joyce8/EMBER2024-capa huggingface dataset:
Function at 0x697250
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x6ab808
push 0x69b288
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov byte [ebp - 0x24], bl
mov dword [ebp - 4], ebx
mov byte [ebp - 0x34], bl
mov byte [ebp - 0x33], bl
mov byte [ebp - 0x32], bl
mov byte [ebp - 0x31], bl
mov byte [ebp - 0x30], bl
mov byte [ebp - 0x2f], 5
lea eax, [ebp - 0x1c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x12
push 1
lea ecx, [ebp - 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x697329
lea edx, [ebp - 0x28]
push edx
push 8
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x697329
mov dword [ebp - 0x2c], ebx
lea eax, [ebp - 0x2c]
push eax
push ebx
push ebx
push 1
mov ecx, dword [ebp - 0x28]
push ecx
mov edi, dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
call edi
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0069a1d3
add esp, 4
mov esi, eax
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x20], esi
cmp esi, ebx
je 0x697329
lea eax, [ebp - 0x2c]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x28]
push edx
call edi
test eax, eax
je 0x697329
mov eax, dword [ebp - 0x1c]
push eax
mov ecx, dword [esi]
push ecx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
neg eax
sbb eax, eax
neg eax
mov byte [ebp - 0x24], al
jmp 0x69732c
mov al, byte [ebp - 0x24]
mov dword [ebp - 4], 0xffffffff
call fcn.00697351
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x697d20
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov edx, dword [esp + 8]
push esi
mov esi, dword [esp + 0x10]
lea eax, [esp + 4]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
mov dword [esp + 0x1c], 8
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x697d58
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov dword [esi], ecx
mov dword [esi + 4], edx
pop esi
pop ecx
ret 0x10

Function at 0x697d60
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
mov eax, dword [ecx + 4]
push esi
push 0
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x697d94
mov eax, dword [esp + 0x14]
test eax, eax
je 0x697d94
push eax
push esi
call fcn.0069a20b
add esp, 8
pop esi
ret 0x10

Function at 0x697da0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x24
lea eax, [esp + 0x28]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x697e22
push ebx
mov ebx, dword [esp + 0x30]
push esi
xor esi, esi
test ebx, ebx
jbe 0x697e15
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov edi, dword [esp + 0x40]
push esi
lea ecx, [esp + 0x18]
push 0x6b0320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00699dff
mov ecx, dword [esp + 0x44]
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
push edx
push edi
push 0
push 0
push eax
push ecx
call ebp
inc esi
add edi, 4
cmp esi, ebx
jb 0x697dda
pop edi
pop ebp
mov edx, dword [esp + 0x30]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
add esp, 0x24
ret 0xc

Function at 0x697e30
Capabilities:
Query or enumerate registry value

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
lea eax, [esp + 0x2c]
push eax
mov eax, dword [ecx + 4]
push 0x20019
push 0
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x697ec2
push ebp
mov ebp, dword [esp + 0x34]
push esi
xor esi, esi
test ebp, ebp
jbe 0x697eb5
push ebx
mov ebx, dword [esp + 0x40]
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push esi
lea ecx, [esp + 0x1c]
push 0x6b0320
push ecx
mov dword [esp + 0x1c], 4
call fcn.00699dff
add esp, 0xc
lea edx, [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push edx
mov edx, dword [esp + 0x40]
push eax
push 0
push 0
push ecx
push edx
call edi
test eax, eax
jne 0x697eab
mov ax, word [esp + 0x14]
mov word [ebx], ax
inc esi
add ebx, 2
cmp esi, ebp
jb 0x697e6a
pop edi
pop ebx
mov ecx, dword [esp + 0x34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
add esp, 0x28
ret 0xc
Function at 0x698000
Capabilities:
Get file version info

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
push esi
lea eax, [esp + 0xc]
push edi
push eax
push ebx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov esi, eax
test esi, esi
je 0x698131
push esi
call fcn.0069b145
add esp, 4
mov edi, eax
push edi
push esi
push 0
push ebx
call sub.VERSION.dll_GetFileVersionInfoW
push 0
push 0x80
push 3
push 0
push 0
push 0xc0000000
push ebx
call fcn.0068a080
mov ebp, eax
add esp, 0x1c
cmp ebp, 0xffffffff
je 0x698131
push 0
push ebp
call fcn.0068a3a0
push 0
push 0
push 0
push 4
push 0
push ebp
mov ebx, eax
call fcn.0068a260
add esp, 0x20
mov dword [esp + 0x18], eax
test eax, eax
jne 0x69808b
push ebp
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
push 0
push 0
push 0
push 6
push eax
call fcn.0068a2f0
mov esi, eax
add esp, 0x14
test esi, esi
je 0x698121
push 0x6b0918
push edi
call fcn.006993f0
push eax
push ebx
push esi
call fcn.00697f60
push 0x6b08f8
push edi
call fcn.006993f0
push eax
push ebx
push esi
call fcn.00697f60
push 0x6b08d8
push edi
call fcn.006993f0
push eax
push ebx
push esi
call fcn.00697f60
push 0x6b08c0
push edi
call fcn.006993f0
add esp, 0x44
push eax
push ebx
push esi
call fcn.00697f60
push 0x6b08a0
push edi
call fcn.006993f0
push eax
push ebx
push esi
call fcn.00697f60
push 0x6b0888
push edi
call fcn.006993f0
push eax
push ebx
push esi
call fcn.00697f60
add esp, 0x34
push esi
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov ecx, dword [esp + 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
push ebp
call esi
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x6991b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.00699140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.00699140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.00699140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.00699140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x699bfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x699c50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x6ab87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x699c43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x699c52
xor eax, eax
pop esi
leave
ret 4
Function at 0x10005879
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10005888
pop dword [ebp - 0x50]
mov eax, 0x4831ff19
add eax, 0xc7ce596f
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0x89120d74
sub dword [ebp - 0x60], 0x3abfc829
mov dword [ebp - 0x5c], 0x159043ac
sub dword [ebp - 0x5c], 0xe35cf767
mov dword [ebp - 0x58], 0xdda7cda8
add dword [ebp - 0x58], 0x6ea47686
mov dword [ebp - 0x54], 0x733eb8fa
add dword [ebp - 0x54], 0x8cc14706
lea eax, [ebp - 0x60]
push eax
mov eax, 0x8ba359d0
add eax, 0x845ff748
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x4d689377
add dword [ebp - 0x60], 0x2709d5df
mov dword [ebp - 0x5c], 0xd3d9c137
sub dword [ebp - 0x5c], 0x926d5fc2
mov dword [ebp - 0x58], 0x44ff6af2
sub dword [ebp - 0x58], 0xe18ffe86
mov dword [ebp - 0x54], 0xc075f367
add dword [ebp - 0x54], 0x3f8a0c99
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x38261
push 0
call eax
mov ecx, 0xa15fe56
add ecx, 0xf5ea3dfc
mov ebx, eax
mov esi, 0x6505c85b
add esi, 0xab02bba5
add esi, dword [ebp - 0x50]
mov edx, 0xe0d3d1dc
add dword [ebp - 0x38], ebx
mov edi, dword [esi]
add dword [ebp - 0x40], edi
xor edi, edx
xor dword [ebp - 0x38], 0x8b2c7dc4
mov dword [ebx], edi
sub dword [ebp - 0x30], 0xd1f35cd8
add ebx, 4
add esi, 0xcea036e3
sub esi, 0xcea036df
loop 0x1000599f
add eax, 0xd84367b
add eax, 0xf27cada0
xor ebx, ebx
add ebx, eax
add eax, 0x554ac018
add eax, 0xaab53fed
mov ecx, 0x10000000
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x10005a23
Capabilities:
Hash data using sha256

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x24], 0
and dword [eax + 0x20], 0
mov dword [eax], 0x6a09e667
mov dword [eax + 4], 0xbb67ae85
mov dword [eax + 8], 0x3c6ef372
mov dword [eax + 0xc], 0xa54ff53a
mov dword [eax + 0x10], 0x510e527f
mov dword [eax + 0x14], 0x9b05688c
mov dword [eax + 0x18], 0x1f83d9ab
mov dword [eax + 0x1c], 0x5be0cd19
ret
Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53

Function at 0x408a51
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x408a60
pop dword [ebp - 0x30]
mov eax, 0x1a478c8a
sub eax, 0x1a07022a
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x77ee6a52
sub dword [ebp - 0x40], 0x299c2507
mov dword [ebp - 0x3c], 0x3ac3ab7b
add dword [ebp - 0x3c], 0xf76fa0ca
mov dword [ebp - 0x38], 0x3ff2ded
add dword [ebp - 0x38], 0x484d1641
mov dword [ebp - 0x34], 0xad5ab4f4
sub dword [ebp - 0x34], 0xad5ab4f4
lea eax, [ebp - 0x40]
push eax
mov eax, 0xd914718a
add eax, 0x272c5eca
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x21bb92e9
sub dword [ebp - 0x40], 0xad492993
mov dword [ebp - 0x3c], 0xfffb8b8a
add dword [ebp - 0x3c], 0x4170d5eb
mov dword [ebp - 0x38], 0xf6b9a4ee
add dword [ebp - 0x38], 0x6cb5c77e
mov dword [ebp - 0x34], 0x46fc678d
sub dword [ebp - 0x34], 0x46fc678d
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x4a9569a6
sub eax, 0x4a54995a
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3b52b
push 0
call eax
mov ecx, 0x20d5dcad
add ecx, 0xdf2a728f
mov esi, eax
mov edx, 0x7792dc58
add edx, 0x88aed3a8
add edx, dword [ebp - 0x30]
mov ebx, 0xa6898f3d
xor dword [ebp - 0x28], 0xeb4e8aac
mov edi, dword [edx]
add dword [ebp - 0x18], 0xce1bfde1
sub edi, ebx
mov dword [esi], edi
add dword [ebp - 0x20], edi
add esi, 0xb60a68eb
add esi, 0x49f59719
add edx, 4
loop 0x408b7c
add eax, 0x66096cb1
add eax, 0x99f7c312
mov ebx, eax
add eax, 0xa699f218
sub eax, 0xa699f213
mov ecx, 0x7ef5cd3b
add ecx, 0x814a32c5
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x66648cb0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x3c
mov ebx, dword [section..bss]
mov esi, dword [0x66657014]
test ebx, ebx
je 0x66648df2
lea esi, [esi]
lea eax, [ebx + 8]
call fcn.666471c0
mov edi, eax
test eax, eax
je 0x66648dcc
lea eax, [ebp - 0x1c]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov dword [esp], 0x80000002
call sub.advapi32.dll_RegCreateKeyW
sub esp, 0xc
test eax, eax
jne 0x66648db0
lea eax, [ebx + 0x24]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.cFormatTags
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x66648db0
lea eax, [ebx + 0x20]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.cFilterTags
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
test eax, eax
jne 0x66648db0
lea eax, [ebx + 0x28]
mov dword [esp + 0x14], 4
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 0xc], 4
mov dword [esp + 8], 0
mov dword [esp + 4], str.fdwSupport
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
test eax, eax
je 0x66648e00
nop
mov eax, dword [0x66657004]
mov dword [esp + 8], edi
mov dword [esp + 4], 0
mov dword [esp], eax
call sub.kernel32.dll_HeapFree
sub esp, 0xc
mov dword [esp], ebx
call fcn.66648ae0
mov ebx, eax
test eax, eax
jne 0x66648cd0
test esi, esi
je 0x66648df6
lea esi, [esi]
mov dword [esp], esi
call fcn.666479e0
mov esi, eax
test esi, esi
jne 0x66648de8
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebx + 0x24]
shl eax, 3
mov dword [esp + 0x14], eax
mov eax, dword [ebx + 0x2c]
mov dword [esp + 0xc], 3
mov dword [esp + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [esp + 8], 0
mov dword [esp + 4], str.aFormatTagCache
mov dword [esp], eax
call sub.advapi32.dll_RegSetValueExA
sub esp, 0x18
jmp 0x66648db0
Function at 0x10017661
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x814
mov eax, 0x1002c826
call fcn.1002a0fc
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, esi
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x10017682
mov eax, dword [esi]
xor ecx, ecx
mov edi, 0x20019
mov word [eax], cx
lea eax, [ebp - 0x820]
push eax
push edi
push ebx
push str.Outlook.Application
push 0x80000000
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100177f4
lea eax, [ebp - 0x81c]
push eax
push edi
push ebx
push str.CurVer
push dword [ebp - 0x820]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100177e8
lea eax, [ebp - 0x818]
mov dword [ebp - 0x814], ebx
push eax
lea eax, [ebp - 0x7e0]
mov dword [ebp - 0x818], 0x7d0
push eax
lea eax, [ebp - 0x814]
push eax
push ebx
push ebx
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100177dc
cmp dword [ebp - 0x814], 1
jne 0x100177dc
cmp dword [ebp - 0x818], ebx
je 0x100177dc
mov word [ebp - 0x7f8], ax
lea ecx, [ebp - 0x7f8]
lea eax, [ebp - 0x7e0]
mov dword [ebp - 0x7e8], ebx
push eax
mov dword [ebp - 0x7e4], 7
call fcn.1000308f
or edi, 0xffffffff
mov dword [ebp - 4], ebx
push edi
push 0x1002ff30
lea ecx, [ebp - 0x7f8]
call fcn.10017ee0
cmp eax, edi
je 0x100177c7
inc eax
cmp eax, edi
je 0x100177c7
push edi
xor ecx, ecx
mov dword [ebp - 0x800], ebx
push eax
lea eax, [ebp - 0x7f8]
mov word [ebp - 0x810], cx
push eax
lea ecx, [ebp - 0x810]
mov dword [ebp - 0x7fc], 7
call fcn.10017ee0
lea eax, [ebp - 0x810]
mov ecx, esi
push eax
call fcn.10017ee0
lea ecx, [ebp - 0x810]
mov byte [ebp - 4], 1
call fcn.10017ee0
push 0x10030868
mov ecx, esi
mov byte [ebp - 4], bl
call fcn.10013c2e
mov bl, 1
lea ecx, [ebp - 0x7f8]
mov dword [ebp - 4], 2
call fcn.10017ee0
mov dword [ebp - 4], edi
push dword [ebp - 0x81c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [ebp - 0x820]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
call fcn.1002a0a6
ret
Function at 0x10017ee0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x10017eef
pop dword [ebp - 0x38]
mov eax, 0x61a438ca
add eax, 0xae5d4625
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x925aa95f
add dword [ebp - 0x48], 0xbbf79bec
mov dword [ebp - 0x44], 0x381d8d9a
sub dword [ebp - 0x44], 0x5ea4155
mov dword [ebp - 0x40], 0x4556b7d5
sub dword [ebp - 0x40], 0xf90a73a7
mov dword [ebp - 0x3c], 0x48c6e9dd
add dword [ebp - 0x3c], 0xb7391623
lea eax, [ebp - 0x48]
push eax
mov eax, 0xfb54fc21
add eax, 0x14ade4cf
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x238ea373
add dword [ebp - 0x48], 0x50e3c5e3
mov dword [ebp - 0x44], 0xccd09b1b
sub dword [ebp - 0x44], 0x8b6439a6
mov dword [ebp - 0x40], 0x26b2013f
add dword [ebp - 0x40], 0x3cbd6b2d
mov dword [ebp - 0x3c], 0xd334e492
sub dword [ebp - 0x3c], 0xd334e492
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x48c7b
push 0
call eax
mov ecx, 0xe148a134
sub ecx, 0xe1484aff
xor ebx, ebx
add ebx, eax
mov esi, 0x29384044
sub esi, 0x1933de44
add esi, dword [ebp - 0x38]
mov edx, 0x1cfd090c
sub edx, 0xe232bfc2
xor dword [ebp - 0x10], 0x49536b8b
mov edi, dword [esi]
mov dword [ebp - 0x10], 0x35ad1d71
sub edi, edx
xor dword [ebp - 0xc], ebx
mov dword [ebx], edi
sub dword [ebp - 0xc], ecx
add ebx, 0x6937763a
sub ebx, 0x69377636
add esi, 4
loop 0x1001800e
add eax, 0x80cae313
sub eax, 0x80c9976c
mov ebx, eax
add eax, 0x7315596e
add eax, 0x8ceaa697
mov ecx, 0x10000000
add ecx, dword [ebp - 0x38]
call ebx
leave
ret

