joyce8/EMBER2024-capa huggingface dataset:
Function at 0xcf7d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcf7d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0xcf7d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0xcf7d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0xcf7d94
push eax
push esi
call fcn.00cfa20b
add esp, 8
pop esi
ret 0x10

Function at 0xcf7da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcf7e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0xcf7e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0xd10320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00cf9dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0xcf7dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0xcf7e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0xcf7ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0xcf7eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0xd10320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00cf9dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0xcf7eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0xcf7e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0xcf8000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0xcf8131
push esi
call fcn.00cfb145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.00cea080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0xcf8131
push 0
push ebp
call fcn.00cea3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.00cea260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0xcf808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.00cea2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0xcf8121
push 0xd10918
push edi
call fcn.00cf93f0
push eax
push ebx
push esi
call fcn.00cf7f60
push 0xd108f8
push edi
call fcn.00cf93f0
push eax
push ebx
push esi
call fcn.00cf7f60
push 0xd108d8
push edi
call fcn.00cf93f0
push eax
push ebx
push esi
call fcn.00cf7f60
push 0xd108c0
push edi
call fcn.00cf93f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00cf7f60
push 0xd108a0
push edi
call fcn.00cf93f0
push eax
push ebx
push esi
call fcn.00cf7f60
push 0xd10888
push edi
call fcn.00cf93f0
push eax
push ebx
push esi
call fcn.00cf7f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0xcf91b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00cf9140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00cf9140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00cf9140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00cf9140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0xcf9bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0xcf9c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0xd0b87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0xcf9c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0xcf9c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x4025a0
Capabilities:
Allocate thread local storage
Initialize winsock library

Disassembly:
push 0x1dc
mov eax, 0x6c0dc0
call fcn.00432a44
mov ebx, ecx
mov al, byte [ebx + 0x2d]
mov ecx, 0x70f780
mov byte [0x70fff0], al
call fcn.00437eb4
call fcn.00432cf0
call fcn.00432cfc
cmp byte [ebx + 0x2c], 0
je 0x4025da
mov byte [0x721aae], 1
mov eax, dword [ebx + 0x24]
lea edi, [ebp - 0x50]
push 0xc
pop ecx
mov esi, ebx
lea edx, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebx + 0x20]
xor edi, edi
mov dword [ebp - 0x1e8], edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], ecx
mov dword [ebp - 4], 2
mov esi, dword [sym.imp.KERNEL32.dll_SetHandleInformation]
push edi
push 1
push dword [ebx]
call esi
cmp dword [ebx + 0x1c], edi
je 0x402622
push edi
push 1
push dword [ebx + 0x1c]
call esi
push edi
push 1
push dword [ebx + 0x20]
call esi
push edi
push 1
push dword [ebx + 0x24]
call esi
mov dword [ebp - 4], 3
push edi
push edi
call dword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
test esi, esi
js 0x402684
lea eax, [ebp - 0x1e4]
push eax
push 0x202
call dword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x40266f
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
push eax
call fcn.00435aec
mov esi, eax
test esi, esi
jne 0x40267e
lea ecx, [ebp - 0x50]
call fcn.00404f69
mov esi, eax
call fcn.0043b047
call dword [sym.imp.ole32.dll_CoUninitialize]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.0043b380
mov eax, esi
call fcn.00402698
ret

Function at 0x432c35
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x1c]
push eax
xor ebx, ebx
push 8
mov dword [ebp - 0x1c], ebx
mov dword [edi], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
test esi, esi
je 0x432ca7
lea eax, [ebp - 0x24]
push eax
push 0x437f98
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x432ca7
mov ecx, dword [ebp - 0x20]
xor eax, eax
inc eax
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push edi
push eax
push dword [ebp - 0x1c]
mov dword [ebp - 8], ebx
call dword [sym.imp.ADVAPI32.dll_PrivilegeCheck]
mov esi, eax
cmp dword [ebp - 0x1c], ebx
je 0x432cb5
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret 4
Function at 0x432d1c
Capabilities:
Parse pe header

