joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10041840
Capabilities:
Reference sql statements

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x10063f3d
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10088020]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, edx
mov dword [ebp - 0x18], ebx
mov esi, ecx
xor eax, eax
lea ecx, [ebp]
push 0xffffffffffffffff
mov edx, str.SELECT__FROM__Condition__WHERE__Condition_._Feature__
mov word [ebp], ax
call fcn.10013290
add esp, 4
cmp word [eax], 0
je 0x100418a9
nop
add eax, 2
cmp word [eax], 0
jne 0x100418a0
push 0xffffffffffffffff
mov edx, ebx
mov ecx, eax
call fcn.10013290
add esp, 4
cmp word [eax], 0
je 0x100418c9
nop dword [eax]
add eax, 2
cmp word [eax], 0
jne 0x100418c0
push 0xffffffffffffffff
mov edx, 0x1007971c
mov ecx, eax
call fcn.10013290
add esp, 4
mov dword [ebp - 0x14], 0
mov dword [ebp - 4], 0
push esi
call dword [sym.imp.msi.dll_MsiGetFeatureCostA]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x14]
mov edi, dword [sym.imp.msi.dll_MsiConfigureFeatureFromDescriptorA]
test ecx, ecx
je 0x10041908
push ecx
call edi
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 0
push eax
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.msi.dll_MsiEnumClientsA]
push 0
push dword [ebp - 0x14]
call dword [sym.imp.msi.dll_MsiViewModify]
mov dword [ebp - 0x10], 0
mov byte [ebp - 4], 2
mov esi, dword [sym.imp.msi.dll_MsiDatabaseIsTablePersistentA]
mov ebx, dword [sym.imp.msi.dll_MsiRecordClearData]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1004194a
push eax
call edi
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push eax
push dword [ebp - 0x14]
call esi
test eax, eax
jne 0x1004196a
push dword [ebp - 0x10]
push 6
push dword [ebp - 0x14]
call ebx
jmp 0x10041940
push 3
call dword [sym.imp.msi.dll_MsiDatabaseExportA]
mov ecx, dword [ebp - 0x10]
mov esi, eax
test ecx, ecx
je 0x1004197e
push ecx
call edi
push dword [ebp - 0x18]
mov dword [ebp - 0x10], esi
push 1
push esi
mov esi, dword [sym.imp.msi.dll_MsiReinstallFeatureW]
call esi
push 0
push 2
push dword [ebp - 0x10]
call dword [sym.imp.msi.dll_MsiRecordSetStringW]
push 0x100707b8
push 3
push dword [ebp - 0x10]
call esi
push dword [ebp - 0x10]
push 7
push dword [ebp - 0x14]
call ebx
mov esi, dword [ebp - 0x1c]
push esi
call dword [sym.imp.msi.dll_MsiDatabaseGenerateTransformW]
test eax, eax
sete bl
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x100419cf
push eax
call edi
mov byte [ebp - 4], 0
test esi, esi
je 0x100419da
push esi
call edi
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x14]
test ecx, ecx
je 0x100419eb
push ecx
call edi
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10044a98
lea esp, [ebp + 0x20c]
pop ebp
ret
Function at 0x100443fd
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.100443d9
pop esi
leave
ret 8

