joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4015f0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x42c760]
xor eax, ebp
mov dword [ebp - 4], eax
movzx eax, word [ebp + 8]
push 0xe
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
jne 0x401626
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push eax
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x401616
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, eax
mov dword [ebp - 0x9c], ecx
test ecx, ecx
je 0x401616
movaps xmm0, xmmword [0x422410]
lea edx, [ecx + 6]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x98], edx
xor esi, esi
movups xmmword [ebp - 0x14], xmm0
test ebx, ebx
js 0x40169d
movzx edi, word [ecx + 4]
xor eax, eax
test edi, edi
je 0x401698
add edx, 6
movzx ecx, word [edx]
cmp ecx, dword [ebp + ebx*4 - 0x14]
jne 0x401684
mov dword [ebp + esi*4 - 0x94], eax
inc esi
inc eax
add edx, 0xe
cmp eax, edi
jl 0x401673
mov edx, dword [ebp - 0x98]
mov ecx, dword [ebp - 0x9c]
dec ebx
test esi, esi
je 0x401662
test esi, esi
jle 0x401715
xor ebx, ebx
xor ecx, ecx
test esi, esi
jle 0x4016d8
mov edi, dword [ebp + 0x10]
nop dword [eax]
movzx eax, byte [edx]
sub eax, edi
cdq
xor eax, edx
sub eax, edx
mov dword [ebp + ecx*4 - 0x54], eax
je 0x4016d8
test edi, edi
je 0x4016d8
mov edx, dword [ebp - 0x98]
inc ecx
add edx, 0xe
mov dword [ebp - 0x98], edx
cmp ecx, esi
jl 0x4016b0
cmp ecx, esi
jne 0x40170c
xor ecx, ecx
test esi, esi
jle 0x40170a
xor edi, edi
nop dword [eax]
nop dword [eax + eax]
lea edx, [ecx*4]
mov eax, dword [ebp + edx - 0x54]
cmp eax, dword [ebp + edi - 0x54]
jge 0x401705
mov ebx, ecx
mov edi, edx
inc ecx
cmp ecx, esi
jl 0x4016f0
mov ecx, ebx
mov eax, dword [ebp + ecx*4 - 0x94]
jmp 0x401725
mov eax, dword [ebp + 0x10]
push 0
push eax
push eax
push 1
push ecx
call dword [sym.imp.USER32.dll_LookupIconIdFromDirectoryEx]
push 3
movzx eax, ax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov esi, eax
test esi, esi
je 0x40175c
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov edi, eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x40175c
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
jne 0x40176f
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0x30000
push 1
push edi
push eax
call dword [sym.imp.USER32.dll_CreateIconFromResourceEx]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
Function at 0x401d30
Capabilities:
Check if file exists
Get file attributes
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x42c760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 3
call fcn.004038c0
add esp, 0xc
cmp eax, 2
jge 0x401d6d
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push 0x4226bc
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x401d88
push eax
call fcn.00409180
add esp, 4
push 0x42d1c0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x401dbd
test al, 0x10
je 0x401dbd
push 0x42d1c0
call fcn.00408780
push 0x42cfb8
push 0x208
push 0x42d1c0
call fcn.0040f8ef
add esp, 0x10
push 0x42d1c0
push 0x4226c8
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x10
test eax, eax
je 0x401df5
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push ebx
push esi
push edi
push 0x4226dc
call fcn.00409040
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 4
mov esi, eax
nop dword [eax]
push 0x42d1c0
push 0x42cfb8
call fcn.00406ca0
mov edi, eax
add esp, 8
test edi, edi
je 0x401e37
test esi, esi
jle 0x401e37
push 0x64
call ebx
sub esi, 0x64
test esi, esi
jg 0x401e10
cmp edi, 0x1f
jne 0x401ef3
push str.REBOOTIFLOCKED
push 0x42d3c8
call fcn.0040f993
add esp, 8
test eax, eax
jne 0x401eec
push 0x42d1c0
push str._s.bak
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00404c40
mov esi, dword [sym.imp.KERNEL32.dll_MoveFileExA]
lea eax, [ebp - 0x108]
add esp, 0x10
push 1
push eax
push 0x42d1c0
call esi
xor ecx, ecx
test eax, eax
push 4
push ecx
lea eax, [ebp - 0x108]
cmovne edi, ecx
push eax
call esi
mov byte [0x42fc52], 1
test edi, edi
jne 0x401ee7
push 0x422700
call fcn.00409040
add esp, 4
mov esi, eax
nop dword [eax + eax]
push 0x42d1c0
push 0x42cfb8
call fcn.00406ca0
mov edi, eax
add esp, 8
