joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e1d4
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x455b44]
cmp dword [eax + 0x30], 0
je 0x44e27e
cmp dword [ebx + 0x94], 0
jne 0x44e278
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44e164
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44e278
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44e23e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44e278
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413ea4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44e24d
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44eddc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44ee11
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404498
jmp 0x44ee1e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004043fc
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44ff30
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44ff71
mov eax, esi
call fcn.004364d0
test al, al
je 0x44ff71
mov eax, dword [ebx + 0x84]
call fcn.004361cc
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44ff71
push 0
mov eax, dword [ebx + 0x84]
call fcn.004361cc
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x4510a8
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451211
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404440
mov eax, dword [ebp - 0x10]
call fcn.00450d34
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x4510fa
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404908
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045143c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4511cf
xor eax, eax
push ebp
push 0x4511c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00450ea4
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00451240
test al, al
je 0x4511a6
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00404498
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4511a6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404868
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4511a0
mov eax, dword [ebp - 0x14]
call fcn.00404868
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004045a0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004510a8
dec ebx
cmp ebx, 0xffffffff
jne 0x451159
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4511cf
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00450ea4
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404868
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00450e90
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451218
lea eax, [ebp - 0x3c]
call fcn.004043a8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004043cc
ret
Function at 0x4511cf
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffc4
push ebx
xor ecx, ecx
mov dword [ebp - 0x3c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x451211
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
mov edx, ebx
call fcn.00404440
mov eax, dword [ebp - 0x10]
call fcn.00450d34
mov byte [ebp - 9], al
cmp byte [ebp - 9], 0
jne 0x4510fa
lea eax, [ebp - 0x10]
mov ecx, 1
mov edx, 1
call fcn.00404908
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0045143c
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4511cf
xor eax, eax
push ebp
push 0x4511c8
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00450ea4
lea edx, [ebp - 0x38]
mov eax, dword [ebp - 4]
call fcn.00451240
test al, al
je 0x4511a6
mov ecx, dword [ebp - 0x34]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00404498
mov ebx, dword [ebp - 0x38]
dec ebx
cmp ebx, 0
jl 0x4511a6
mov eax, dword [ebp - 0x34]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404868
push eax
push ebx
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x4511a0
mov eax, dword [ebp - 0x14]
call fcn.00404868
mov edx, eax
lea eax, [ebp - 0x3c]
call fcn.004045a0
mov edx, dword [ebp - 0x3c]
mov eax, dword [ebp - 4]
call fcn.004510a8
dec ebx
cmp ebx, 0xffffffff
jne 0x451159
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4511cf
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00450ea4
mov eax, dword [ebp - 0x1c]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
mov eax, dword [ebp - 0x10]
call fcn.00404868
push eax
mov dl, byte [ebp - 9]
mov eax, dword [ebp - 4]
call fcn.00450e90
push eax
call sub.advapi32.dll_RegDeleteKeyA
test eax, eax
sete bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451218
lea eax, [ebp - 0x3c]
call fcn.004043a8
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.004043cc
ret

Function at 0x451240
Capabilities:
Query or enumerate registry key

Disassembly:
push ebx
push esi
mov ebx, edx
mov esi, eax
mov eax, ebx
xor ecx, ecx
mov edx, 0x1c
call fcn.0040304c
