joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40c57e
Capabilities:
Check os version
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
mov eax, dword [0x40e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [0x40eb04]
xor esi, esi
mov dword [ebp - 0xb0], 0xc
mov dword [ebp - 0xa8], esi
cmp edi, 0xfffffffe
jne 0x40c6a6
lea eax, [ebp - 0xa4]
mov dword [0x40eb04], esi
push eax
mov dword [ebp - 0xa4], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x40c6a0
xor edi, edi
inc edi
cmp dword [ebp - 0x94], edi
jne 0x40c6a0
cmp dword [ebp - 0xa0], 4
jne 0x40c6a0
cmp dword [ebp - 0x9c], 0xa
jae 0x40c6a0
push 0x4a
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
je 0x40c6a0
lea eax, [ebp - 0xac]
push eax
push 0x20019
push esi
push 0x401964
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x40c6a0
lea eax, [ebp - 0xb0]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xb4]
push eax
push esi
push 0x401060
push dword [ebp - 0xac]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 0xac]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x40c672
mov eax, dword [0x40eb04]
jmp 0x40c6a8
lea edx, [ebp - 0xa8]
lea ecx, [ebp - 0x10]
call fcn.0040c44c
test eax, eax
je 0x40c6a0
mov eax, dword [ebp - 0xa8]
and eax, 0x3ff
cmp eax, edi
je 0x40c698
cmp eax, 0xd
jne 0x40c6a0
mov dword [0x40eb04], edi
jmp 0x40c6a6
mov edi, dword [0x40eb04]
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040cb2e
mov esp, ebp
pop ebp
ret
Function at 0x40c90d
Capabilities:
Terminate process

Disassembly:
call fcn.0040cfc8
jmp 0x40c91c
push 0x58
push 0x40d140
call fcn.0040d094
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x68]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov dword [ebp - 4], 0xfffffffe
mov dword [ebp - 4], 1
mov eax, dword fs:[0x18]
mov edi, dword [eax + 4]
mov esi, ebx
mov edx, 0x4108e4
mov ecx, edi
xor eax, eax
lock cmpxchg dword [edx], ecx
test eax, eax
je 0x40c96b
cmp eax, edi
jne 0x40c97e
xor esi, esi
inc esi
cmp dword [0x4108e8], 1
jne 0x40c98b
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x40c9c1
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x40c953
cmp dword [0x4108e8], ebx
jne 0x40c9b7
mov dword [0x4108e8], 1
push 0x40101c
push 0x401010
call fcn.0040cb05
pop ecx
pop ecx
test eax, eax
je 0x40c9c1
jmp 0x40caee
mov dword [0x40eb24], 1
cmp dword [0x4108e8], 1
jne 0x40c9e5
push 0x40100c
push 0x401004
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x4108e8], 2
test esi, esi
jne 0x40c9f2
xor eax, eax
mov ecx, 0x4108e4
xchg dword [ecx], eax
cmp dword [0x4108ec], 0
je 0x40ca14
push 0x4108ec
call fcn.0040cec0
pop ecx
test eax, eax
je 0x40ca14
push ebx
push 2
push ebx
call dword [0x4108ec]
mov eax, dword [sym.imp.msvcrt.dll__acmdln]
mov esi, dword [eax]
mov dword [ebp - 0x1c], esi
mov edi, dword [ebp - 0x20]
mov cl, byte [esi]
cmp cl, 0x20
ja 0x40ca71
test cl, cl
je 0x40ca30
test edi, edi
jne 0x40ca71
mov al, byte [esi]
test al, al
je 0x40ca40
cmp al, 0x20
ja 0x40ca40
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x40ca30
test byte [ebp - 0x3c], 1
je 0x40ca4c
movzx eax, word [ebp - 0x38]
jmp 0x40ca4f
push 0xa
pop eax
push eax
push esi
push ebx
push 0x400000
call main
mov dword [0x40eb20], eax
cmp dword [0x40eb38], 0
jne 0x40caca
push eax
call dword [sym.imp.msvcrt.dll_exit]
cmp cl, 0x22
jne 0x40ca82
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [ebp - 0x20], edi
movzx eax, cl
push eax
call dword [sym.imp.msvcrt.dll__ismbblead]
pop ecx
test eax, eax
je 0x40ca95
inc esi
mov dword [ebp - 0x1c], esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x40ca21
cmp dword [0x40eb24], 0
jne 0x40cade
call dword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x40eb20]
mov dword [ebp - 4], 0xfffffffe
jmp 0x40cafa
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
call fcn.0040d0d9
ret

Function at 0x40cdad
Capabilities:
Parse pe header

Disassembly:
push 0xc
push 0x40d168
call fcn.0040d094
xor ecx, ecx
mov eax, dword [ebp + 8]
test eax, eax
je 0x40ce0d
cmp eax, 0xffffffff
je 0x40ce0d
mov dword [ebp - 4], ecx
mov edx, 0x5a4d
cmp word [eax], dx
jne 0x40ce06
mov edx, dword [eax + 0x3c]
test edx, edx
js 0x40ce06
cmp edx, 0x10000000
jae 0x40ce06
add eax, edx
mov dword [ebp - 0x1c], eax
mov ecx, dword [eax]
sub ecx, 0x4550
neg ecx
sbb ecx, ecx
not ecx
and ecx, eax
jmp 0x40ce03
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 4], 0xfffffffe
mov eax, ecx
call fcn.0040d0d9
ret 4
Function at 0x40ce70
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40ceae
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x40cea6
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x40ceb0
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x40ce96
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x40cf90
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
je 0x40cfa6
xor eax, eax
pop ebp
ret
mov ecx, dword [eax + 0x3c]
add ecx, eax
xor eax, eax
cmp dword [ecx], 0x4550
jne 0x40cfc1
mov edx, 0x10b
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0
mov dword [ebp - 4], 0
call dword [sym.imp.MSVCR90.dll___iob_func]
add eax, 0x40
push eax
push str.cvtgxl:_not_configured_for_conversion_from_GXL_to_GV_n
call dword [sym.imp.MSVCR90.dll_fputs]
add esp, 8
push 1
call dword [sym.imp.MSVCR90.dll_exit]
mov esp, ebp
pop ebp
ret
Function at 0x405130
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1208
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x4d0c20]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
add eax, 0x520
push eax
lea ecx, [ebp - 0x10]
call fcn.0040a7d0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x18]
push ecx
mov ecx, dword [ebp - 0x2c]
add ecx, 0x538
call fcn.00406bb0
jmp 0x405192
push 0
lea edx, [ebp - 0x20]
push edx
lea ecx, [ebp - 0x18]
call fcn.00407570
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x538
call fcn.00406be0
push eax
lea ecx, [ebp - 0x18]
call fcn.004075b0
movzx ecx, al
test ecx, ecx
je 0x4051dc
push 0
lea ecx, [ebp - 0x18]
call fcn.00407550
mov edx, dword [eax + 4]
push edx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
lea ecx, [ebp - 0x18]
call fcn.00407550
mov eax, dword [eax + 4]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x405184
mov ecx, dword [ebp - 0x2c]
add ecx, 0x538
call fcn.004073f0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x10]
call fcn.0040a790
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x405230
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 8]
push eax
call fcn.00419830
add esp, 4
push str.ZIPINSTALL
push 0x6d
call fcn.004197b0
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x405265
xor al, al
jmp 0x405310
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.004197b0
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x40528f
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor al, al
jmp 0x405310
mov eax, dword [ebp - 0xc]
push eax
call fcn.004197b0
push eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
cmp dword [ebp + 0x10], 0
jne 0x4052ae
xor al, al
jmp 0x405310
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
call fcn.00418a1c
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0
je 0x4052e8
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov edx, dword [ebp - 4]
push edx
call fcn.00495700
add esp, 0xc
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
push 0
mov ecx, dword [ebp + 0x10]
mov edx, dword [ecx]
push edx
mov eax, dword [ebp - 4]
push eax
call fcn.00419840
add esp, 0xc
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x405700
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x4d0c20]
xor eax, ebp
mov dword [ebp - 8], eax
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
xor eax, eax
mov word [ebp - 0x210], ax
push 0x206
push 0
lea ecx, [ebp - 0x20e]
push ecx
call fcn.004955c0
add esp, 0xc
lea edx, [ebp - 0x218]
push edx
push 0x4b363c
push 1
push 0
push 0x4b364c
call dword [sym.imp.ole32.dll_CoCreateInstance]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x40576b
xor eax, eax