test edi, edi
je 0x401ee7
test esi, esi
jle 0x401ee7
push 0x64
call ebx
sub esi, 0x64
test esi, esi
jg 0x401ec0
cmp edi, 0x1f
jne 0x401ef3
mov edi, 8
jmp 0x401ef7
test edi, edi
je 0x401f25
push str.SILENT
push 0x42d3c8
call fcn.0040f993
add esp, 8
test eax, eax
jne 0x401f25
push 0x42d1c0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor ecx, ecx
mov edi, 8
cmp eax, 0xffffffff
cmovne edi, ecx
push 0x422714
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x401f41
push 0
call fcn.00409180
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
Function at 0x4020f0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push dword [ebp + 0xc]
push dword [ebp + 8]
push 5
call fcn.004038c0
add esp, 0xc
cmp eax, 4
jge 0x402114
mov eax, 3
mov esp, ebp
pop ebp
ret
push 0x42d5d0
push 0x42d3c8
push 0x4227a8
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x14
test eax, eax
je 0x402151
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4227c8
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x40216c
push eax
call fcn.00409180
add esp, 4
push ebx
push edi
push 0x42cfb8
xor edi, edi
call fcn.00403920
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402207
cmp byte [0x42fc50], 0
push esi
mov esi, 0xf003f
je 0x4021b2
push 0x4227d4
push 0x42d7d8
call fcn.0040f993
add esp, 8
mov ecx, 0xf013f
test eax, eax
cmove esi, ecx
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0
push 0
push 0
push 0x42d1c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov ecx, 0x42d5d0
pop esi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x4021d8
sub ecx, edx
lea eax, [ecx + 1]
push eax
push 0x42d5d0
push 1
push 0
push 0x42d3c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40220c
mov edi, 0xb
push 0x4227d8
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x402228
push 0
call fcn.00409180
add esp, 4
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push dword [ebp + 0xc]
push dword [ebp + 8]
push 5
call fcn.004038c0
add esp, 0xc
cmp eax, 4
jge 0x402254
mov eax, 3
mov esp, ebp
pop ebp
ret
push 0x42d5d0
push 0x42d3c8
push str.Creating_Registry_value:__s_s
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x14
test eax, eax
je 0x402291
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x422804
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x4022ac
push eax
call fcn.00409180
add esp, 4
push ebx
push edi
push 0xa
push 0
push 0x42d5d0
call fcn.00413555
push 0x42cfb8
mov dword [ebp - 8], eax
xor edi, edi
call fcn.00403920
mov ebx, eax
add esp, 0x10
test ebx, ebx
je 0x402340
cmp byte [0x42fc50], 0
push esi
mov esi, 0xf003f
je 0x4022ff
push 0x422810
push 0x42d7d8
call fcn.0040f993
add esp, 8
mov ecx, 0xf013f
test eax, eax
cmove esi, ecx
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push 0
push esi
push 0
push 0
push 0
push 0x42d1c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
push 4
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x42d3c8
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
jmp 0x402345
mov edi, 0xc
push 0x422814
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x402361
push 0
call fcn.00409180
add esp, 4
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x402720
Capabilities:
Check if file exists
Delete file
Enumerate files on windows
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x350
mov eax, dword [0x42c760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 2
call fcn.004038c0
add esp, 0xc
cmp eax, 1
jge 0x40275d
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push 0x4228d8
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x402778
push eax
call fcn.00409180
add esp, 4
push 0x42cfb8
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.0040f453
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call fcn.0040c820
add esp, 0x14
test eax, eax
je 0x4027a7
mov byte [eax + 1], 0
lea eax, [ebp - 0x34c]
push eax
push 0x42cfb8
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x350], eax
cmp eax, 0xffffffff
je 0x4028c2
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
nop word [eax + eax]
lea eax, [ebp - 0x320]
push eax
lea eax, [ebp - 0x20c]
