joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473bb0
Capabilities:
Set registry value

Disassembly:
push ecx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x18]
lea ecx, [esp]
push eax
mov eax, dword [esp + 0x18]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push edx
push eax
mov dword [esp + 0x24], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x473c09
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
push ecx
mov ecx, dword [esp + 0xc]
push edx
mov edx, dword [esp + 8]
push eax
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x473c1e
mov eax, dword [esp]
test eax, eax
je 0x473c18
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop ecx
ret 0x18
mov eax, dword [esp]
test eax, eax
je 0x473c2d
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop ecx
ret 0x18

Function at 0x473c40
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ecx
mov ecx, dword [esp + 8]
push esi
test ecx, ecx
mov dword [esp + 4], 0
je 0x473cab
mov eax, dword [esp + 0x10]
test eax, eax
je 0x473cab
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x473c74
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
neg eax
sbb eax, eax
pop esi
inc eax
pop ecx
ret 0xc
lea edx, [esp + 4]
push edx
push 0xf003f
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x473c9c
mov eax, dword [esp + 4]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x473cb2
mov eax, dword [esp + 4]
test eax, eax
je 0x473cab
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ecx
ret 0xc
mov eax, dword [esp + 4]
test eax, eax
je 0x473cc1
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
pop ecx
ret 0xc
Function at 0x473cd0
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x398
mov eax, dword [esp + 0x39c]
push esi
test eax, eax
push edi
mov esi, ecx
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0x378
je 0x473e5b
mov ecx, dword [esp + 0x3a8]
test ecx, ecx
je 0x473e5b
mov edi, dword [esp + 0x3ac]
test edi, edi
je 0x473e5b
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x473e5b
mov edx, dword [esp + 8]
lea eax, [esp + 0xc]
lea ecx, [esp + 0x28]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x473e1c
cmp dword [esp + 0xc], 0x378
jne 0x473e1c
lea eax, [esp + 0x28]
push eax
push edi
call fcn.0047e280
add esp, 8
test eax, eax
je 0x473e3c
cmp dword [esp + 0x154], 1
jne 0x473e3c
cmp dword [esp + 0x178], 2
jne 0x473e3c
mov ecx, dword [esp + 0x150]
lea edx, [esp + 0x10]
push ecx
push 0x5f64d4
push edx
call fcn.0047dc93
mov eax, dword [esp + 0x18]
add esp, 0xc
lea ecx, [esp + 0x28]
lea edx, [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
push eax
push ecx
push edx
mov ecx, esi
call fcn.00473bb0
test eax, eax
je 0x473e1c
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0x28]
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [esp + 0x28]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, dword [esp + 8]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0xc]
push ecx
push edx
push 3
push 0
push str.PackedCatalogItem
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x473e2f
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
test eax, eax
je 0x473e26
push eax
call esi
jmp 0x473e22
mov eax, dword [esp + 0x3b0]
test eax, eax
je 0x473e3c
inc dword [eax]
mov eax, dword [esp + 8]
test eax, eax
je 0x473e4b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x398
ret 0x10
pop edi
xor eax, eax
pop esi
add esp, 0x398
ret 0x10
Function at 0x473e70
Capabilities:
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x39c
mov eax, dword [esp + 0x3a0]
push esi
push edi
mov edi, ecx
test eax, eax
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0x378
je 0x473fdc
mov ecx, dword [esp + 0x3ac]
test ecx, ecx
je 0x473fdc
mov edx, dword [esp + 0x3b0]
test edx, edx
je 0x473fdc
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea edx, [esp + 8]
push edx
push 0xf003f
push 0
push ecx
