joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49e2e0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x244
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x240], ecx
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
jne 0x49e317
jmp 0x49e474
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.004307d0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
push 1
mov ecx, dword [ebp - 0x240]
call sym.Install_adv.exe_public:_void___thiscall_CNsHook::AdjustTokenPrivilegesForNT_bool_
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x49e467
mov eax, dword [ebp - 0x228]
push eax
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x23c], eax
cmp dword [ebp - 0x23c], 0
jne 0x49e3aa
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x49e35e
mov eax, dword [ebp - 0x23c]
push eax
mov ecx, dword [ebp - 0x240]
call sym.Install_adv.exe_public:_int___thiscall_CNsHook::IsWow64ProcessEx_void__
test eax, eax
je 0x49e3ec
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x49e35e
mov dword [ebp - 0x244], 0
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x228]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x240]
call sym.Install_adv.exe_public:_bool___thiscall_CNsHook::GetModuleAddr_wchar_t_const___unsigned_long_int__unsigned_char___
movzx ecx, al
test ecx, ecx
jne 0x49e439
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x49e35e
push 0
mov ecx, dword [ebp - 0x23c]
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_Process32NextW]
mov dword [ebp - 0x238], eax
jmp 0x49e35e
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret 4
Function at 0x49e640
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa989
mov eax, dword fs:[0]
push eax
sub esp, 0x424
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
lea ecx, [ebp - 0x430]
call fcn.004a29b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call sym.Install_adv.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx ecx, al
test ecx, ecx
jne 0x49e6aa
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.004a29e0
jmp 0x49e80b
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.004127a0
movzx edx, al
test edx, edx
je 0x49e6c4
mov ecx, dword [ebp + 8]
call sym.Install_adv.exe_private:_bool___thiscall_CNsLog::GetDefLogPath_void_
push 0x4c8814
mov ecx, dword [ebp + 8]
add ecx, 0x10
call sym.Install_adv.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call fcn.004395a8
add esp, 8
mov dword [ebp - 0x428], eax
cmp dword [ebp - 0x428], 0
je 0x49e7f9
lea eax, [ebp + 0x10]
mov dword [ebp - 0x42c], eax
push 0x400
push 0
lea ecx, [ebp - 0x410]
push ecx
call fcn.004307d0
add esp, 0xc
mov edx, dword [ebp - 0x42c]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x400
lea ecx, [ebp - 0x410]
push ecx
call fcn.004259d0
add esp, 0x10
mov dword [ebp - 0x42c], 0
lea edx, [ebp - 0x420]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x424]
call fcn.00425770
mov byte [ebp - 4], 1
lea eax, [ebp - 0x410]
push eax
push 0xa2
push 0x4c881c
movzx ecx, word [ebp - 0x414]
push ecx
movzx edx, word [ebp - 0x416]
push edx
movzx eax, word [ebp - 0x418]
push eax
movzx ecx, word [ebp - 0x41a]
push ecx
movzx edx, word [ebp - 0x41e]
push edx
movzx eax, word [ebp - 0x420]
push eax
push 0x4c8840
lea ecx, [ebp - 0x424]
push ecx
call fcn.00425790
add esp, 0x2c
mov edx, dword [ebp - 0x428]
push edx
lea ecx, [ebp - 0x424]
call fcn.00418d50
push eax
call fcn.00439720
add esp, 4
push eax
push 1
lea ecx, [ebp - 0x424]
call fcn.00418d50
push eax
call fcn.004393ce
add esp, 0x10
mov eax, dword [ebp - 0x428]
push eax
call fcn.0043969e
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x424]
call fcn.004198f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x430]
call fcn.004a29e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret
Function at 0x49e830
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aa9c1