jmp 0x4057fd
mov ecx, dword [ebp + 8]
call fcn.00402ab0
push eax
mov eax, dword [ebp - 0x218]
mov ecx, dword [eax]
mov edx, dword [ebp - 0x218]
push edx
mov eax, dword [ecx + 0x50]
call eax
lea ecx, [ebp - 4]
push ecx
push 0x4b366c
mov edx, dword [ebp - 0x218]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [eax]
call edx
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jge 0x4057b7
xor eax, eax
jmp 0x4057fd
push 2
mov ecx, dword [ebp + 0xc]
call fcn.00402ab0
push eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 0x18]
call eax
mov dword [ebp - 0x214], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [edx + 8]
call ecx
mov edx, dword [ebp - 0x218]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x218]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, 1
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.00492337
mov esp, ebp
pop ebp
ret
Function at 0x405810
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b1628
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x4d0c20]
xor eax, ebp
mov dword [ebp - 0x18], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], 0
lea eax, [ebp - 0x14]
push eax
lea ecx, [ebp - 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall5C3ABA3A_F5D6_48CE_AF14_A6C48E918899_is1
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov dword [ebp - 0x38], eax
push 0x4c6780
lea ecx, [ebp - 0x34]
call fcn.00401680
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00476f40
shl eax, 1
push eax
lea ecx, [ebp - 0x34]
call fcn.00402ab0
push eax
push 1
push 0
push str.DisplayName
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x38], eax
cmp dword [0x4d526c], 0
je 0x4058cc
mov eax, dword [0x4d526c]
add eax, 0x20
push eax
lea ecx, [ebp - 0x34]
call fcn.004016e0
push 0x4c67a4
lea ecx, [ebp - 0x34]
call fcn.00401e50
lea ecx, [ebp - 0x34]
call fcn.00476f40
shl eax, 1
push eax
lea ecx, [ebp - 0x34]
call fcn.00402ab0
push eax
push 1
push 0
push str.UninstallString
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x38], eax
cmp dword [0x4d526c], 0
je 0x40591e
mov edx, dword [0x4d526c]
add edx, 0x20
push edx
lea ecx, [ebp - 0x34]
call fcn.004016e0
push str._saibojiasu.exe
lea ecx, [ebp - 0x34]
call fcn.00401e50
lea ecx, [ebp - 0x34]
call fcn.00476f40
shl eax, 1
push eax
lea ecx, [ebp - 0x34]
call fcn.00402ab0
push eax
push 1
push 0
push str.DisplayIcon
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x38], eax
cmp dword [0x4d526c], 0
je 0x405987
mov ecx, dword [0x4d526c]
add ecx, 0x58
call fcn.00476f40
shl eax, 1
push eax
mov ecx, dword [0x4d526c]
add ecx, 0x58
call fcn.00402ab0
push eax
push 1
push 0
push str.DisplayShortcut
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x38], eax
cmp dword [ebp - 0x10], 0
je 0x405997
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.004016c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00492337
mov esp, ebp
pop ebp
ret
Function at 0x4059c0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x814
mov eax, dword [0x4d0c20]
xor eax, ebp
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x814], 0
lea eax, [ebp - 4]
push eax
call dword [sym.imp.SHELL32.dll_SHGetMalloc]
test eax, eax
jl 0x405a78
lea ecx, [ebp - 8]
push ecx
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderLocation]
test eax, eax
jl 0x405a6a
xor edx, edx
mov word [ebp - 0x810], dx
push 0x7fe
push 0
lea eax, [ebp - 0x80e]
push eax
call fcn.004955c0
add esp, 0xc
lea ecx, [ebp - 0x810]
push ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.SHELL32.dll_SHGetPathFromIDListW]
test eax, eax
je 0x405a58
lea eax, [ebp - 0x810]
push eax
mov ecx, dword [ebp + 8]
call fcn.00401680
mov ecx, dword [ebp - 0x814]
or ecx, 1
mov dword [ebp - 0x814], ecx
mov eax, dword [ebp + 8]
jmp 0x405a97
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ecx + 0x14]
call eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [edx + 8]
call ecx
push 0x4c6838
mov ecx, dword [ebp + 8]
call fcn.00401680
mov edx, dword [ebp - 0x814]
or edx, 1
mov dword [ebp - 0x814], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
xor ecx, ebp
call fcn.00492337
mov esp, ebp
pop ebp
ret
Function at 0x405ce0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b15ed
mov eax, dword fs:[0]
push eax
sub esp, 0x8d0
mov eax, dword [0x4d0c20]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov word [ebp - 0x814], ax
push 0x7fe
push 0
lea ecx, [ebp - 0x812]
push ecx
call fcn.004955c0
add esp, 0xc
push 0
push 0xb
lea edx, [ebp - 0x814]
push edx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 0
je 0x405ed7
lea eax, [ebp - 0x814]
push eax
lea ecx, [ebp - 0x834]
call fcn.00401680
mov dword [ebp - 4], 0
push 0x4c6880
lea ecx, [ebp - 0x834]
call fcn.00401e50
lea ecx, [ebp - 0x834]
push ecx
call fcn.0040e4e0
add esp, 4
mov dword [ebp - 0x818], eax
cmp dword [ebp - 0x818], 0
je 0x405ec5
push 0x4c6890
lea edx, [ebp - 0x834]
push edx
lea eax, [ebp - 0x86c]
push eax
call fcn.00401d00
add esp, 0xc
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x86c]
call fcn.00402ab0
push eax
lea ecx, [ebp - 0x888]
call fcn.00401680
mov byte [ebp - 4], 2
mov ecx, dword [ebp + 8]
call fcn.00402ab0
push eax
lea ecx, [ebp - 0x8a4]
call fcn.00401680
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x888]
push ecx
lea edx, [ebp - 0x8a4]
push edx
call fcn.00405700
add esp, 8
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x8a4]
call fcn.004016c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x888]
call fcn.004016c0
push 0x4c68ac
lea eax, [ebp - 0x834]
push eax
lea ecx, [ebp - 0x850]
push ecx
call fcn.00401d00
add esp, 0xc
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x850]
call fcn.00402ab0
push eax
lea ecx, [ebp - 0x8c0]
call fcn.00401680
mov byte [ebp - 4], 5
mov ecx, dword [ebp + 0xc]
call fcn.00402ab0
push eax
lea ecx, [ebp - 0x8dc]
call fcn.00401680
mov byte [ebp - 4], 6
lea edx, [ebp - 0x8c0]
push edx
lea eax, [ebp - 0x8dc]
push eax
call fcn.00405700
add esp, 8
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x8dc]
call fcn.004016c0
mov byte [ebp - 4], 4
lea ecx, [ebp - 0x8c0]
call fcn.004016c0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x850]
call fcn.004016c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x86c]
call fcn.004016c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x834]
call fcn.004016c0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00492337
mov esp, ebp
pop ebp
ret
Function at 0x40a1d0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x4d0c20]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x230], ecx
lea ecx, [ebp - 0x14]
call fcn.0040a740
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax + 4]
or ecx, 0x2001f
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x230]
mov ecx, dword [eax]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040a660
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40a23b
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x224], edx
lea ecx, [ebp - 0x14]
call fcn.0040a720
mov eax, dword [ebp - 0x224]
jmp 0x40a2cc
mov dword [ebp - 4], pe_nt_image_headers32
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea ecx, [ebp - 4]
push ecx
lea edx, [ebp - 0x220]
push edx
push 0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40a2a1
lea ecx, [ebp - 0x220]
push ecx
lea ecx, [ebp - 0x14]
call fcn.0040a1d0
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x40a298
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x228], edx
lea ecx, [ebp - 0x14]
call fcn.0040a720
mov eax, dword [ebp - 0x228]
jmp 0x40a2cc
mov dword [ebp - 4], pe_nt_image_headers32
jmp 0x40a242
lea ecx, [ebp - 0x14]
call fcn.0040a6d0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x230]
call fcn.0040a140
mov dword [ebp - 0x22c], eax
lea ecx, [ebp - 0x14]
call fcn.0040a720
mov eax, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.00492337
mov esp, ebp
pop ebp
ret 4

Function at 0x40a5a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x40a5a9
xor ecx, ecx
jne 0x40a5a9
mov edx, dword [ebp + 0x10]