push eax
push 0x4228e4
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00404c40
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call ebx
test al, 0x10
jne 0x40289e
lea eax, [ebp - 0x108]
push eax
push str.Deleting_file:__s
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x10
test eax, eax
je 0x402852
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push str.TRYTIME
call fcn.00409040
mov esi, eax
add esp, 4
cmp esi, 0x3e8
mov eax, 0x3e8
cmovl esi, eax
nop
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40289e
test esi, esi
jle 0x40289e
lea eax, [ebp - 0x108]
push eax
call ebx
cmp eax, 0xffffffff
je 0x40289e
push 0x64
call edi
sub esi, 0x64
test esi, esi
jg 0x402870
lea eax, [ebp - 0x34c]
push eax
push dword [ebp - 0x350]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4027e0
mov eax, dword [ebp - 0x350]
pop edi
pop esi
pop ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
push 0x42290c
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x4028e5
push 0
call fcn.00409180
add esp, 4
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
Function at 0x402900
Capabilities:
Check if file exists
Delete directory
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push 1
call fcn.004038c0
add esp, 0xc
cmp eax, 1
je 0x40291f
mov eax, 3
pop ebp
ret
push 0x42cfb8
push str.Removing_directory:__s
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x10
test eax, eax
je 0x402957
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x422930
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x402972
push eax
call fcn.00409180
add esp, 4
push esi
push 0x42cfb8
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40299a
push 0x42cfb8
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
test eax, eax
mov ecx, 0x14
cmove esi, ecx
push 0x42293c
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x4029b6
push 0
call fcn.00409180
add esp, 4
mov eax, esi
pop esi
pop ebp
ret

Function at 0x4029c0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 3
call fcn.004038c0
add esp, 0xc
cmp eax, 2
jge 0x4029e1
mov eax, 3
pop ebp
ret
push 0x42d1c0
push str.Deleting_Registry_key:__s
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x10
test eax, eax
je 0x402a19
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x42298c
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x402a34
push eax
call fcn.00409180
add esp, 4
push esi
push edi
push 0x42cfb8
xor edi, edi
call fcn.00403920
mov esi, eax
add esp, 4
test esi, esi
je 0x402a8a
cmp byte [0x42fc50], 0
je 0x402a7c
push 0x422998
push 0x42d3c8
call fcn.0040f993
test eax, eax
sete al
movzx eax, al
push eax
push 0x42d1c0
push esi
call fcn.004039b0
add esp, 0x14
jmp 0x402a8f
push 0x42d1c0
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
jmp 0x402a8f
mov edi, 0x15
push 0x42299c
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x402aab
push 0
call fcn.00409180
add esp, 4
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x402ac0
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
push 4
call fcn.004038c0
add esp, 0xc
cmp eax, 3
jge 0x402ae2
mov eax, 3
mov esp, ebp
pop ebp
ret
push 0x42d3c8
push str.Deleting_Registry_value:__s
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x10
test eax, eax
je 0x402b1a
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x4229c4
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x402b35
push eax
call fcn.00409180
add esp, 4
push ebx
push edi
push 0x42cfb8
xor edi, edi
call fcn.00403920
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x402ba9
cmp byte [0x42fc50], 0
push esi
mov esi, 0xf003f
je 0x402b77
push 0x4229d0
push 0x42d5d0
call fcn.0040f993
add esp, 8
mov ecx, 0xf013f
test eax, eax
cmove esi, ecx
lea eax, [ebp - 4]
push eax
push esi
push 0
push 0x42d1c0
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 4]
pop esi
test eax, eax
je 0x402bae
push 0x42d3c8
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x402bae
mov edi, 0x16
push str.REALUSER
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x402bca
push 0
call fcn.00409180
add esp, 4
mov eax, edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x402ff0
