joyce8/EMBER2024-capa huggingface dataset:
Function at 0x436ce0
Capabilities:
Create thread

Disassembly:
sub esp, 0x20
push ebp
push esi
push edi
mov esi, ecx
call fcn.0042cb00
mov edi, eax
xor ebp, ebp
cmp edi, ebp
jne 0x436cfe
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
push ebx
lea ebx, [esi + 0x50]
push ebx
mov ecx, edi
call fcn.0042fca0
test eax, eax
je 0x436d24
mov ecx, dword [esi + 8]
mov eax, dword [ecx]
mov edx, dword [eax + 0x14]
push ebp
call edx
mov ecx, esi
call fcn.0042cb80
cmp eax, ebp
jne 0x436d2e
pop ebx
pop edi
pop esi
xor eax, eax
pop ebp
add esp, 0x20
ret
mov edx, dword [ebx]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 4]
call eax
mov ecx, edi
call fcn.0042f500
cmp eax, ebp
je 0x436d4f
mov edx, dword [ebx]
mov ecx, dword [eax]
push edx
push eax
mov eax, dword [ecx + 0x28]
call eax
mov ecx, 0x436b60
mov dword [esp + 0x10], vtable.CSimpleThread.0
mov dword [esp + 0x28], 0x436b60
mov dword [esp + 0x2c], esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x1c], ebp
mov dword [esp + 0x20], ebp
mov dword [esp + 0x24], ebp
test ecx, ecx
je 0x436d9e
lea edx, [esp + 0x18]
push edx
push ebp
push esi
push 0x436b60
push ebp
push ebp
call fcn.0044b92e
add esp, 0x18
mov dword [esp + 0x14], eax
lea ecx, [esp + 0x10]
call fcn.00403570
pop ebx
pop edi
pop esi
mov eax, 1
pop ebp
add esp, 0x20
ret

Function at 0x437350
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x465483
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
mov eax, dword [0x47eb18]
xor eax, esp
push eax
lea eax, [esp + 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0xc], esi
call fcn.0042cd90
xor ebx, ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
or eax, 0xffffffff
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov byte [esi + 0x48], bl
mov dword [esi + 0x38], ebx
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], eax
mov dword [esi + 0x44], eax
mov dword [esi + 0xc], 0x3e8
mov dword [esi], vtable.CUninstallProgressDialog.1.0
mov dword [esi + 0x10], vtable.CUninstallProgressDialog.0
mov eax, dword [0x47d064]
mov dword [esp + 0x18], ebx
mov dword [esi + 0x50], eax
lea ecx, [esi + 0x54]
mov byte [esp + 0x18], 1
call fcn.00432fd0
mov dword [esi + 0xb4], ebx
mov dword [esi + 0xb8], ebx
mov eax, esi
mov ecx, dword [esp + 0x10]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
add esp, 0x10
ret
Function at 0x441d00
Capabilities:
Hash data with md5

Disassembly:
xor eax, eax
mov dword [ecx + 0x14], eax
mov dword [ecx + 0x10], eax
mov dword [ecx], 0x67452301
mov dword [ecx + 4], 0xefcdab89
mov dword [ecx + 8], 0x98badcfe
mov dword [ecx + 0xc], 0x10325476
ret

Function at 0x4425b0
Capabilities:
Hash data with md5

Disassembly:
push ebp
lea ebp, [esp - 0x805c]
mov eax, 0x805c
call fcn.00449f20
push 0xffffffffffffffff
push 0x465d60
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x47eb18]
xor eax, ebp
mov dword [ebp + 0x8058], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ecx
mov edi, dword [ebp + 0x8064]
mov eax, dword [ebp + 0x8068]
xor esi, esi
push esi
push esi
push esi
push edi
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], esi
mov dword [ebp + 0x14], esi
mov dword [ebp + 0x10], esi
mov dword [ebp], 0x67452301
mov dword [ebp + 4], 0xefcdab89
mov dword [ebp + 8], 0x98badcfe
mov dword [ebp + 0xc], 0x10325476
call dword [0x46824c]
cmp eax, 0xffffffff
jne 0x442650
push 0x46d308
push esi
push 0x1ae
push str..QHMD5.cpp
call fcn.0043abd0
add esp, 0x10
mov ebx, dword [0x468240]
push 0
lea ecx, [ebp - 0x1c]
push ecx
push 0x8000
lea edx, [ebp + 0x58]
push edx
push edi
call ebx
test eax, eax
jne 0x442684
push 0x46d2e4
push eax
push 0x1b1
push str..QHMD5.cpp
call fcn.0043abd0
add esp, 0x10
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x44269c
push esi
lea eax, [ebp + 0x58]
push eax
lea ecx, [ebp]
push ecx
mov ecx, dword [ebp - 0x14]
call fcn.004423e0
cmp esi, 0x8000
je 0x442656
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x14]
lea edx, [ebp]
push edx
push eax
call fcn.004424a0
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x8058]
xor ecx, ebp
call fcn.0044951c
add ebp, 0x805c
mov esp, ebp
pop ebp
ret 8
Function at 0x446e60
Capabilities:
Hash data with md5

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
mov dword [eax + 0x14], ecx
mov dword [eax + 0x10], ecx
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x447fa0
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push 0
push 0
push 0
push 0
push eax
mov eax, dword [esp + 0x18]
push ecx
push edx
push eax
call dword [0x468010]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x447fd0
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [0x46800c]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x448000
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov edx, dword [esp + 0xc]
push eax
mov eax, dword [esp + 0xc]
push ecx
mov ecx, dword [esp + 0xc]
push edx
push 0
push eax
push ecx
call dword [0x468008]
neg eax
sbb eax, eax
inc eax
ret

Function at 0x4492e0
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1004
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x1000], eax
push esi
mov esi, dword [esp + 0x1010]
push edi
mov edi, dword [esp + 0x1010]
push 0x1000
lea eax, [esp + 0xc]
push 0
push eax
call fcn.00449530
push 0x800
lea ecx, [esp + 0x18]
push 0x46dff4
push ecx
call fcn.00449f8b
push 0x800
lea edx, [esp + 0x24]
push esi
push edx
call fcn.00449f4b
push 0x800
lea eax, [esp + 0x30]
push 0x46dfc8
push eax
call fcn.00449f4b
push 0x800
lea ecx, [esp + 0x3c]
push esi
push ecx
call fcn.00449f4b
push 0x800
lea edx, [esp + 0x48]
push str.vL
push edx
call fcn.00449f4b
add esp, 0x48
push 0x800
lea eax, [esp + 0xc]
push edi
push eax
call fcn.00449f4b
push 0x800
lea ecx, [esp + 0x18]
push 0x46df88
push ecx
call fcn.00449f4b
add esp, 0x18
push 0x14
push esi
lea edx, [esp + 0x10]
push edx
call dword [0x46840c]
push eax
call dword [0x468410]
mov esi, eax
cmp esi, 6
jne 0x4493d3
push 5
push 0
push 0
push str.http:__down.360safe.com_setup.exe
push str.open
push 0
call dword [0x468344]
cmp dword [esp + 0x1018], 0
je 0x4493e4
push 0
call fcn.0044ca96
mov ecx, dword [esp + 0x1008]
pop edi
mov eax, esi
pop esi
xor ecx, esp
call fcn.0044951c
add esp, 0x1004
ret
Function at 0x449400
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x140
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x13c], eax
mov eax, dword [esp + 0x144]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push 3
push ebx
push 1
push 0x80000000
push eax
call dword [0x4680b0]
mov esi, eax
cmp esi, 0xffffffff
jne 0x449452
pop esi
xor eax, eax
pop ebx
mov ecx, dword [esp + 0x13c]
xor ecx, esp
call fcn.0044951c
add esp, 0x140
ret
push edi
mov edi, dword [0x468240]
push 0
lea eax, [esp + 0x10]
push eax
push 0x40
lea ecx, [esp + 0x114]
push ecx
push esi
call edi
test eax, eax
je 0x4494db
cmp dword [esp + 0xc], 0x40
jne 0x4494db
mov edx, 0x5a4d
cmp word [esp + 0x108], dx
jne 0x4494db
mov eax, dword [esp + 0x144]
push 0
push 0
push eax
push esi
call dword [0x46824c]
cmp eax, dword [esp + 0x144]
jne 0x4494db
push 0
lea ecx, [esp + 0x10]
push ecx
push pe_nt_image_headers32
lea edx, [esp + 0x1c]
push edx
push esi
call edi
test eax, eax
je 0x4494db
cmp dword [esp + 0xc], 0xf8
jne 0x4494db
cmp dword [esp + 0x10], 0x4550
jne 0x4494db
cmp word [esp + 0x16], bx
je 0x4494db
mov ebx, 1
push esi
call dword [0x468074]
mov ecx, dword [esp + 0x148]
pop edi
pop esi
mov eax, ebx
pop ebx
xor ecx, esp
call fcn.0044951c
add esp, 0x140
ret

