joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d71f
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push edi
xor edi, edi
mov esi, ecx
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x38], eax
test eax, eax
je 0x41d778
lea eax, [esi + 0x3c]
push eax
push edi
push esi
push 0x41d110
push edi
push edi
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
mov dword [esi + 4], eax
test eax, eax
je 0x41d767
push 0x32
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x41d755
cmp dword [esi + 0x38], edi
je 0x41d778
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x38], edi
pop edi
pop esi
ret 4

Function at 0x41e074
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x444f94]
push esi
xor esi, esi
mov dword [ebp - 4], ecx
mov dword [ebp - 8], esi
test eax, eax
je 0x41e0ad
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e0ad
push dword [ebp - 4]
push esi
push 0x5c6
push dword [0x444f94]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 8]
push eax
push 2
push esi
push 0x4017c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e0f4
cmp dword [ebp - 4], esi
jne 0x41e0d4
mov dword [ebp - 4], 1
push 4
lea eax, [ebp - 4]
push eax
push 4
push esi
push 0x401b44
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x41e0f9
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [0x444f94]
push esi
xor esi, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], esi
test eax, eax
je 0x41e132
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41e132
push dword [ebp - 8]
push esi
push 0x5c7
push dword [0x444f94]
call dword [sym.imp.USER32.dll_PostMessageW]
lea eax, [ebp - 4]
push eax
push 2
push esi
push 0x4017c0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41e16d
push 4
lea eax, [ebp - 8]
push eax
push 4
push esi
push 0x401b14
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x41f29f
Capabilities:
Get disk size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push ecx
mov edx, 0x103
lea ecx, [ebp - 0x210]
call fcn.0040c010
lea eax, [ebp - 0x210]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcschr]
mov ebx, eax
xor eax, eax
pop ecx
pop ecx
test ebx, ebx
jne 0x41f2e8
xor edx, edx
jmp 0x41f38e
mov word [ebx + 2], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
jne 0x41f33f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x41f321
push 0x57
pop eax
test eax, eax
jle 0x41f32b
movzx eax, ax
or eax, 0x80070000
push eax
push 0x4043a4
push 2
call fcn.0041ea5f
add esp, 0xc
xor eax, eax
jmp 0x41f2e1
mov edi, dword [ebp - 0x218]
mov esi, dword [ebp - 0x214]
test edi, edi
jne 0x41f38a
test esi, esi
jne 0x41f38a
xor eax, eax
mov word [ebx], ax
lea eax, [ebp - 0x220]
push eax
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x218]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
test eax, eax
je 0x41f38a
mov edi, dword [ebp - 0x218]
mov esi, dword [ebp - 0x214]
mov eax, edi
mov edx, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret

Function at 0x41f3f3
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push ecx
mov edx, 0x104
lea ecx, [ebp - 0x20c]
xor esi, esi
call fcn.0040c010
test eax, eax
js 0x41f46e
lea ecx, [ebp - 0x20c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x41f429
sub ecx, edx
sar ecx, 1
je 0x41f455
cmp word [ebp + ecx*2 - 0x20e], 0x5c
jne 0x41f455
test ecx, ecx
je 0x41f455
xor eax, eax
mov word [ebp + ecx*2 - 0x20e], ax
jmp 0x41f420
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f46e
test al, 0x10
je 0x41f46e
xor esi, esi
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret

Function at 0x41f47f
Capabilities:
Check if file exists
Get file attributes

Disassembly:
test ecx, ecx
je 0x41f497
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x41f497
test al, 0x10
jne 0x41f497
xor eax, eax
inc eax
ret
xor eax, eax
ret
Function at 0x41f49a
Capabilities:
Create directory

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
lea edx, [ecx + 2]
push 2
mov dword [ebp - 0x10], edi
xor ebx, ebx
pop esi
mov ax, word [ecx]
add ecx, esi
cmp ax, bx
jne 0x41f4bc
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 0x14]
xor ecx, ecx
mov dword [ebp - 8], eax
mul esi
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x41f5bf
mov edx, dword [ebp - 8]
mov ecx, esi
push edi
call fcn.0040c010
push 0x4043d8
push esi
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x41f5b8
add eax, 4
mov dword [ebp - 0xc], ebx
push 0x4043e0
push eax
call dword [sym.imp.msvcrt.dll_wcsstr]
pop ecx
pop ecx
test eax, eax
je 0x41f5b0
xor ecx, ecx
mov word [eax], cx
add eax, 2
mov ecx, esi
mov dword [ebp - 0x14], eax
call fcn.0041f3f3
test eax, eax
jne 0x41f57d
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
test edi, edi
jne 0x41f558
push 0x57
pop edi
test edi, edi
jle 0x41f563
movzx edi, di
or edi, 0x80070000
mov ecx, esi
call fcn.0041f3f3
test eax, eax
je 0x41f59c
push ebx
push esi
push 5
push 8
call dword [sym.imp.SHELL32.dll_SHChangeNotify]
mov edi, dword [ebp - 0x10]
mov edx, dword [ebp - 8]
mov ecx, esi
push edi
call fcn.0040c010
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, 0xa
jge 0x41f5b0
mov eax, dword [ebp - 0x14]
jmp 0x41f513
push edi
push esi
push 0x4043e4
push 2
call fcn.0041ea5f
mov edi, dword [ebp - 0x10]
add esp, 0x10
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push esi
call fcn.00441807
pop ecx
test edi, edi
je 0x41f5cc
mov ecx, edi
call fcn.0041f3f3
mov ebx, eax
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x41fa39
Capabilities:
Compare security identifiers

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
or dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x10]
push ebx
push eax
push 0x20008
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41fb29
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], ebx
push eax
push ebx
push ebx
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
push dword [ebp - 0x14]
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x41fb19
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x14]
push esi
push 2
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x41fb12
lea eax, [ebp - 0x1c]
mov dword [ebp - 0xc], ebx
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x500
push eax
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x41fb12
push edi
mov edi, ebx
cmp dword [esi], ebx
jbe 0x41fb08
lea eax, [esi + 4]
mov dword [ebp - 0x18], eax
push dword [eax]
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
jne 0x41fb05
mov eax, dword [ebp - 0x18]
inc edi
add eax, 8
mov dword [ebp - 0x18], eax
cmp edi, dword [esi]
jb 0x41fae6
jmp 0x41fb08
xor ebx, ebx
inc ebx
push dword [ebp - 0x1c]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
pop edi
push esi
call fcn.00441807
pop ecx
cmp dword [ebp - 0x10], 0
pop esi
je 0x41fb29
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret

Function at 0x41fd14
Capabilities:
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x18]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x41fd91
lea eax, [ebp - 0x10]
xor esi, esi
push eax
push 0x404698
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 1
push eax
push esi
push dword [ebp - 0x18]
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x41fd83
push 0x80040002
push 4
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_InitiateShutdownW]
cmp dword [ebp - 0x18], esi
je 0x41fd91
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x420056
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x214
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
mov dword [ebp - 0x214], ecx
push esi
lea eax, [ebp - 0x20c]
mov edi, edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4200df
push ecx
lea eax, [ebp - 0x210]
mov edx, esi
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040c131
test eax, eax
js 0x4200df
mov eax, dword [ebp - 0x210]
mov edx, esi
push ecx
push 0x401668
push ecx
lea ecx, [ebp - 0x20c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x4200df
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4200df
test al, 0x10
je 0x420145
push esi
lea eax, [ebp - 0x20c]
xor ebx, ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x420166
push ecx
lea eax, [ebp - 0x210]
mov edx, esi
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040c131
test eax, eax
js 0x420166
mov eax, dword [ebp - 0x210]
sub esi, eax
push ecx
push 0x40473c
push ecx
lea ecx, [ebp - 0x20c]
mov edx, esi
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x420166
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420164
test al, 0x10
jne 0x420164
mov ecx, dword [ebp - 0x214]
lea eax, [ebp - 0x20c]
shr edi, 1
push eax
mov edx, edi
call fcn.0041fb3c
xor ebx, ebx
test eax, eax
setns bl
jmp 0x420166
xor ebx, ebx
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret

Function at 0x420179
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4201fc
push ecx
lea eax, [ebp - 0x210]
mov edx, edi
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040c131
test eax, eax
js 0x4201fc
mov eax, dword [ebp - 0x210]
sub edi, eax
push ecx
push 0x401668
push ecx
lea ecx, [ebp - 0x20c]
mov edx, edi
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x4201fc
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4201fc
test al, 0x10
jne 0x4201fc
inc esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x42020e
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x20c]
push edi
push eax
mov esi, ecx
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x4202a8
push ecx
lea eax, [ebp - 0x210]
mov edx, edi
push eax
lea ecx, [ebp - 0x20c]
call fcn.0040c131
test eax, eax
js 0x4202a8
mov eax, dword [ebp - 0x210]
mov edx, edi
push ecx
push 0x401c8c
push ecx
lea ecx, [ebp - 0x20c]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
test eax, eax
js 0x4202a8
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x4202a8
test al, 0x10
jne 0x4202a8
lea eax, [ebp - 0x20c]
mov edx, edi
push eax
mov ecx, esi
call fcn.0040c010
test eax, eax
setns bl
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x42089d
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [0x444f8c]
lea eax, [ebp - 4]
push edi
xor edi, edi
push edi
push eax
push edi
push 2
push edi
push edi
push edi
push 0x404760
push SysReAllocStringLen
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x420914
mov edx, 0x402e68
test esi, esi
jne 0x4208dd
mov edx, 0x4047c4
mov ecx, edx
lea esi, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, di
jne 0x4208e2
sub ecx, esi
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push edx
push 1
push edi
push 0x403798
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x420a97
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push 2
push 0
push 0x4047d0
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x420aef
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 1
push eax
push 4
push esi
push 0x404834
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x420aff
push esi
push 0x404860
push 2
call fcn.0041fb3c
add esp, 0xc
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x420eb9
Capabilities:
Check if file exists
Delete directory
Get file attributes
Set file attributes

Disassembly:
mov edi, edi
push esi
push edi
mov edi, ecx
xor esi, esi
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x420f1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x420edb
push 0x57
pop esi
cmp esi, 5
jne 0x420f1d
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x420f1d
test al, 1
je 0x420f1d
and eax, 0xfffffffe
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x420f1d
push edi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
je 0x420f0e
xor esi, esi
jmp 0x420f1d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
jne 0x420f1d
push 0x57
pop esi
pop edi
mov eax, esi
pop esi
ret
Function at 0x42146e
Capabilities:
Copy file
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
xor ebx, ebx
test eax, 0x4000
je 0x4214e0
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0041eb51
test eax, eax
je 0x4214d2
mov ecx, dword [ebp - 0xc]
push ebx
push edi
call dword [0x446624]
call dword [ebp - 0xc]
test eax, eax
jne 0x4214d2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x404ad8
push 2
call fcn.0041ea5f
add esp, 0x10
cmp dword [ebp - 8], ebx
je 0x4214e0
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
test eax, 0x4000
je 0x421542
lea ecx, [ebp - 0xc]
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call fcn.0041eb51
test eax, eax
je 0x421534
mov ecx, dword [ebp - 0xc]
push ebx
push esi
call dword [0x446624]
call dword [ebp - 0xc]
test eax, eax
jne 0x421534
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push 0x404ad8
push 2
call fcn.0041ea5f
add esp, 0x10
cmp dword [ebp - 8], ebx
je 0x421542
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00441b90
mov esp, ebp
pop ebp
ret

Function at 0x421555
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x4434f4]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x104
lea eax, [ebp - 0x210]
push edi
push eax
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x421632
push esi
mov edx, edi
lea ecx, [ebp - 0x418]
call fcn.0040c010
push ecx
lea eax, [ebp - 0x41c]
mov edx, edi
push eax
lea ecx, [ebp - 0x210]
call fcn.0040c131
test eax, eax
js 0x4215cf
mov eax, dword [ebp - 0x41c]
mov edx, edi
push ecx
push 0x404b18
push ecx
lea ecx, [ebp - 0x210]
sub edx, eax
lea ecx, [ecx + eax*2]
call fcn.0040c197
lea eax, [ebp - 0x418]
push 0x5c
push eax
call dword [sym.imp.msvcrt.dll_wcsrchr]
pop ecx
pop ecx
test eax, eax
je 0x421632
push eax
mov edx, edi
lea ecx, [ebp - 0x210]
call fcn.0040c045
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x421632
test al, 0x10
jne 0x421632
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x418]
call fcn.0042146e
test eax, eax
jne 0x421632
push eax
push eax
push 1
lea edx, [ebp - 0x210]
lea ecx, [ebp - 0x418]
call fcn.00420b04
push esi
push 0x404b2c
push 4
call fcn.0041ea5f
mov ecx, dword [ebp - 4]
add esp, 0xc
xor ecx, ebp
pop edi
pop esi
call fcn.00441b90
mov esp, ebp
pop ebp
ret
Function at 0x421652
Capabilities:
Persist via run registry key
Query or enumerate registry value
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
xor esi, esi
mov ebx, ecx
push 0x28
mov dword [ebp - 8], esi
mov dword [ebp - 4], esi
call fcn.0044183a
mov edi, eax
pop ecx
test edi, edi
jne 0x42167f
mov eax, 0x8007000e
jmp 0x4217fd
lea eax, [ebp - 4]
push eax
push 2
push esi
push 0x401848
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x42170f
push 0x208
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x421704
mov edx, 0x104
mov ecx, esi
call fcn.0041eb9c
test eax, eax
je 0x4216fd
push 0x404edc
mov edx, 0x104
mov ecx, esi
call fcn.0040c045
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 8]
jne 0x4216d1
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
xor eax, eax
push eax
push 0x404ef0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push esi
call fcn.00441807
pop ecx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 3
push esi
push esi
push esi
push 0x404f10
push SysReAllocStringLen
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
jne 0x4217d8
push dword [0x444fa0]
push 0x4043d0
push 0x14
push edi
call fcn.0040c0b5
jmp 0x421769
mov eax, dword [0x444fa0]
cmp eax, 0x3e8
jge 0x42177e
inc eax
push eax
push 0x4043d0
push 0x14
push edi
mov dword [0x444fa0], eax
call fcn.0040c0b5
add esp, 0x10
push esi
push esi
push esi
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x421749
mov ecx, ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, si
jne 0x421783
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push ebx
push 2
push esi
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
test esi, esi
jne 0x4217b4
inc dword [0x444fa0]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4217d8
push ebx
push 0x404fc4
push 4
call fcn.0041fb3c
add esp, 0xc
mov esi, 0xd2af9
jmp 0x4217f4
jle 0x4217e3
movzx esi, si
or esi, 0x80070000
push esi
push ebx
push 0x404f84
push 2
call fcn.0041ea5f
add esp, 0x10
push edi
call fcn.00441807
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42217c
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
xor edi, edi
lea eax, [ebp - 8]
push edi
push edi
push edi
push edi
push edi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword [ebp - 0x20], edi
push eax
push edi
push edi
mov esi, ecx
mov dword [ebp - 0xc], edi
push edi
mov ebx, edx
mov dword [ebp - 0x18], esi
push esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
je 0x4221c2
xor eax, eax
jmp 0x42230a
mov ecx, ebx
push 2
pop ebx
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, ebx
cmp ax, di
jne 0x4221ca
mov eax, dword [ebp - 8]
sub ecx, edx
sar ecx, 1
mov dword [ebp - 0x10], ecx
cmp ecx, eax
jbe 0x4221e4
mov eax, ecx
inc dword [ebp - 0xc]
add eax, 5
xor ecx, ecx
mov dword [ebp - 8], eax
mul ebx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0044183a
mov edi, eax
pop ecx
test edi, edi
jne 0x42220f
push 8
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x4221bb
xor eax, eax
mov dword [ebp - 4], eax
mov ebx, eax
push ebx
push dword [ebp - 0x1c]
push 0x405474
push dword [ebp - 8]
push edi
call fcn.0040c0b5
add esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x2001f
xor eax, eax
push eax
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4222df
cmp dword [ebp + 8], eax
je 0x4222bc
push 0x208
call fcn.0044183a
mov esi, eax
pop ecx
test esi, esi
je 0x4222b9
lea eax, [ebp - 0x10]
mov dword [ebp - 0x14], 1
push eax
push esi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x10], 0x104
push eax
xor eax, eax
push eax
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4222b2
cmp dword [ebp - 0x14], 1
jne 0x4222b2
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
cmp ax, word [ebp - 0x20]
jne 0x422290
sub ecx, edx
sar ecx, 1
je 0x4222b2
push dword [ebp + 8]
push esi
call dword [sym.imp.msvcrt.dll__wcsicmp]
pop ecx
pop ecx
test eax, eax
je 0x4222d6
push esi
call fcn.00441807
pop ecx
mov esi, dword [ebp - 0x18]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc ebx
mov dword [ebp - 4], eax
cmp ebx, dword [ebp - 0xc]
jbe 0x422216
jmp 0x422300
push esi
call fcn.00441807
pop ecx
jmp 0x422300
xor ecx, ecx
lea eax, [ebp - 4]
push ecx
push eax
push ecx
push 0x2001f
push ecx
push ecx
push ecx
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
neg eax
sbb eax, eax
not eax
and dword [ebp - 4], eax
push edi
call fcn.00441807
mov eax, dword [ebp - 4]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4