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x24]
add eax, 0x18
push eax
lea ecx, [ebp - 0x30]
call fcn.004a29b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x24]
call sym.Install_adv.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx ecx, al
test ecx, ecx
jne 0x49e894
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004a29e0
jmp 0x49e977
mov ecx, dword [ebp - 0x24]
add ecx, 0x10
call fcn.004127a0
movzx edx, al
test edx, edx
je 0x49e8ae
mov ecx, dword [ebp - 0x24]
call sym.Install_adv.exe_private:_bool___thiscall_CNsLog::GetDefLogPath_void_
push 0x4c87bc
mov ecx, dword [ebp - 0x24]
add ecx, 0x10
call sym.Install_adv.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call fcn.004395a8
add esp, 8
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0
je 0x49e968
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x28]
call fcn.00425770
mov byte [ebp - 4], 1
mov ecx, dword [ebp + 8]
push ecx
push 0x81
push 0x4c87c4
movzx edx, word [ebp - 0x14]
push edx
movzx eax, word [ebp - 0x16]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1a]
push edx
movzx eax, word [ebp - 0x1e]
push eax
movzx ecx, word [ebp - 0x20]
push ecx
push 0x4c87e8
lea edx, [ebp - 0x28]
push edx
call fcn.00425790
add esp, 0x2c
mov eax, dword [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x28]
call fcn.00418d50
push eax
call fcn.00439720
add esp, 4
push eax
push 1
lea ecx, [ebp - 0x28]
call fcn.00418d50
push eax
call fcn.004393ce
add esp, 0x10
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0043969e
add esp, 4
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.004198f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004a29e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret 4
Function at 0x49e9a0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aaa12
mov eax, dword fs:[0]
push eax
sub esp, 0xb4
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0xa8], ecx
mov eax, dword [ebp - 0xa8]
add eax, 0x18
push eax
lea ecx, [ebp - 0xb8]
call fcn.004a29b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0xa8]
call sym.Install_adv.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx ecx, al
test ecx, ecx
jne 0x49ea16
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.004a29e0
jmp 0x49eb7a
mov ecx, dword [ebp - 0xa8]
add ecx, 0x10
call fcn.004127a0
movzx edx, al
test edx, edx
je 0x49ea36
mov ecx, dword [ebp - 0xa8]
call sym.Install_adv.exe_private:_bool___thiscall_CNsLog::GetDefLogPath_void_
push 0x4c8764
mov ecx, dword [ebp - 0xa8]
add ecx, 0x10
call sym.Install_adv.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call fcn.004395a8
add esp, 8
mov dword [ebp - 0xb0], eax
cmp dword [ebp - 0xb0], 0
je 0x49eb68
lea eax, [ebp - 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [ebp + 8]
push ecx
lea ecx, [ebp - 0xa4]
call fcn.00419c50
mov dword [ebp - 0xbc], eax
mov edx, dword [ebp - 0xbc]
mov dword [ebp - 0xc0], edx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0xc0]
call fcn.00418d50
push eax
lea ecx, [ebp - 0xb4]
call fcn.00419910
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xa4]
call fcn.00419c20
lea ecx, [ebp - 0xac]
call fcn.00425770
mov byte [ebp - 4], 4
mov eax, dword [ebp - 0xb4]
push eax
push 0x68
push 0x4c876c
movzx ecx, word [ebp - 0x14]
push ecx
movzx edx, word [ebp - 0x16]
push edx
movzx eax, word [ebp - 0x18]
push eax
movzx ecx, word [ebp - 0x1a]
push ecx
movzx edx, word [ebp - 0x1e]
push edx
movzx eax, word [ebp - 0x20]
push eax
push 0x4c8790
lea ecx, [ebp - 0xac]
push ecx
call fcn.00425790
add esp, 0x2c
mov edx, dword [ebp - 0xb0]
push edx
lea ecx, [ebp - 0xac]
call fcn.00418d50
push eax
call fcn.00439720
add esp, 4
push eax
push 1
lea ecx, [ebp - 0xac]
call fcn.00418d50
push eax
call fcn.004393ce
add esp, 0x10
mov eax, dword [ebp - 0xb0]
push eax
call fcn.0043969e
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0xac]
