joyce8/EMBER2024-capa huggingface dataset:
Function at 0x471200
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
movzx ecx, word [eax]
cmp ecx, 0x5a4d
jne 0x4712e5
mov edx, dword [ebp + 8]
mov eax, dword [edx + 0x3c]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0x14]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
cmp dword [edx], 0x4550
jne 0x4712e5
mov eax, 8
shl eax, 0
mov ecx, dword [ebp - 0xc]
mov edx, dword [ecx + eax + 0x78]
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
je 0x4712e5
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax + 0x50]
jae 0x4712e5
mov edx, dword [ebp + 8]
add edx, dword [ebp - 0x10]
mov dword [ebp - 4], edx
je 0x4712e5
mov eax, dword [ebp - 4]
cmp dword [eax + 0xc], 0
je 0x4712e5
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x4712e5
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 0xc]
mov ecx, dword [edx + 0x10]
cmp ecx, dword [eax + 0x50]
jae 0x4712e5
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0x10]
je 0x4712e5
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 8]
add edx, dword [ecx + 0x10]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x4712da
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
cmp edx, dword [ebp + 0xc]
jne 0x4712cf
push 4
mov eax, dword [ebp - 8]
push eax
call fcn.0046eec0
test eax, eax
je 0x4712cf
mov ecx, dword [ebp - 8]
mov edx, dword [ebp + 0x10]
mov dword [ecx], edx
mov eax, dword [ebp - 8]
add eax, 4
mov dword [ebp - 8], eax
jmp 0x4712a6
mov ecx, dword [ebp - 4]
add ecx, 0x14
mov dword [ebp - 4], ecx
jmp 0x47126f
mov esp, ebp
pop ebp
ret 0xc
Function at 0x477f80
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], ecx
cmp dword [0x4c8f24], 0
je 0x477f9b
cmp dword [0x4c8f28], 0
jne 0x477fee
push 1
push 0x48c6a0
call fcn.0046d270
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x40
push 4
mov ecx, dword [ebp - 4]
add ecx, 0xa
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x477fec
mov edx, dword [0x4c8f20]
sub edx, dword [ebp - 4]
sub edx, 0xe
mov eax, dword [ebp - 4]
mov dword [eax + 0xa], edx
lea ecx, [ebp - 8]
push ecx
mov edx, dword [ebp - 8]
push edx
push 4
mov eax, dword [ebp - 4]
add eax, 0xa
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x477ff9
push 0x476810
call dword [0x4c8f28]
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4

Function at 0x47de20
Capabilities:
Get thread local storage value

Disassembly:
push ecx
mov eax, dword [0x4c92d0]
test eax, eax
je 0x47de87
push esi
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
push eax
call esi
test eax, eax
je 0x47de86
mov eax, dword [0x4c92d0]
test eax, eax
jne 0x47de45
xor ecx, ecx
jmp 0x47de4f
push eax
call esi
mov ecx, eax
mov eax, dword [0x4c92d0]
cmp byte [ecx + 0x18], 0
je 0x47de86
test eax, eax
je 0x47de86
push eax
call esi
test eax, eax
je 0x47de86
mov eax, dword [0x4c92d0]
test eax, eax
je 0x47de6c
push eax
call esi
push 0
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x47de86
mov eax, dword [0x4c92d0]
test eax, eax
jne 0x47de89
jmp 0x47de8c
pop esi
pop ecx
ret
push eax
call esi
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_ResetEvent]
push 0x4a89d0
lea eax, [esp + 0xb]
push eax
mov byte [esp + 0xf], 0
call sub.MSVCR110.dll__CxxThrowException
int3
Function at 0x47df40
Capabilities:
Get thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x47f6e8
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push ebp
push esi
push edi
mov eax, dword [0x4c33d0]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov eax, dword [0x4c92d0]
test eax, eax
jne 0x47df72
xor ebx, ebx
jmp 0x47df7b
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
mov dword [esp + 0x14], ebx
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
or ecx, 0xffffffff
