afd0
mov dword [ebp - 4], 0
push str.HKEY_CURRENT_USER_
push 0
lea ecx, [ebp - 0x20]
call fcn.0041b6a0
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x14]
push edx
push 0
push 0x20006
push 0
push 0
push 0
mov eax, dword [ebp + 8]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x41ae27
mov dword [ebp - 0x24], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00404a50
mov eax, dword [ebp - 0x24]
jmp 0x41ae62
mov dword [ebp - 0x10], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
call fcn.00404a50
push 0x42f044
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp dword [ebp - 0x1c], 0
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x41af30
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42cdd1
mov eax, dword fs:[0]
push eax
sub esp, 0x434
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x228]
call fcn.00403fe0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x228]
push ecx
call fcn.0041ad40
add esp, 8
lea edx, [ebp - 0x224]
push edx
push 0xf003f
push 0
lea ecx, [ebp - 0x228]
call fcn.00418500
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x22c], eax
cmp dword [ebp - 0x22c], 0
je 0x41afdb
mov dword [ebp - 0x43c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00404a50
mov eax, dword [ebp - 0x43c]
jmp 0x41b0bb
xor eax, eax
mov word [ebp - 0x21c], ax
push 0x206
push 0
lea ecx, [ebp - 0x21a]
push ecx
call fcn.0041c220
add esp, 0xc
mov dword [ebp - 0x438], 0x208
lea edx, [ebp - 0x438]
push edx
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
push ecx
push 0
push 0x42f06c
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x42f07c
lea eax, [ebp - 0x434]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x434]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
mov dword [ebp - 0x22c], 0
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x434]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41b084
push str.Progid
mov edx, dword [ebp - 0x224]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 0x224]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor ecx, ecx
cmp dword [ebp - 0x22c], 0
sete cl
mov dword [ebp - 0x440], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x228]
call fcn.00404a50
mov eax, dword [ebp - 0x440]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret
Function at 0x41b0e0
Capabilities:
Delete registry key
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x81c
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x81c], ecx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x81c]
call fcn.0041b400
test eax, eax
jne 0x41b116
mov eax, 1
jmp 0x41b208
mov dword [ebp - 0x814], 0x800
xor ecx, ecx
mov word [ebp - 0x810], cx
lea edx, [ebp - 0x814]
push edx
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x81c]
mov eax, dword [edx]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x41b16f
mov ecx, dword [ebp + 8]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov dword [ebp - 0x818], eax
xor eax, eax
jmp 0x41b208
push str.NoAssociate.KuaiZipMount
lea edx, [ebp - 0x810]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x41b198
mov eax, dword [ebp + 8]
push eax
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
xor eax, eax
jmp 0x41b208
mov dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x41b206
lea eax, [ebp - 0x810]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
lea ecx, [eax + eax + 2]
push ecx
lea edx, [ebp - 0x810]
push edx
push 1
push 0
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov edx, dword [ebp + 8]
push edx
call fcn.0041af30
add esp, 4
xor eax, eax
cmp dword [ebp - 8], 0
sete al
jmp 0x41b208
xor eax, eax
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 4