push eax
call esi
test eax, eax
jne 0x473fdc
mov edx, dword [esp + 8]
lea eax, [esp + 0x10]
lea ecx, [esp + 0x2c]
push eax
push ecx
push 0
push 0
push str.PackedCatalogItem
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x473fc0
cmp dword [esp + 0x10], 0x378
jne 0x473fc0
cmp dword [esp + 0x158], 1
jne 0x473fe9
cmp dword [esp + 0x17c], 2
jne 0x473fe9
mov eax, dword [esp + 0x154]
lea ecx, [esp + 0x14]
push eax
push 0x5f64d4
push ecx
call fcn.0047dc93
add esp, 0xc
lea edx, [esp + 0xc]
push edx
push 0x20019
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
call esi
test eax, eax
jne 0x473fc0
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push eax
push ecx
mov ecx, edi
call fcn.00474020
test eax, eax
je 0x473fc0
mov edx, dword [esp + 0x10]
push 3
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
lea eax, [esp + 0x38]
push edx
lea ecx, [esp + 0x24]
push eax
push ecx
mov ecx, edi
call fcn.00473b20
test eax, eax
je 0x473fc0
mov edx, dword [esp + 0x10]
mov ecx, dword [esp + 8]
lea eax, [esp + 0x2c]
push edx
push eax
push 3
push 0
push str.PackedCatalogItem
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x473fe9
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x473fd1
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x473fdc
push eax
call esi
pop edi
xor eax, eax
pop esi
add esp, 0x39c
ret 0xc
mov eax, dword [esp + 0xc]
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x473ffa
push eax
call esi
mov eax, dword [esp + 8]
test eax, eax
je 0x474005
push eax
call esi
pop edi
mov eax, 1
pop esi
add esp, 0x39c
ret 0xc
Function at 0x474020
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
sub esp, 0x480
mov ecx, dword [esp + 0x484]
mov dword [esp], 0x378
test ecx, ecx
je 0x4740e1
mov eax, dword [esp + 0x488]
test eax, eax
je 0x4740e1
lea edx, [esp]
push edx
lea edx, [esp + 0x10c]
push edx
push 0
push 0
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4740e1
cmp dword [esp], 0x378
jne 0x4740e1
lea eax, [esp + 4]
push 0x104
lea ecx, [esp + 0x10c]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x4740e1
lea edx, [esp + 4]
push edx
call fcn.00473ab0
add esp, 4
test eax, eax
je 0x4740e1
cmp dword [esp + 0x234], 1
jne 0x4740d3
cmp dword [esp + 0x258], 2
jne 0x4740d3
lea eax, [esp + 4]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x4740e1
push str.WSPStartup
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4740e1
mov eax, 1
add esp, 0x480
ret 8
xor eax, eax
add esp, 0x480
ret 8

Function at 0x4740f0
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x104
push esi
mov esi, dword [esp + 0x10c]
test esi, esi
je 0x47414f
push esi
call fcn.00473ab0
add esp, 4
test eax, eax
je 0x47414f
lea eax, [esp + 4]
push 0x104
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
test eax, eax
je 0x47414f
lea ecx, [esp + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x47414f
push 0x5f64f8
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
neg eax
sbb eax, eax
pop esi
neg eax
add esp, 0x104
ret 4
xor eax, eax
pop esi
add esp, 0x104
ret 4
Function at 0x4741e0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x110
push ebx
push ebp
mov ebp, dword [esp + 0x11c]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov ebx, ecx
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
jne 0x474214
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.004740f0
test eax, eax
jne 0x47422d
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x110
ret 4
push ebp
mov ecx, ebx
call fcn.00474160
cmp eax, 1
je 0x4743ba
lea eax, [esp + 0x10]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x474266
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov edx, dword [esp + 0x10]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x1c]
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
jne 0x4742e2
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x1c]
push eax
