joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ecefb
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x51e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x18], eax
call fcn.004e72e5
add eax, 0x50
lea edi, [ebp - 0x10]
mov dword [ebp - 0x14], eax
xor eax, eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
call fcn.004e72e5
lea ecx, [ebp - 0x10]
xor edx, edx
mov dword [eax + 0x34c], ecx
lea ecx, [esi + 0x80]
mov eax, dword [ebp - 0x14]
mov dword [eax], esi
lea edi, [eax + 4]
mov dword [edi], ecx
test ecx, ecx
je 0x4ecf72
cmp word [ecx], dx
je 0x4ecf72
mov eax, dword [0x5005bc]
push edi
dec eax
push eax
push 0x5004a8
call fcn.004ece9a
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor edx, edx
mov dword [ebp - 0x10], edx
mov eax, dword [eax]
test eax, eax
je 0x4ecfe5
cmp word [eax], dx
je 0x4ecfe5
mov eax, dword [edi]
test eax, eax
je 0x4ecf96
cmp word [eax], dx
je 0x4ecf96
lea eax, [ebp - 0x10]
push eax
call fcn.004ec87d
jmp 0x4ecf9f
lea eax, [ebp - 0x10]
push eax
call fcn.004ec918
cmp dword [ebp - 0x10], 0
pop ecx
jne 0x4ed00f
mov eax, dword [0x5004a4]
push dword [ebp - 0x14]
dec eax
push eax
push 0x500198
call fcn.004ece9a
add esp, 0xc
test al, al
je 0x4ed00f
mov eax, dword [edi]
xor edi, edi
test eax, eax
je 0x4ecfda
cmp word [eax], di
je 0x4ecfda
lea eax, [ebp - 0x10]
push eax
call fcn.004ec87d
pop ecx
jmp 0x4ed011
lea eax, [ebp - 0x10]
push eax
call fcn.004ec918
jmp 0x4ecfd7
mov eax, dword [edi]
test eax, eax
je 0x4ecffc
cmp word [eax], dx
je 0x4ecffc
lea eax, [ebp - 0x10]
push eax
call fcn.004ec832
pop ecx
jmp 0x4ed00f
mov dword [ebp - 0x10], 0x104
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
xor edi, edi
cmp dword [ebp - 0x10], 0
je 0x4ed0da
lea eax, [ebp - 0x10]
push eax
lea eax, [esi + 0x100]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.004ecd1f
mov esi, eax
pop ecx
pop ecx
test esi, esi
je 0x4ed0da
movzx ecx, si
push ecx
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
test eax, eax
je 0x4ed0da
push 1
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
test eax, eax
je 0x4ed0da
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x4ed067
mov dword [eax], esi
mov eax, dword [ebp - 0x14]
push edi
push 0x55
add eax, 0x250
push eax
push dword [ebp - 0xc]
call fcn.004e7bcb
test ebx, ebx
je 0x4ed0d5
push edi
push 0x55
lea eax, [ebx + 0x120]
push eax
push dword [ebp - 0xc]
call fcn.004e7bcb
push 0x40
push ebx
push 0x1001
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4ed0da
push 0x40
lea eax, [ebx + 0x80]
push eax
push 0x1002
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
test eax, eax
je 0x4ed0da
push 0xa
push 0x10
lea ecx, [ebx + 0x100]
push ecx
push esi
call fcn.004e29b5
add esp, 0x10
xor eax, eax
inc eax
jmp 0x4ed0dc
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004d3878
leave
ret
Function at 0x4f34c0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4f34ed
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4f34ed
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x401807
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x41f29c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, 0x104
lea eax, [ebp - 0x20c]
push esi
push eax
mov ebx, ecx
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
dec eax
cmp eax, 0x102
ja 0x401874
lea eax, [ebp - 0x414]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
dec eax
cmp eax, 0x102
ja 0x401874
mov esi, dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea eax, [ebp - 0x20c]
push eax
call esi
push ecx
mov ecx, ebx
call fcn.004017ac
mov edi, eax
lea eax, [ebp - 0x414]
push eax
call esi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414f12
mov esp, ebp
pop ebp
ret
Function at 0x405944
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [0x41f29c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x420000]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov esi, edx
mov dword [ebp - 0x230], ebx
xor edi, edi
mov dword [ebp - 0x234], eax
mov byte [ebp - 0x22c], 0
test esi, esi
je 0x4059de
cmp byte [esi], 0
je 0x4059de
cmp byte [esi + 1], 0x3a
jne 0x4059de
cmp byte [esi + 2], 0x5c
jne 0x4059de
lea eax, [ebp - 0x22c]
push eax
push 0x226
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov al, byte [esi]
mov ecx, esi
jmp 0x4059b6
cmp al, 0x5c
push ecx
cmove edi, ecx
call dword [sym.imp.USER32.dll_CharNextA]
mov ecx, eax
mov al, byte [ecx]
test al, al
jne 0x4059a6
mov eax, edi
sub eax, esi
cmp eax, 2
jne 0x4059c4
inc edi
mov bl, byte [edi]
push esi
mov byte [edi], 0
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov eax, dword [ebp - 0x234]
mov byte [edi], bl
mov ebx, dword [ebp - 0x230]
push ebx
sub esp, 0xc
mov edx, esi
mov ecx, eax
call fcn.004138e0
mov esi, eax
test ebx, ebx
je 0x4059f8
test esi, esi
jns 0x4059f8
and dword [ebx], 0
cmp byte [ebp - 0x22c], 0
je 0x405a0e
lea eax, [ebp - 0x22c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414f12
mov esp, ebp
pop ebp
ret 4
Function at 0x4084e8
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x41f29c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, ecx
mov dword [ebp - 0x18], eax
push esi
push edi
xor esi, esi
mov dword [ebp - 0x20], ebx
mov eax, dword [ebx + 0x1cc]
mov edi, dword [ebx + 0x104]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0x1d0]
mov dword [ebp - 0x24], eax
mov eax, dword [ebx + 0x1d8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
add eax, 6
lea edi, [eax + edi*2]
mov dword [ebp - 0x1c], edi
cmp dword [ebx + 0x140], esi
je 0x4085b8
lea eax, [ebp - 0x14]
push eax
push dword [ebx + 0x148]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
push 1
push dword [ebx + 0x148]
call esi
push 0xd
xor eax, eax
push eax
push eax
push edi
push dword [ebx + 0x6c]
push eax
push dword [ebx + 0x148]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_DeferWindowPos]
push 1
push dword [ebx + 0x15c]
call esi
mov ecx, dword [ebx + 0x6c]
xor edx, edx
mov eax, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
add eax, 6
push 0xd
push edx
push edx
push edi
add eax, ecx
push eax
push edx
push dword [ebx + 0x15c]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_DeferWindowPos]
imul eax, dword [ebx + 0xfc], 0xe
add eax, 4
add edi, eax
mov dword [ebp - 0x1c], edi
jmp 0x4085ea
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push esi
push dword [ebx + 0x15c]
call edi
push esi
push dword [ebx + 0x15c]
mov esi, dword [sym.imp.USER32.dll_EnableWindow]
call esi
push 0
push dword [ebx + 0x148]
call edi
push 0
push dword [ebx + 0x148]
call esi
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp + 0xc]
mov edi, ebx
mov esi, dword [ebp - 0x28]
sub edi, esi
mov ecx, dword [ebp - 0x24]
sub edi, ecx
mov edx, dword [ebp - 0x2c]
sub edi, edx
push 0xd
mov dword [eax + 0x1d0], ecx
xor ecx, ecx
push ecx
push ecx
push dword [ebp - 0x1c]
mov dword [eax + 0x1cc], esi
push esi
push ecx
mov dword [eax + 0x1d4], edi
mov dword [eax + 0x1d8], edx
push dword [eax + 0x170]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_DeferWindowPos]
add esi, dword [ebp - 0x24]
xor eax, eax
push 0xd
push eax
push eax
push dword [ebp - 0x1c]
push esi
push eax
mov eax, dword [ebp - 0x20]
push dword [eax + 0x184]
push dword [ebp - 0x18]
call dword [sym.imp.USER32.dll_DeferWindowPos]
push 0xd
xor ecx, ecx
lea eax, [esi + edi]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x18]
push ecx
push ecx
push dword [ebp - 0x1c]
push eax
push ecx
push dword [esi + 0x198]
push edi
call dword [sym.imp.USER32.dll_DeferWindowPos]
mov eax, dword [esi + 0xfc]
add eax, dword [esi + 0xc0]
mov ecx, dword [ebp - 0x1c]
add ecx, eax
mov eax, dword [ebp + 0x14]
push 0xc
sub eax, ecx
push eax
lea eax, [ebx - 1]
push eax
push ecx
push 0
push 0
push dword [esi + 0x1b8]
push edi
call dword [sym.imp.USER32.dll_DeferWindowPos]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414f12
mov esp, ebp
pop ebp
ret 0x10
Function at 0x40a920
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