call fcn.004198f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0xb4]
call fcn.004198f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0xb8]
call fcn.004a29e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret 4
Function at 0x49ee60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4aaa97
mov eax, dword fs:[0]
push eax
sub esp, 0x8b4
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
add eax, 0x18
push eax
lea ecx, [ebp - 0x8b8]
call fcn.004a29b0
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
call sym.Install_adv.exe_private:_bool___thiscall_CNsLog::isLog_void_
movzx ecx, al
test ecx, ecx
jne 0x49eeca
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b8]
call fcn.004a29e0
jmp 0x49f088
mov ecx, dword [ebp + 8]
add ecx, 0x10
call fcn.004127a0
movzx edx, al
test edx, edx
je 0x49eee4
mov ecx, dword [ebp + 8]
call sym.Install_adv.exe_private:_bool___thiscall_CNsLog::GetDefLogPath_void_
push 0x4c886c
mov ecx, dword [ebp + 8]
add ecx, 0x10
call sym.Install_adv.exe_public:_char_const____thiscall_Json::StaticString::operator_char_const__void_const
push eax
call fcn.004395a8
add esp, 8
mov dword [ebp - 0x8ac], eax
cmp dword [ebp - 0x8ac], 0
je 0x49f076
push 0x800
push 0
lea eax, [ebp - 0x810]
push eax
call fcn.004307d0
add esp, 0xc
lea ecx, [ebp + 0x10]
mov dword [ebp - 0x8b0], ecx
mov edx, dword [ebp - 0x8b0]
push edx
mov eax, dword [ebp + 0xc]
push eax
push 0x800
lea ecx, [ebp - 0x810]
push ecx
call fcn.004259b0
add esp, 0x10
mov dword [ebp - 0x8b0], 0
lea edx, [ebp - 0x820]
push edx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea eax, [ebp - 0x810]
push eax
lea ecx, [ebp - 0x8a4]
call fcn.00419c50
mov dword [ebp - 0x8bc], eax
mov ecx, dword [ebp - 0x8bc]
mov dword [ebp - 0x8c0], ecx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x8c0]
call fcn.00418d50
push eax
lea ecx, [ebp - 0x8b4]
call fcn.00419910
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8a4]
call fcn.00419c20
lea ecx, [ebp - 0x8a8]
call fcn.00425770
mov byte [ebp - 4], 4
mov edx, dword [ebp - 0x8b4]
push edx
push 0xc4
push str.d:my2018_nslib_nscore_nslog.cpp
movzx eax, word [ebp - 0x814]
push eax
movzx ecx, word [ebp - 0x816]
push ecx
movzx edx, word [ebp - 0x818]
push edx
movzx eax, word [ebp - 0x81a]
push eax
movzx ecx, word [ebp - 0x81e]
push ecx
movzx edx, word [ebp - 0x820]
push edx
push str.__d__02d__02d__02d:_02d:_02d___s___d___s_r_n
lea eax, [ebp - 0x8a8]
push eax
call fcn.00425790
add esp, 0x2c
mov ecx, dword [ebp - 0x8ac]
push ecx
lea ecx, [ebp - 0x8a8]
call fcn.00418d50
push eax
call fcn.00439720
add esp, 4
push eax
push 1
lea ecx, [ebp - 0x8a8]
call fcn.00418d50
push eax
call fcn.004393ce
add esp, 0x10
mov edx, dword [ebp - 0x8ac]
push edx
call fcn.0043969e
add esp, 4
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x8a8]
call fcn.004198f0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x8b4]
call fcn.004198f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x8b8]
call fcn.004a29e0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret
Function at 0x4a0b30
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 0x14], ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x4a0b4e
xor al, al
jmp 0x4a0bd8
mov ecx, dword [ebp + 8]
push ecx
call sym.Install_adv.exe_long_long___int64____cdecl_FileSize_wchar_t_const__
add esp, 4
mov dword [ebp - 8], eax
mov edx, dword [ebp - 8]
add edx, 1
push edx
call fcn.0047912d
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.Install_adv.exe_int___cdecl_NsReadFile_wchar_t_const___void___unsigned_long_int_
add esp, 0xc
test eax, eax
je 0x4a0b93
mov byte [ebp - 2], 1
jmp 0x4a0b97
mov byte [ebp - 2], 0
mov cl, byte [ebp - 2]
mov byte [ebp - 1], cl
movzx edx, byte [ebp - 1]
test edx, edx
je 0x4a0bc3
mov eax, dword [ebp - 0xc]
add eax, dword [ebp - 8]
mov byte [eax], 0
push 1
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 0x14]