Function at 0x449510
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
push eax
call dword [0x46832c]
ret
Function at 0x4614e0
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2c14
call fcn.00449f20
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x2c10], eax
mov eax, dword [esp + 0x2c18]
push edi
xor edi, edi
mov dword [esp + 0xc], eax
cmp eax, edi
je 0x46164b
cmp dword [esp + 0x2c20], edi
je 0x46164b
push ebx
push ebp
mov ebp, dword [0x4680d8]
push esi
mov dword [esp + 0x10], edi
xor ebx, ebx
lea ebx, [ebx]
push ebx
push str..PhysicalDrive_d
lea eax, [esp + 0x30]
push 0x100
push eax
call fcn.00460f00
add esp, 0x10
push edi
push edi
push 3
push edi
push 3
push edi
lea ecx, [esp + 0x40]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x461624
xor eax, eax
push 0x2710
lea edx, [esp + 0x514]
push edi
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
push edx
mov dword [esp + 0x20], edi
mov dword [esp + 0x30], eax
mov dword [esp + 0x28], edi
mov dword [esp + 0x2c], edi
call fcn.00449530
add esp, 0xc
push edi
lea eax, [esp + 0x18]
push eax
push 0x2710
lea ecx, [esp + 0x51c]
push ecx
push 0xc
lea edx, [esp + 0x30]
push edx
push 0x2d1400
push esi
call dword [0x468290]
test eax, eax
je 0x461617
push 0x3e8
lea eax, [esp + 0x12c]
push edi
push eax
call fcn.00449530
mov edx, dword [esp + 0x534]
lea ecx, [esp + 0x134]
push ecx
push 1
push edx
lea eax, [esp + 0x528]
push eax
call fcn.00462c00
mov edx, dword [esp + 0x2c48]
mov eax, dword [esp + 0x34]
add esp, 0x1c
lea ecx, [esp + 0x128]
push ecx
push edx
push eax
call fcn.00460e00
test eax, eax
jne 0x461617
mov dword [esp + 0x10], 1
push esi
call dword [0x468074]
cmp dword [esp + 0x10], edi
jne 0x46162e
inc ebx
cmp ebx, 0x10
jl 0x461530
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
mov ecx, dword [esp + 0x2c10]
xor ecx, esp
call fcn.0044951c
add esp, 0x2c14
ret
mov ecx, dword [esp + 0x2c14]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0044951c
add esp, 0x2c14
ret
Function at 0x4618f0
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x2ec
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x2e8], eax
push edi
mov edi, dword [esp + 0x2f4]
mov dword [esp + 0x18], edi
test edi, edi
je 0x461af1
cmp dword [esp + 0x2f8], 0
je 0x461af1
push 0x64
lea eax, [esp + 0x20]
push 0
push eax
call fcn.00449530
add esp, 0xc
lea ecx, [esp + 4]
push ecx
push 8
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionNetworkCards
push 0x80000002
call dword [0x46802c]
test eax, eax
jne 0x461ab8
mov ecx, dword [esp + 4]
push ebx
push esi
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
lea edx, [esp + 0x20]
push edx
lea eax, [esp + 0x100]
push eax
push ebx
mov esi, 0x104
push ecx
mov dword [esp + 0x30], esi
call dword [0x468004]
test eax, eax
jne 0x461aab
lea ebx, [ebx]
mov ecx, dword [esp + 0xc]
lea edx, [esp + 0x14]
push edx
push 1
push 0
lea eax, [esp + 0xf8]
push eax
push ecx
call dword [0x46802c]
test eax, eax
jne 0x461a79
lea edx, [esp + 0x1c]
push edx
mov edx, dword [esp + 0x18]
lea eax, [esp + 0x1f4]
push eax
lea ecx, [esp + 0x20]
push ecx
push 0
push str.ServiceName
push edx
mov dword [esp + 0x30], 1
mov dword [esp + 0x34], esi
call dword [0x468008]
test eax, eax
jne 0x461a6e
push 0x64
push eax
lea eax, [esp + 0x90]
push eax
call fcn.00449530