and dword [esp + 4], 0
xor eax, eax
push ebx
push esi
push edi
mov ebx, edx
lea edi, [esp + 0x1c]
mov edx, ecx
mov esi, 0x41f6d0
push 9
pop ecx
rep stosd dword es:[edi], eax
or dword [esp + 0x3c], 0xffffffff
xor edi, edi
or dword [esp + 0x38], 0xffffffff
mov dword [esp + 0x18], edx
mov dword [esp + 0x14], edi
cmp dword [0x41f6d0], eax
je 0x40a9a3
mov eax, dword [edx]
lea ecx, [esp + 0x10]
push ecx
push edi
push 0x10
push edi
push dword [esi]
push edx
call dword [eax + 0x10]
test eax, eax
jne 0x40a998
mov ecx, dword [esp + 0x10]
lea eax, [esp + 0x1c]
push eax
mov edx, esi
call fcn.00409ffc
test eax, eax
jne 0x40aa03
mov eax, dword [esp + 0x10]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov dword [esp + 0x10], edi
mov edx, dword [esp + 0x18]
add esi, 0x10
cmp dword [esi], edi
jne 0x40a961
mov esi, dword [esp + 0x1c]
lea ecx, [esp + 0x14]
mov eax, dword [ebx]
push ecx
push 2
push dword [esp + 0x30]
push esi
push ebx
call dword [eax + 0x34]
test eax, eax
jne 0x40aa03
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
add edx, 4
test esi, esi
je 0x40a9e6
mov eax, dword [edx]
xor eax, dword [ecx]
movzx eax, ax
xor eax, dword [edx]
lea edx, [edx + 4]
mov dword [ecx], eax
lea ecx, [ecx + 0x10]
sub esi, 1
jne 0x40a9cc
mov ecx, dword [esp + 0x24]
cmp dword [esp + 0x1c], edi
je 0x40a9f8
mov eax, dword [ebx]
push edi
push ecx
push dword [esp + 0x24]
push ebx
call dword [eax + 0x20]
lea edx, [esp + 0x1c]
mov ecx, ebx
call fcn.0040a7b6
push dword [esp + 0x14]
call dword [sym.imp.OLMAPI32.dll_Ordinal_17]
mov ecx, dword [esp + 0x10]
test ecx, ecx
je 0x40aa1b
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
lea ecx, [esp + 0x1c]
call fcn.00409a47
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x40b6ab
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x41f29c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
and dword [ebp - 0x158], 0
push 0x10
pop ecx
mov esi, str.SoftwarePoliciesMicrosoftOffice16.0CommonLanguageResources
mov eax, dword [0x41f794]
lea edi, [ebp - 0x9c]
rep movsd dword es:[edi], dword [esi]
push 0xe
pop ecx
push 7
movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x58]
mov esi, str.SoftwareMicrosoftOffice16.0CommonLanguageResources
rep movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x20]
mov esi, str.UILanguageTag
pop ecx
rep movsd dword es:[edi], dword [esi]
cmp eax, 0xffffffff
jne 0x40b82f
lea eax, [ebp - 0x150]
mov dword [ebp - 0x154], 0xaa
push eax
xor esi, esi
lea eax, [ebp - 0x9c]
inc esi
push esi
push 0
push eax
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 0x14c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40b78f
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
push eax
push 2
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40b787
cmp dword [ebp - 0x14c], esi
jne 0x40b787
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
mov esi, dword [ebp - 0x158]
mov dword [ebx], eax
push dword [ebp - 0x150]
call edi
test esi, esi
je 0x40b826
lea eax, [ebp - 0x150]
mov dword [ebp - 0x154], 0xaa
push eax
xor esi, esi
lea eax, [ebp - 0x58]
inc esi
push esi
push 0
push eax
push reloc.AppVIsvSubsystems32.dll_Ordinal_1
mov dword [ebp - 0x14c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40b81e
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x14c]
push eax
push 2
lea eax, [ebp - 0x20]
push eax
push 0
push dword [ebp - 0x150]
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x40b80c
cmp dword [ebp - 0x14c], esi
jne 0x40b80c
push eax
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.KERNEL32.dll_LocaleNameToLCID]
jmp 0x40b812
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
push dword [ebp - 0x150]
mov dword [ebx], eax
call edi
jmp 0x40b826
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [0x41f794], eax
jmp 0x40b831
mov dword [ebx], eax
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414f12
mov esp, ebp
pop ebp
ret

Function at 0x40da26
Capabilities:
Allocate thread local storage

