joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6269d2
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov bh, byte [esp + 0xa]
jmp 0x626a1e
mov word [esp + 0xa], di
xchg word [esp + 0xc], di
mov bp, 0x562d
xchg word [esp + 6], dx
and esi, ecx
cmc
jmp 0x626aea
mov edi, dword [esp + 1]
push word [esp + 3]
mov cx, 0x14a9
sub esp, 2
mov edx, 0x1e31640c
xchg dword [esp + 2], ebp
jmp 0x626ac0
bswap edi
pop word [esp]
xor dl, ch
push edx
lea esi, [ebx*4]
ror ebx, 0x19
jmp 0x626a76
stc
stc
mov dx, word [esp + 0x12]
bsr si, bp
and eax, ecx
bswap edi
jmp 0x626ad3
mov byte [esp + 3], bh
btc edi, edi
mov ecx, dword [esp]
pushal
pop dword [esp + 2]
inc cx
jmp 0x626aaa
lea ebx, [edx + edi]
mov bl, 0xd0
mov dword [esp + 0x20], eax
mov cl, ch
xchg dh, al
pop ebp
jmp 0x626b38
mov bl, 0x88
lea esp, [esp + 3]
pop dword [esp]
mov al, 0x2e
lea esp, [esp + 3]
mov ebp, dword [esp + 2]
jmp 0x626a95
rdtsc
mov bp, 0xf3e3
pop bp
stc
mov dl, 0xac
lea esi, [esi*4]
jmp 0x626b50
xchg edi, ebx
mov dword [esp + 5], eax
pop dword [esp + 4]
lea esp, [esp + 0x12]
mov cx, 0x9ef9
pop dword [esp + 3]
jmp 0x626aff
mov si, 0xb635
xchg byte [esp + 0x18], cl
and bp, 0x29ea
mov bp, bx
xchg byte [esp + 0x1e], bl
inc cx
jmp 0x626b1a
mov bx, di
cld
btc ecx, edi
mov al, ah
bswap ebx
mov si, word [esp]
jmp 0x626dc6
mov di, 0x5465
xchg edi, eax
pop word [esp]
mov edx, 0x3c266924
lea eax, [edx + edx]
lea eax, [ebp - 0x7f]
jmp 0x626c75
inc cx
sete ah
xor si, 0x5604
lea eax, [ecx + 0xab]
not bx
push edx
jmp 0x626b8d
lea edi, [ebx*4]
mov byte [esp], ch
xchg ebp, eax
mov ah, byte [esp]
sub esp, 2
pop cx
jmp 0x626bb0
xchg bp, ax
mov dx, 0x275f
not si
lea esp, [esp]
mov cl, ch
xchg dx, ax
jmp 0x626c58
pop ebp
ror edi, 0x17
sub esp, 0x10
mov eax, ebp
bswap ebx
jmp 0x626cb9
lea esp, [esp + 2]
clc
inc ebp
mov cx, di
add cx, 0x296
mov ecx, 0xe74cd23a
jmp 0x626bf0
mov ax, 0xb7eb
push word [esp]
pop bp
mov byte [esp + 1], ah
bsf bx, si
bsf bp, ax
jmp 0x626c1a
xchg ebx, esi
clc
sub esp, 0xa
mov cx, word [esp + 6]
neg bp
mov dword [esp + 3], ecx
jmp 0x626c04
not ecx
lea ebp, [eax + 0x59]
lea esp, [esp]
xchg word [esp], si
bswap esi
rdtsc
jmp 0x626c40
xchg word [esp + 7], cx
mov eax, ebp
mov dl, 0xdc
call fcn.00626cd4
inc edx
fdiv qword [edx + 0x15]
in al, 0x63
test eax, 0x2bd8b929
std
enter 0x66f8, 0xffffffffffffff87
retf 0x348d
clc
xchg dx, cx
lea esi, [esi*4]
push dword [esp + 0x13]
inc cl
jmp 0x626c87
mov ecx, 0x3546ec92
xchg cx, si
not bx
lea ebx, [ecx + edx]
lea eax, reloc.RASAPI32.dll_RasHangUpA
mov word [esp + 7], dx
jmp 0x626ca2
mov esi, dword [esp]
bswap eax
mov ebx, 0x88406dc8
sete ch
neg edx
mov edi, 0x6b44ec8a
jmp 0x626bda
cpuid
cmc
neg bh
pop dword [esp]
pop ebx
rdtsc
jmp 0x626cf3
not ah
push esp
mov byte [esp + 3], bh
pop word [esp + 5]
neg bx
xchg word [esp + 3], bx
jmp 0x626d8e
Function at 0x627086
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov si, dx
not dx
mov ah, byte [esp + 0xb]
xchg word [esp + 5], bx
cld
mov al, ah
jmp 0x626fa8
shr ch, 5
xchg word [esp + 0xc], bp
rdtsc
mov di, 0x3715
lea edi, [eax - 0x69]
xor bx, 0x22cc
jmp 0x626f4f
rcr ch, 5
push word [esp + 0xd]
bswap edi
lea eax, reloc.RASAPI32.dll_RasHangUpA
lea ebp, [esi*4]
jmp 0x627054
lea ebx, [esi + edi]
not edi
mov dx, word [esp + 4]