lea ecx, [esp + 0x1fc]
push 0x64
push ecx
lea edi, [esp + 0x9c]
call fcn.004617e0
add esp, 0x14
test eax, eax
je 0x461a6e
cmp byte [esp + 0x24], 0
je 0x461a32
lea edx, [esp + 0x24]
push edx
mov eax, edi
push eax
call dword [0x468100]
test eax, eax
jge 0x461a6e
lea eax, [esp + 0x24]
lea esi, [esp + 0x88]
mov ecx, eax
mov edx, 0x64
sub esi, ecx
lea ecx, [edx + 0x7fffff9a]
test ecx, ecx
je 0x461a61
mov cl, byte [esi + eax]
test cl, cl
je 0x461a61
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x461a46
jmp 0x461a65
test edx, edx
jne 0x461a66
dec eax
mov byte [eax], 0
mov esi, 0x104
mov edx, dword [esp + 0x14]
push edx
call dword [section..rdata]
mov edx, dword [esp + 0xc]
push 0
push 0
push 0
push 0
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x100]
push ecx
inc ebx
push ebx
push edx
mov dword [esp + 0x30], esi
call dword [0x468004]
test eax, eax
je 0x461990
mov edi, dword [esp + 0x20]
mov eax, dword [esp + 0xc]
push eax
call dword [section..rdata]
pop esi
pop ebx
cmp byte [esp + 0x1c], 0
je 0x461af1
mov edx, dword [esp + 0x2f8]
lea ecx, [esp + 0x1c]
push ecx
push edx
push edi
call fcn.00460e00
xor ecx, ecx
test eax, eax
setge cl
pop edi
mov eax, ecx
mov ecx, dword [esp + 0x2e8]
xor ecx, esp
call fcn.0044951c
add esp, 0x2ec
ret
mov ecx, dword [esp + 0x2ec]
pop edi
xor ecx, esp
xor eax, eax
call fcn.0044951c
add esp, 0x2ec
ret
Function at 0x461d60
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x50c
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x508], eax
push ebp
mov ebp, dword [esp + 0x514]
test edi, edi
je 0x461edd
cmp ebp, 0x20
jb 0x461edd
push 0x400
lea eax, [esp + 0x110]
push 0
push eax
mov dword [esp + 0x14], 1
mov dword [esp + 0x10], 0x400
call fcn.00449530
add esp, 0xc
lea ecx, [esp + 4]
push ecx
lea edx, [esp + 0x110]
push edx
lea eax, [esp + 0x10]
push eax
push 0x46fe4c
push str.Software360SafeLiveup
push 0x80000002
call dword [0x4683ac]
test eax, eax
jne 0x461edd
lea eax, [esp + 0x10c]
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461df0
sub eax, edx
cmp eax, 0x40
jne 0x461edd
push ebx
lea edx, [eax + 0x40]
push esi
lea eax, [esp + 0x14]
lea esi, [esp + 0x114]
mov ecx, eax
sub esi, ecx
lea ecx, [edx - 0x60]
test ecx, ecx
je 0x461e2e
mov cl, byte [esi + eax]
test cl, cl
je 0x461e2e
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x461e16
jmp 0x461e32
test edx, edx
jne 0x461e33
dec eax
mov byte [eax], 0
lea eax, [esp + 0x94]
lea edx, [esp + 0x134]
mov ecx, eax
mov esi, 0x80
sub edx, ecx
lea ecx, [ecx]
lea ecx, [esi + 0x7fffff7e]
test ecx, ecx
je 0x461e6b
mov cl, byte [edx + eax]
test cl, cl
je 0x461e6b
mov byte [eax], cl
inc eax
sub esi, 1
jne 0x461e50
jmp 0x461e6f
test esi, esi
jne 0x461e70
dec eax
push 0x400
lea edx, [esp + 0x118]
push 0
push edx
mov byte [eax], 0
call fcn.00449530
push 0x400
lea ebx, [esp + 0x124]
lea ecx, [esp + 0x24]
call fcn.00460f60
add esp, 0x10
lea eax, [esp + 0x94]
push eax
mov ecx, ebx
push ecx
call dword [0x468150]
pop esi
pop ebx
test eax, eax
jne 0x461edd
lea edx, [esp + 0xc]
push edx
push ebp
push edi
call fcn.00460e00
neg eax
sbb eax, eax
inc eax
pop ebp
mov ecx, dword [esp + 0x508]
xor ecx, esp
call fcn.0044951c
add esp, 0x50c
ret
mov ecx, dword [esp + 0x50c]
pop ebp
xor ecx, esp
xor eax, eax
call fcn.0044951c
add esp, 0x50c
ret