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetVersion]
test eax, eax
jns 0x40da4c
cmp al, 3
ja 0x40da4c
cmp esi, 2
ja 0x40da4c
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esi, eax
jmp 0x40da3d
mov eax, esi
pop esi
ret
Function at 0x41059d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push edi
mov edi, dword [ecx + 0x24]
xor esi, esi
test edi, edi
jne 0x4105b2
cmp dword [ecx + 0x28], esi
jne 0x4105b2
xor eax, eax
inc eax
jmp 0x41060a
push ebx
mov ebx, dword [ecx + 0x28]
test edi, edi
je 0x4105e1
call fcn.0040e495
push 5
mov ebx, eax
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4105dd
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
jne 0x4105e1
xor eax, eax
jmp 0x410609
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
test byte [eax], 1
jne 0x4105f3
cmp word [eax + 0xa], si
je 0x4105f9
cmp word [eax + 0xc], si
jne 0x4105fc
xor esi, esi
inc esi
test edi, edi
je 0x410607
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
pop edi
pop esi
ret

Function at 0x4119ab
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], edx
mov edi, esi
call fcn.0040e495
push 5
mov ebx, eax
push ecx
push ebx
mov dword [ebp - 8], ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
test eax, eax
je 0x411a30
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x411a30
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x411a29
push dword [ebp - 4]
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [0x423f48]
mov edi, eax
push edi
test ecx, ecx
je 0x411a0f
call ecx
jmp 0x411a16
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
pop ecx
mov esi, eax
test esi, esi
je 0x411a29
push edi
push dword [ebp - 0xc]
push esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x411a39
mov dword [eax], edi
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x41451b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x41f29c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncpy_s]
lea eax, [ebp - 0x20c]
push edi
push 0xffffffffffffffff
push ecx
push 0x104
push eax
mov edi, edx
call esi
lea eax, [ebp - 0x20c]
push 0x5c
push eax
call dword [sym.imp.VCRUNTIME140.dll_wcsrchr]
add eax, 2
lea ecx, [ebp - 4]
push 0xffffffffffffffff
sub ecx, eax
push edi
sar ecx, 1
push ecx
push eax
call esi
add esp, 0x24
lea ecx, [ebp - 0x20c]
call fcn.004017ac
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x41458c
and dword [0x423f6c], 0
jmp 0x414593
call edi
mov dword [0x423f6c], eax
test esi, esi
je 0x4145a0
and dword [0x423f70], 0
jmp 0x4145b7
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov dword [0x423f70], eax
cmp eax, 0xffffffff
je 0x4145c0
and dword [0x423f74], 0
jmp 0x4145c7
call edi
mov dword [0x423f74], eax
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
xor ecx, ebp
pop esi
call fcn.00414f12
mov esp, ebp
pop ebp
ret

Function at 0x4145d9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41f29c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
push 2
push str.CommonFilesDir
push str.SoftwareMicrosoftWindowsCurrentVersion
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x41466b
mov ecx, dword [ebp - 0x210]
cmp ecx, 4
jb 0x41466b
shr ecx, 1
push 0xffffffffffffffff
cmp word [ebp + ecx*2 - 0x210], 0x5c
sete al
lea eax, [eax*2 + str.Microsoft_SharedOffice16_]
push eax
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsncat_s]
add esp, 0x10
lea ecx, [ebp - 0x20c]
mov edx, esi
call fcn.0041451b
jmp 0x41466d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00414f12
mov esp, ebp
pop ebp
ret

Function at 0x41469c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x41f29c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
lea eax, [ebp - 0x210]
mov dword [ebp - 0x210], 0x208
push eax
lea eax, [ebp - 0x20c]
mov esi, ecx
push eax
push 0
push 2
push esi
push str.SoftwareMicrosoftOffice16.0CommonFilesPaths
push 0x80000002
mov edi, edx
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x414703
cmp dword [ebp - 0x210], 4
jb 0x414703
