joyce8/EMBER2024-capa huggingface dataset:
Function at 0x454ff4
Capabilities:
Read .ini file

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0xf8
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x74], eax
push ebx
push esi
push edi
xor eax, eax
push 0xc6
push eax
mov word [ebp - 0x54], ax
lea eax, [ebp - 0x52]
push eax
mov ebx, ecx
call fcn.00464d20
push str.config.ini
lea eax, [ebx + 0xbc]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.00404cd0
add esp, 0x18
push dword [eax]
lea eax, [ebp - 0x54]
push 0x64
push eax
mov esi, 0x49064c
push esi
push str.language
push 0x48fda8
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 0x58]
add ecx, 0xfffffff0
call fcn.004016d0
lea eax, [ebp - 0x54]
lea edi, [ebx + 0xb4]
push eax
mov ecx, edi
call fcn.00404f90
push esi
mov ecx, edi
call fcn.00404f90
push str.zh_tw
mov ecx, edi
call fcn.0040a320
test eax, eax
je 0x4550e1
push esi
mov ecx, edi
call fcn.0040a320
test eax, eax
je 0x4550e1
push 0x490614
mov ecx, edi
call fcn.0040a320
test eax, eax
je 0x4550e1
push 0x4905d8
mov ecx, edi
call fcn.0040a320
test eax, eax
je 0x4550e1
push 0x4905e0
mov ecx, edi
call fcn.0040a320
test eax, eax
je 0x4550e1
push 0x4905f8
mov ecx, edi
call fcn.0040a320
test eax, eax
je 0x4550e1
push esi
mov ecx, edi
call fcn.00404f90
push 0
push str.languages
push str.default
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebx + 0x3c]
call fcn.0044c147
lea ecx, [ebp - 0x80]
call fcn.0044b5b4
mov esi, dword [ebp - 0x58]
push 0x493e40
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.0044bf3f
mov eax, dword [edi]
add esp, 0xc
mov dword [ebp - 0x58], eax
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x70]
lea ecx, [ebp - 0x68]
call fcn.00446e12
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x74]
lea ecx, [ebp - 0x60]
call fcn.00446e12
lea eax, [ebp - 0x58]
push eax
push dword [ebp - 0x64]
lea eax, [ebp - 0x60]
push dword [ebp - 0x68]
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
push eax
call fcn.00453009
add esp, 0x18
lea eax, [ebp - 0x80]
push eax
push dword [ebp - 0x70]
lea ecx, [ebp - 0x68]
call fcn.00446e12
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x68]
call fcn.00456826
test al, al
jne 0x45517f
push edi
lea ecx, [ebx + 0x20]
call fcn.0040a790
jmp 0x455186
mov ecx, ebx
call fcn.00453fe8
lea ecx, [ebp - 0x80]
call fcn.0044b60e
push dword [ebp - 0x80]
call fcn.004617a0
pop ecx
lea ecx, [esi - 0x10]
call fcn.004016d0
mov ecx, dword [ebp + 0x74]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.00464fe1
add ebp, 0x78
leave
ret
Function at 0x4565c3
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp byte [esi + 0x4c], 0
je 0x4565e3
mov al, 1
jmp 0x45663a
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00464d20
add esp, 0xc
push 0x494e94
push 0x4b6e88
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x456638
lea eax, [ebp - 0x20c]
push eax
call fcn.00461990
pop ecx
test eax, eax
je 0x456638
mov byte [esi + 0x4c], 1
jmp 0x4565df
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00464fe1
leave
ret

