joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40831d
Capabilities:
Delete service
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, 0x51c275
push edi
call fcn.004b1bc6
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
test edi, edi
je 0x408383
push esi
push 0xf01ff
push dword [ebp + 8]
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
jne 0x408362
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x408382
lea eax, [ebp - 0x1c]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop esi
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00405cf0
pop edi
leave
ret

Function at 0x408391
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov ecx, 0x51c275
push ebx
push edi
call fcn.004b1bc6
lea ecx, [ebp - 0x1c]
call fcn.00402315
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 3
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x4083f2
mov ecx, dword [ebp + 0xc]
push esi
mov dword [ebp - 4], ebx
mov esi, dword [ecx + 0x10]
call fcn.004028b0
push ebx
lea ecx, [ebp - 4]
push ecx
push esi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
lea ecx, [ebp - 0x1c]
call fcn.0040291c
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.00405cf0
pop edi
pop ebx
leave
ret

Function at 0x40842b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4dff5b
call fcn.004b1eac
sub esp, 0x804
push edi
xor edi, edi
mov ecx, 0x51c275
mov dword [ebp - 0x10], edi
call fcn.004b1bc6
mov ecx, dword [ebp + 8]
call fcn.00404035
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
call fcn.004b5210
add esp, 0xc
lea eax, [ebp - 0x810]
push edi
push 0x10
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
pop edi
test eax, eax
je 0x4084a4
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x810]
push eax
call fcn.00406096
mov ecx, dword [ebp + 8]
push 0x4e5994
call fcn.0040496e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x4084b3
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4dff5b
call fcn.004b1eac
sub esp, 0x804
push edi
xor edi, edi
mov ecx, 0x51c275
mov dword [ebp - 0x10], edi
call fcn.004b1bc6
mov ecx, dword [ebp + 8]
call fcn.00404035
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
call fcn.004b5210
add esp, 0xc
lea eax, [ebp - 0x810]
push edi
push 0x19
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
pop edi
test eax, eax
je 0x40852c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x810]
push eax
call fcn.00406096
mov ecx, dword [ebp + 8]
push 0x4e5994
call fcn.0040496e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret
Function at 0x40855a
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4dff5b
call fcn.004b1eac
sub esp, 0x804
push edi
xor edi, edi
mov ecx, 0x51c275
mov dword [ebp - 0x10], edi
call fcn.004b1bc6
mov ecx, dword [ebp + 8]
call fcn.00404035
push 0x800
lea eax, [ebp - 0x810]
mov dword [ebp - 4], edi
push edi
push eax
mov dword [ebp - 0x10], 1
call fcn.004b5210
add esp, 0xc
lea eax, [ebp - 0x810]
push edi
push 2
push eax
push edi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
pop edi
test eax, eax
je 0x4085d3
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x810]
push eax
call fcn.00406096
mov ecx, dword [ebp + 8]
push 0x4e5994
call fcn.0040496e
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret

Function at 0x4085e2
Capabilities:
Get common file path

Disassembly:
mov eax, 0x4dff74
call fcn.004b1eac
sub esp, 0x808
mov ecx, 0x51c275
push esi
xor esi, esi
call fcn.004b1bc6
call dword [sym.imp.SHELL32.dll_IsUserAnAdmin]
test eax, eax
je 0x408614
push dword [ebp + 8]
call fcn.004084b3
pop ecx
jmp 0x40867c
lea ecx, [ebp - 0x10]
call fcn.00404035
push 0x800
lea eax, [ebp - 0x814]
mov dword [ebp - 4], esi
push esi
push eax
call fcn.004b5210
add esp, 0xc
lea eax, [ebp - 0x814]
push esi
push 0x10
push eax
push esi
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
test eax, eax
je 0x408665
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x10]
call fcn.00406096
push 0x4e5994
lea ecx, [ebp - 0x10]
call fcn.0040496e
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.00403f4a
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00405cf0
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x40868c
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov ecx, 0x51c275
call fcn.004b1bc6
xor ebx, ebx
push ebx
push 0x80
push 2
push ebx
push 2
push 0x40000000
push dword [ebp + 8]
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x408712
movzx eax, word [ebp + 0xc]
push edi
push dword [ebp + 0x10]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x40870a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
test eax, eax
je 0x40870a
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push ebx
lea ecx, [ebp - 4]
push ecx
push eax
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor edx, edx
movzx ebx, bl
inc edx
test eax, eax
cmovne ebx, edx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.00405cf0
mov ecx, dword [ebp + 0x10]
add ecx, 0xfffffff0
call fcn.00405cf0
pop esi
mov al, bl
pop ebx
leave
ret
Function at 0x40889b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
mov ecx, 0x51c21c
call fcn.004b1bc6
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4088ff
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x4088ff
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edx, dword [ebp + 0x10]
lea ecx, [esi + eax]
and edx, 0xf
jbe 0x4088ef
cmp esi, ecx
jae 0x4088ff
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub edx, 1
jne 0x4088dd
cmp esi, ecx
jae 0x4088ff
xor eax, eax
cmp word [esi], ax
cmove esi, eax
mov eax, esi
jmp 0x408901
xor eax, eax
pop esi
pop ebp
ret