Disassembly:
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x405b40
call edi
xor ecx, ecx
mov esi, eax
test esi, esi
setne cl
push ecx
call fcn.004050cb
test eax, eax
js 0x432dc5
push ebx
push 0x432dc8
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
xor ecx, ecx
mov ebx, eax
test ebx, ebx
setne cl
push ecx
call fcn.004050cb
test eax, eax
js 0x432dc4
push 0x432de4
call edi
xor ecx, ecx
mov esi, eax
test esi, esi
setne cl
push ecx
call fcn.004050cb
test eax, eax
js 0x432dc4
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x432dbf
mov edi, dword [esi + 0x3c]
cmp dword [edi + esi], 0x4550
jne 0x432dbf
push 0x49e323
push 0
call ebx
neg eax
sbb eax, eax
neg eax
push eax
call fcn.004050cb
test eax, eax
jne 0x432dc4
mov ecx, dword [edi + esi + 0x50]
add ecx, esi
mov dword [0x70ffe8], esi
mov dword [0x70ffe4], ecx
jmp 0x432dc4
mov eax, 0x80070482
pop ebx
pop edi
pop esi
ret

Function at 0x433af1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x34
xor ebx, ebx
mov edi, ecx
push ebx
push edi
call fcn.00436326
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, eax
push 0x22
pop eax
cmp word [esi], ax
jne 0x433b43
push eax
lea eax, [esi + 2]
push eax
call fcn.00435c37
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x433b93
cmp word [esi], bx
je 0x433b85
add esi, 2
jmp 0x433b81
push 0x104
lea eax, [ebp - 0x20c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov ebx, eax
test ebx, ebx
je 0x433b73
push ebx
push esi
lea eax, [ebp - 0x20c]
push eax
call fcn.00433f17
test eax, eax
jne 0x433b73
lea esi, [esi + ebx*2]
jmp 0x433b7f
push 0x20
push esi
call fcn.00435c37
pop ecx
pop ecx
mov esi, eax
xor ebx, ebx
test esi, esi
je 0x433b93
push 0x20
pop eax
cmp word [esi], ax
jne 0x433ba9
inc esi
add esi, 1
jne 0x433b88
mov eax, ebx
cmp dword [edi + 0x10], ebx
jne 0x433be1
cmp byte [edi + 0x14], 0
je 0x433bcd
mov dword [edi + 0x10], 0x14
jmp 0x433be1
cmp word [esi], bx
je 0x433b93
push esi
push 0x400
push 0x70f7d8
call fcn.00437d78
mov edx, edi
mov ecx, esi
call fcn.00433bf0
test eax, eax
jne 0x433be1
jmp 0x433b95
xor ecx, ecx
cmp dword [edi + 0x18], 3
setne cl
dec ecx
and ecx, 0x385
dec ecx
mov dword [edi + 0x10], ecx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret
Function at 0x437631
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6e83f9
mov eax, dword fs:[0]
push eax
mov eax, 0x8020
call fcn.004333d8
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 0x6fe5b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x8018]
push eax
push 0xf003f
push ebx
push 0x4377a8
push SysReAllocString
mov dword [ebp - 0x8018], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x437778
mov esi, ebx
push 0x7ffe
lea eax, [ebp - 0x8010]
mov dword [ebp - 0x8024], 0x3fff
push ebx
push eax
call fcn.00436326
add esp, 0xc
mov dword [ebp - 0x801c], ebx
lea eax, [ebp - 0x8020]
mov dword [ebp - 0x8020], 4
push eax
lea eax, [ebp - 0x801c]
push eax
push ebx
push ebx
lea eax, [ebp - 0x8024]
push eax
lea eax, [ebp - 0x8010]
push eax
push esi
push dword [ebp - 0x8018]
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, eax
test edi, edi
jne 0x437763
lea eax, [ebp - 0x8010]
push eax
lea ecx, [ebp - 0x8028]
call fcn.004a8611
mov byte [ebp - 4], 1
lea eax, [ebp - 0x8011]
mov ecx, dword [0x6fe5b4]
push eax
lea eax, [ebp - 0x8010]
push eax
call fcn.006126e3
test al, al
jne 0x437752
cmp dword [ebp - 0x801c], edi
mov ecx, dword [0x6fe5b4]
setne al
movzx eax, al
push eax
lea eax, [ebp - 0x8010]
push eax
call fcn.00612a74
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x8028]
lea ecx, [ecx - 0x10]
call fcn.0040119b
inc esi
test edi, edi
je 0x4376a0
push dword [ebp - 0x8018]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 0x6fe5b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0040548e
leave
ret