Function at 0x1001bb74
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1003d1f4], 0
jne 0x1001bbe3
push ebx
call fcn.10017ee0
xor ebx, ebx
mov byte [0x1003d1f5], al
inc ebx
test al, al
jne 0x1001bbdc
call fcn.100286d1
cmp eax, 0x6b
jl 0x1001bbdc
xor eax, eax
mov byte [ebp - 2], al
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 2]
push eax
call fcn.10017ee0
add esp, 0x10
test al, al
je 0x1001bbdc
movzx eax, byte [0x1003d1f5]
cmp byte [ebp - 1], 0
cmovne eax, ebx
mov byte [0x1003d1f5], al
mov byte [0x1003d1f4], bl
pop ebx
cmp byte [0x1003cde0], 0
je 0x1001bc26
cmp byte [0x1003d1f5], 0
mov ecx, str.FALSE
push esi
mov eax, str.TRUE
mov esi, 0x1003cde8
cmove eax, ecx
push eax
push str.IsRunningInAppContainer___s
push esi
call fcn.10017ee0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1001bc25
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop esi
mov al, byte [0x1003d1f5]
leave
ret
Function at 0x401943
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
lea eax, [ebp - 0x134]
push esi
push edi
push str.SYSTEMCurrentControlSetServicesEventLogApplication_
push eax
mov edi, edx
mov esi, ecx
call fcn.004206a4
lea eax, [ebp - 0x134]
push esi
push eax
call fcn.004206c6
add esp, 0x10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x134]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x401991
xor eax, eax
jmp 0x4019f1
push edi
call fcn.00420819
pop ecx
xor esi, esi
lea eax, [eax*2 + 2]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 2
push esi
push str.EventMessageFile
push dword [ebp - 4]
call edi
test eax, eax
je 0x4019c5
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40198d
push 4
lea eax, [ebp - 8]
mov dword [ebp - 8], 7
push eax
push 4
push esi
push str.TypesSupported
push dword [ebp - 4]
call edi
test eax, eax
jne 0x4019e6
xor esi, esi
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x401a40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 8]
xor esi, esi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 4], esi
push eax
push esi
push 0xf003f
push esi
push esi
push esi
push edx
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x401a70
xor eax, eax
jmp 0x401aa9
push edi
push dword [ebp + 0xc]
call fcn.00420819
pop ecx
xor edi, edi
inc edi
lea eax, [eax*2 + 2]
push eax
push dword [ebp + 0xc]
push edi
push esi
push str.Splash_screen
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 4]
test eax, eax
cmove esi, edi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret

Function at 0x401aac
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.004311d0
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push edx
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x401add
xor eax, eax
jmp 0x401b22
lea eax, [ebp - 8]
mov dword [ebp - 8], 0x2000
push eax
lea eax, [ebp - 0x200c]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push str.Splash_screen
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401b17
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x200c]
xor esi, esi
inc esi
call fcn.0040fb5d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x401b2b
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, ecx
mov ecx, edx
push edi
call fcn.00401ea7
mov edi, eax
test edi, edi
jne 0x401c3f
cmp dword [0x44a534], eax
je 0x401b86
mov edi, 0x43ba48
mov ecx, edi
call fcn.00401d6f
test eax, eax
je 0x401b86
mov edx, edi
lea ecx, [ebp - 8]
call fcn.00402c7c
mov ecx, eax
call fcn.0040fb17
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea ecx, [ebp - 8]
mov esi, eax
call fcn.0040fa89
mov eax, esi
jmp 0x401c51
mov ecx, esi
call fcn.00401c55
test eax, eax
jne 0x401bca
mov ecx, dword [0x44a544]
cmp dword [ecx + 0x63a], eax
jne 0x401bca
cmp dword [ecx + 0x878], eax
je 0x401bb2
mov ecx, esi
call fcn.00401cf3
test eax, eax
jne 0x401bca
mov ecx, esi
call fcn.00401d6f
test eax, eax
jne 0x401bca
mov ecx, esi
call fcn.00401e49
neg eax
sbb eax, eax
neg eax
cmp dword [0x44aa94], 1
je 0x401bf0
mov ecx, esi
test eax, eax
je 0x401be4
call fcn.00402a56
test eax, eax
je 0x401bf0
jmp 0x401be9
call fcn.004029ff
mov ecx, esi
call fcn.0040240c
mov edx, esi
lea ecx, [ebp - 4]
call fcn.00402c7c
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov esi, eax
jmp 0x401c22
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, esi
cmp ecx, 0x1388
ja 0x401c37
cmp eax, esi
jb 0x401c37
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ebp - 4]
call fcn.0040fb17
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
test edi, edi
je 0x401c04
lea ecx, [ebp - 4]
call fcn.0040fa89
call fcn.004185dc
test eax, eax
lea ecx, [edi + 0x800000]
cmove ecx, edi
mov eax, ecx
pop edi
pop esi
leave
ret

Function at 0x401f4a
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
push dword [ebp + 8]
lea eax, [ebp - 0xc]
mov dword [ebp - 4], 0x104
push str.SoftwarePC_SOFTFramework29.0
push 0x43bb28
push eax
mov edi, ecx
xor esi, esi
call fcn.00402dfa
add esp, 0x10
mov dword [ebp - 8], esi
lea ecx, [ebp - 0xc]
call fcn.0040fb17
lea ecx, [ebp - 8]
push ecx
push 1
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x401fd0
mov eax, dword [ebp - 4]
add eax, eax
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push edi
lea eax, [ebp - 0x10]
push eax
push esi
push str.CHEMIN
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x401fc2
inc esi
jmp 0x401fc7
xor eax, eax
mov word [edi], ax
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea ecx, [ebp - 0xc]
call fcn.0040fa89
pop edi
mov eax, esi
pop esi
leave
ret