mov word [esp + 8], bx
jmp 0x626f8b
mov cx, 0xf18d
mov ebx, 0xb3c187a0
mov ecx, dword [esp + 0x13]
pop dword [esp + 5]
pop bx
pop bx
jmp 0x626f73
xchg dword [esp + 0x10], ecx
rdtsc
bswap esi
setne bh
mov dl, dh
mov bx, dx
jmp 0x627032
bswap esi
lea ebx, [eax + ebx]
sub esp, 0x10
shl ax, cl
mov bp, bx
cpuid
jmp 0x627019
lea ecx, [ecx - 0xb3]
mov edi, 0x7cdd3db2
bsr bp, cx
cpuid
pop dword [esp + 0x12]
rdtsc
jmp 0x626fd6
btc eax, edi
call fcn.0062706f
pushal
not byte [ecx - 0x62f37da0]
or eax, 0x6c4ca754
jg 0x627076
int1
invalid
lea esp, [esp + 4]
mov bx, di
mov word [esp + 2], dx
ror eax, 7
neg bh
inc dl
jmp 0x626fe8
mov di, word [esp + 8]
lea eax, [edx*4]
push dword [esp + 6]
sub esp, 8
mov dword [esp + 0x18], ecx
mov dl, dh
jmp 0x627000
enter 0xffffffffffff8307, 0xffffffffffffffc4
push es
not edi
jmp 0x627129
rcr bh, 3
sub esp, 0x10
lea ebx, [esi - 0xa5]
bsf dx, ax
jmp 0x626fbf
btr eax, esp
call fcn.00627112
lodsb al, byte [esi]
cmp ch, byte [eax - 0x7170c531]
pop ds
invalid
popal
neg edi
cpuid
push dword [esp + 4]
xchg edi, eax
mov edx, dword [esp + 0xb]
jmp 0x62709b
pop word [esp + 1]
btc eax, edi
xchg word [esp + 1], di
mov al, ah
pushal
mov dword [esp + 7], esi
jmp 0x6270b2
pushal
lea esp, [esp + 0x45]
push edx
mov ebp, esi
sub esp, 6
xchg ah, bl
jmp 0x6270d7
Function at 0x627112
Capabilities:
Execute anti-debugging instructions

Disassembly:
setge ah
mov al, ah
pop dword [esp + 2]
mov dword [esp + 1], ecx
mov dl, dh
inc bl
jmp 0x6271ec
mov word [esp + 8], di
xchg ch, dl
lea esp, [esp + 1]
bswap ebp
lea ebx, [esp + edi]
jmp 0x6270ed
neg edx
lea esi, [ebp + 0x47]
xchg dword [esp + 4], edx
mov dword [esp + 3], ecx
pop eax
setge ah
jmp 0x6271c4
lea eax, [edx*4]
setg dh
lea edi, [ebx*4]
mov si, word [esp + 5]
jmp 0x627138
mov di, sp
lea ebx, [ebp*4]
xchg edi, eax
mov dword [esp + 1], ebp
cpuid
mov edx, 0xa72a8fea
jmp 0x62714f
btr eax, esp
mov ebx, dword [esp]
push esp
mov bh, byte [esp + 3]
rdtsc
cpuid
jmp 0x6272aa
bswap esi
mov edx, 0xbf627550
xchg ebp, edi
mov bl, bh
ror dh, 7
rdtsc
jmp 0x627185
add esp, 1
mov byte [esp + 1], bh
pop bp
pop si
mov di, bx
setae bh
jmp 0x6271a2
push esp
mov cx, 0x8fab
bsr si, cx
pop edi
pop word [esp + 4]
xchg dword [esp + 2], eax
jmp 0x62716c
xchg word [esp + 0xe], dx
mov ebx, dword [esp + 0xd]
setp dh
call 0x627216
xchg edi, eax
mov eax, dword [esp + 0x1a]
xchg dword [esp + 0xf], ebx
inc bl
jmp 0x62728d
mov cx, word [esp + 0xa]
btr edi, esp
btr ebx, esp
and cl, bh
mov al, 0x46
cpuid
jmp 0x627204
mov bp, dx
rdtsc
pop ebp
mov bl, bh
setns ch
pop si
jmp 0x627230
btc edi, ebx
mov si, word [esp]
lea ebp, [esp + edx]
xchg ecx, edi
mov cl, ch
pushal
jmp 0x627248
lea ebp, [edx + ebp]
ror esi, 0x1b
lea esi, [eax + edi]
lea edx, reloc.RASAPI32.dll_RasHangUpA
call fcn.0062730b
sub al, byte [ebp - 0xc]
out 0x87, eax
into
xchg esi, ecx
pop dword [esp + 4]
xchg byte [esp + 4], cl
mov dword [esp + 3], ebp
bsr di, cx
mov eax, dword [esp + 4]
jmp 0x627275
xchg word [esp + 1], bx
xchg dword [esp], ebx
mov si, dx
lea esp, [esp + 1]
setns dh
not ch
jmp 0x627264

Function at 0x62730b
Capabilities:
Execute anti-debugging instructions

Disassembly:
cmc
cmc
neg ax
cmc
mov dx, di
mov dh, byte [esp + 0xb]
jmp 0x627a94
mov cx, word [esp + 0x1a]
mov bl, 0x38
mov dx, bx