Function at 0x461f00
Capabilities:
Set registry value

Disassembly:
sub esp, 0x188
mov eax, dword [0x47eb18]
xor eax, esp
mov dword [esp + 0x184], eax
push ebx
push esi
push 0x80
lea eax, [esp + 0xc]
push 0
push eax
mov esi, ecx
call fcn.00449530
push 0x80
lea ebx, [esp + 0x18]
mov ecx, esi
call fcn.00460f60
lea eax, [esp + 0x98]
mov ecx, eax
add esp, 0x10
mov edx, 0x104
sub esi, ecx
lea esp, [esp]
lea ecx, [edx + 0x7ffffefa]
test ecx, ecx
je 0x461f6b
mov cl, byte [esi + eax]
test cl, cl
je 0x461f6b
mov byte [eax], cl
inc eax
sub edx, 1
jne 0x461f50
jmp 0x461f6f
test edx, edx
jne 0x461f70
dec eax
lea edx, [esp + 8]
push edx
mov byte [eax], 0
push 0x104
lea eax, [esp + 0x90]
push eax
call fcn.00460e70
lea eax, [esp + 0x88]
pop esi
lea edx, [eax + 1]
pop ebx
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x461f96
sub eax, edx
push eax
lea ecx, [esp + 0x84]
push ecx
push 1
push 0x46fe4c
push str.Software360SafeLiveup
push 0x80000002
call dword [0x468384]
mov ecx, dword [esp + 0x184]
xor ecx, esp
call fcn.0044951c
add esp, 0x188
ret
Function at 0x407ac0
Capabilities:
Set registry value

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5af64b
push eax
mov dword fs:[0], esp
sub esp, 0x220
push esi
mov esi, ecx
push edi
xor edi, edi
cmp dword [esi + 0x14], edi
je 0x407bd8
mov eax, dword [esi + 8]
mov dword [esp + 8], edi
cmp eax, edi
mov dword [esp + 0xc], edi
jle 0x407bd8
push ebx
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
xor ebx, ebx
mov eax, dword [esi + 4]
lea ecx, [esp + 0x1c]
lea edx, [esp + 0x10]
push ecx
mov eax, dword [eax + ebx + 4]
push edx
push edi
push 0xf003f
push edi
push 0x67df58
push edi
push eax
mov eax, dword [esi + 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x407b6a
lea ecx, [esp + 0x20]
call fcn.00481cc0
push 1
push str.Cannot_open__create__registry_subkey_during_CBrowsersIntegration::Save__._r_n
lea ecx, [esp + 0x28]
mov dword [esp + 0x240], edi
call fcn.00481de0
lea ecx, [esp + 0x20]
mov dword [esp + 0x238], 0xffffffff
call fcn.00481dd0
jmp 0x407bb0
mov ecx, dword [esi + 4]
xor eax, eax
mov edx, dword [ecx + ebx]
or ecx, 0xffffffff
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
push ecx
push edx
mov edx, dword [esp + 0x18]
push 1
push eax
push 0x6535f8
push edx
call ebp
mov eax, dword [esi + 4]
lea edx, [esp + 0x18]
push 4
push edx
mov ecx, dword [eax + ebx + 8]
mov eax, dword [esp + 0x18]
push 4
push 0
push 0x6535f4
push eax
mov dword [esp + 0x30], ecx
call ebp
xor edi, edi
mov eax, dword [esp + 0x14]
mov ecx, dword [esi + 8]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x407b07
mov eax, dword [esp + 0x10]
pop ebp
cmp eax, edi
pop ebx
je 0x407bd8
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [esp + 0x228]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x22c
ret
Function at 0x409df0
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 8
mov edx, dword [esp + 0xc]
lea eax, [esp]
push esi
xor esi, esi
push eax
mov eax, dword [ecx + 0x14]
push 1
push esi
push edx
push eax
mov dword [esp + 0x18], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x409e45
lea ecx, [esp + 0x10]
lea edx, [esp + 8]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x14]
push str.found
push eax
mov dword [esp + 0x28], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x409e45
mov esi, dword [esp + 8]
mov eax, dword [esp + 4]
test eax, eax
je 0x409e54
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 8
ret 4
Function at 0x40b670
Capabilities:
Shutdown system
Terminate process