mov eax, dword [edx]
shl eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
lea edx, [ebp - 8]
push edx
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 4]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x40a5f0
mov eax, dword [ebp - 0xc]
jmp 0x40a64d
cmp dword [ebp - 4], 1
je 0x40a603
cmp dword [ebp - 4], 2
je 0x40a603
mov eax, 0xd
jmp 0x40a64d
cmp dword [ebp + 0xc], 0
je 0x40a641
cmp dword [ebp - 8], 0
je 0x40a639
mov eax, dword [ebp - 8]
xor edx, edx
mov ecx, 2
div ecx
test edx, edx
jne 0x40a630
mov edx, dword [ebp - 8]
shr edx, 1
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + edx*2 - 2]
test ecx, ecx
je 0x40a637
mov eax, 0xd
jmp 0x40a64d
jmp 0x40a641
xor edx, edx
mov eax, dword [ebp + 0xc]
mov word [eax], dx
mov ecx, dword [ebp - 8]
shr ecx, 1
mov edx, dword [ebp + 0x10]
mov dword [edx], ecx
xor eax, eax
mov esp, ebp
pop ebp
ret 0xc
Function at 0x40e280
Capabilities:
Create process on windows
Get common file path
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b166b
mov eax, dword fs:[0]
push eax
sub esp, 0x464
mov eax, dword [0x4d0c20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x470], ecx
push str.taskkill__f__im
lea ecx, [ebp - 0x4c]
call fcn.00401680
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x4c]
call fcn.0040c590
push 0x4c58c8
lea ecx, [ebp - 0x4c]
call fcn.00401e50
push str._c__
lea ecx, [ebp - 0x468]
call fcn.00401680
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x4c]
push ecx
lea ecx, [ebp - 0x468]
call fcn.0040c590
push 0x4c58dc
lea ecx, [ebp - 0x468]
call fcn.00401e50
xor edx, edx
mov word [ebp - 0x44c], dx
push 0x3fe
push 0
lea eax, [ebp - 0x44a]
push eax
call fcn.004955c0
add esp, 0xc
push 0x400
lea ecx, [ebp - 0x44c]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea edx, [ebp - 0x44c]
push edx
lea ecx, [ebp - 0x30]
call fcn.00401680
mov byte [ebp - 4], 2
push 0x4c58e0
lea ecx, [ebp - 0x30]
call fcn.00401e50
lea ecx, [ebp - 0x468]
call fcn.00402ab0
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0
push 0x4c58f4
lea ecx, [ebp - 0x468]
call fcn.00402ab0
push eax
lea ecx, [ebp - 0x30]
call fcn.00402ab0
push eax
push 0x4c58f8
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x46c], eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x30]
call fcn.004016c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x468]
call fcn.004016c0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.004016c0
mov eax, dword [ebp - 0x46c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00492337
mov esp, ebp
pop ebp
ret 4
Function at 0x40e4e0
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4b14a8
mov eax, dword fs:[0]
push eax
sub esp, 0x30
mov eax, dword [0x4d0c20]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, dword [ebp + 8]
call fcn.00402ab0
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x40e525
mov eax, 1
jmp 0x40e5fd
mov eax, dword [0x4c6f14]
push eax
push 0x4c4a30
mov ecx, dword [ebp + 8]
call fcn.0040f210
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [0x4c6f14]
je 0x40e5f4
mov edx, dword [ebp - 0x10]
push edx
push 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.0040c6f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x30]
call fcn.00402ab0
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x40e5a1
lea ecx, [ebp - 0x30]
push ecx
call fcn.0040e4e0
add esp, 4
test eax, eax
jne 0x40e5a1
mov dword [ebp - 0x38], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004016c0
mov eax, dword [ebp - 0x38]
jmp 0x40e5fd
push 0
mov ecx, dword [ebp + 8]
call fcn.00402ab0
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40e5e3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0xb7
je 0x40e5e3
mov dword [ebp - 0x3c], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004016c0
mov eax, dword [ebp - 0x3c]
jmp 0x40e5fd
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.004016c0
jmp 0x40e5f8
xor eax, eax
jmp 0x40e5fd
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00492337
mov esp, ebp
pop ebp
ret