Function at 0x409889
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ecx, 0x51c39d
xor ebx, ebx
call fcn.004b1bc6
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ebx
push 0x40000001
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
jne 0x4098c0
mov eax, dword [ebp + 8]
mov dword [eax], ebx
jmp 0x40990f
push esi
push dword [ebp - 4]
lea eax, [ebp - 8]
push eax
call fcn.004095ce
pop ecx
pop ecx
lea ecx, [ebp - 8]
mov esi, dword [eax]
mov dword [eax], ebx
mov dword [ebp - 0xc], esi
call fcn.004096d0
lea eax, [ebp - 4]
push eax
push esi
push 0x40000001
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
test eax, eax
jne 0x409909
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0xc]
mov dword [esi], ebx
call fcn.004096d0
mov eax, esi
jmp 0x40990e
mov eax, dword [ebp + 8]
mov dword [eax], esi
pop esi
pop ebx
leave
ret
Function at 0x409e4d
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x4e046b
call fcn.004b1eac
sub esp, 0x264
push ebx
mov ecx, 0x51c39d
call fcn.004b1bc6
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ebx
push str.OpenWithProgids
push dword [ebp + 8]
lea eax, [ebp - 0x58]
mov dword [ebp - 4], ebx
push eax
call fcn.004092e6
add esp, 0xc
lea ecx, [ebp - 0x58]
mov byte [ebp - 4], 1
call fcn.004032bd
push 0x20019
push eax
push connect
lea ecx, [ebp - 0x1c]
call fcn.00405895
test eax, eax
jne 0x409fd7
push esi
push edi
lea ecx, [ebp - 0x28]
call fcn.00409677
mov esi, dword [ebp - 0x1c]
lea eax, [ebp - 0x10]
push ebx
push ebx
push ebx
push ebx
push eax
lea eax, [ebp - 0x270]
mov byte [ebp - 4], 2
push eax
mov edi, ebx
mov dword [ebp - 0x10], 0x200
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
jmp 0x409f2e
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x40]
call fcn.00402f3d
cmp dword [ebp - 0x30], 0
mov byte [ebp - 4], 3
je 0x409f08
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
call fcn.004093ac
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x10], 0x200
inc edi
mov byte [ebp - 4], 2
call fcn.004032db
xor eax, eax
push eax
push eax
push eax
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x270]
push eax
push edi
push esi
call ebx
test eax, eax
je 0x409ee3
test esi, esi
je 0x409f44
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x1c], 0
and dword [ebp - 0x18], 0
lea ecx, [ebp - 0x1c]
push 0xf003f
push str.SoftwareMicrosoftWindowsCurrentVersionApplicationAssociationToasts
push reloc.WS2_32.dll_accept
call fcn.00405895
test eax, eax
jne 0x409fcd
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x24]
jmp 0x409fb8
push 0x4e6210
lea eax, [ebp - 0x70]
push esi
push eax
call fcn.004092e6
push dword [ebp + 8]
mov byte [ebp - 4], 4
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.004092bf
add esp, 0x18
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x70]
call fcn.004032db
lea ecx, [ebp - 0x40]
call fcn.004032bd
push 0
push eax
lea ecx, [ebp - 0x1c]
call fcn.0040a071
lea ecx, [ebp - 0x40]
call fcn.004032db
add esi, 0x18
cmp esi, edi
jne 0x409f6b
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
lea ecx, [ebp - 0x1c]
call fcn.00404c74
lea ecx, [ebp - 0x28]
call fcn.0040a9a8
pop edi
pop esi
lea ecx, [ebp - 0x58]
call fcn.004032db
lea ecx, [ebp - 0x1c]
call fcn.00404c74
mov ecx, dword [ebp - 0xc]
pop ebx
mov dword fs:[0], ecx
leave
ret