Function at 0x456647
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
cmp esi, ebx
je 0x456717
push 0x104
push esi
call fcn.00465d05
add eax, 0xfffffffc
pop ecx
pop ecx
cmp eax, 0xff
ja 0x456717
mov eax, dword [0x493db0]
mov dword [ebp - 0xc], eax
mov eax, dword [0x493db4]
mov dword [ebp - 8], eax
mov ax, word [esi]
mov word [ebp - 0xc], ax
push dword [ebp - 0xc]
call fcn.0045fec3
pop ecx
cmp eax, 1
je 0x4566aa
push 0x70
jmp 0x456719
push edi
xor eax, eax
mov dword [ebp - 0x14], ebx
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
mov dword [ebp - 0x24], ebx
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], ebx
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExW]
pop edi
test eax, eax
je 0x4566f1
cmp dword [ebp - 0x10], ebx
ja 0x4566f1
jb 0x4566ed
cmp dword [ebp - 0x14], 0x11e1a300
ja 0x4566f1
push 0x6f
jmp 0x456719
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push esi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x456713
push esi
call fcn.00458a22
pop ecx
test al, al
je 0x456713
xor eax, eax
jmp 0x45671a
push 0x6c
jmp 0x456719
push 0x65
pop eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
leave
ret

Function at 0x456746
Capabilities:
Terminate process

Disassembly:
push esi
push dword [esp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x456773
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
jmp 0x456775
xor eax, eax
pop esi
ret 4
Function at 0x4567bb
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 0x20000000
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 4], eax
cmp eax, esi
je 0x45680f
push ebx
push edi
push 2
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ebx, eax
cmp ebx, esi
je 0x456808
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0xffffffffffffffff
push dword [ebp + 0xc]
push 0xffffffffffffffff
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
push ebx
call edi
push dword [ebp - 4]
call edi
pop edi
pop ebx
pop esi
leave
ret 8

Function at 0x456d28
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push edi
xor edi, edi
push 0x4b84ac
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xc], edi
call fcn.00401ae0
push str.DeepScan
push str.software360TotalSecurity
lea eax, [ebp - 0x10]
push str._s_s
push eax
call fcn.004028a0
add esp, 0x10
push edi
lea eax, [ebp - 0xc]
push eax
push edi
push 3
push edi
push edi
push edi
push dword [ebp - 0x10]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x456d82
cmp dword [ebp - 0xc], edi
je 0x456e45
mov eax, dword [0x4b6e74]
push ebx
push esi
push 4
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x2c], str.EnableBD
mov dword [ebp - 0x28], str.EnableAvira
mov dword [ebp - 8], edi
pop esi
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 8]
test dword [ebp + ecx - 0x24], eax
je 0x456e2d
mov eax, ecx
mov ebx, dword [ebp + eax - 0x2c]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x14]
push eax
push edi
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], edi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x456e0f
mov eax, dword [ebp - 4]
cmp eax, 3
je 0x456e06
cmp eax, esi
je 0x456e06
cmp eax, 5
je 0x456e06
cmp eax, 1
je 0x456e2d
push 2
pop ecx
cmp eax, ecx
je 0x456e2d
mov dword [ebp - 4], ecx
jmp 0x456e16
mov dword [ebp - 4], 1
jmp 0x456e16
mov dword [ebp - 4], 2
push esi
lea eax, [ebp - 4]
push eax
push esi
push edi
push ebx
push dword [ebp - 0xc]
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
add dword [ebp - 8], esi
cmp dword [ebp - 8], 8
jb 0x456dae
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.004016d0
mov al, 1
pop edi
leave
ret
Function at 0x457ded
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1c8]
sub esp, 0x248
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x1c4], eax
mov eax, dword [ebp + 0x1d0]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x1d4]
xor ebx, ebx
test byte [0x4b7670], 1
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x7c], edi
mov dword [ebp - 0x70], ebx
mov esi, 0x4b7650
jne 0x457e49
or dword [0x4b7670], 1
mov ecx, esi
call fcn.00442759
push 0x48ebb0
call fcn.004659a2
pop ecx
cmp dword [0x4b766c], ebx
je 0x457e74
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [0x4b764c]
sub ecx, eax
cmp ecx, 0x1388
ja 0x457e74
cmp byte [ebp + 0x1d8], 1
jne 0x457f1d
push ebx
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x457f1d
mov ecx, esi
call fcn.0045762e
push 0x228
lea eax, [ebp - 0x64]
push 0
push eax
call fcn.00464d20
add esp, 0xc
lea eax, [ebp - 0x68]
push eax
mov edi, 0x22c
push ebx
mov dword [ebp - 0x68], edi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x457f0f
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x6c]
call fcn.00404be0
lea ecx, [ebp - 0x6c]
call fcn.00444269
mov ecx, eax
call fcn.00444174
lea ecx, [ebp - 0x6c]
call fcn.0040a4c0
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
call fcn.00457d29
mov ecx, dword [ebp - 0x60]
push edi
mov dword [eax], ecx
lea eax, [ebp - 0x68]
push 0
push eax
call fcn.00464d20
mov ecx, dword [ebp - 0x6c]
add esp, 0xc
add ecx, 0xfffffff0
mov dword [ebp - 0x68], edi
call fcn.004016d0
lea eax, [ebp - 0x68]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x457eb5
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, dword [ebp - 0x7c]
push dword [ebp - 0x74]
lea ecx, [ebp - 0x6c]
call fcn.00404be0
lea ecx, [ebp - 0x6c]
call fcn.0040a4c0
push esi
push dword [0x4b7668]
lea ecx, [ebp - 0x78]
call fcn.0044ec85
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x80]
push eax
mov ecx, esi
call fcn.00456f4e
lea ecx, [ebp - 0x78]
push ecx
mov ecx, eax
call fcn.00456826
test al, al
jne 0x457f77
test edi, edi
je 0x457f70
lea eax, [ebp - 0x6c]
push eax
mov ecx, esi
call fcn.00457d29
mov eax, dword [eax]
mov dword [edi], eax
mov dword [ebp - 0x70], 1
mov ecx, dword [ebp - 0x6c]
add ecx, 0xfffffff0
call fcn.004016d0
mov ecx, dword [ebp + 0x1c4]
mov eax, dword [ebp - 0x70]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x1c8
leave
ret
Function at 0x4585e6
Capabilities:
Check if file exists
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, ecx
push 0x4b6e5c
lea ecx, [ebp - 4]
call fcn.00404bc0
lea eax, [ebp - 4]
lea edi, [esi + 0x5c]
push eax
mov ecx, edi
call fcn.00404e20
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
call fcn.004016d0
mov eax, dword [edi]
xor ebx, ebx
cmp dword [eax - 0xc], ebx
jne 0x458622
xor al, al
jmp 0x45866d
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x45861e
push dword [ebp + 8]
lea ecx, [esi + 0x60]
call fcn.00404f90
lea edi, [esi + 0x68]
mov ecx, edi
call fcn.00460ca0
cmp al, 1
jne 0x458665
push ebx
push ebx
push esi
push 0x458555
push ebx
push ebx
call fcn.0046902c
add esp, 0x18
test eax, eax
je 0x458665
mov ecx, edi
call fcn.00460b03
xor eax, eax
cmp dword [esi + 0x64], ebx
sete al
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x45869e
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
lea eax, [ebp - 4]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x4586bf
xor eax, eax
leave
ret
push esi
lea eax, [ebp - 0x10]
push eax
push str.SeShutdownPrivilege
xor esi, esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push esi
push esi
push esi
lea eax, [ebp - 0x14]
push eax
push esi
push dword [ebp - 4]
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
test eax, eax
jne 0x4586bb
push 2
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
neg eax
sbb eax, eax
neg eax
leave
ret
Function at 0x458a22
Capabilities:
Delete file
Write file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x3a0]
sub esp, 0x420
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x39c], eax
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push edi
mov edi, dword [ebp + 0x3a8]
xor ebx, ebx
push edi
mov byte [ebp - 0x75], bl
call esi
test eax, eax
jne 0x458a60
push edi
push ebx
call dword [sym.imp.SHELL32.dll_SHCreateDirectory]
push edi
call esi
test eax, eax
je 0x458b26
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp + 0x194], ax
lea eax, [ebp + 0x196]
push ebx
push eax
call fcn.00464d20
xor eax, eax
push esi
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x72]
push ebx
push eax
call fcn.00464d20
add esp, 0x18
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
push str.writeable_test__d.dat
lea eax, [ebp - 0x74]
push 0x208
push eax
call fcn.00405560
add esp, 0x10
lea eax, [ebp - 0x74]
push eax
push edi
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push ebx
push 0x80
push 2
push ebx
push 7
push 0x40000000
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, ebx
je 0x458b26
cmp esi, 0xffffffff
je 0x458b26
or dword [ebp - 0x7c], 0xffffffff
push ebx
lea eax, [ebp - 0x80]
push eax
push 2
lea eax, [ebp - 0x7c]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x458b26
lea eax, [ebp + 0x194]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 0x75], 1
mov ecx, dword [ebp + 0x39c]
mov al, byte [ebp - 0x75]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x3a0
leave
ret