Function at 0x100500c6
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10069210
push 0x10069208
push str.FlsAlloc
push 0x1e
call fcn.1004ffe4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x100500fa
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006556c]
call esi
jmp 0x10050100
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10050144
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10069220
push 0x10069218
push str.FlsGetValue
push 0x20
call fcn.1004ffe4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x1005017b
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006556c]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x100535d0
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1005366d
push ebx
push esi
call fcn.10053599
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10052521
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1005361a
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005366c
push edi
push eax
call fcn.1004e953
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1005363a
call fcn.1004e87d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1005366b
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10052521
add esp, 0x20
test eax, eax
jne 0x10053659
push edi
call fcn.1004e87d
jmp 0x10053661
push ebx
call fcn.1004e87d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10058cb0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10058cdd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10058cdd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x47d4b0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x12000]
push edi
or ebp, 0xffffffff
jmp 0x47d4d2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x47d4d9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x47d4c8
mov eax, 1
add ebx, ebx
jne 0x47d4eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x47d4e0
jne 0x47d4fc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47d4e0
xor ecx, ecx
sub eax, 3
jb 0x47d510
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x47d582
mov ebp, eax
add ebx, ebx
jne 0x47d51b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x47d528
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x47d54c
inc ecx
add ebx, ebx
jne 0x47d538
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x47d52d
jne 0x47d549
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x47d52d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x47d56c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x47d55d
jmp 0x47d4ce
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x47d56c
add edi, ecx
jmp 0x47d4ce
pop esi
lea edi, [esi + 0x7b000]
mov eax, dword [edi]
or eax, eax
je 0x47d5cb
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x7d000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x7d064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x47d589
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x7d06c]
or eax, eax
je 0x47d5c5
mov dword [ebx], eax
add ebx, 4
jmp 0x47d5a6
call dword [esi + 0x7d068]
mov ebp, dword [esi + 0x7d070]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1d7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x47d5ff
sub esp, 0xffffff80
jmp section.UPX0
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x38c21b0d
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x432024
nop
nop
nop
mov eax, section..text_1
nop
mov ebx, 0x42f314
nop
nop
mov ecx, 0x3c8b25a9
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401104
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, ecx
call fcn.00414680
xor ebx, ebx
push ebx
lea esi, [edi + 0x108]
push 0x8d
mov ecx, esi
call fcn.0041888d
lea eax, [ebp - 0x18]
push eax
push 0x18
push dword [edi + 0x10c]
call dword [sym.imp.GDI32.dll_GetObjectW]
test eax, eax
je 0x401151
push 6
push dword [ebp - 0x10]
mov ecx, edi
push dword [ebp - 0x14]
push ebx
push ebx
push ebx
call fcn.00420b8e
push esi
lea ecx, [edi + 0x110]
call fcn.00401585
lea esi, [edi + 0x7c]
push 0x64
pop eax
mov dword [esi + 0x64], eax
cdq
xor eax, edx
sub eax, edx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x68], eax
jne 0x40117a
mov dword [esi + 0x68], 1
push 0x640000
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push 0x401
push dword [esi + 0x20]
call ebx
mov dword [esi + 0x54], 1
mov dword [esi + 0x58], 0xa
mov ecx, dword [esi + 0x60]
xor eax, eax
test ecx, ecx
jle 0x4011a9
mov eax, ecx
mov ecx, dword [esi + 0x64]
cmp eax, ecx
jle 0x4011b2
mov eax, ecx
push 0
push eax
push 0x402
push dword [esi + 0x20]
mov dword [esi + 0x70], eax
call ebx
xor eax, eax
push 0
inc eax
push eax
push 0x404
push dword [esi + 0x20]
mov dword [esi + 0x6c], eax
call ebx
mov ecx, esi
call fcn.0040be2f
push 4
push 0xf
push 0x1e0
push 0x154
push 0x88
xor ebx, ebx
push ebx
mov ecx, esi
call fcn.00420b8e
mov edi, dword [edi + 0x20]
push ebx
push ebx
push edi
push 0x40121b
push ebx
push ebx
call fcn.0050c331
add esp, 0x18
pop edi
mov dword [0x58ffe8], eax
xor eax, eax
pop esi
inc eax
pop ebx
leave
ret

Function at 0x4013a3
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, eax
mov eax, dword [0x58ffe8]
xor ebx, ebx
push edi
cmp eax, ebx
je 0x4013bc
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edi, dword [sym.imp.USER32.dll_SetTimer]
push ebx
push 0x19
push 0x77
push dword [esi + 0x20]
call edi
mov eax, dword [esi + 0x20]
push ebx
push ebx
push eax
push 0x4014b1
push ebx
push ebx
call fcn.0050c331
add esp, 0x18
push ebx
push 0x1388
push 0x75
push dword [esi + 0x20]
mov dword [esi + 0x74], eax
call edi
cmp byte [0x58ffee], bl
je 0x401408
push ebx
push 0x7d0
push 0x76
push dword [esi + 0x20]
call edi
jmp 0x401415
mov esi, dword [0x58fff0]
xor bl, bl
call fcn.0040763d
pop edi
pop esi
pop ebx
ret

Function at 0x401447
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebx
push esi
xor ebx, ebx
push ebx
mov byte [0x58ffec], 1
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
push 1
cmp byte [0x58ffee], bl
je 0x40146b
push ebx
push 0x562998
jmp 0x401472
push dword [0x590164]
push ebx
push dword [0x590028]
push str.open
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
push 0x7d0
call esi
cmp byte [0x58ffee], bl
je 0x4014a0
push 0xbb8
call esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
pop ebx
ret
Function at 0x4019a0
Capabilities:
Create new key via cryptacquirecontext

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0xf0000000
push ebx
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider
push 0
push edi
call esi
test eax, eax
je 0x4019c8
cmp dword [edi], 0
jne 0x4019da
push ebx
push 0x18
push str.Microsoft_Enhanced_RSA_and_AES_Cryptographic_Provider__Prototype_
push 0
push edi
call esi
cmp dword [edi], 0
je 0x4019fe
push dword [ebp + 0xc]
lea esi, [ebp - 8]
push dword [ebp + 8]
call fcn.00401943
lea eax, [edi + 4]
push eax
push 0
push 0
push dword [ebp - 4]
push dword [ebp - 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
mov ecx, dword [edi + 4]
test ecx, ecx
je 0x401a2c
mov esi, dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
xor eax, eax
inc eax
push 0
mov dword [ebp + 0xc], eax
mov dword [ebp + 8], eax
lea eax, [ebp + 0xc]
push eax
push 3
push ecx
call esi
push 0
lea eax, [ebp + 8]
push eax
push 4
push dword [edi + 4]
call esi
pop esi
pop ebx
leave
ret 8

Function at 0x401a54
Capabilities:
Encrypt or decrypt via wincrypt

Disassembly:
push 4
mov eax, 0x533e9c
call fcn.0050e613
mov edi, ecx
mov ebx, dword [ebp + 0xc]
and dword [ebp - 4], 0
and dword [ebp - 0x10], 0
mov esi, ebx
call fcn.00401b1b
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
cmp dword [eax + 4], 0
mov dword [ebp - 0x10], 1
je 0x401b11
mov esi, dword [ebx]
call fcn.00401b76
test al, al
je 0x401b11
mov eax, dword [ebx]
push edi
push dword [ebp + 0x10]
push dword [eax]
call fcn.0050d980
mov eax, dword [ebx]
add esp, 0xc
lea ecx, [ebp + 0x10]
push ecx
mov dword [ebp + 0x10], edi
mov eax, dword [eax]
push eax
mov eax, dword [ebp + 8]
push 0
push 1
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
je 0x401ace
mov edi, dword [ebp + 0x10]
jmp 0x401b0a
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xea
jne 0x401b08
mov edi, dword [ebp + 0x10]
mov esi, dword [ebx]
call fcn.00401b76
test al, al
je 0x401b08
mov eax, dword [ebx]
mov eax, dword [eax]
lea ecx, [ebp + 0x10]
push ecx
push eax
mov eax, dword [ebp + 8]
push 0
push 1
push 0
push dword [eax + 4]
call dword [sym.imp.ADVAPI32.dll_CryptDecrypt]
test eax, eax
jne 0x401b11
xor edi, edi
mov esi, dword [ebx]
call fcn.00401b76
mov eax, ebx
call fcn.0050e6eb
ret 0xc
Function at 0x40440b
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x53429c
call fcn.0050e613
mov dword [ebp - 4], 1
or dword [ebp - 0x14], 0xffffffff
xor ebx, ebx
xor eax, eax
cmp byte [ebp + 0x10], bl
push ebx
sete al
lea ecx, [ebp - 0x10]
push ecx
push ebx
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x10], ebx
dec eax
and eax, 0x100
inc eax
push eax
push ebx
push ebx
push ebx
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
cmp eax, ebx
jne 0x40447e
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x1c]
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [ebp - 0x14]
mov byte [ebp - 4], bl
lea ecx, [ebp + 8]
call fcn.00401781
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 0xc]
call fcn.00401781
mov eax, esi
call fcn.0050e6eb
ret

Function at 0x4044a0
Capabilities:
Create process on windows

Disassembly:
push 0x60
mov eax, 0x5345fc
call fcn.0050e613
xor ebx, ebx
mov dword [ebp - 4], ebx
push 0x44
pop esi
push esi
lea eax, [ebp - 0x6c]
push ebx
push eax
call fcn.0050d860
xor eax, eax
mov word [ebp - 0x3c], ax
lea edi, [ebp - 0x20]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
mov dword [ebp - 0x6c], esi
push ebx
lea esi, [ebp + 8]
mov dword [ebp - 0x40], 1
call fcn.00401d81
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x40450b
push dword [ebp - 0x20]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x1c]
call esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00401781
call fcn.0050e6eb
ret
Function at 0x404e18
Capabilities:
Get token privileges

Disassembly:
push 0x20
mov eax, 0x534a8c
call fcn.0050e613
lea eax, [ebp - 0x10]
push eax
xor edi, edi
push 0x28
mov dword [ebp - 0x10], edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x404ed8
lea eax, [ebp - 0x2c]
push eax
call fcn.004063ea
mov dword [ebp - 4], edi
mov eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
jne 0x404e5d
call fcn.0050ca25
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
lea ecx, [ebp - 0x14]
push ecx
sub eax, esi
push eax
push esi
push 3
push dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
call dword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x404ea4
xor ecx, ecx
cmp dword [esi], edi
jbe 0x404e94
lea eax, [esi + 0xc]
mov dword [eax], 2
inc ecx
add eax, 0xc
cmp ecx, dword [esi]
jb 0x404e86
push edi
push edi
push dword [ebp - 0x14]
push esi
push edi
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 4], 1
cmp dword [ebp - 0x20], edi
je 0x404ec2
push dword [ebp - 0x20]
call fcn.004115f1
pop ecx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x2c]
push eax
call fcn.00409a26
call fcn.0050e6eb
ret

Function at 0x404f6d
Capabilities:
Set registry value

Disassembly:
push 4
mov eax, 0x536714
call fcn.0050e613
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.004024e4
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
lea esi, [ebp - 0x10]
call fcn.00401d81
mov edi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
push eax
push 1
push str.Location
mov ebx, str.SoftwarePCCleanerSettings
push ebx
push SysReAllocString
call edi
mov eax, dword [ebp - 0x10]
mov eax, dword [eax - 0xc]
add eax, eax
push eax
call fcn.00401d81
push eax
push 1
push str.Location
push ebx
push reloc.OLEAUT32.dll_SysReAllocString
call edi
or dword [ebp - 4], 0xffffffff
mov ecx, esi
call fcn.00401781
call fcn.0050e6eb
ret
Function at 0x404fe5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x208
lea ebp, [esp - 4]
mov eax, dword [0x588710]
xor eax, ebp
mov dword [ebp + 0x208], eax
push 0x10
mov eax, 0x535a14
call fcn.0050e613
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], ebx
push 0x206
mov word [ebp], ax
lea eax, [ebp + 2]
push ebx
push eax
mov dword [ebp - 0x1c], esi
call fcn.0050d860
add esp, 0xc
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x18]
push eax
xor eax, eax
cmp byte [ebp + 0x214], bl
push str.Location
setne al
push str.SoftwarePCCleanerSettings
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x10], 0x104
add eax, 0x80000001
push eax
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov eax, dword [ebp - 0x10]
shr eax, 1
xor ecx, ecx
mov word [ebp + eax*2], cx
lea eax, [ebp]
push eax
push esi
call fcn.004024e4
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 1
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.0050be6b
add ebp, 0x20c
leave
ret
Function at 0x4052f7
Capabilities:
Delete registry value
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x53636d
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push esi
push edi
mov eax, dword [0x588710]
xor eax, esp
push eax
lea eax, [esp + 0x28]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
and dword [esp + 0x10], 0
test eax, eax
jne 0x405348
lea eax, [esp + 0x18]
push eax
call fcn.004050fb
pop ecx
and dword [esp + 0x30], 0
mov eax, dword [eax]
mov dword [esp + 0x10], 1
push eax
lea eax, [esp + 0x18]
push eax
call fcn.004024e4
mov dword [esp + 0x30], 2
test byte [esp + 0x10], 1
je 0x405370
and dword [esp + 0x10], 0xfffffffe
lea ecx, [esp + 0x18]
call fcn.00401781
push dword [esp + 0x14]
call fcn.004051f7
pop ecx
test al, al
je 0x4053d2
push 0x10
lea eax, [esp + 0x1c]
push eax
call fcn.0040955a
mov byte [esp + 0x30], 3
push dword [eax]
mov esi, dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
mov edi, str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push edi
push SysReAllocString
call esi
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
call fcn.00401781
push 0x10
lea eax, [esp + 0x1c]
push eax
call fcn.0040955a
mov byte [esp + 0x30], 4
push dword [eax]
push edi
push reloc.OLEAUT32.dll_SysReAllocString
call esi
jmp 0x40546b
push 0x563138
lea eax, [esp + 0x24]
push eax
call fcn.004024e4
mov byte [esp + 0x30], 5
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x20]
push ecx
mov esi, eax
call fcn.00405a31
mov byte [esp + 0x38], 6
lea ecx, [esp + 0x20]
push str.___minimize
push ecx
mov ecx, eax
call fcn.00405a83
add esp, 0x10
mov byte [esp + 0x30], 8
lea ecx, [esp + 0x1c]
call fcn.00401781
mov byte [esp + 0x30], 9
lea ecx, [esp + 0x20]
call fcn.00401781
push 0x10
lea eax, [esp + 0x24]
push eax
call fcn.0040955a
mov byte [esp + 0x30], 0xa
mov edx, dword [esp + 0x18]
mov ecx, dword [edx - 0xc]
mov eax, dword [eax]
add ecx, ecx
push ecx
push edx
push 1
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov byte [esp + 0x30], 9
lea ecx, [esp + 0x20]
call fcn.00401781
mov byte [esp + 0x30], 2
lea ecx, [esp + 0x18]
call fcn.00401781
or dword [esp + 0x30], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.00401781
mov ecx, dword [esp + 0x28]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4055ee
Capabilities:
Write file on windows

Disassembly:
push 8
mov eax, 0x53424e
call fcn.0050e613
xor ebx, ebx
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
mov dword [ebp - 0x14], esi
mov dword [ebp - 4], ebx
cmp esi, 0xffffffff
je 0x405647
cmp edi, ebx
jle 0x405645
push ebx
lea eax, [ebp - 0x10]
push eax
push edi
push dword [ebp + 0xc]
mov dword [ebp - 0x10], edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x405647
cmp dword [ebp - 0x10], ebx
je 0x405647
push esi
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov bl, 1
or dword [ebp - 4], 0xffffffff
cmp esi, 0xffffffff
je 0x405657
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, bl
call fcn.0050e6eb
ret
Function at 0x405702
Capabilities:
Get common file path

Disassembly:
push 0x30
mov eax, 0x534d93
call fcn.0050e67c
mov eax, dword [ebp + 8]
and dword [ebp - 0x34], 0
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push 0x400
lea eax, [ebp - 0x2c]
call fcn.0040637a
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov esi, dword [ebp - 0x18]
xor edi, edi
lea eax, [ebp - 0x2c]
call fcn.00401dc4
push eax
dec esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
cmp dword [ebp - 0x14], 8
mov ecx, dword [ebp - 0x28]
jae 0x405753
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x38]
push eax
call fcn.00405b8c
mov byte [ebp - 4], 2
push dword [ebp - 0x3c]
mov ecx, eax
push dword [ebp - 0x30]
call fcn.00405c8c
pop ecx
pop ecx
mov dword [ebp - 0x34], ebx
mov byte [ebp - 4], bl
lea eax, [ebp - 0x38]
push eax
call fcn.00405be5
mov byte [ebp - 4], 0
push 0
push ebx
lea esi, [ebp - 0x2c]
call fcn.00401e62
mov eax, dword [ebp - 0x30]
call fcn.0050e6ff
ret