Function at 0x40a1e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov ecx, 0x51c388
call fcn.004b1bc6
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x40a1fc
push 0xd
pop eax
jmp 0x40a22e
mov ecx, edx
push ebx
push edi
xor ebx, ebx
lea edi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, bx
jne 0x40a205
sub ecx, edi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop ebx
pop esi
pop ebp
ret 0xc
Function at 0x40aee5
Capabilities:
Check http status code
Check if file exists
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
push edi
mov edi, dword [ebp + 0x28]
mov ecx, 0x51c4c1
call fcn.004b1bc6
push 0x1c
pop esi
push 0x104
lea eax, [ebp - 0x218]
mov byte [ebp + 0x2b], 0
push 0
push eax
call fcn.004b5210
add esp, 0xc
lea ecx, [ebp + 8]
call fcn.004028b0
cmp dword [ebp + 0x24], 0
push dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x218]
cmovne eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40af4d
push dword [ebp + 0x20]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
or ebx, 0xffffffff
test edi, edi
cmovg ebx, edi
xor eax, eax
test edi, edi
cmovg eax, edi
mov dword [ebp + 0x24], eax
cmp esi, 0x1c
je 0x40af6d
cmp esi, 6
jne 0x40b103
push 0x4e6dd0
push dword [ebp + 0x20]
call fcn.004be2dc
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x40b0ff
push edi
call fcn.0040b11e
pop ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 4], edx
call fcn.004183f0
mov esi, eax
test esi, esi
je 0x40b0f6
push dword [ebp - 0xc]
push 0x2712
push esi
call fcn.0041b4f0
push edi
push 0x2711
push esi
call fcn.0041b4f0
push 0x40adfa
push 0x4e2b
push esi
call fcn.0041b4f0
push 0
push 0x2b
push esi
call fcn.0041b4f0
push 5
push 0x44
push esi
call fcn.0041b4f0
push 1
push 0x34
push esi
call fcn.0041b4f0
add esp, 0x48
push 0x40acb8
push 0x4e58
push esi
call fcn.0041b4f0
push dword [ebp - 0x10]
push 0x2749
push esi
call fcn.0041b4f0
push 0xa
push 0x4e
push esi
call fcn.0041b4f0
push dword [ebp + 0x24]
push 0xd
push esi
call fcn.0041b4f0
push 1
push 0x13
push esi
call fcn.0041b4f0
push 5
push 0x14
push esi
call fcn.0041b4f0
add esp, 0x48
lea eax, [ebp - 0x114]
push 0xff
push 0
push eax
call fcn.004b5210
push dword [ebp - 4]
lea eax, [ebp - 0x114]
push dword [ebp - 0x14]
push str._I64u_
push 0xff
push eax
call fcn.0040b3fd
lea eax, [ebp - 0x114]
push eax
push 0x2717
push esi
call fcn.0041b4f0
push esi
call fcn.00418450
add esp, 0x30
mov dword [ebp - 4], eax
test eax, eax
jne 0x40b08e
mov byte [ebp + 0x2b], 1
jmp 0x40b0ab
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
cmp eax, 0x2a
je 0x40b0f6
cmp eax, 0x1c
jne 0x40b0ab
cmp ebx, 0xffffffff
jne 0x40b0f6
cmp ebx, 0xffffffff
je 0x40b0c0
mov eax, dword [ebp + 0x24]
dec ebx
dec eax
mov dword [ebp + 0x24], eax
test eax, eax
jle 0x40b0f6
test ebx, ebx
jle 0x40b0f6
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
push 0x200002
push esi
call fcn.004183d0
cmp dword [ebp - 8], 0x190
push esi
sbb al, al
and byte [ebp + 0x2b], al
call fcn.004183b0
push edi
call fcn.004be418
mov esi, dword [ebp - 4]
add esp, 0x14
jmp 0x40af5f
push edi
call fcn.004be418
pop ecx
jmp 0x40b103
mov byte [ebp + 0x2b], 0
lea ecx, [ebp + 8]
call fcn.0040291c
mov ecx, dword [ebp + 0x20]
add ecx, 0xfffffff0
call fcn.00405cf0
mov al, byte [ebp + 0x2b]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40bcfd
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
mov eax, 0x4e05c6
call fcn.004b1eac
sub esp, 0x264
push ebx
mov ecx, 0x51c5be
xor ebx, ebx
call fcn.004b1bc6
push 0x104
lea eax, [ebp - 0x16c]
push ebx
push eax
call fcn.004b5210
add esp, 0xc
mov dword [ebp - 0x10], ebx
lea eax, [ebp - 0x10]
push eax
push ebx
mov ebx, dword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
call ebx
cmp eax, 0x6f
je 0x40bd5f
push 1
lea eax, [ebp - 0x16c]
push str.:3:_d
push eax
call fcn.0040b67a
add esp, 0xc
jmp 0x40bf22
push edi
push dword [ebp - 0x10]
call fcn.004bf0dc
mov edi, eax
pop ecx
test edi, edi
jne 0x40bd8a
push 1
lea eax, [ebp - 0x16c]
push str.:4:_d
push eax
call fcn.0040b67a
add esp, 0xc
jmp 0x40bf21
push esi
lea eax, [ebp - 0x10]
mov esi, edi
push eax
push edi
call ebx
test eax, eax
je 0x40bdb9
push 1
lea eax, [ebp - 0x16c]
push str.:5:_d
push eax
call fcn.0040b67a
push edi
call fcn.004b9604
add esp, 0x10
jmp 0x40bf20
mov eax, dword [esi + 0x190]
cmp eax, 6
jb 0x40bf0f
cmp eax, 8
ja 0x40bf0f
lea ecx, [ebp - 0x50]
call fcn.0040b765
and dword [ebp - 4], 0
lea eax, [esi + 0x10c]
push eax
lea ecx, [ebp - 0x38]
call fcn.00403336
lea eax, [esi + 0x1b0]
cmp eax, str.0.0.0.0
je 0x40befb
lea eax, [esi + 8]
test eax, eax
je 0x40befb
cmp byte [eax], 0
je 0x40befb
push eax
lea ecx, [ebp - 0x68]
call fcn.004022e3
lea eax, [ebp - 0x68]
push eax
call fcn.0040bf41
pop ecx
lea ecx, [ebp - 0x68]
mov dword [ebp - 0x20], eax
call fcn.0040291c
mov eax, dword [esi + 0x1a0]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0x190]
mov dword [ebp - 0x18], eax
cmp eax, 6
jne 0x40be8c
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x270]
push str._02X__02X__02X__02X__02X__02X
push eax
call fcn.0040b67a
add esp, 0x20
jmp 0x40bee0
movzx eax, byte [esi + 0x19b]
push eax
movzx eax, byte [esi + 0x19a]
push eax
movzx eax, byte [esi + 0x199]
push eax
movzx eax, byte [esi + 0x198]
push eax
movzx eax, byte [esi + 0x197]
push eax
movzx eax, byte [esi + 0x196]
push eax
movzx eax, byte [esi + 0x195]
push eax
movzx eax, byte [esi + 0x194]
push eax
lea eax, [ebp - 0x270]
push str._02X__02X__02X__02X__02X__02X__02X__02X
push eax
call fcn.0040b67a
add esp, 0x28
lea eax, [ebp - 0x270]
push eax
lea ecx, [ebp - 0x50]
call fcn.00403336
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x50]
push eax
call fcn.0040b4b9
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0040291c
lea ecx, [ebp - 0x50]
call fcn.0040291c
mov esi, dword [esi]
test esi, esi
jne 0x40bdb9
push edi
call fcn.004b9604
pop ecx
pop esi
pop edi
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x16c]
push eax
call fcn.004022e3
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x40bf41
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x220
push ebx
push esi
push edi
mov ecx, 0x51c5be
call fcn.004b1bc6
lea eax, [ebp - 0xc]
xor edi, edi
push eax
push 0x20019
push edi
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push reloc.WS2_32.dll_bind
mov dword [ebp - 0xc], edi
or ebx, 0xffffffff
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40c0a3
push edi
push edi
push edi
push edi
push edi
push edi
push edi
lea eax, [ebp - 8]
push eax
push edi
push edi
push edi
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyA]
mov ecx, dword [ebp - 8]
test eax, eax
push 0x64
pop edx
cmovne ecx, edx
mov dword [ebp - 8], ecx
test ecx, ecx
je 0x40c0a3
and dword [ebp - 4], 0
lea eax, [ebp - 0x220]
push 0x104
push 0
push eax
call fcn.004b5210
xor eax, eax
mov ecx, 0x104
push ecx
push eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x11c]
push eax
mov dword [ebp - 0x10], ecx
call fcn.004b5210
push edi
push str._04u
lea eax, [ebp - 0x11c]
push 0x104
push eax
call fcn.0040b651
add esp, 0x28
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
lea eax, [ebp - 0x11c]
push eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c08f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push str.NetCfgInstanceId
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c08a
mov ecx, dword [ebp + 8]
call fcn.004028b0
lea ecx, [ebp - 0x220]
push ecx
push eax
call fcn.004bf120
pop ecx
pop ecx
test eax, eax
jne 0x40c08a
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 4
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0x4e6e64
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x40c09b
push dword [ebp - 4]
call esi
inc edi
cmp edi, dword [ebp - 8]
jb 0x40bfb7
jmp 0x40c0a3
push dword [ebp - 4]
mov ebx, dword [ebp - 0x18]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret

Function at 0x40c775
Capabilities:
Create thread

Disassembly:
mov eax, 0x4e06b2
call fcn.004b1eac
push ecx
push ebx
push esi
mov ebx, ecx
mov ecx, 0x51c737
push edi
xor edi, edi
call fcn.004b1bc6
push 8
call fcn.004b1c1b
mov esi, eax
pop ecx
test esi, esi
je 0x40c7ae
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esi], edx
mov dword [esi + 4], ecx
jmp 0x40c7b0
mov esi, edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], edi
call fcn.0040cad7
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.0040cad7
xor eax, eax
lea edi, [ebx + 4]
push edi
push eax
push esi
push 0x40c6c9
push eax
push eax
call fcn.004c07ab
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x40c7fa
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
and dword [edi], 0
push 6
call fcn.004b366d
int3
Function at 0x40c805
Capabilities:
Create thread

Disassembly:
mov eax, 0x4e06b2
call fcn.004b1eac
push ecx
push ebx
push esi
mov ebx, ecx
mov ecx, 0x51c737
push edi
xor edi, edi
call fcn.004b1bc6
push 8
call fcn.004b1c1b
mov esi, eax
pop ecx
test esi, esi
je 0x40c83e
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [ecx + 4]
mov dword [esi], edx
mov dword [esi + 4], ecx
jmp 0x40c840
mov esi, edi
lea ecx, [ebp + 8]
mov dword [ebp + 8], edi
call fcn.0040cad7
mov dword [ebp + 8], edi
mov dword [ebp - 0x10], esi
lea ecx, [ebp + 8]
mov dword [ebp - 4], edi
call fcn.0040cad7
xor eax, eax
lea edi, [ebx + 4]
push edi
push eax
push esi
push 0x40c71f
push eax
push eax
call fcn.004c07ab
add esp, 0x18
mov dword [ebx], eax
test eax, eax
je 0x40c88a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
and dword [edi], 0
push 6
call fcn.004b366d
int3

Function at 0x40d10c
Capabilities:
Check if file exists
Create directory
Delete directory

Disassembly:
mov eax, 0x4e004a
call fcn.004b1eac
sub esp, 0xc
mov ecx, 0x51c747
push ebx
call fcn.004b1bc6
sub esp, 0x18
mov ecx, esp
push 0x4e7984
call fcn.004022e3
call fcn.00407a45
add esp, 0x18
test al, al
je 0x40d14a
mov eax, dword [ebp + 8]
mov byte [eax], 0
jmp 0x40d1e5
push 0x4e7988
lea ecx, [ebp - 0x14]
call fcn.004040c9
xor ebx, ebx
lea ecx, [ebp - 0x10]
push str.D:Program_Filesgptchrometmp
mov dword [ebp - 4], ebx
call fcn.004040c9
push dword [ebp - 0x14]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d18c
push ebx
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov eax, dword [ebp + 8]
je 0x40d1cd
push dword [ebp - 0x14]
jmp 0x40d1c2
push dword [ebp - 0x10]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d1ae
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
mov eax, dword [ebp + 8]
setne cl
mov byte [eax], cl
jmp 0x40d1cf
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
mov eax, dword [ebp + 8]
je 0x40d1cd
push dword [ebp - 0x10]
mov byte [eax], 1
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x40d1cf
mov byte [eax], bl
mov ecx, dword [ebp - 0x10]
lea ecx, [ecx - 0x10]
call fcn.00405cf0
mov ecx, dword [ebp - 0x14]
lea ecx, [ecx - 0x10]
call fcn.00405cf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
leave
ret