Function at 0x437ef1
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x18]
xor edi, edi
push eax
push 0x28
mov dword [ebp - 0x18], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
test esi, esi
je 0x437f75
lea eax, [ebp - 0x20]
push eax
push 0x437f98
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x437f75
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
neg eax
mov dword [ebp - 0x14], 1
push edi
sbb eax, eax
mov dword [ebp - 0xc], ecx
push edi
and eax, 2
push 0x10
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 0x18]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
neg eax
sbb eax, eax
not eax
and esi, eax
cmp dword [ebp - 0x18], edi
je 0x437f83
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.0040548e
leave
ret 4
Function at 0x437fba
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x6c2728
call fcn.00401167
mov esi, ecx
cmp dword [0x6fe660], 0
jne 0x4380b6
cmp dword [0x6fe65c], 0
jne 0x4380b6
cmp dword [0x70ffe0], 0
jne 0x4380b6
cmp dword [0x70ffd8], 0
jne 0x4380b6
call fcn.00432d1c
test eax, eax
js 0x4380bb
mov edx, 0x6fe660
mov ecx, esi
call fcn.004380c1
test eax, eax
js 0x4380bb
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ecx, ecx
mov dword [0x6fe65c], eax
test eax, eax
setne cl
push ecx
call fcn.004050cb
test eax, eax
js 0x4380bb
push 0x49e2f3
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor ecx, ecx
mov dword [0x70ffe0], eax
test eax, eax
setne cl
push ecx
call fcn.004050cb
test eax, eax
js 0x4380bb
push 0x70ffd8
push ebx
push ebx
push 0x404d7c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
xor ecx, ecx
test esi, esi
setne cl
push ecx
call fcn.004050cb
mov edi, eax
test edi, edi
js 0x4380a0
push 1
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edi, ebx
or dword [ebp - 4], 0xffffffff
test esi, esi
je 0x4380b2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], ebx
mov eax, edi
jmp 0x4380bb
mov eax, 0x800704df
call fcn.004026a3
ret

Function at 0x438a18
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
xor eax, eax
mov ebx, 0x104
mov dword [ebp - 0x210], ebx
mov word [edi], ax
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
push eax
call fcn.004050cb
mov esi, eax
test esi, esi
jne 0x438a9b
cmp dword [ebp - 0x210], 0xa
jbe 0x438a89
push 0xa
push 0x438b00
lea eax, [ebp - 0x20c]
push eax
call fcn.00433f17
test eax, eax
je 0x438a9b
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x438ac5
push ebx
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x438ab3
cmp eax, ebx
jbe 0x438ac1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
mov esi, eax
test esi, esi
jne 0x438aec
push ebx
push edi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
test eax, eax
je 0x438adc
cmp eax, ebx
jb 0x438aec
lea eax, [ebp - 0x20c]
push eax
push ebx
push edi
call fcn.00437d78
mov esi, eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040548e
leave
ret
Function at 0x438db9
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x6fe1c0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [ecx], edi
je 0x438e2a
lea eax, [ebp - 0x20]
push eax
push 0x437f98
push edi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x438e2a
lea eax, [ebp - 0x18]
push eax
push 0x20
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x438e2a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
push edi
push edi
push 0x10
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x14]
push eax
push edi
push dword [ebp - 0x18]
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040548e
leave
ret 4
Function at 0x43a3a9
Capabilities:
Set registry value

Disassembly:
push 0xc
mov eax, 0x6e84ec
call fcn.00401167
mov esi, ecx
push 0x6fe5b8
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [0x6fe5b4]
cmp dword [eax + 4], ebx
jbe 0x43a455
mov ecx, esi
call fcn.00437631
push ebx
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], ebx
push eax
push ebx
push 0xf003f
push ebx
push ebx
push ebx
push 0x4377a8
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x43a455
mov edi, dword [0x6fe5b4]
mov ecx, edi
call fcn.0061230c
mov ebx, eax
test ebx, ebx
je 0x43a44c
push ebx
mov ecx, edi
mov esi, ebx
call fcn.00612160
mov ebx, eax
xor eax, eax
cmp byte [esi + 4], al
push 4
setne al
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 4
push 0
push dword [esi]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test ebx, ebx
je 0x43a44c
mov edi, dword [0x6fe5b4]
jmp 0x43a414
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
or dword [ebp - 4], 0xffffffff
push 0x6fe5b8
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call fcn.004026a3
ret

Function at 0x43b047
Capabilities:
Check for time delay via gettickcount
Suspend thread
Terminate process

Disassembly:
call fcn.0043b258
mov byte [0x6fe810], 1
call fcn.0043a053
cmp dword [0x6fe820], 0
je 0x43b06e
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, eax
call fcn.0043a080
test eax, eax
jne 0x43b092
call fcn.0043b244
test eax, eax
jne 0x43b092
call fcn.0043a08c
test eax, eax
je 0x43b0bf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3a98
jae 0x43b0ab
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x43b077
mov eax, dword [0x6fe820]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
call fcn.0043b0df
call fcn.0043b0cd
xor eax, eax
pop edi
ret

Function at 0x48c502
Capabilities:
Get hostname

Disassembly:
push 8
mov eax, 0x6c01b0
call fcn.00401167
lea eax, [ebp - 0x10]
xor edi, edi
push eax
push edi
push 5
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x48c594
call esi
cmp eax, 0xea
jne 0x48c594
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
xor ecx, ecx
mov eax, dword [ebp - 0x10]
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.00439c0c
mov edi, eax
lea eax, [ebp - 0x10]
pop ecx
push eax
push edi
push 5
mov dword [ebp - 0x14], edi
call dword [sym.imp.KERNEL32.dll_GetComputerNameExW]
test eax, eax
jne 0x48c573
call esi
push eax
call fcn.00435aec
mov esi, eax
jmp 0x48c581
push edi
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ecx], eax
or dword [ebp - 4], 0xffffffff
push edi
call fcn.004030a8
and dword [ebp - 0x14], 0
mov eax, esi
pop ecx
jmp 0x48c59c
call esi
push eax
call fcn.00435aec
call fcn.004026a3
ret 4
Function at 0x48d0b0
Capabilities:
Terminate process

Disassembly:
push 0x50
mov eax, 0x6c04c8
call fcn.00432a44
mov dword [ebp - 0x54], ecx
mov esi, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x58], esi
mov dword [ebp - 0x50], eax
mov dword [ebp - 4], eax
push eax
push eax
push 1
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
xor eax, eax
test edi, edi
mov dword [ebp - 0x50], edi
setne al
push eax
call fcn.004050cb
mov ebx, eax
mov dword [ebp - 0x44], ebx
test ebx, ebx
js 0x48d234
and dword [ebp - 0x4c], 0
mov byte [ebp - 4], 1
mov ecx, dword [esi + 8]
test ecx, ecx
jne 0x48d10b
mov ecx, 0x47dc88
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x4c]
push eax
call fcn.0048ba30
mov ebx, eax
mov dword [ebp - 0x44], ebx
test ebx, ebx
js 0x48d227
and dword [ebp - 0x48], 0
mov byte [ebp - 4], 2
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, dword [ebp - 0x54]
lea edi, [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x58]
lea esi, [ecx + 0x14]
movsd dword es:[edi], dword [esi]
mov eax, dword [eax + 0xc]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x28], eax
mov eax, dword [ecx + 4]
mov dword [ebp - 0x20], eax
mov eax, dword [ecx + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ecx + 0x10]
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov al, byte [0x721aae]
mov byte [ebp - 0x14], al
lea eax, [ebp - 0x48]
push eax
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x13], 0
call fcn.00438e94
mov esi, dword [ebp - 0x48]
mov ebx, eax
mov dword [ebp - 0x44], ebx
test ebx, ebx
jne 0x48d214
push eax
push 0x7530
push eax
lea eax, [ebp - 0x5c]
mov dword [ebp - 0x5c], esi
push eax
push 2
mov dword [ebp - 0x58], edi
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
test eax, eax
jne 0x48d1c7
lea eax, [ebp - 0x44]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ebx, dword [ebp - 0x44]
test ebx, ebx
js 0x48d205
mov ebx, 0x80080005
jmp 0x48d200
cmp eax, 1
jne 0x48d1d3
xor ebx, ebx
mov dword [ebp - 0x44], ebx
jmp 0x48d207
cmp eax, 0x102
jne 0x48d1f2
push 0x5b4
push esi
mov dword [ebp - 0x44], 0x800705b4
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ebx, dword [ebp - 0x44]
jmp 0x48d203
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00435aec
mov ebx, eax
mov dword [ebp - 0x44], ebx
test ebx, ebx
jne 0x48d214
mov ecx, dword [ebp - 0x54]
mov eax, esi
xor esi, esi
mov dword [ebp - 0x48], esi
mov dword [ecx + 0xc], eax
mov byte [ebp - 4], 1
test esi, esi
je 0x48d227
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x48], 0
mov byte [ebp - 4], 0
push dword [ebp - 0x4c]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
or dword [ebp - 4], 0xffffffff
test edi, edi
je 0x48d247
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 0x50], 0
mov eax, ebx
call fcn.00402698
ret 0xc