test edi, edi
lea ecx, [ebp - 0x20c]
cmovne esi, edi
mov edx, esi
call fcn.0041451b
jmp 0x414705
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00414f12
mov esp, ebp
pop ebp
ret
Function at 0x4151e1
Capabilities:
Terminate process

Disassembly:
push 0x14
push 0x41c108
call fcn.0041599a
push 1
call fcn.00415264
pop ecx
test al, al
jne 0x415098
push 7
call fcn.00415762
xor bl, bl
mov byte [ebp - 0x19], bl
and dword [ebp - 4], 0
call fcn.0041522f
mov byte [ebp - 0x24], al
mov eax, dword [0x41fc3c]
xor ecx, ecx
inc ecx
cmp eax, ecx
je 0x415091
test eax, eax
jne 0x415102
mov dword [0x41fc3c], ecx
push 0x418358
push 0x418344
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm_e
pop ecx
pop ecx
test eax, eax
je 0x4150e5
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x4151db
push 0x418340
push 0x418318
call sub.api_ms_win_crt_runtime_l1_1_0.dll__initterm
pop ecx
pop ecx
mov dword [0x41fc3c], 2
jmp 0x415107
mov bl, cl
mov byte [ebp - 0x19], bl
push dword [ebp - 0x24]
call fcn.004153d1
pop ecx
call fcn.00415756
mov esi, eax
xor edi, edi
cmp dword [esi], edi
je 0x415137
push esi
call fcn.00415347
pop ecx
test al, al
je 0x415137
push edi
push 2
push edi
mov esi, dword [esi]
mov ecx, esi
call fcn.004156eb
call esi
call fcn.0041575c
mov esi, eax
cmp dword [esi], edi
je 0x415155
push esi
call fcn.00415347
pop ecx
test al, al
je 0x415155
push dword [esi]
call sub.api_ms_win_crt_runtime_l1_1_0.dll__register_thread_local_exe_atexit_callback
pop ecx
call fcn.00415878
movzx eax, ax
push eax
call sub.api_ms_win_crt_runtime_l1_1_0.dll__get_narrow_winmain_command_line
push eax
push edi
push 0x400000
call main
mov esi, eax
call fcn.004158ab
test al, al
jne 0x415180
push esi
call sub.api_ms_win_crt_runtime_l1_1_0.dll_exit
test bl, bl
jne 0x415189
call sub.api_ms_win_crt_runtime_l1_1_0.dll__cexit
push edi
push 1
call fcn.004153ee
pop ecx
pop ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, esi
jmp 0x4151db
call fcn.004159df
ret
call fcn.00414f1f
jmp 0x415079
Function at 0x100017f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
push 0x104
push 0
lea eax, [ebp - 0x108]
push eax
call fcn.1024b810
add esp, 0xc
mov dword [ebp - 4], 0
push 0x104
lea ecx, [ebp - 0x108]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov dword [0x10500e94], 0
lea edx, [ebp - 0x108]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
test ecx, ecx
je 0x10001876
mov edx, dword [ebp - 4]
movsx eax, byte [edx]
cmp eax, 0x41
jl 0x1000186b
mov ecx, dword [ebp - 4]
movsx edx, byte [ecx]
cmp edx, 0x5a
jg 0x1000186b
mov eax, dword [ebp - 4]
movsx ecx, byte [eax]
add ecx, 0x20
mov edx, dword [ebp - 4]
mov byte [edx], cl
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1000183d
push str.powershell.exe
lea ecx, [ebp - 0x108]
push ecx
call fcn.1024b970
add esp, 8
test eax, eax
je 0x100018c8
mov dword [0x10500e9c], 1
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x10500e90], eax
push 0x10500e84
push 0
push 0
push 0x10001700
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10500e98], eax
mov esp, ebp
pop ebp
ret

Function at 0x10036990
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x1003699b
jmp 0x100369ca
cmp dword [0x10500fec], 0
je 0x100369b1
mov eax, dword [ebp + 0xc]
push eax
call dword [0x10500fec]
add esp, 4
mov ecx, dword [ebp + 0xc]
push ecx
push str.error:__s_n
call dword [0x103a6e60]
add esp, 8
push 0xfffffffffffffffb
call fcn.1025ae23
pop ebp
ret

Function at 0x100376d0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x14]
push eax
call fcn.1025326f
add esp, 4
lea ecx, [eax + eax + 2]
push ecx
mov edx, dword [ebp + 0x14]
push edx
push 1
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10037712
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 4], 0
jg 0x10037720
mov ecx, dword [ebp - 4]
mov dword [ebp - 8], ecx
jmp 0x10037738
mov edx, dword [ebp - 4]
and edx, 0xffff
or edx, 0x70000
or edx, 0x80000000
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret