joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40dab0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
mov edi, ecx
call fcn.00428450
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x11c], 6
jae 0x40db10
mov eax, 1
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
push esi
push str.Kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40db32
push str.SetFileInformationByHandle
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
jne 0x40db44
pop esi
xor eax, eax
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
push 0x28
push ebx
push 0
push edi
call eax
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop esi
mov eax, edi
xor ecx, ebp
pop edi
call fcn.004217a4
mov esp, ebp
pop ebp
ret

Function at 0x40e790
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa20
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [ebp - 0xa0e]
push ecx
mov dword [ebp - 0xa1c], 0
mov word [ebp - 0xa10], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.00428450
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
lea ecx, [ebp - 0x210]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options_s
push ecx
call edi
add esp, 0xc
lea edx, [ebp - 0xa1c]
push edx
lea eax, [ebp - 0xa14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x40e879
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0xa10]
push 0x440d68
push eax
call edi
lea ecx, [ebp - 0xa10]
add esp, 0x14
push ecx
call fcn.00406870
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xa14]
push 4
lea edx, [ebp - 0xa18]
push edx
push 4
push 0
push str.GlobalFlag
push eax
mov dword [ebp - 0xa18], 0x200
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xa14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x40e8d0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0xa0e]
push ecx
mov word [ebp - 0xa10], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.00428450
mov edi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea ecx, [ebp - 0x210]
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionImage_File_Execution_Options
push ecx
call edi
add esp, 8
lea edx, [ebp - 0xa14]
push edx
push 0xf003f
push 0
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
je 0x40e99f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0xa10]
push 0x440e88
push edx
call edi
lea eax, [ebp - 0xa10]
add esp, 0x14
push eax
call fcn.00406870
add esp, 4
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xa14]
push str.GCBClient.exe
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov edx, dword [ebp - 0xa14]
push edx
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
test esi, esi
sete al
pop edi
xor ecx, ebp
pop esi
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x40f0d0
Capabilities:
Connect network resource

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
xor esi, esi
xor eax, eax
push esi
push ebx
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
push edi
lea ecx, [ebp - 0x24]
push ecx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], esi
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
cmp eax, 0x4c3
jne 0x40f163
mov edx, dword [ebp + 8]
push 1
push esi
push edx
call dword [sym.imp.MPR.dll_WNetCancelConnection2W]
push esi
push ebx
push edi
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.MPR.dll_WNetAddConnection2W]
cmp eax, 0x4c3
je 0x40f16f
cmp eax, esi
je 0x40f16f
push eax
push 0x441274
push 0x48f198
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, esi
je 0x40f16f
push eax
push 0x4412a8
jmp 0x40f141
push 0x4412dc
call fcn.00406870
add esp, 4
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x40f1d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
mov esi, ecx
push 0x7fe
push eax
lea ecx, [ebp - 0x816]
push ecx
mov dword [ebp - 0x820], esi
mov word [ebp - 0x818], ax
call fcn.00428450
add esp, 0xc
push esi
push 0
push 0x43cb40
push str.ComputerNameList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov edi, eax
xor eax, eax
xor edx, edx
mov dword [ebp - 0x81c], edi
mov word [ebp - 0x14], dx
mov dword [ebp - 0x12], eax
mov dword [ebp - 0xe], eax
mov dword [ebp - 0xa], eax
mov word [ebp - 6], ax
cmp edi, 1
jge 0x40f252
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
push 0x4400
push 0
push 0x47bd40
call fcn.00428450
add esp, 0xc
mov dword [0x47bd40], edi
xor eax, eax
mov edi, edi
movzx ecx, word [eax + 0x43d31c]
mov word [eax + 0x47bd44], cx
add eax, 2
test cx, cx
jne 0x40f270
mov ebx, 1
cmp edi, ebx
jl 0x40f326
mov esi, 0x47bd84
push 0xa
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [esi], ebx
call fcn.00423125
mov ecx, dword [ebp - 0x820]
add esp, 0xc
push ecx
push 0x20
lea eax, [esi + 4]
push eax
push 0x43d31c
lea edx, [ebp - 0x14]
push edx
push str.ComputerNameList
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp dword [0x48ba88], 0
je 0x40f31a
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0x818]
rep stosd dword es:[edi], eax
lea eax, [esi + 4]
push eax
mov eax, dword [esi]
push eax
lea ecx, [ebp - 0x818]
push str._Debug__GetPcList___u__s
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x818]
push edx
call fcn.00406870
mov edi, dword [ebp - 0x81c]
add esp, 0x14
inc ebx
add esi, 0x44
cmp ebx, edi
jle 0x40f298
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x40fd60
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x3e
push eax
lea ecx, [ebp - 0x42]
push ecx
mov word [ebp - 0x44], ax
call fcn.00428450
add esp, 0xc
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 0x44]
push eax
mov dword [ebp - 0x48], 0x20
call dword [sym.imp.KERNEL32.dll_GetComputerNameW]
cmp eax, 1
jne 0x40fdc8
xor eax, eax
movzx ecx, word [ebp + eax - 0x44]
mov word [eax + 0x48f998], cx
add eax, 2
test cx, cx
jne 0x40fda1
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x4111d0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x280c
call fcn.0042d2a0
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1006]
push ecx
mov word [ebp - 0x1008], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x2006]
push eax
mov word [ebp - 0x2008], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x806]
push edx
mov word [ebp - 0x808], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x2806]
push ecx
mov word [ebp - 0x2808], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1806]
push eax
mov word [ebp - 0x1808], dx
call fcn.00428450
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push 0x4901d8
push 0x3fe
lea ecx, [ebp - 0x1008]
push ecx
push 0x43d31c
push 0x441e2c
push 0x441c38
call esi
push 0x4901d8
push 0x3fe
lea edx, [ebp - 0x2008]
push edx
push 0x43d31c
push str.Passphrase
push 0x441c38
call esi
lea eax, [ebp - 0x1008]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4112d3
sub eax, edx
sar eax, 1
je 0x41144d
lea ecx, [ebp - 0x2008]
lea esi, [ecx + 2]
mov dx, word [ecx]
add ecx, 2
test dx, dx
jne 0x4112f1
sub ecx, esi
sar ecx, 1
je 0x41144d
cmp eax, 0x90
jbe 0x411446
cmp ecx, 0x90
jbe 0x411446
lea edi, [ebp - 0x2808]
lea esi, [ebp - 0x2008]
call fcn.00407400
lea edi, [ebp - 0x808]
lea esi, [ebp - 0x1008]
call fcn.00407400
mov eax, edi
push 0x5c
push eax
call fcn.0042220c
add esp, 8
test eax, eax
je 0x4113bf
xor eax, eax
jmp 0x411360
movzx ecx, word [ebp + eax - 0x808]
mov word [ebp + eax - 0x1808], cx
add eax, 2
test cx, cx
jne 0x411360
lea ecx, [ebp - 0x1808]
push 0x5c
push ecx
call fcn.0042220c
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x808]
push 0x5c
push eax
call fcn.0042220c
add eax, 2
lea edx, [ebp - 0x808]
add esp, 0x10
sub edx, eax
jmp 0x4113b0
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x4113b0
lea eax, [ebp - 0x2808]
lea edx, [eax + 2]
jmp 0x4113d0
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4113d0
sub eax, edx
lea ecx, [ebp - 0x1808]
push ecx
sar eax, 1
push eax
lea edx, [ebp - 0x808]
push edx
push str.DispatchRange
push 0x48f198
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x48f198
call fcn.00406870
add esp, 4
push 0x48a870
lea edi, [ebp - 0x2808]
lea ebx, [ebp - 0x808]
call fcn.0040f0d0
add esp, 4
test eax, eax
je 0x41146a
mov eax, 1
mov dword [0x48986c], eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
push 0x441eb0
jmp 0x411452
push 0x441e50
push 0x48f198
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x48f198
call fcn.00406870
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x411480
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x280c
call fcn.0042d2a0
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x1006]
push ecx
mov word [ebp - 0x1008], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x2006]
push eax
mov word [ebp - 0x2008], dx
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0x806]
push edx
mov word [ebp - 0x808], cx
call fcn.00428450
add esp, 0xc
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x2806]
push ecx
mov word [ebp - 0x2808], ax
call fcn.00428450
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0x1806]
push eax
mov word [ebp - 0x1808], dx
call fcn.00428450
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
add esp, 0xc
push 0x4901d8
push 0x3fe
lea ecx, [ebp - 0x1008]
push ecx
push 0x43d31c
push 0x441e2c
push 0x441f74
call esi
push 0x4901d8
push 0x3fe
lea edx, [ebp - 0x2008]
push edx
push 0x43d31c
push str.Passphrase
push 0x441f74
call esi
lea eax, [ebp - 0x1008]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411583
sub eax, edx
sar eax, 1
cmp eax, 0x90
jbe 0x4116d8
lea eax, [ebp - 0x2008]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4115a6
sub eax, edx
sar eax, 1
cmp eax, 0x90
jbe 0x4116d8
lea edi, [ebp - 0x2808]
lea esi, [ebp - 0x2008]
call fcn.00407400
lea edi, [ebp - 0x808]
lea esi, [ebp - 0x1008]
call fcn.00407400
mov eax, edi
push 0x5c
push eax
call fcn.0042220c
add esp, 8
test eax, eax
je 0x41165f
xor eax, eax
jmp 0x411600
movzx ecx, word [ebp + eax - 0x808]
mov word [ebp + eax - 0x1808], cx
add eax, 2
test cx, cx
jne 0x411600
lea ecx, [ebp - 0x1808]
push 0x5c
push ecx
call fcn.0042220c
xor edx, edx
mov word [eax], dx
lea eax, [ebp - 0x808]
push 0x5c
push eax
call fcn.0042220c
add eax, 2
lea edx, [ebp - 0x808]
add esp, 0x10
sub edx, eax
jmp 0x411650
movzx ecx, word [eax]
mov word [edx + eax], cx
add eax, 2
test cx, cx
jne 0x411650
lea eax, [ebp - 0x2808]
lea edx, [eax + 2]
jmp 0x411670
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x411670
sub eax, edx
lea ecx, [ebp - 0x1808]
push ecx
sar eax, 1
push eax
lea edx, [ebp - 0x808]
push edx
push str.ServerLog
push 0x48f198
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x14
push 0x48f198
call fcn.00406870
add esp, 4
push 0x489660
lea edi, [ebp - 0x2808]
lea ebx, [ebp - 0x808]
call fcn.0040f0d0
add esp, 4
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
push 0x441f88
push 0x48f198
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x48f198
call fcn.00406870
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x411710
Capabilities:
Check os version
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x11c
lea eax, [ebp - 0x120]
push 0
push eax
mov dword [ebp - 0x130], 0
mov dword [ebp - 0x124], 0
call fcn.00428450
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov eax, dword [ebp - 0x11c]
cmp eax, 6
jb 0x411858
jne 0x411782
cmp dword [ebp - 0x118], 2
jb 0x411858
lea eax, [ebp - 0x130]
push eax
lea ecx, [ebp - 0x124]
push ecx
push 0
push 0xf003f
xor edx, edx
cmp byte [ebp + 8], 1
push 0
push 0
sete dl
push 0
push str.SYSTEMCurrentControlSetControlSession_ManagerPower
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x128], edx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x411858
lea edx, [ebp - 0x138]
push edx
mov edx, dword [ebp - 0x124]
mov dword [ebp - 0x12c], eax
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x134]
push ecx
push 0
push str.HiberbootEnabled
push edx
mov dword [ebp - 0x134], 4
mov dword [ebp - 0x138], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x411819
mov edx, dword [ebp - 0x12c]
cmp edx, dword [ebp - 0x128]
je 0x411838
mov ecx, dword [ebp - 0x124]
push 4
lea eax, [ebp - 0x128]
push eax
push 4
push 0
push str.HiberbootEnabled
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x411870
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48c
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00428450
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x48df60
lea edx, [ebp - 0x210]
push str._sPCScript.dat
push edx
call esi
add esp, 0xc
lea eax, [ebp - 0x470]
push eax
lea ecx, [ebp - 0x210]
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
cmp eax, 0xffffffff
jne 0x411909
lea edx, [ebp - 0x210]
push edx
push 0x442094
push 0x48f198
call esi
add esp, 0xc
push 0x48f198
call fcn.00406870
add esp, 4
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x45c]
mov edx, dword [ebp - 0x458]
push eax
mov dword [ebp - 0x47c], ecx
mov dword [ebp - 0x478], edx
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [ebp - 0x480]
push eax
lea ecx, [ebp - 0x474]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREPCScriptUpdateInfo
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x480], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x411989
push 0x4420f8
push 0x48f198
call esi
push 0x48f198
call fcn.00406870
add esp, 0xc
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x474]
push 8
lea edx, [ebp - 0x47c]
push edx
push 3
push 0
push str.ForceUpdateTime
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0x474]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea edx, [ebp - 0x488]
push edx
lea eax, [ebp - 0x47c]
push eax
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea ecx, [ebp - 0x220]
push ecx
lea edx, [ebp - 0x488]
push edx
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [ebp - 0x214]
movzx ecx, word [ebp - 0x216]
movzx edx, word [ebp - 0x218]
push eax
movzx eax, word [ebp - 0x21a]
push ecx
movzx ecx, word [ebp - 0x21e]
push edx
movzx edx, word [ebp - 0x220]
push eax
push ecx
push edx
push 0x442140
push 0x48f198
call esi
push 0x48f198
call fcn.00406870
mov ecx, dword [ebp - 4]
add esp, 0x24
xor ecx, ebp
pop esi
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x412d70
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x12c
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x48ceec]
push esi
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
push 0
push 0x1a
push 0x402
push eax
call esi
call fcn.004181b0
test eax, eax
jne 0x412db5
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
mov ecx, dword [0x48ceec]
push 0
push 0x1e
push 0x402
push ecx
call esi
push 0
call fcn.00418540
add esp, 4
call fcn.00418a00
mov edx, dword [0x48ceec]
push 0
push 0x1f
push 0x402
push edx
call esi
push str._Terminate_All_Process_.
call fcn.00406870
add esp, 4
call fcn.00419ec0
test al, al
je 0x412da4
mov eax, dword [0x48ceec]
push 0
push 0x2d
push 0x402
push eax
call esi
call fcn.00403ad0
test eax, eax
jne 0x412e3c
call fcn.00404850
test eax, eax
jne 0x412e3c
call fcn.00404980
test eax, eax
jne 0x412e3c
push str._Terminate_Driver_.
call fcn.00406870
add esp, 4
call fcn.00418e90
call fcn.0041a530
push 0x11c
lea ecx, [ebp - 0x128]
push 0
push ecx
call fcn.00428450
add esp, 0xc
lea edx, [ebp - 0x128]
push edx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x124], 6
jb 0x412e7c
call fcn.0041ab20
mov eax, dword [0x48ceec]
push 0
push 0x31
push 0x402
push eax
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov al, 1
pop esi
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x412ea0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe64
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push edi
push 0x103
lea edx, [ebp - 0x113]
push 0
push edx
mov dword [ebp - 0xe5c], eax
mov dword [ebp - 0xe58], ecx
mov byte [ebp - 0x114], 0
call fcn.00428450
add esp, 0xc
push 0x3ff
lea eax, [ebp - 0x513]
push 0
push eax
mov byte [ebp - 0x514], 0
call fcn.00428450
add esp, 0xc
xor ecx, ecx
push 0x7fe
push ecx
lea edx, [ebp - 0xd12]
push edx
mov word [ebp - 0xd14], cx
call fcn.00428450
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push esi
lea eax, [ebp - 0x114]
push str._s.EXE
push eax
call edi
add esp, 0xc
lea ecx, [ebp - 0xe54]
push ecx
lea edx, [ebp - 0x114]
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov ebx, eax
mov dword [ebp - 0xe60], ebx
cmp ebx, 0xffffffff
jne 0x412f70
xor eax, eax
pop edi
pop ebx
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
push 0x104
lea eax, [ebp - 0x114]
push 0
push eax
call fcn.00428450
add esp, 0xc
lea ecx, [ebp - 0xe28]
push ecx
push esi
lea edx, [ebp - 0x114]
push str._s_s
push edx
call edi
add esp, 0x10
push 0
lea eax, [ebp - 0x114]
push eax
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
test eax, eax
jne 0x41303d
lea ecx, [ebp - 0x114]
push ecx
lea edx, [ebp - 0x514]
push 0x442a48
push edx
call edi
lea eax, [ebp - 0xd14]
add esp, 0xc
push eax
lea ebx, [ebp - 0x514]
call fcn.0040d6a0
lea ecx, [ebp - 0xd14]
add esp, 4
push ecx
call fcn.00406870
add esp, 4
push 0x104
push 0
push 0x4903e8
call fcn.00428450
add esp, 0xc
xor eax, eax
jmp 0x413010
mov cl, byte [ebp + eax - 0x114]
mov byte [eax + 0x4903e8], cl
inc eax
test cl, cl
jne 0x413010
mov edx, dword [ebp - 0xe58]
mov ecx, dword [ebp - 0xe5c]
push esi
call fcn.0040e5b0
mov ebx, dword [ebp - 0xe60]
add esp, 4
lea edx, [ebp - 0xe54]
push edx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x412f70
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 8]
pop edi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.004217a4
mov esp, ebp
pop ebp
ret
Function at 0x4142e0
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x44c044]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x202]
push ecx
mov dword [ebp - 0x208], 0
mov dword [ebp - 0x20c], 0
mov word [ebp - 0x204], ax
call fcn.00428450
lea edx, [ebp - 0x204]
push str.SystemCurrentControlSetServicesWin_Win7
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
add esp, 0x14
lea eax, [ebp - 0x208]
push eax
push 0x2001f
push 0
lea ecx, [ebp - 0x204]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
je 0x4143cf
lea edx, [ebp - 0x20c]
push edx
lea eax, [ebp - 0x208]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x204]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x4143a0
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.004217a4
mov esp, ebp
pop ebp
ret
lea edx, [ebp - 0x208]
push edx
push 0xf003f
push 0
push 0
push reloc.OLEAUT32.dll_SysReAllocString
call esi
test eax, eax
jne 0x4143cf
mov ecx, dword [ebp - 0x208]
lea eax, [ebp - 0x204]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov eax, dword [ebp - 0x208]
test eax, eax
je 0x4143e0
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.004217a4
mov esp, ebp
pop ebp
ret