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x42c760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 1
call fcn.004038c0
add esp, 0xc
cmp eax, 1
je 0x40302a
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push 0x42cfb8
push str.Stopping_service:__s
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x10
test eax, eax
je 0x403062
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push esi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov esi, eax
test esi, esi
jne 0x40308a
lea eax, [esi + 1]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push edi
push 0xf01ff
push 0x42cfb8
push esi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
je 0x4030c9
lea eax, [ebp - 0x20]
mov dword [ebp - 8], 0
push eax
xorps xmm0, xmm0
push 1
push edi
movups xmmword [ebp - 0x20], xmm0
movq qword [ebp - 0x10], xmm0
call dword [sym.imp.ADVAPI32.dll_ControlService]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
Function at 0x403170
Capabilities:
Check if file exists
Get file attributes
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x744
mov eax, dword [0x42c760]
xor eax, ebp
mov dword [ebp - 4], eax
push str.Removing_DeskSoft_license_file_association
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0xc
test eax, eax
je 0x4031b6
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x42246c
call fcn.00409dd0
add esp, 4
test eax, eax
je 0x4031da
mov eax, 0x1a
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push esi
push 0x52e
lea eax, [ebp - 0x73c]
push 0
push eax
call fcn.0040cfa0
add esp, 0xc
lea eax, [ebp - 0x744]
xor esi, esi
push eax
push 0x20019
push esi
push 0x42247c
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x403226
lea eax, [esi + 0x1a]
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
lea eax, [ebp - 0x740]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0x20c]
mov dword [ebp - 0x740], 0x104
push eax
push 0
push dword [ebp - 0x744]
call edi
test eax, eax
jne 0x4032e5
mov ebx, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
lea eax, [ebp - 0x73c]
inc esi
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.004097c0
add esp, 8
test al, al
je 0x4032b8
push str.SetDLC.exe
lea eax, [ebp - 0x728]
push eax
push 0x42249c
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00404c40
add esp, 0x14
lea eax, [ebp - 0x108]
push eax
call ebx
cmp eax, 0xffffffff
jne 0x403343
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x740]
mov dword [ebp - 0x740], 0x104
push eax
lea eax, [ebp - 0x20c]
push eax
push esi
push dword [ebp - 0x744]
call edi
test eax, eax
je 0x403266
cmp byte [ebp - 0x728], 0
je 0x403330
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x728]
push eax
push str._s_s.exe
lea eax, [ebp - 0x108]
push 0x104
push eax
call fcn.00404c40
push 0x4224dc
push 0x4224e0
lea eax, [ebp - 0x108]
push eax
push 0x4224f8
call fcn.00409a50
add esp, 0x24
pop edi
pop ebx
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push 0x4224a4
push 0x4224a8
lea eax, [ebp - 0x108]
push eax
push 0x4224c0
call fcn.00409a50
mov ecx, dword [ebp - 4]
add esp, 0x10
xor ecx, ebp
xor eax, eax
pop edi
pop ebx
pop esi
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
Function at 0x403380
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0xc]
push dword [ebp + 8]
push 3
call fcn.004038c0
add esp, 0xc
cmp eax, 1
jge 0x40339f
mov eax, 3
pop ebp
ret
push 0x422508
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x4033ba
push eax
call fcn.00409180
add esp, 4
push esi
xor esi, esi
cmp dword [0x42fc4c], 0x258
jl 0x40340c
push str..exe
push 0x42cfb8
call fcn.0040c960
add esp, 8
test eax, eax
je 0x40340c
push str.Elevated
push 0x42d3c8
call fcn.0040f993
add esp, 8
test eax, eax
je 0x40340c
push esi
push 0x42d1c0
push 0x42cfb8
call fcn.00409e70
add esp, 0xc
mov esi, eax
jmp 0x40342f
push 1
push 0
push 0x42d1c0
push 0x42cfb8
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
mov ecx, 0x1b
cmovbe esi, ecx
push 0x422528
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x40344b
push 0
call fcn.00409180
add esp, 4
mov eax, esi
pop esi
pop ebp
ret
Function at 0x403450