Function at 0x459721
Capabilities:
Create thread
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
push 0x459528
push 0
push 0
call fcn.0046902c
mov edi, eax
add esp, 0x18
test edi, edi
je 0x45976d
push 0x2710
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x459766
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
leave
ret

Function at 0x45b969
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 8]
and dword [ebp - 4], 0
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
push edi
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
push eax
push 0
lea eax, [ebp - 0xc]
push eax
push 0x45b947
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov edi, eax
test edi, edi
je 0x45b9b6
push 0xffffffffffffffff
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
pop edi
leave
ret
Function at 0x45b9dd
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push edi
push 7
pop ecx
xor eax, eax
push 1
push eax
lea edi, [ebp - 0x24]
push eax
rep stosd dword es:[edi], eax
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 8], eax
test eax, eax
je 0x45ba91
push 0x10024
push dword [ebp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
mov dword [ebp - 4], edi
test edi, edi
je 0x45ba88
cmp byte [ebp + 0xc], 1
jne 0x45ba76
lea eax, [ebp - 0x24]
push eax
push 1
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x45ba76
push ebx
push esi
push dword [ebp + 8]
push str.Stopping__s.
call fcn.004690dc
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
pop ecx
pop ecx
mov ebx, 0x3e8
push ebx
call esi
lea eax, [ebp - 0x24]
push eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x45ba6e
cmp dword [ebp - 0x20], 3
jne 0x45ba74
push ebx
call esi
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 4]
call edi
test eax, eax
jne 0x45ba5e
pop esi
pop ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
leave
ret

Function at 0x45bfad
Capabilities:
Terminate process

Disassembly:
push esi
push dword [esp + 8]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x45bfda
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
pop edi
pop esi
ret
xor eax, eax
pop esi
ret

Function at 0x45c08a
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
add ecx, 0x900
push ecx
push str.SOFTWAREMicrosoftWindowsCurrentVersionRunOnce
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
ret

Function at 0x45c567
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 4]
lea ecx, [ebp - 4]
push ecx
mov ecx, dword [esi + 0xc]
or ecx, 2
push ecx
push 0
push eax
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45c5b0
push dword [esi + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 4]
mov esi, eax
neg esi
sbb esi, esi
inc esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x45c5b2
xor eax, eax
pop esi
leave
ret
Function at 0x45c600
Capabilities:
Delete registry key