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x5af8dc
push eax
mov eax, dword [esp + 0x10]
mov dword fs:[0], esp
sub esp, 0x12c
test eax, eax
je 0x40b702
push 0
lea ecx, [esp + 0x18]
call fcn.004d7b60
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], 0
call fcn.00599ed3
lea ecx, [esp + 0xe8]
mov dword [esp + 0x134], 3
call fcn.005a5a49
lea ecx, [esp + 0xac]
mov byte [esp + 0x134], 2
call fcn.0059867d
lea ecx, [esp + 0x70]
mov byte [esp + 0x134], 1
call fcn.005a5a81
lea ecx, [esp + 0x14]
mov dword [esp + 0x134], 0xffffffff
call fcn.00599b14
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x40b754
lea ecx, [esp + 8]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
mov eax, dword [esp]
push 0
push 0
lea edx, [esp + 0xc]
push 0
push edx
push 0
push eax
mov dword [esp + 0x1c], 1
mov dword [esp + 0x28], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0
push 2
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x40c4b0
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x10c
add ecx, 4
push ebx
push ebp
push esi
push edi
push str.IEXPLORE
call fcn.00409d90
mov ebp, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ebx, eax
lea eax, [esp + 0x10]
push eax
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WSOCK32.dll_accept
call ebp
test eax, eax
jne 0x40c583
lea ecx, [esp + 0x14]
lea edx, [esp + 0x18]
push ecx
push edx
push eax
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c551
test ebx, ebx
je 0x40c578
mov esi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov cl, dl
cmp dl, byte [esi]
jne 0x40c548
test cl, cl
je 0x40c544
mov dl, byte [eax + 1]
mov cl, dl
cmp dl, byte [esi + 1]
jne 0x40c548
add eax, 2
add esi, 2
test cl, cl
jne 0x40c524
xor eax, eax
jmp 0x40c54d
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c578
mov edi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push 1
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [esp + 0x10]
push edx
push 0xf003f
push 0
push str.SoftwareMicrosoftInternet_Explorer
push reloc.WSOCK32.dll_bind
call ebp
test eax, eax
jne 0x40c63d
mov edx, dword [esp + 0x10]
lea eax, [esp + 0x14]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push str.DownloadUI
push edx
mov dword [esp + 0x2c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40c60b
test ebx, ebx
je 0x40c632
mov esi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
lea eax, [esp + 0x18]
mov dl, byte [eax]
mov bl, byte [esi]
mov cl, dl
cmp dl, bl
jne 0x40c602
test cl, cl
je 0x40c5fe
mov dl, byte [eax + 1]
mov bl, byte [esi + 1]
mov cl, dl
cmp dl, bl
jne 0x40c602
add eax, 2
add esi, 2
test cl, cl
jne 0x40c5da
xor eax, eax
jmp 0x40c607
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0x40c632
mov edi, str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
push str.7D11E719_FF90_479C_B0D7_96EB43EE55D7
push 1
push eax
mov eax, dword [esp + 0x20]
push str.DownloadUI
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [esp + 0x10]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret
Function at 0x40e040
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push esi
push edi
call fcn.004351a0
neg eax
sbb eax, eax
lea ecx, [esp + 8]
and eax, 0x100
push ecx
add eax, 0xf003f
push eax
push 0
push str.SYSTEMCurrentControlSetServicesIDMTDI
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x40e0a6
mov eax, dword [esp + 8]
lea edx, [esp + 0xc]
push 4
push edx
push 4
push 0
push 0x6541b4
push eax
mov dword [esp + 0x24], 1
call esi
mov ecx, dword [esp + 8]
push ecx
call edi
lea edx, [esp + 8]
push 0
push edx
push 0
push 0xf003f
push 0
push 0x67df58
push 0
push 0x652e90
push reloc.WSOCK32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x40e0f7
mov ecx, dword [esp + 8]
lea eax, [esp + 0xc]
push 4
push eax
push 4
push 0
push str.AdvIntDriverEnabled2
push ecx
mov dword [esp + 0x24], 1
call esi
mov edx, dword [esp + 8]
push edx
call edi
pop edi
pop esi
add esp, 8
ret