mov dword [esp + 0x20], 0
test ebx, ebx
je 0x47dfbf
jmp 0x47dfa6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
cmp dword [ebx + 0x14], 0
mov edi, dword [ebx + 0x10]
jne 0x47dff9
test edi, edi
jne 0x47e000
push edi
call fcn.0047e0a0
add esp, 4
or ecx, 0xffffffff
mov dword [esp + 0x20], 0xffffffff
test ebx, ebx
je 0x47dfe5
lea eax, [ebx + 4]
lock xadd dword [eax], ecx
dec ecx
jne 0x47dfe5
mov eax, dword [ebx]
push 0
mov ecx, ebx
call dword [eax]
push ebx
push 0
call esi
push eax
call ebp
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
test edi, edi
je 0x47e038
lea ecx, [ecx]
mov eax, dword [edi + 4]
mov dword [ebx + 0x10], eax
mov ecx, dword [edi]
test ecx, ecx
je 0x47e029
mov eax, dword [ecx]
call dword [eax + 4]
mov esi, dword [edi]
push 0
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0
call esi
push eax
call ebp
push edi
push 0
call esi
push eax
call ebp
mov edi, dword [ebx + 0x10]
test edi, edi
jne 0x47e000
mov esi, dword [ebx + 0x14]
test esi, esi
je 0x47dfa0
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x14], eax
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x47e058
mov eax, dword [ecx]
push dword [esi + 0xc]
call dword [eax + 4]
mov edi, dword [esi + 8]
test edi, edi
je 0x47e085
lea eax, [edi + 4]
or ecx, 0xffffffff
lock xadd dword [eax], ecx
jne 0x47e085
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 4]
lea eax, [edi + 8]
or edx, 0xffffffff
lock xadd dword [eax], edx
jne 0x47e085
mov eax, dword [edi]
mov ecx, edi
call dword [eax + 8]
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov esi, dword [ebx + 0x14]
test esi, esi
jne 0x47e043
jmp 0x47dfa0

Function at 0x47e0a0
Capabilities:
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x47f718
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x4c33d0]
xor eax, esp
push eax
lea eax, [esp + 0x14]
mov dword fs:[0], eax
push 0x47dce0
push 0x4c92c8
call fcn.0047d920
mov eax, dword [0x4c92d0]
add esp, 8
test eax, eax
je 0x47e0f9
push dword [esp + 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [esp + 0x14]
mov dword fs:[0], ecx
pop ecx
add esp, 0x1c
ret
lea ecx, [esp + 4]
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_]
mov dword [esp + 0x10], 0
mov dword [esp + 4], vtable.boost::thread_resource_error.0
lea eax, [esp + 4]
push eax
mov dword [esp + 0x20], 0
call fcn.004045d0
int3
Function at 0x47e130
Capabilities:
Create thread
Resume thread

Disassembly:
push 0xffffffffffffffff
push 0x47f748
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x4c33d0]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov esi, ecx
mov edx, dword [esi]
lea eax, [edx + 0x1c]
push eax
push 4
push edx
push 0x47e1f0
push 0
push 0
call dword [sym.imp.MSVCR110.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x47e19d
lea ecx, [esp + 0x10]
call dword [sym.imp.MSVCR110.dll_public:_void___thiscall_std::exception::constructor_void_]
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x10], vtable.boost::thread_resource_error.0
lea eax, [esp + 0x10]
push eax
mov dword [esp + 0x2c], ebx
call fcn.004045d0
mov ecx, dword [esi]
add ecx, 4
mov eax, 1
lock xadd dword [ecx], eax
mov edi, dword [esi]
mov eax, dword [edi + 8]
test eax, eax
je 0x47e1c0
cmp eax, 0xffffffff
je 0x47e1c0
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 8], ebx
mov eax, dword [esi]
push dword [eax + 8]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x1c
ret
Function at 0x40adc0
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1014
call fcn.00404730
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0
mov eax, dword [0x4170bc]
cmp ebx, eax
jae 0x40adfb
mov eax, ebx
and eax, 0x1f
mov edx, ebx
sar edx, 5
mov edx, dword [edx*4 + 0x4170c0]
test byte [edx + eax*8 + 4], 1
jne 0x40ae0d
mov dword [0x415c84], 9