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x42c760]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
push eax
push ecx
push 5
call fcn.004038c0
add esp, 0xc
cmp eax, 1
jge 0x40348d
mov eax, 3
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push 0x42d1c0
push 0x42cfb8
push str.__s___s
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.00404c40
lea eax, [ebp - 0x20c]
push eax
push str.Executing:__s
push 0x208
push 0x42d9e0
call fcn.00404c40
mov eax, dword [0x42de00]
add esp, 0x24
test eax, eax
je 0x4034e7
push 0x42d9e0
push 0
push 0x8001
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push 0x42254c
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x403502
push eax
call fcn.00409180
add esp, 4
push 0x40
lea eax, [ebp - 0x260]
mov dword [ebp - 0x264], 0x44
push 0
push eax
call fcn.0040cfa0
movsx eax, byte [0x42d5d0]
push eax
call fcn.0040f8bf
add esp, 0x10
cmp eax, 0x48
jne 0x403544
xor eax, eax
mov dword [ebp - 0x238], 1
mov word [ebp - 0x234], ax
push edi
xor edi, edi
xor ecx, ecx
cmp byte [0x42d3c8], cl
mov eax, 0x42d3c8
xorps xmm0, xmm0
cmove eax, ecx
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x264]
push ecx
push eax
push edi
push 0x20
push edi
push edi
push edi
lea eax, [ebp - 0x20c]
push eax
push edi
movups xmmword [ebp - 0x220], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp eax, 1
jne 0x403664
cmp byte [0x42fc53], 0
push ebx
push esi
mov dword [ebp - 0x210], 0x103
jne 0x4035f0
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
nop
lea eax, [ebp - 0x210]
push eax
push dword [ebp - 0x220]
call ebx
cmp eax, 1
jne 0x4035e3
mov eax, dword [ebp - 0x210]
cmp eax, 0x103
jne 0x403607
call fcn.00404e00
push 0x32
call esi
cmp byte [0x42fc53], 0
je 0x4035b0
mov eax, dword [ebp - 0x210]
cmp eax, 0x103
jne 0x403607
push 0x103
push dword [ebp - 0x220]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov eax, dword [ebp - 0x210]
test eax, eax
je 0x403638
push eax
push 0x422558
lea eax, [ebp - 0x20c]
push 0x208
push eax
call fcn.00404c40
lea eax, [ebp - 0x20c]
push eax
push 0x422560
call fcn.00408dd0
add esp, 0x18
jmp 0x40364a
push 0x42256c
push 0x422570
call fcn.00408dd0
add esp, 8
push dword [ebp - 0x220]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x21c]
call esi
pop esi
pop ebx
jmp 0x40367f
push 0x42257c
push 0x42d7d8
call fcn.0040f993
add esp, 8
mov edi, eax
neg edi
sbb edi, edi
and edi, 0x1b
push 0x422584
call fcn.00409040
add esp, 4
cmp eax, 1
jne 0x40369b
push 0
call fcn.00409180
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, edi
xor ecx, ebp
pop edi
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
Function at 0x4039b0
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1460
call fcn.0040b490
mov eax, dword [0x42c760]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [ebp + 0x10], 0
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x403ad5
push str.RegDeleteKeyEx
push 0x422958
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1460], eax
test eax, eax
je 0x403ad5
lea eax, [ebp - 0x1458]
push eax
push 0xf013f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x1458]
test eax, eax
je 0x403add
push ebx
xor ebx, ebx
mov dword [ebp - 0x145c], 0xa28
push ebx
push ebx
push ebx
push ebx
lea ecx, [ebp - 0x145c]
push ecx
lea ecx, [ebp - 0xa2c]
push ecx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x403aa9
nop dword [eax]
lea eax, [ebp - 0xa2c]
inc ebx
push eax
push edi
push 0x422968
lea eax, [ebp - 0x1454]
push 0xa28
push eax
call fcn.00404c40
push dword [ebp + 0x10]
lea eax, [ebp - 0x1454]
push eax
push esi
call fcn.004039b0
add esp, 0x20
lea eax, [ebp - 0x145c]
push 0
push 0
push 0
push 0
push eax
lea eax, [ebp - 0xa2c]
push eax
push ebx
push dword [ebp - 0x1458]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x403a50
push dword [ebp - 0x1458]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0x100
push edi
push esi
call dword [ebp - 0x1460]
pop ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040b37e
mov esp, ebp
pop ebp
ret
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040b37e
mov esp, ebp
pop ebp
ret