Disassembly:
push ebp
lea ebp, [esp - 0x1b8]
sub esp, 0x238
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x1b4], eax
push ebx
push esi
mov esi, dword [ebp + 0x1c0]
push edi
xor eax, eax
push 0x206
mov word [ebp - 0x54], ax
xor edi, edi
lea eax, [ebp - 0x52]
push edi
xor ebx, ebx
push eax
inc ebx
call fcn.00464d20
mov eax, dword [esi + 4]
add esp, 0xc
lea ecx, [ebp - 0x58]
push ecx
push 0x20019
push edi
push eax
push dword [esi]
mov dword [ebp - 0x60], 0x104
mov dword [ebp - 0x5c], edi
mov dword [ebp - 0x58], edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45c6a1
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x5c]
push eax
push edi
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x54]
push eax
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
cmp dword [ebp - 0x5c], edi
jbe 0x45c6a1
xor ebx, ebx
cmp dword [ebp - 0x58], edi
je 0x45c6af
push dword [ebp - 0x58]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push dword [esi + 4]
push dword [esi]
cmp ebx, 1
jne 0x45c6c1
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyW]
jmp 0x45c6c7
call dword [sym.imp.SHLWAPI.dll_SHDeleteEmptyKeyW]
mov ecx, dword [ebp + 0x1b4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x1b8
leave
ret
Function at 0x45c6df
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1ec]
sub esp, 0x26c
mov eax, dword [0x4b1d00]
xor eax, ebp
mov dword [ebp + 0x1e8], eax
push ebx
push esi
push edi
push 4
pop ebx
push 0x11
pop ecx
mov esi, str.SYSTEMCurrentControlSetServices_
lea edi, [ebp + 0x1a0]
rep movsd dword es:[edi], dword [esi]
xor eax, eax
mov word [ebp - 0x68], ax
lea eax, [ebp + 0x1a0]
push eax
movsw word es:[edi], word [esi]
mov esi, 0x208
push esi
lea eax, [ebp - 0x68]
push eax
mov dword [ebp - 0x7c], ebx
mov dword [ebp - 0x70], 1
call fcn.004054a0
push dword [ebp + 0x1f4]
lea eax, [ebp - 0x68]
push esi
push eax
call fcn.004054a0
lea eax, [ebp - 0x74]
push eax
push 1
push 0
lea eax, [ebp - 0x68]
push eax
mov esi, reloc.OLEAUT32.dll_SysReAllocString
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x45c7c2
push dword [ebp - 0x74]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 0x80], 0
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x6c]
push eax
mov edi, str.Start
push edi
lea eax, [ebp - 0x68]
push eax
push esi
mov dword [ebp - 0x78], ebx
mov dword [ebp - 0x6c], ebx
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x45c7c2
push ebx
lea eax, [ebp - 0x7c]
push eax
push ebx
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
lea eax, [ebp - 0x68]
push eax
push esi
call edi
push ebx
lea eax, [ebp - 0x70]
push eax
push ebx
push str.DeleteFlag
lea eax, [ebp - 0x68]
push eax
push esi
call edi
mov al, 1
jmp 0x45c7c4
xor al, al
mov ecx, dword [ebp + 0x1e8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00464fe1
add ebp, 0x1ec
leave
ret
Function at 0x45e16f
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 4], ecx
call ebx
test eax, eax
je 0x45e190
xor eax, eax
inc eax
jmp 0x45e224
and dword [ebp + 8], 0
push edi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
cmp eax, 0xffffffff
je 0x45e1d4
test al, 0x10
je 0x45e1d4
push esi
mov dword [ebp + 8], 1
call edi
test eax, eax
jne 0x45e1df
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x45e1e4
cmp dword [ebp + 8], 0
push esi
jne 0x45e1d9
call ebx
jmp 0x45e1db
push esi
call ebx
jmp 0x45e1b5
call edi
test eax, eax
je 0x45e1e4
xor eax, eax
inc eax
jmp 0x45e223
cmp byte [ebp + 0xc], 0
je 0x45e1f7
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x45e221
push esi
lea ecx, [ebp + 0xc]
call fcn.00404be0
mov esi, dword [ebp - 4]
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 4]
call fcn.0040a790
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
call fcn.004016d0
mov dword [esi + 0x1c], 1
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8