or eax, 0xffffffff
jmp 0x40af32
push 1
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x40ae37
push 2
push 0
push ebx
call fcn.00409fd0
add esp, 0xc
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40ae3f
or eax, 0xffffffff
jmp 0x40af32
mov eax, dword [ebp + 0xc]
mov esi, eax
sub esi, dword [ebp - 8]
or esi, esi
jle 0x40aee4
lea edx, [ebp - 0x1010]
mov ecx, 0x1000
xor eax, eax
push edi
push edx
pop edi
rep stosb byte es:[edi], al
pop edi
push edx
pop eax
push 0x8000
push ebx
call fcn.0040b330
add esp, 8
mov dword [ebp - 0x10], eax
mov eax, esi
cmp eax, 0x1000
jb 0x40ae8a
mov dword [ebp - 0x1014], 0x1000
jmp 0x40ae92
push esi
pop eax
mov dword [ebp - 0x1014], eax
mov eax, dword [ebp - 0x1014]
push eax
lea eax, [ebp - 0x1010]
push eax
push ebx
call fcn.004086d0
add esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
jne 0x40aecb
call dword [sym.imp.KERNEL32.DLL_GetLastError]
cmp eax, 5
jne 0x40aec5
mov dword [0x415c84], 0xd
or dword [ebp - 4], 0xffffffff
jmp 0x40aed5
push esi
pop eax
sub eax, edi
push eax
pop esi
or eax, eax
jg 0x40ae75
mov eax, dword [ebp - 0x10]
push eax
push ebx
call fcn.0040b330
add esp, 8
jmp 0x40af20
test esi, esi
jge 0x40af20
push 0
mov eax, dword [ebp + 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
push ebx
call fcn.00408b00
pop ecx
push eax
call dword [sym.imp.KERNEL32.DLL_SetEndOfFile]
test eax, eax
setne al
and eax, 1
dec eax
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x40af20
mov dword [0x415c84], 0xd
push 0
mov eax, dword [ebp - 0xc]
push eax
push ebx
call fcn.00409fd0
add esp, 0xc
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
push ebp
pop esp
pop ebp
ret

Function at 0x430005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
mov ebx, 0x408f6c
nop
mov ecx, 0x1572131a
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x59ae0edf
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x46e004]
jne 0x40100a
repz ret
jmp fcn.00401912

Function at 0x4077ae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0040263b
and dword [ebp - 4], 0
cmp dword [0x470284], 0
mov ebx, eax
jne 0x40785f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x407910
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x407910
push eax
call fcn.004025c9
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x470284], eax
call esi
push eax
call fcn.004025c9
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x470288], eax
call esi
push eax
call fcn.004025c9
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x47028c], eax
call esi
push eax
call fcn.004025c9
pop ecx
mov dword [0x470294], eax
test eax, eax
je 0x40785f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004025c9
pop ecx
mov dword [0x470290], eax
mov eax, dword [0x470290]
cmp eax, ebx
je 0x4078b7
cmp dword [0x470294], ebx
je 0x4078b7
push eax
call fcn.00402644
push dword [0x470294]
mov esi, eax
call fcn.00402644
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x4078b7
test edi, edi
je 0x4078b7
call esi
test eax, eax
je 0x4078ae
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x4078ae
test byte [ebp - 0xc], 1
jne 0x4078b7
or dword [ebp + 0x10], 0x200000
jmp 0x4078f0
mov eax, dword [0x470288]
cmp eax, ebx
je 0x4078f0
push eax
call fcn.00402644
pop ecx
test eax, eax
je 0x4078f0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4078f0
mov eax, dword [0x47028c]
cmp eax, ebx
je 0x4078f0
push eax
call fcn.00402644
pop ecx
test eax, eax
je 0x4078f0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x470284]
call fcn.00402644
pop ecx
test eax, eax
je 0x407910
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x407912
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x469fe5
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80c