lea esp, [esp + 7]
mov eax, dword [esp + 0xd]
jmp 0x6272c0
xchg di, cx
lea edi, [ecx*4]
btr esi, edx
mov esi, dword [esp + 0xf]
jmp 0x6272da
xchg ecx, edi
lea esp, [esp + 6]
jmp 0x6272f2
inc ecx
xor ebx, esi
not edx
mov ebx, 0x3696ac1e
call fcn.00627342
sbb dword [esi + 0x7c9e6304], edx
xchg dword [esi], ebp
cmp dword [eax], ebx
mov word [esp + 5], bx
lea edi, [esp + ecx]
mov ebx, esi
ror edi, 9
cpuid
xchg word [esp + 2], bp
jmp 0x62735a
lea ecx, [eax + edx]
lea eax, [eax + ebx]
popal
bswap ebp
mov ax, word [esp + 5]
pop word [esp + 5]
jmp 0x627373
lea edi, [ecx + 0x4b]
bsf ax, ax
mov al, ah
rdtsc
mov eax, esi
pushal
jmp 0x62740f
setae ch
not ebp
pop dword [esp + 5]
btr eax, esp
rdtsc
mov dh, byte [esp + 2]
jmp 0x6274bb
lea esi, [ecx*4]
rdtsc
not bh
mov dl, 4
add esp, 9
lea ecx, [esi*4]
jmp 0x62759f
push edx
xchg word [esp + 7], dx
mov dword [esp + 0x11], ebp
mov word [esp + 0xc], dx
clc
xchg word [esp + 9], dx
jmp 0x6279b3
Function at 0x627342
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov di, word [esp + 0xb]
mov edi, ebp
jmp 0x6273bc
mov ebp, 0x6f556258
pop word [esp + 1]
bsf di, ax
push word [esp + 6]
jmp 0x6273f8
btc eax, ebx
cmc
xchg dx, cx
xchg word [esp + 4], di
lea esi, [ecx + 0x13]
mov dh, byte [esp + 7]
jmp 0x627389
inc bp
xor dl, ch
pop ecx
cpuid
bswap ebp
bswap edi
jmp 0x6273a3
mov edi, 0x50e30fd2
cld
rdtsc
cpuid
not ch
rdtsc
jmp 0x627442
mov cl, 0xc2
mov edi, 0xd513d8ca
pop dword [esp]
pop word [esp]
jmp 0x6273c9
xchg dword [esp], ecx
mov dl, dh
rcr eax, 1
not ch
cmc
cmc
jmp 0x6273e0
not edx
mov bp, word [esp + 2]
mov cl, ch
pushal
pop bp
rdtsc
jmp 0x627481
sub bp, 0xccf0
setp bh
not ebp
bswap ebx
not ah
mov byte [esp + 1], bh
jmp 0x627427
mov dword [esp + 7], esi
mov bp, 0xf815
lea ebx, [ecx + 0x2b]
mov di, 0x70d1
xchg word [esp + 0xb], bp
mov ebx, dword [esp + 9]
jmp 0x627497
lea esp, [esp + 0x10]
mov dword [esp + 7], ecx
bswap edx
rol ax, cl
mov dword [esp + 0xc], ebp
xchg cx, di
jmp 0x627456
setge ah
bsf ax, ax
mov edx, dword [esp + 9]
inc ebp
rdtsc
cpuid
jmp 0x6274ff
lea eax, [edx*4]
add esp, 0
shr bh, 3
lea esp, [esp]
jmp 0x627583
lea ecx, [ecx*4]
lea esp, [esp + 0xe]
cmc
bswap ebp
setno ch
jmp 0x6274ce
bswap edi
sub eax, eax
mov dl, 0xc4
lea esi, [eax*4]
pop bp
btr edx, esp
jmp 0x6274e5
rdtsc
call fcn.0062752c
mov cl, byte [eax]
sahf
stc
or ah, bl
and al, 0xa5
xor eax, 0x564baf5c
salc
inc esp
and ebx, esi
aas
invalid

Function at 0x627791
Capabilities:
Access peb ldr_data
Parse pe header

Disassembly:
push edx
mov word [esp + 4], di
pop word [esp + 3]
mov byte [esp], ah
jmp 0x62785f
mov word [esp], bx
lea esp, [esp + 2]
Function at 0x404c50
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6990
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1774
call fcn.00589870
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebp - 0x7e4]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0xd0c]
mov dword [ebp - 0x14], esi
test eax, eax
mov dword [ebp - 4], 0
push 0x7cf
je 0x404cd8
mov ecx, dword [esi + 0xd08]
lea eax, [ebp - 0x1784]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x404cec
lea edx, [ebp - 0x7e4]
push 0x7d0
lea eax, [ebp - 0x1784]
push edx
push eax
call fcn.00404160
add esp, 0xc
jmp 0x404cec
mov edx, dword [esi + 0xd08]