call sym.Install_adv.exe_public:_bool___thiscall_CNsStringManager::ParseStrings_unsigned_char_const___int__bool_
mov byte [ebp - 1], al
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.00479128
add esp, 4
mov al, byte [ebp - 1]
mov esp, ebp
pop ebp
ret 4
Function at 0x4a1460
Capabilities:
Initialize winsock library

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x198], ecx
lea eax, [ebp - 0x194]
push eax
push 2
call dword [sym.imp.WS2_32.dll_WSAStartup]
mov eax, dword [ebp - 0x198]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret
Function at 0x4a23d0
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
lea eax, [ebp - 0x210]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x4a2417
xor eax, eax
jmp 0x4a24d6
cmp dword [ebp + 0xc], 0
je 0x4a24b3
push 0x208
push 0
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004307d0
add esp, 0xc
cmp dword [ebp + 0x10], 0
jne 0x4a2453
push 0x104
lea edx, [ebp - 0x20c]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x4a2464
mov eax, dword [ebp + 0x10]
push eax
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea edx, [ebp - 0x20c]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
shl eax, 1
mov dword [ebp - 0x214], eax
mov eax, dword [ebp - 0x214]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push 1
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4a24b1
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
jmp 0x4a24d6
jmp 0x4a24c4
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x210]
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov ecx, dword [ebp - 0x210]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4a2510
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], ecx
push 0x26c
call fcn.0042f06b
add esp, 4
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
mov dword [ecx], edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
add ecx, 4
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0x10]
mov dword [edx + 0x25c], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x14]
mov dword [ecx + 0x260], edx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x18]
mov dword [eax + 0x264], ecx
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [edx + 0x268], eax
mov ecx, dword [ebp - 8]
mov dword [ecx], 0
lea edx, [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 4]
push eax
push sym.Install_adv.exe_public:_static_unsigned_long_int___stdcall_CNsReg::MonitorThread_void__
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4a25ad
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a2890
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x220], 7
mov dword [ebp - 0x214], 0xf003f
cmp dword [ebp + 0x14], 0
je 0x4a28d6
mov eax, dword [ebp - 0x214]
or eax, 0x100
mov dword [ebp - 0x214], eax
jmp 0x4a28f1
call sym.Install_adv.exe_int___cdecl_isWow64_void_
test eax, eax
je 0x4a28f1
mov ecx, dword [ebp - 0x214]
or ecx, 0x200
mov dword [ebp - 0x214], ecx
lea edx, [ebp - 0x218]
push edx
mov eax, dword [ebp - 0x214]
push eax
push 0
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4a2991
mov dword [ebp - 0x21c], 0x104
push 0x20a
push 0
lea eax, [ebp - 0x210]
push eax
call fcn.004307d0
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0x220]
push eax
push 0
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4a2984
lea eax, [ebp - 0x210]
push eax
mov ecx, dword [ebp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp - 0x218]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
jmp 0x4a2993
mov eax, dword [ebp - 0x218]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret 0x14
Function at 0x4a2b40
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
shl eax, 3
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
push edx
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
push ecx
mov edx, dword [ebp + 0xc]
push edx