mov eax, dword [0x46e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
test ebx, ebx
jle 0x46a042
and dword [ebp - 0x808], 0
lea ecx, [ebp - 0x808]
call fcn.00469fdd
mov al, byte [ebp - 0x808]
xor byte [edi + esi], al
cmp ebx, 0xf
jne 0x46a03d
lea eax, [ebp - 0x80c]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SleepEx]
inc esi
cmp esi, ebx
jl 0x469fff
pop esi
cmp ebx, 0x2d
jne 0x46a059
or dword [0x27583bc], 0xffffffff
mov dword [0x27583b8], 0xa62e7790
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401000
leave
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
nop
pop eax
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x10003af0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push 0
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
push eax
push dword [ebp + 0x10]
mov dword [ebp - 0xc], 1
push ebx
push dword [ebp + 8]
mov dword [ebp - 8], 0
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x10003bc7
push esi
push dword [ebp - 8]
call fcn.1001be46
push dword [ebp - 8]
mov esi, eax
push 0
push esi
call fcn.1001ac20
add esp, 0x10
mov dword [ebp - 0xc], 1
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test esi, esi
je 0x10003bbc
mov ecx, dword [ebp + 0x14]
mov eax, esi
nop word [eax + eax]
mov dx, word [eax]
cmp dx, word [ecx]
jne 0x10003b96
test dx, dx
je 0x10003b92
mov dx, word [eax + 2]
cmp dx, word [ecx + 2]
jne 0x10003b96
add eax, 4
add ecx, 4
test dx, dx
jne 0x10003b70
xor eax, eax
jmp 0x10003b9b
sbb eax, eax
or eax, 1
movzx ebx, byte [ebp - 1]
test eax, eax
mov ecx, 1
push esi
cmove ebx, ecx
call fcn.1001be41
add esp, 4
mov al, bl
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [ebp - 1]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10003f80
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x198
mov eax, dword [0x100430b4]
xor eax, ebp
mov dword [ebp - 4], eax
movups xmm0, xmmword [str.SOFTWARERegisteredApplications]
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
movups xmmword [ebp - 0xcc], xmm0
push esi
movups xmm0, xmmword [0x10032300]
push 0x88
mov dword [ebp - 0x198], eax
lea eax, [ebp - 0x8c]
movups xmmword [ebp - 0xbc], xmm0
push 0
movups xmm0, xmmword [0x10032310]
push eax
movups xmmword [ebp - 0xac], xmm0
movups xmm0, xmmword [0x10032320]
movups xmmword [ebp - 0x9c], xmm0
call fcn.1001ac20
push 0xc8
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.1001ac20
add esp, 0x18
xor ecx, ecx
movzx eax, word [ebp + ecx - 0xcc]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x196], ax
test ax, ax
jne 0x10004004
push edi
lea edi, [ebp - 0x194]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10004026
mov eax, dword [0x10031718]
mov edx, ebx
mov dword [edi], eax
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004040
lea edi, [ebp - 0x194]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004056
mov ecx, edx
lea eax, [ebp - 0xcc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
push ebx
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
cmp dword [ebp + 0x10], 0
je 0x100040c2
mov esi, dword [ebp - 0x198]
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004095
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
push esi
push 1
push ebx
lea eax, [ebp - 0xcc]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10018315
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10004380
Capabilities:
Delete registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x324
mov eax, dword [0x100430b4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x324]
push esi
mov esi, dword [ebp + 8]
push 0x190
push 0
push eax
call fcn.1001ac20
push 0xc8
lea eax, [ebp - 0xcc]
push 0
push eax
call fcn.1001ac20
push 0xc8
lea eax, [ebp - 0x194]
push 0
push eax
call fcn.1001ac20
push ebx
push esi
lea eax, [ebp - 0x194]
push str._s_s