lea eax, [ebx + 0x14]
push eax
push 0
lea eax, [ebx + 0x10]
push eax
lea eax, [ebx + 0xc]
push eax
lea eax, [ebx + 8]
push eax
push 0
lea eax, [ebx + 4]
push eax
push ebx
push 0
push 0
push 0
mov eax, dword [esi + 4]
push eax
call sub.advapi32.dll_RegQueryInfoKeyA
test eax, eax
sete al
mov edx, dword [0x4540f8]
cmp byte [edx + 0xc], 0
je 0x4512a4
mov edx, dword [0x4540ec]
cmp dword [edx], 2
jne 0x4512a4
mov edx, dword [ebx + 4]
add dword [ebx + 4], edx
mov edx, dword [ebx + 0xc]
add dword [ebx + 0xc], edx
pop esi
pop ebx
ret
Function at 0x451360
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov al, byte [ebp + 8]
call fcn.00450d48
mov esi, eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push 0
mov eax, edi
call fcn.00404868
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegSetValueExA
test eax, eax
je 0x4513be
mov dword [ebp - 0xc], edi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x453f30]
mov dl, 1
mov eax, dword [0x450c6c]
call fcn.0040b964
call fcn.00403dbc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4513c8
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.00404868
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x451420
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x454104]
mov dl, 1
mov eax, dword [0x450c6c]
call fcn.0040b964
call fcn.00403dbc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00450d78
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x451660
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 4], edx
mov esi, eax
xor eax, eax
push ebp
push 0x451777
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, esi
call fcn.00450ea4
xor eax, eax
push ebp
push 0x451752
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x2c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00451240
test al, al
je 0x451736
mov eax, dword [ebp + 8]
push eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00451540
pop ecx
mov ecx, dword [ebp - 0x20]
inc ecx
lea eax, [ebp - 0xc]
xor edx, edx
call fcn.00404498
mov ebx, dword [ebp - 0x24]
dec ebx
test ebx, ebx
jl 0x451736
inc ebx
xor edi, edi
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 8], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404868
push eax
push edi
push esi
call sub.advapi32.dll_RegEnumValueA
test eax, eax
jne 0x451732
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00404868
mov edx, eax
lea eax, [ebp - 0x30]
call fcn.004045a0
mov ecx, dword [ebp - 0x30]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.00451540
pop ecx
inc edi
dec ebx
jne 0x4516e7
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451759
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x10]
call fcn.00450ea4
ret
Function at 0x451788
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffb0
xor ecx, ecx
mov dword [ebp - 0x50], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x48], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4519c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 4]
call fcn.00450ea4
xor eax, eax
push ebp
push 0x45199f
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x44]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00451240
test al, al
je 0x451983
mov ecx, dword [ebp - 0x40]
inc ecx
lea eax, [ebp - 0x14]
xor edx, edx
call fcn.00404498
mov eax, dword [ebp - 0x44]
dec eax
test eax, eax
jl 0x451983
inc eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x40]
inc eax
mov dword [ebp - 0xc], eax
push 0
push 0
push 0
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x14]
call fcn.00404868
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegEnumKeyExA
test eax, eax
jne 0x451977
mov eax, dword [ebp - 0x14]
call fcn.00404868
mov edx, eax
lea eax, [ebp - 0x48]
call fcn.004045a0
mov edx, dword [ebp - 0x48]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0045143c
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x451977
xor eax, eax
push ebp
push 0x451970
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov eax, dword [eax + 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 8]
call fcn.00450ea4
xor eax, eax
push ebp
push 0x451952
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x14]
call fcn.00404868
mov edx, eax
lea eax, [ebp - 0x4c]
call fcn.004045a0
mov edx, dword [ebp - 0x4c]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.00450ea8
mov eax, dword [ebp - 0x14]
call fcn.00404868
mov edx, eax
lea eax, [ebp - 0x50]
call fcn.004045a0
mov edx, dword [ebp - 0x50]
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
call fcn.0045143c
mov dword [ebp - 0x24], eax
xor eax, eax
push ebp
push 0x45192f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00451660
pop ecx
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x20]