call sym.Install_adv.exe_public:_static_bool___cdecl_CNsEncrypt::EasyEncode_unsigned_char___unsigned_int__unsigned_char_
add esp, 0xc
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x12
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0xa0
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x14], 0xab
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x14], 0x52
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x14], 0x24
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x14], 0x3c
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x14], 0x5a
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x14], 0x1c
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x3f
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x1f
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x14], 0x44
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x14], 0x32
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x14], 0x48
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x14], 0x4f
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x14], 0x5a
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x14], 0x8a
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.Install_adv.exe_public:_static_bool___cdecl_CNsEncrypt::AesDecode_unsigned_char_const___unsigned_char___unsigned_char_const___unsigned_char___unsigned_int___unsigned_int_
add esp, 0x18
mov byte [ebp - 0x15], al
mov al, byte [ebp - 0x15]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret
Function at 0x4a2c80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4e100c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, 1
imul ecx, eax, 0
mov byte [ebp + ecx - 0x14], 0x12
mov edx, 1
shl edx, 0
mov byte [ebp + edx - 0x14], 0xa0
mov eax, 1
shl eax, 1
mov byte [ebp + eax - 0x14], 0xab
mov ecx, 1
imul edx, ecx, 3
mov byte [ebp + edx - 0x14], 0x52
mov eax, 1
shl eax, 2
mov byte [ebp + eax - 0x14], 0x24
mov ecx, 1
imul edx, ecx, 5
mov byte [ebp + edx - 0x14], 0x3c
mov eax, 1
imul ecx, eax, 6
mov byte [ebp + ecx - 0x14], 0x5a
mov edx, 1
imul eax, edx, 7
mov byte [ebp + eax - 0x14], 0x1c
mov ecx, 1
shl ecx, 3
mov byte [ebp + ecx - 0x14], 0x3f
mov edx, 1
imul eax, edx, 9
mov byte [ebp + eax - 0x14], 0x1f
mov ecx, 1
imul edx, ecx, 0xa
mov byte [ebp + edx - 0x14], 0x44
mov eax, 1
imul ecx, eax, 0xb
mov byte [ebp + ecx - 0x14], 0x32
mov edx, 1
imul eax, edx, 0xc
mov byte [ebp + eax - 0x14], 0x48
mov ecx, 1
imul edx, ecx, 0xd
mov byte [ebp + edx - 0x14], 0x4f
mov eax, 1
imul ecx, eax, 0xe
mov byte [ebp + ecx - 0x14], 0x5a
mov edx, 1
imul eax, edx, 0xf
mov byte [ebp + eax - 0x14], 0x8a
mov ecx, dword [ebp + 0x18]
push ecx
mov edx, dword [ebp + 0x14]
push edx
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp + 8]
push eax
call sym.Install_adv.exe_public:_static_bool___cdecl_CNsEncrypt::AesEncode_unsigned_char_const___unsigned_char___unsigned_char_const___unsigned_char___unsigned_int___unsigned_int_
add esp, 0x18
mov byte [ebp - 0x15], al
movzx ecx, byte [ebp - 0x15]
test ecx, ecx
jne 0x4a2d8e
xor al, al
jmp 0x4a2db2
mov edx, 1
shl edx, 3
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
push ecx
mov edx, dword [ebp + 0x14]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
call sym.Install_adv.exe_public:_static_bool___cdecl_CNsEncrypt::EasyEncode_unsigned_char___unsigned_int__unsigned_char_
add esp, 0xc
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0042eb1e
mov esp, ebp
pop ebp
ret
Function at 0x4028ef
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x402907
push dword [esp + 4]
push 0x402888
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x402944
push esi
mov esi, dword [0x40c21c]
test esi, esi
je 0x402943
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40293b
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x40c21c
call fcn.00408acf
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x402914
pop edi
pop ebx
pop esi
ret 4