push eax
call fcn.10006e10
push esi
lea eax, [ebp - 0x324]
push str.SOFTWARE_sCapabilitiesFileAssociations
push eax
call fcn.10006e10
add esp, 0x40
xor eax, eax
nop
movzx ecx, word [ebp + eax - 0x324]
lea eax, [eax + 2]
mov word [ebp + eax - 0xce], cx
test cx, cx
jne 0x10004400
push edi
lea edi, [ebp - 0xcc]
add edi, 0xfffffffe
mov ax, word [edi + 2]
lea edi, [edi + 2]
test ax, ax
jne 0x10004422
mov eax, dword [0x10031718]
mov edx, ebx
mov dword [edi], eax
mov esi, edx
nop dword [eax]
mov ax, word [edx]
add edx, 2
test ax, ax
jne 0x10004440
lea edi, [ebp - 0xcc]
sub edx, esi
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x10004456
mov ecx, edx
lea eax, [ebp - 0xcc]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
lea ecx, [ebp - 0x194]
lea edx, [ecx + 2]
pop edi
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10004490
sub ecx, edx
sar ecx, 1
lea eax, [ecx*2 + 2]
push eax
lea eax, [ebp - 0x194]
push eax
push 1
push ebx
lea eax, [ebp - 0x324]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.SHLWAPI.dll_SHSetValueW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10018315
mov esp, ebp
pop ebp
ret 8
Function at 0x10004760
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f690
mov eax, dword fs:[0]
push eax
sub esp, 0x280
mov eax, dword [0x100430b4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x28c], ebx
test eax, eax
je 0x1000494c
push eax
lea ecx, [ebp - 0x40]
call fcn.100035e0
lea eax, [ebp - 0x40]
mov dword [ebp - 4], 0
push eax
call fcn.100117f0
push 0x22c
lea eax, [ebp - 0x284]
push 0
push eax
call fcn.1001ac20
add esp, 0x10
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
cmp esi, 0xffffffff
je 0x10004933
lea eax, [ebp - 0x284]
mov dword [ebp - 0x284], 0x22c
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1000492c
nop dword [eax]
nop word [eax + eax]
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov word [ebp - 0x28], ax
cmp word [ebp - 0x260], ax
je 0x10004845
lea eax, [ebp - 0x260]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10004836
sub eax, edx
sar eax, 1
push eax
lea eax, [ebp - 0x260]
push eax
lea ecx, [ebp - 0x28]
call fcn.10006920
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 1
push eax
call fcn.100117f0
cmp dword [ebp - 0x2c], 8
lea ecx, [ebp - 0x40]
push dword [ebp - 0x30]
cmovae ecx, dword [ebp - 0x40]
lea eax, [ebp - 0x28]
cmp dword [ebp - 0x14], 8
push ecx
cmovae eax, dword [ebp - 0x28]
push dword [ebp - 0x18]
push eax
call fcn.10006480
add esp, 0x14
test eax, eax
je 0x100048d1
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x58]
push eax
call fcn.10010fa0
mov ecx, eax
add esp, 8
or ebx, 1
cmp dword [ecx + 0x14], 8
lea edx, [ecx + 0x10]
jb 0x100048ac
mov ecx, dword [ecx]
push dword [edx]
cmp dword [ebp - 0x2c], 8
lea eax, [ebp - 0x40]
push ecx
cmovae eax, dword [ebp - 0x40]
push dword [ebp - 0x30]
push eax
call fcn.10006480
add esp, 0x10
mov byte [ebp - 0x285], 0
test eax, eax
jne 0x100048d8
mov byte [ebp - 0x285], 1
test bl, 1
je 0x100048f5
mov eax, dword [ebp - 0x44]
and ebx, 0xfffffffe
cmp eax, 8
jb 0x100048f5
inc eax
lea ecx, [ebp - 0x58]
push eax
push dword [ebp - 0x58]
call fcn.10006a20
cmp byte [ebp - 0x285], 0
jne 0x10004967
mov eax, dword [ebp - 0x14]
mov byte [ebp - 4], 0
cmp eax, 8
jb 0x10004917
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.10006a20
lea eax, [ebp - 0x284]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10004810
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 0x2c]
cmp ecx, 8
jb 0x1000494a
inc ecx
push ecx
push dword [ebp - 0x40]
lea ecx, [ebp - 0x40]
call fcn.10006a20
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10018315
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x27c]
lea ecx, [ebp - 0x28]
call fcn.10003880
jmp 0x10004935