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x474362
mov eax, dword [esp + 0x14]
push str.PackedCatalogItem
push eax
mov ecx, ebx
call fcn.00474020
mov ecx, dword [esp + 0x14]
test eax, eax
push ecx
je 0x474379
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
inc esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x24], 0
call edi
test eax, eax
je 0x474282
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x1c]
xor esi, esi
push 0x104
push edx
push esi
push eax
mov dword [esp + 0x28], esi
call edi
test eax, eax
jne 0x474330
mov eax, dword [esp + 0x10]
lea ecx, [esp + 0x18]
push ecx
lea edx, [esp + 0x20]
push ebp
push edx
push eax
mov ecx, ebx
call fcn.00473cd0
test eax, eax
je 0x474362
mov edx, dword [esp + 0x10]
lea ecx, [esp + 0x1c]
inc esi
push 0x104
push ecx
push esi
push edx
call edi
test eax, eax
je 0x4742fe
cmp dword [esp + 0x18], 1
jb 0x474362
mov edi, ebp
or ecx, 0xffffffff
xor eax, eax
push 1
repne scasb al, byte es:[edi]
not ecx
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
dec ecx
push closesocket
push ecx
push ebp
push str.FileName
mov ecx, ebx
call fcn.00473bb0
cmp eax, 1
je 0x4743ab
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x474389
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [esp + 0x14], 0
jmp 0x474362
push ebp
mov ecx, ebx
call fcn.004743d0
mov eax, dword [esp + 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x110
ret 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x4743ba
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x110
ret 4
Function at 0x4743d0
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x10c
push ebp
mov ebp, dword [esp + 0x114]
push esi
xor esi, esi
push edi
cmp ebp, esi
mov edi, ecx
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 1
jne 0x474402
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
push esi
mov ecx, edi
call fcn.00474160
test eax, eax
jne 0x47441f
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x10c
ret 4
lea eax, [esp + 0xc]
push eax
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
je 0x474446
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x10c
ret 4
mov edx, dword [esp + 0xc]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
lea ecx, [esp + 0x18]
push 0x104
push ecx
push esi
push edx
call ebx
test eax, eax
jne 0x474494
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x18]
push ebp
push eax
push ecx
mov ecx, edi
call fcn.00473e70
test eax, eax
jne 0x47447d
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x10]
lea edx, [esp + 0x18]
inc esi
push 0x104
push edx
push esi
push eax
call ebx
test eax, eax
je 0x474463
push 0
push str.SYSTEMCurrentControlSetServicesWinSock2ESPI11
push closesocket
mov ecx, edi
call fcn.00473c40
mov eax, dword [esp + 0x10]
pop ebx
test eax, eax
je 0x4744b7
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
add esp, 0x10c
ret 4

Function at 0x48e914
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48e94c
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.0048c9b9
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048c991
jmp 0x48e958
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x490006
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x490048
call fcn.00495bbe
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x490048
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x49003f
xor eax, eax
jmp 0x490050
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00490056
pop edi
pop esi
pop ebx
ret 4
Function at 0x4960ee
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x49611c
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x49613a
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.00496054
jmp 0x49613a
mov eax, dword [esi + 0x14]
test eax, eax
je 0x49613a
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.00496054
test edi, edi
mov eax, edi
jne 0x496124
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0xc10770
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0xc10776
ret

Function at 0xc4bb44
Capabilities:
Encode data using xor

Disassembly:
ret
fcom dword [eax + edx]
adc al, 0x32
std
adc al, 0x4b
mov bl, 0x4d
sbb byte [eax], cl
xchg esi, eax
sub byte [0xa6458880], dh
sbb al, 0xbe
or byte [esp + eax*8], dh
mov bl, 0x28
add ecx, dword [eax]
mov ds, esp
add al, 2
dec eax
cmp eax, 0x3ed75b15
in al, 8
and al, 0xc2
outsd dx, dword [esi]
and byte [edx], dl
fdiv dword [eax]
sub byte [ecx + edx], ah
ret
xor dword [eax], ecx
pop ebx
jae 0xc4bac9
jns 0xc4bb0f
pushal
lds edx, [ebp - 0x42]
or al, byte [ecx]
or esi, dword [ebx]
inc edi
xchg esp, eax
pop ecx
add eax, dword [ecx + 0x5420dbfd]
mov ah, 0x4c
mov ch, 0xe4
adc byte [esp + ebx*2], 0x5b
mov al, byte [0x78042c90]
je 0xc4bb72
mov byte [0x3eb83913], al
adc byte [esi], cl
jle 0xc4bb82
ror cl, 0x3d
inc esp
jb 0xc4bbf0
cmp ecx, dword [esi]
xchg edi, eax
cmp esp, 0x412940a8
adc al, 0x84
sub dword [ecx - 0xd], eax
adc al, 0x84
cmp eax, 0xb68ae653
rcl bl, 0x50
inc eax
mov byte [ecx], 0xf8
cmp byte [eax - 0x4f6fcc77], cl
cmp ah, byte [0xa8f4fa28]
and al, 0xe
outsb dx, byte [esi]
rol dword es:[esp + ebp*2 + 0x722e9789], 0xf0
dec esp
or byte [eax + 0xe8328a], 0x15
mov dl, 0x87
adc esp, dword [edx]
xor dword [eax + 0x476c035c], 0x52
scasb al, byte es:[edi]
invalid
adc al, 0x49
test byte [ebp - 0x30], ah
add ebp, edi
add al, 0xad
jbe 0xc4bc02
cmp al, 0x15
xchg dword [eax - 0x6ce97c02], ecx
xchg ebx, eax
fxch st(4)
mov dword [0xef218080], eax
mov ah, 0xcd
adc ebx, dword [ecx - 0x72a6ed14]
pushal
loop 0xc4bc1f
add byte [esp + ebp + 0x64], 0x90
or al, 0xdf
mov byte [edx], bl
pop esp
mov byte [eax - 3], 0xa6
or dword [eax], 0x349df980
les ebp, [ebp - 0x66]
push ss
adc ah, byte [ebx - 4]
push esi
xor al, 0x62
test byte [esi + eax*2], dh
test al, 0x40
cmp al, dh
ror dword [eax], 0x21
inc ebx
into
retf 0x9ca0
Function at 0x401000
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov ecx, 0x49c864
mov eax, 0x4aff20
lea ecx, [ecx]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x401036
test dx, dx
je 0x401032
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x401036
add eax, 4
add ecx, 4
test dx, dx
jne 0x401010
xor eax, eax
jmp 0x40103b
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x40109f
lea eax, [esp]
push eax
push 1
push 0
push str.SOFTWARESecureAge_TechnologySecureAgeApplicationsAppWhitelisting
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 0x20a
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40109f
mov edx, dword [esp]
lea ecx, [esp + 4]
push ecx
push 0x4aff20
push eax
push eax
push str.Path
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x401095
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x4aff20
add esp, 8
ret
mov ecx, dword [esp]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 0x4aff20
add esp, 8
ret

Function at 0x4011a0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, dword [esp + 8]
push esi
mov eax, ebx
push edi
lea edx, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4011b0
sub eax, edx
sar eax, 1
mov edx, eax
mov eax, ebp
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4011c6
sub eax, esi
sar eax, 1
lea esi, [eax + edx + 0x50]
shr esi, 4
shl esi, 4
lea eax, [esi + esi]
push eax
call fcn.0047a780
mov edi, eax
add esp, 4
test edi, edi
jne 0x4011f8
lea eax, [edi + 8]
pop edi
pop esi
pop ebp
ret
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ebp
push ebx
push str.a__t7z___s____s_
push esi
push edi
call fcn.0047a84a
add esp, 0x14
call section..text
push eax
push edi
call fcn.004010b0
mov ecx, dword [esp + 0x1c]
mov edx, eax
call fcn.004068d0
push edi
mov esi, eax
call fcn.0047a868
add esp, 0xc
pop edi
mov eax, esi
pop esi
pop ebp
ret
Function at 0x403ed0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0xc
push esi
push edi
mov edi, eax
lea eax, [esp + 8]
push eax
push 1
push 0
push str.SYSTEMCurrentControlSet_servicesSAScanDbExclusionsPath
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x403f27
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push eax
mov eax, dword [esp + 0x18]
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
test esi, esi
je 0x403f82
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
mov ecx, edi
lea esi, [ecx + 2]
lea esp, [esp]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x403f30
sub ecx, esi
sar ecx, 1
cmp ecx, 2
jbe 0x403f73
cmp word [edi + 2], 0x3a
jne 0x403f73
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x14]
push ecx
add edi, 4
push edi
mov ecx, str.SYSTEMCurrentControlSet_servicesSAScanDbExclusionsPath
mov edx, reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x18], 4
call fcn.0040b8d0
add esp, 0xc
xor edx, edx
test eax, eax
sete dl
pop edi
mov al, dl
pop esi
add esp, 0xc
ret
mov edx, dword [esp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
xor edx, edx
test eax, eax
sete dl
pop edi
mov al, dl
pop esi
add esp, 0xc
ret

Function at 0x404ef0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 0xc
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
push esi
push edi
lea eax, [esp + 0x10]
push eax
push 0x2001f
xor edi, edi
push edi
push str.SYSTEMCurrentControlSetServicesPerfOSPerformance
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x24], edi
call ebp
cmp eax, edi
jne 0x404f8a
mov esi, dword [esp + 0x10]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea ecx, [esp + 0x18]
push ecx
push 4
push edi
push str.Disable_Performance_Counters
push esi
mov dword [esp + 0x2c], edi
call ebx
cmp esi, edi
je 0x404f4b
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
lea edx, [esp + 0x14]
push edx
push 0x2001f
push edi
push str.SYSTEMCurrentControlSetServicesPerfProcPerformance
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [esp + 0x28], edi
call ebp
cmp eax, edi
jne 0x404f7f
xor eax, eax
cmp esi, edi
je 0x404f77
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov esi, dword [esp + 0x14]
cmp eax, edi
je 0x404f94
cmp esi, edi
je 0x404f8a
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push 4
lea eax, [esp + 0x1c]
push eax
push 4
push edi
push str.Disable_Performance_Counters
push esi
mov dword [esp + 0x30], edi
call ebx
cmp esi, edi
je 0x404fb5
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0xc
ret
Function at 0x405250
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x28
mov eax, dword [0x4aab30]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, 1
test byte [0x4b3860], al
jne 0x405297
or dword [0x4b3860], eax
push 0x19000
mov dword [0x4b385c], 0x19000
call fcn.0047a780
push 0x492360
mov dword [0x4b3858], eax
call fcn.0047b8d8
add esp, 8
mov ecx, dword [esp + 0x2c]
mov eax, dword [0x4b385c]
push esi
push ecx
push 0x49ca50
lea edx, [esp + 0x10]
mov dword [esp + 0xc], eax
call fcn.00405510
mov edx, dword [0x4b385c]
mov eax, dword [0x4b3858]
push edx
push 0
push eax
call fcn.0047d730
mov edx, dword [0x4b3858]
mov esi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
add esp, 0x14
lea ecx, [esp + 4]
push ecx
push edx
push 0
push 0
lea eax, [esp + 0x18]
push eax
push reloc.WS2_32.dll_connect
call esi
cmp eax, 0xea
jne 0x40535e
jmp 0x405300
mov eax, dword [esp + 4]
mov ecx, dword [0x4b3858]
add eax, 0x2800
push eax
push ecx
mov dword [esp + 0xc], eax
mov dword [0x4b385c], eax
call fcn.0047ba93
add esp, 8
lea edx, [esp + 4]
push edx
push eax
push 0
mov dword [0x4b3858], eax
push 0
lea eax, [esp + 0x18]
push eax
push reloc.WS2_32.dll_connect
call esi
cmp eax, 0xea
je 0x405300
mov ecx, dword [0x4b3858]
mov dword [edi], ecx
pop esi
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.0047a722
add esp, 0x28
ret 4
mov ecx, dword [esp + 0x28]
mov edx, dword [0x4b3858]
pop esi
xor ecx, esp
mov dword [edi], edx
call fcn.0047a722
add esp, 0x28
ret 4