call fcn.00451788
pop ecx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451936
mov eax, dword [ebp - 0x24]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
inc dword [ebp - 0x10]
dec dword [ebp - 0x28]
jne 0x451813
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4519a6
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [ebp - 0x18]
call fcn.00450ea4
ret
Function at 0x451d74
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov edi, ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404858
xor eax, eax
push ebp
push 0x451e0a
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
mov eax, dword [ebp - 4]
call fcn.00404868
push eax
push 0
call sub.kernel32.dll_FindResourceA
mov ebx, eax
push ebx
push 0
call sub.kernel32.dll_LoadResource
mov esi, eax
push ebx
push 0
call sub.kernel32.dll_SizeofResource
mov ebx, eax
push esi
call sub.kernel32.dll_LockResource
mov dword [ebp - 8], eax
lea eax, [ebp - 0xc]
mov ecx, ebx
mov edx, dword [ebp - 8]
call fcn.00404498
mov eax, edi
mov edx, dword [ebp - 0xc]
call fcn.004043fc
push esi
call sub.kernel32.dll_FreeResource
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451e11
lea eax, [ebp - 0xc]
call fcn.004043a8
lea eax, [ebp - 4]
call fcn.004043a8
ret

Function at 0x451e18
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x12c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x451ef0
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor edx, edx
mov eax, 2
call fcn.00450a88
mov edi, eax
test edi, edi
je 0x451ed7
mov dword [ebp - 0x128], 0x128
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.00450aa8
test eax, eax
je 0x451ed1
lea eax, [ebp - 0x12c]
lea edx, [ebp - 0x104]
mov ecx, 0x104
call fcn.00404618
mov eax, dword [ebp - 0x12c]
mov edx, esi
call fcn.004047b4
jne 0x451ec0
mov eax, dword [ebp - 0x120]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov esi, eax
test esi, esi
je 0x451ed1
push 0
push esi
call sub.kernel32.dll_TerminateProcess
cmp eax, 1
sbb ebx, ebx
inc ebx
push esi
call sub.kernel32.dll_CloseHandle
jmp 0x451ed1
lea edx, [ebp - 0x128]
mov eax, edi
call fcn.00450ac8
test eax, eax
jne 0x451e6f
push edi
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x451ef7
lea eax, [ebp - 0x12c]
call fcn.004043a8
ret

Function at 0x451fc8
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffef8
mov ebx, eax
push 0x105
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetWindowsDirectoryA
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.00404618
mov eax, dword [ebx]
call fcn.00404668
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x5c
je 0x45200a
mov eax, ebx
mov edx, 0x45201c
call fcn.00404670
add esp, 0x108
pop ebx
ret
Function at 0x452020
Capabilities:
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, 0x455bbc
xor eax, eax
push ebp
push 0x4520d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x450ccc]
call fcn.00450da0
mov dword [ebx], eax
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00450e40
mov cl, 1
mov edx, 0x4520e8
mov eax, dword [ebx]
call fcn.00450f84
lea edx, [ebp - 4]
xor eax, eax
call fcn.00402dec
mov eax, dword [ebp - 4]
push eax
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00402dec
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.0040879c
mov edx, dword [ebp - 8]
mov eax, dword [ebx]
pop ecx
call fcn.00451320
mov eax, dword [ebx]
call fcn.00450e10
mov eax, dword [ebx]
call fcn.00403634
lea edx, [ebp - 0x10]
xor eax, eax
call fcn.00402dec
mov eax, dword [ebp - 0x10]
mov edx, 2
call fcn.004086ec
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4520da
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004043cc
ret

Function at 0x452118
Capabilities:
Create process on windows
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
mov ebx, 0x455bbc
xor eax, eax
push ebp
push 0x4521e2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x450ccc]
call fcn.00450da0
mov dword [ebx], eax
mov edx, 0x80000001
mov eax, dword [ebx]
call fcn.00450e40
mov cl, 1
mov edx, 0x4521f8
mov eax, dword [ebx]
call fcn.00450f84
lea edx, [ebp - 8]
xor eax, eax
call fcn.00402dec
mov eax, dword [ebp - 8]
lea edx, [ebp - 4]
call fcn.0040879c
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
call fcn.00451220
mov eax, dword [ebx]
call fcn.00450e10
mov eax, dword [ebx]
call fcn.00403634
push 0
push 0x452228
push 0x452228
lea eax, [ebp - 0xc]
call fcn.00451fc8
lea eax, [ebp - 0xc]
mov edx, 0x452234
call fcn.00404670
mov eax, dword [ebp - 0xc]
call fcn.00404868
push eax
push 0x452244
push 0
call sub.shell32.dll_ShellExecuteA
push 0
call sub.kernel32.dll_ExitProcess_1
Function at 0x401d28
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
sub esp, 0x18
mov eax, ecx
mov ecx, esp
mov esi, edx
push eax
call fcn.00403eeb
lea ecx, [ebp - 0x10]
call fcn.004019c2
mov eax, dword [ebp - 0xc]
add esp, 0x18
sub eax, dword [ebp - 0x10]
je 0x401d8d
cmp dword [esi + 0x14], 8
jb 0x401d5c
mov eax, dword [esi]
jmp 0x401d5e
mov eax, esi
push 0x42b2a0
push eax
call fcn.0040f815
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x401da2
cmp dword [esi + 0x14], 8
jb 0x401d79
mov esi, dword [esi]
push esi
push str.Cant_create_file__s_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0xc
mov esi, 0x80004005
lea ecx, [ebp - 0x10]
call fcn.00403d26
pop edi
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xc]
sub eax, dword [ebp - 0x10]
push edi
push eax
push 1
push dword [ebp - 0x10]
call fcn.0040f55b
push edi
call fcn.0040aee7
add esp, 0x14
xor esi, esi
jmp 0x401d92

Function at 0x401dc1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov bl, byte [0x4305a4]
lea eax, [ebp - 0x3c]
push esi
push edi
push 0x38
push 0
push eax
mov esi, edx
mov edi, ecx
call fcn.0040a310
and dword [ebp - 0x38], 0
add esp, 0xc
cmp dword [edi + 0x14], 8
mov dword [ebp - 0x40], 0x3c
mov dword [ebp - 0x3c], 0x440
mov dword [ebp - 0x34], str.open
jb 0x401e05
mov edi, dword [edi]
cmp dword [esi + 0x14], 8
mov dword [ebp - 0x30], edi
jb 0x401e10
mov esi, dword [esi]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x2c], esi
push eax
mov dword [ebp - 0x24], 5
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x401e42
push str.ShellExecuteEx_Ok_n
push dword [0x4305a8]
call fcn.0040103c
pop ecx
pop ecx
jmp 0x401e58
call esi
push eax
push str.Error:_0x_X_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0xc
test bl, bl
je 0x401ecf
cmp dword [ebp - 8], 0
je 0x401ecf
push str.Waiting_for_installing..._n
push dword [0x4305a8]
call fcn.0040103c
push dword [0x4305a8]
call fcn.0040ae18
add esp, 0xc
push 0xffffffffffffffff
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x401eaa
push dword [ebp - 4]
push str.Exit_code:_0x_X_n
jmp 0x401eb2
call esi
push eax
push str.Cant_get_exit_code._Error:_0x_X_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0xc
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [ebp - 8], 0
jmp 0x401ef6
push 1
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
test eax, eax
jne 0x401ef6
call esi
push eax
push str.SetHandleInformation_error:_0x_08X_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0xc
push dword [0x4305a8]
call fcn.0040ae18
mov eax, dword [ebp - 8]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401f0c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42413e
mov eax, dword fs:[0]
push eax
mov eax, 0x10090
call fcn.00408620
mov eax, dword [0x42f024]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, edx
mov esi, ecx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x1002c]
call fcn.00406a04
and dword [ebp - 4], 0
mov ecx, 0x42b418
call fcn.004010d7
push eax
push 0x42b418
lea ecx, [ebp - 0x1002c]
call fcn.00404d97
push 0xffffffffffffffff
push 0
push esi
lea ecx, [ebp - 0x1002c]
call fcn.00404e37
test edi, edi
je 0x40201f
mov esi, 0x42b41c
mov ecx, esi
call fcn.004010d7
push eax
push esi
lea ecx, [ebp - 0x1002c]
call fcn.00404d97
mov edx, edi
lea ecx, [ebp - 0x10044]
call fcn.00406d96
push 0xffffffffffffffff
push 0
push eax
lea ecx, [ebp - 0x1002c]
mov byte [ebp - 4], 1
call fcn.00404e37
push 0
push 1
lea ecx, [ebp - 0x10044]
mov byte [ebp - 4], 0
call fcn.004040bc
mov esi, str.___st
mov ecx, esi
call fcn.004010d7
push eax
push esi
lea ecx, [ebp - 0x1002c]
call fcn.00404d97
mov edx, ebx
lea ecx, [ebp - 0x10044]
call fcn.00406d96
push 0xffffffffffffffff
xor ebx, ebx
mov byte [ebp - 4], 2
push ebx
push eax
lea ecx, [ebp - 0x1002c]
call fcn.00404e37
push ebx
push 1
lea ecx, [ebp - 0x10044]
call fcn.004040bc
jmp 0x402021
xor ebx, ebx
cmp dword [ebp - 0x10018], 8
lea eax, [ebp - 0x1002c]
cmovae eax, dword [ebp - 0x1002c]
push eax
lea eax, [ebp - 0x10014]
push 0x8000
push eax
call fcn.0040f095
add esp, 0xc
mov dword [ebp - 0x1009c], 0x44
lea eax, [ebp - 0x10098]
push 0x40
push ebx
push eax
call fcn.0040a310
add esp, 0xc
lea eax, [ebp - 0x10054]
xorps xmm0, xmm0
movups xmmword [ebp - 0x10054], xmm0
push eax
lea eax, [ebp - 0x1009c]
push eax
push ebx
push ebx
push ebx
push 1
push ebx
push ebx
lea eax, [ebp - 0x10014]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x4020af
push dword [ebp - 0x10050]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x10054]
call esi
jmp 0x4020c9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.Clone_Error:_0x_08X_n
push dword [0x4305a8]
call fcn.0040103c
add esp, 0xc
push ebx
push 1
lea ecx, [ebp - 0x1002c]
call fcn.004040bc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004078e5
mov esp, ebp
pop ebp
ret