lea ecx, [ebp - 0x7e4]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x7e4]
mov ecx, esi
push eax
call fcn.00404900
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x406700
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6d80
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x1770
call fcn.00589870
push ebx
push esi
mov esi, ecx
push edi
mov ecx, 0x1f4
xor eax, eax
lea edi, [ebp - 0x7e0]
mov dword [ebp - 0x10], esp
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x4f8]
mov dword [ebp - 4], 0
test eax, eax
push 0x7cf
je 0x406785
mov ecx, dword [esi + 0x4f4]
lea eax, [ebp - 0x1780]
push eax
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x406799
lea edx, [ebp - 0x7e0]
push 0x7d0
lea eax, [ebp - 0x1780]
push edx
push eax
call fcn.00404160
add esp, 0xc
jmp 0x406799
mov edx, dword [esi + 0x4f4]
lea ecx, [ebp - 0x7e0]
push ecx
push edx
call dword [sym.imp.USER32.dll_GetWindowTextA]
lea eax, [ebp - 0x7e0]
lea ecx, [esi + 0x4d0]
push eax
push 0x65bf6c
push ecx
call fcn.0059e618
add esp, 0xc
mov ecx, esi
call fcn.00406df0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407530
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x5b6ee8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x318
push ebx
push esi
push edi
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov eax, dword [esi + 0x78]
push ebx
push ebx
push 0x1009
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
xor edi, edi
mov dword [ebp - 0x14], ebx
mov eax, dword [esi + 0x98]
cmp ebx, dword [eax + 0x1c]
jge 0x4076c7
mov ecx, dword [0x682f9c]
mov dword [ebp - 0x18], ecx
mov edx, dword [eax + 0x18]
lea ebx, [ebx + ebx*8]
shl ebx, 2
mov byte [ebp - 4], 1
mov ecx, dword [edx + ebx + 4]
mov edx, dword [eax + 4]
push ecx
push edx
lea eax, [ebp - 0x18]
push 0x65c250
push eax
call fcn.0059e618
mov edx, dword [ebp - 0x18]
add esp, 0x10
lea ecx, [esi + 0x5c]
push 0
push 0
push 0
push 0
push edx
push edi
push 1
call fcn.0059f984
inc edi
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edi
mov ecx, 0xad
xor eax, eax
lea edi, [ebp - 0x324]
rep stosd dword es:[edi], eax
mov eax, dword [esi + 0x98]
push 0x4411
lea edx, [ebp - 0x324]
push 0x160
mov ecx, dword [eax + 0x18]
push edx
push 0x80
mov eax, dword [ecx + ebx]
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov edx, dword [esi + 0x78]
mov eax, dword [ebp - 0x320]
mov edi, dword [ebp - 0x20]
lea ecx, [ebp - 0x48]
push ecx
push 0
push 0x1006
push edx
mov dword [ebp - 0x48], 2
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x44], edi
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [esi + 0x98]
mov ecx, dword [eax + 0x18]
mov eax, dword [ecx + ebx + 8]
test eax, eax
mov eax, 0x6882cc
jne 0x407653
mov eax, 0x6882c8
mov eax, dword [eax]
lea ecx, [esi + 0x5c]
push eax
push 1
push edi
call fcn.0059fa7f
mov edx, dword [esi + 0x98]
mov dword [ebp - 0x68], 2
lea ecx, [ebp - 0x70]
mov eax, dword [edx + 0x18]
mov edx, dword [esi + 0x78]
push ecx
push edi
mov ebx, dword [eax + ebx]
push 0x1074
push edx
mov dword [ebp - 0x5c], ebx
call dword [sym.imp.USER32.dll_SendMessageA]
mov eax, dword [ebp - 0x14]
lea ecx, [esi + 0x5c]
push eax
push 0
push 0
push 0
push 0
push 4
push 0
push edi
call fcn.0059fa06
lea ecx, [ebp - 0x18]
mov byte [ebp - 4], 0
call fcn.005a584d
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x14], eax
mov ebx, eax
jmp 0x407571
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4079f0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b6f7b
push eax
mov dword fs:[0], esp
sub esp, 0x220
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
je 0x407b08
mov eax, dword [esi + 8]
mov dword [esp + 8], edi
cmp eax, edi
mov dword [esp + 0xc], edi
jle 0x407b08
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
mov eax, dword [esi + 4]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
mov eax, dword [eax + ebx + 4]
push edx
push edi
push 0xf003f
push edi
push 0x6874e8
push edi
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x407a9a
lea ecx, [esp + 0x20]
call fcn.004849d0
push 1
push str.Cannot_open__create__registry_subkey_during_CBrowsersIntegration::Save__._r_n
lea ecx, [esp + 0x28]
mov dword [esp + 0x240], edi
call fcn.00484af0
lea ecx, [esp + 0x20]
mov dword [esp + 0x238], 0xffffffff
call fcn.00484ae0
jmp 0x407ae0
mov ecx, dword [esi + 4]
xor eax, eax
mov edx, dword [ecx + ebx]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push eax
push 0x65c5a8
push edx
call ebp
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push 4
push edx
mov ecx, dword [eax + ebx + 8]
mov eax, dword [esp + 0x18]
push 4
push 0
push 0x65c5a4
push eax
mov dword [esp + 0x30], ecx
call ebp
xor edi, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x407a37
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, edi
pop ebx
je 0x407b08
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x228]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x22c
ret
Function at 0x409d40
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp]
push esi
xor esi, esi
push eax
mov eax, dword [ecx + 0x14]
push 1
push esi
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409d95
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.found
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409d95
mov esi, dword [esp + 8]
mov eax, dword [esp + 4]
test eax, eax
je 0x409da4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4
Function at 0x40b540
Capabilities:
Shutdown system
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5b720c
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x12c
test eax, eax
je 0x40b5d2
push 0
lea ecx, [esp + 0x18]
call fcn.004daa40
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], 0
call fcn.005a17e3
lea ecx, [esp + 0xe8]
mov dword [esp + 0x134], 3
call fcn.005ad359
lea ecx, [esp + 0xac]
mov byte [esp + 0x134], 2
call fcn.0059ff8d
lea ecx, [esp + 0x70]
mov byte [esp + 0x134], 1
call fcn.005ad391
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], 0xffffffff
call fcn.005a1424
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b624
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c380
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10c
add ecx, 4
push ebx
push ebp
push esi
push edi
push str.IEXPLORE
call fcn.00409ce0
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
jne 0x40c453
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c421
test ebx, ebx
je 0x40c448
mov esi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40c418
test cl, cl
je 0x40c414
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40c418
add eax, 2
add esi, 2
test cl, cl
jne 0x40c3f4
xor eax, eax
jmp 0x40c41d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c448
mov edi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push 1
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WSOCK32.dll_bind
call ebp
test eax, eax
jne 0x40c50d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.DownloadUI
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c4db
test ebx, ebx
je 0x40c502
mov esi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40c4d2
test cl, cl
je 0x40c4ce
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40c4d2
add eax, 2
add esi, 2
test cl, cl
jne 0x40c4aa
xor eax, eax
jmp 0x40c4d7
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c502
mov edi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push 1
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40dfe0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
call fcn.004368b0
neg eax
sbb eax, eax
lea ecx, [esp + 8]
and eax, 0x100
push ecx
add eax, 0xf003f
push eax
push 0
push str.SYSTEMCurrentControlSetServicesIDMTDI
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40e046
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push 0
push 0x65d164
push eax
mov dword [esp + 0x24], 1
call esi
mov ecx, dword [esp + 8]
push ecx
call edi
lea edx, [esp + 8]
push 0
push edx
push 0
push 0xf003f
push 0
push 0x6874e8
push 0
push 0x65be60
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e097
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push str.AdvIntDriverEnabled2
push ecx
mov dword [esp + 0x24], 1
call esi
mov edx, dword [esp + 8]
push edx
call edi
pop edi
pop esi
add esp, 8
ret
Function at 0x40e750
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
sub esp, 0xa0
push esi
lea eax, [esp + 0x10]
push edi
mov edi, ecx
push eax
xor esi, esi
mov dword [esp + 0x18], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40e79c
cmp dword [esp + 0x24], 2
jne 0x40e79c
cmp dword [esp + 0x18], 6
jb 0x40e7aa
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
mov esi, 1
push str..IDMWFP
jmp 0x40e7be
mov eax, dword [edi + 0x1c]
pop edi
pop esi
add esp, 0xa0
ret 4
push 0
push 0
push 3
push 0
push 3
push 0xc0000000
push str..IDMTDI
call dword [sym.imp.KERNEL32.dll_CreateFileA]
cmp eax, 0xffffffff
je 0x40e7ed
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [esp + 0xac]
pop edi
mov eax, 1
pop esi
mov dword [ecx], 1
add esp, 0xa0
ret 4
call fcn.004368b0
mov edi, dword [esp + 0xac]
neg eax
sbb eax, eax
mov dword [edi], 0
and eax, 0x100
add eax, 0x20019
test esi, esi
je 0x40e820
lea edx, [esp + 8]
push edx
push eax
push 0
push str.SYSTEMCurrentControlSetServicesIDMWFP
jmp 0x40e82d
lea ecx, [esp + 8]
push ecx
push eax
push 0
push str.SYSTEMCurrentControlSetServicesIDMTDI
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40e885
mov ecx, dword [esp + 8]
lea edx, [esp + 0xc]
lea eax, [esp + 0x10]
push edx
push eax
push 0
push 0
push 0x65d164
push ecx
mov dword [esp + 0x24], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40e87a
mov eax, dword [esp + 0x10]
cmp eax, 1
je 0x40e87a
cmp eax, 2
je 0x40e87a
mov dword [edi], 1
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
xor eax, eax
pop esi
add esp, 0xa0
ret 4