Function at 0x41b220
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x80c], ecx
mov eax, dword [ebp + 8]
push eax
push 0x42f0dc
push 0x42f0f8
lea ecx, [ebp - 0x808]
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea edx, [ebp - 0x808]
push edx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
neg eax
sbb eax, eax
add eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 4
Function at 0x41b400
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42ce04
mov eax, dword fs:[0]
push eax
mov eax, 0x1234
call fcn.0041d440
mov eax, dword [0x436a98]
xor eax, ebp
mov dword [ebp - 0x1c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x1240], ecx
mov dword [ebp - 0x14], 0
lea eax, [ebp - 0x10]
push eax
mov ecx, dword [ebp + 8]
push ecx
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
je 0x41b465
xor eax, eax
jmp 0x41b5bd
mov dword [ebp - 0x1028], 0x400
lea edx, [ebp - 0x1028]
push edx
lea eax, [ebp - 0x1024]
push eax
push 0
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
je 0x41b4a9
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x41b5bd
push str.KuaiZipMount
push 0x42f16c
lea eax, [ebp - 0x81c]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x81c]
push ecx
lea edx, [ebp - 0x1024]
push edx
call fcn.00415ad0
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x1024]
cmp eax, ecx
jne 0x41b5b0
lea ecx, [ebp - 0x1030]
call fcn.00411f20
mov dword [ebp - 4], 0
push str._shellopencommand
lea edx, [ebp - 0x1024]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 1
lea eax, [ebp - 0x1024]
push eax
push SysReAllocStringLen
lea ecx, [ebp - 0x1030]
call fcn.004120f0
mov dword [ebp - 0x820], eax
cmp dword [ebp - 0x820], 0
jne 0x41b59e
mov dword [ebp - 0x1034], 0x400
lea ecx, [ebp - 0x1034]
push ecx
lea edx, [ebp - 0x81c]
push edx
push 0
lea ecx, [ebp - 0x1030]
call fcn.0041b5e0
push 0x104
lea eax, [ebp - 0x123c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea ecx, [ebp - 0x123c]
push ecx
lea edx, [ebp - 0x81c]
push edx
call fcn.00415ad0
add esp, 8
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
lea ecx, [ebp - 0x81c]
xor edx, edx
cmp eax, ecx
sete dl
mov dword [ebp - 0x14], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1030]
call fcn.00411f50
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.0041c203
mov esp, ebp
pop ebp
ret 4
Function at 0x41b5e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x41b5e9
xor ecx, ecx
jne 0x41b5e9
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x41b630
mov eax, dword [ebp - 0xc]
jmp 0x41b68d
cmp dword [ebp - 4], 1
je 0x41b643
cmp dword [ebp - 4], 2
je 0x41b643
mov eax, 0xd
jmp 0x41b68d
cmp dword [ebp + 0xc], 0
je 0x41b681
cmp dword [ebp - 8], 0
je 0x41b679
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x41b670
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x41b677
mov eax, 0xd
jmp 0x41b68d
jmp 0x41b681
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc

Function at 0x41bac5
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x437e18], 0
push esi
jne 0x41ba38
call fcn.0041b95e
test eax, eax
je 0x41ba7b
mov eax, dword [0x437e18]
cmp eax, 1
jne 0x41ba59
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x41ba7b
pop esi
ret
push eax
call dword [0x437e20]
test eax, eax
jne 0x41bac3
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x41ba7f
xor eax, eax
pop esi
ret
mov eax, dword [esi]
push edi
push dword [0x437e18]
call dword [0x437e20]
mov edi, eax
test edi, edi
je 0x41baa4
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x41bac0
mov edi, esi
add esi, 0xff0
push edi
push dword [0x437e18]
call dword [0x437e1c]
add edi, 0x10
cmp edi, esi
jb 0x41baac
mov eax, edi
pop edi
pop esi
ret
jmp 0x41ba25

Function at 0x41c203
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x436a98]
jne 0x41c20d
repz ret
jmp fcn.004208ec
Function at 0x42864e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042022e
and dword [ebp - 4], 0
cmp dword [0x438a18], 0
mov ebx, eax
jne 0x4286ff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4287b0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4287b0
push eax
call fcn.004201bc
mov dword [esp], 0x430c1c
push edi
mov dword [0x438a18], eax
call esi
push eax
call fcn.004201bc
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x438a1c], eax
call esi
push eax
call fcn.004201bc
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x438a20], eax
call esi
push eax
call fcn.004201bc
pop ecx
mov dword [0x438a28], eax
test eax, eax
je 0x4286ff
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004201bc
pop ecx
mov dword [0x438a24], eax
mov eax, dword [0x438a24]
cmp eax, ebx
je 0x428757
cmp dword [0x438a28], ebx
je 0x428757
push eax
call fcn.00420237
push dword [0x438a28]
mov esi, eax
call fcn.00420237
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x428757
test edi, edi
je 0x428757
call esi
test eax, eax
je 0x42874e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x42874e
test byte [ebp - 0xc], 1
jne 0x428757
or dword [ebp + 0x10], 0x200000
jmp 0x428790
mov eax, dword [0x438a1c]
cmp eax, ebx
je 0x428790
push eax
call fcn.00420237
pop ecx
test eax, eax
je 0x428790
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x428790
mov eax, dword [0x438a20]
cmp eax, ebx
je 0x428790
push eax
call fcn.00420237
pop ecx
test eax, eax
je 0x428790
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x438a18]
call fcn.00420237
pop ecx
test eax, eax
je 0x4287b0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4287b2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret