joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4046b0
Capabilities:
Delete file
Get common file path
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x644
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20a]
push ecx
mov word [ebp - 0x20c], ax
call fcn.00413700
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x412]
push eax
mov word [ebp - 0x414], dx
call fcn.00413700
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x61a]
push edx
mov word [ebp - 0x61c], cx
call fcn.00413700
add esp, 0x24
push 0x104
lea eax, [ebp - 0x61c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x61c]
push ecx
lea edx, [ebp - 0x20c]
push str._spcinfo7.exe
push edx
call esi
lea eax, [ebp - 0x414]
push str.C:Program_FilesWW2017CF
push eax
call esi
add esp, 0x14
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40477b
lea ecx, [ebp - 0x644]
push ecx
call eax
movzx eax, word [ebp - 0x644]
mov ebx, dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x4047ef
cmp eax, 9
jne 0x4047ef
push edi
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push str.Kernel32.dll
mov dword [ebp - 0x620], 0
call edi
mov esi, eax
test esi, esi
je 0x4047d3
push str.Wow64DisableWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea edx, [ebp - 0x620]
push edx
call eax
push esi
test eax, eax
jne 0x40484f
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x80
lea edx, [ebp - 0x20c]
push edx
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
pop edi
push 0x80
lea ecx, [ebp - 0x20c]
push ecx
call ebx
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edx, [ebp - 0x20c]
push edx
call esi
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push str._sWM7Ldr.exe
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x80
lea edx, [ebp - 0x20c]
push edx
call ebx
lea eax, [ebp - 0x20c]
push eax
call esi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push 0x80
lea eax, [ebp - 0x20c]
push eax
call ebx
lea ecx, [ebp - 0x20c]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push str.Kernel32.dll
call edi
mov esi, eax
test esi, esi
je 0x4047ee
push str.Wow64RevertWow64FsRedirection
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0
call eax
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x4047ee
Function at 0x404cb0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa40
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x806]
push ecx
mov word [ebp - 0x808], ax
call fcn.00413700
add esp, 0xc
push 0x228
lea edx, [ebp - 0xa34]
push 0
push edx
mov dword [ebp - 0xa3c], 1
mov dword [ebp - 0xa38], 0x22c
call fcn.00413700
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0xa38]
push eax
push esi
mov dword [ebp - 0xa40], esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x404e47
mov ebx, dword [sym.imp.USER32.dll_wsprintfW]
jmp 0x404d40
lea ecx, [ebp - 0xa14]
push edi
push ecx
call fcn.0040f6de
add esp, 8
test eax, eax
jne 0x404e31
mov edx, dword [ebp - 0xa30]
push edx
push 1
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov eax, dword [ebp - 0xa30]
push eax
push esi
push edi
lea ecx, [ebp - 0x808]
push 0x41d690
push ecx
call ebx
lea edx, [ebp - 0x808]
add esp, 0x14
push edx
call fcn.00402950
add esp, 4
push 9
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x1388
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x404dd3
push edi
lea eax, [ebp - 0x808]
push 0x41d6d4
push eax
call ebx
lea ecx, [ebp - 0x808]
add esp, 0xc
push ecx
call fcn.00402950
add esp, 4
jmp 0x404e1c
cmp eax, 0x102
jne 0x404df3
push eax
push edi
lea edx, [ebp - 0x808]
push 0x41d6ec
push edx
call ebx
lea eax, [ebp - 0x808]
push eax
jmp 0x404e0a
push eax
push edi
lea ecx, [ebp - 0x808]
push 0x41d730
push ecx
call ebx
lea edx, [ebp - 0x808]
push edx
call fcn.00402950
mov dword [ebp - 0xa3c], 0
add esp, 0x14
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, dword [ebp - 0xa40]
lea eax, [ebp - 0xa38]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x404d40
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xa3c]
pop esi
xor ecx, ebp
pop ebx
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
Function at 0x4052e0
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x240
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0x103
lea ecx, [ebp - 0x23b]
push 0
push ecx
mov dword [ebp - 0x240], eax
mov byte [ebp - 0x23c], 0
call fcn.00413700
push 0x103
lea edx, [ebp - 0x137]
push 0
push edx
mov byte [ebp - 0x138], 0
call fcn.00413700
xor eax, eax
add esp, 0x18
mov dword [ebp - 0x33], eax
mov dword [ebp - 0x2f], eax
mov dword [ebp - 0x2b], eax
mov dword [ebp - 0x27], eax
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov word [ebp - 0x17], ax
mov byte [ebp - 0x15], al
mov byte [ebp - 0x14], al
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
push 0x104
lea eax, [ebp - 0x23c]
push eax
mov byte [ebp - 0x34], 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ebx, dword [sym.imp.USER32.dll_wsprintfA]
mov esi, dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xor edi, edi
jmp 0x405390
push 0x104
lea ecx, [ebp - 0x138]
push 0
push ecx
call fcn.00413700
push edi
lea edx, [ebp - 0x23c]
push edx
lea eax, [ebp - 0x138]
push str._sinfoem_i.inf
push eax
call ebx
add esp, 0x1c
lea ecx, [ebp - 0x138]
push ecx
push 0x20
xor eax, eax
lea edx, [ebp - 0x34]
push edx
push 0x41c2c1
push 0x41d8a8
push str.Strings
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
call esi
test eax, eax
je 0x405465
lea eax, [ebp - 0x34]
push str.SunMoon_Rise
push eax
call fcn.00419034
add esp, 8
test eax, eax
jne 0x405465
lea ecx, [ebp - 0x138]
push ecx
push 0x10
lea edx, [ebp - 0x14]
push edx
push 0x41c2c1
push str.DriverName
push str.Strings
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
call esi
test eax, eax
je 0x405465
lea eax, [ebp - 0x14]
push str.WM7F
push eax
call fcn.00419034
add esp, 8
test eax, eax
jne 0x405465
lea ecx, [ebp - 0x138]
push 0x5c
push ecx
call fcn.00410150
add esp, 8
test eax, eax
jne 0x405485
inc edi
cmp edi, 0x3e7
jl 0x405390
pop edi
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x240]
push 0xc
inc eax
push eax
push edx
call fcn.0040fa50
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
Function at 0x4054b0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x41d8d0
call fcn.00402950
xor eax, eax
add esp, 4
xor ebx, ebx
push 0x3e
lea ecx, [ebp - 0x66]
push ebx
push ecx
mov byte [ebp - 0x24], bl
mov dword [ebp - 0x23], eax
mov dword [ebp - 0x1f], eax
mov dword [ebp - 0x1b], eax
mov dword [ebp - 0x17], eax
mov dword [ebp - 0x13], eax
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov word [ebp - 7], ax
mov byte [ebp - 5], al
mov word [ebp - 0x68], ax
call fcn.00413700
add esp, 0xc
push 0x3fe
lea eax, [ebp - 0x56e]
xor edx, edx
push ebx
push eax
mov word [ebp - 0x570], dx
call fcn.00413700
add esp, 0xc
push 0x103
lea ecx, [ebp - 0x16f]
push ebx
push ecx
mov byte [ebp - 0x170], bl
call fcn.00413700
lea edx, [ebp - 0x24]
add esp, 0xc
push edx
call fcn.004052e0
add esp, 4
test eax, eax
je 0x40564f
lea eax, [ebp - 0x68]
push eax
lea ebx, [ebp - 0x24]
call fcn.00402070
add esp, 4
lea ecx, [ebp - 0x68]
push ecx
lea edx, [ebp - 0x570]
push str.PnP___s__Exist.
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x570]
add esp, 0xc
push eax
call fcn.00402950
add esp, 4
mov ecx, ebx
push ecx
lea edx, [ebp - 0x170]
push str.pnputil.exe__f__d__s
push edx
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4055c8
lea ecx, [ebp - 0x594]
push ecx
call eax
movzx eax, word [ebp - 0x594]
test eax, eax
je 0x405603
cmp eax, 9
jne 0x405603
call fcn.00402370
push 0
cmp eax, 1
jne 0x4055fa
lea edx, [ebp - 0x170]
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
call fcn.004023d0
jmp 0x405614
lea eax, [ebp - 0x170]
push eax
jmp 0x40560c
push 0
lea ecx, [ebp - 0x170]
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
cmp esi, 0x1f
jbe 0x405636
lea edx, [ebp - 0x24]
push edx
call fcn.004052e0
add esp, 4
test eax, eax
je 0x405648
push str.PnP_Delete_Fail___
call fcn.00402950
add esp, 4
xor al, al
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
push str.PnP_Delete_Success___
jmp 0x405654
push str.PnP_oemX.inf_not_Exist.
call fcn.00402950
mov ecx, dword [ebp - 4]
add esp, 4
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
Function at 0x406db0
Capabilities:
Check os version
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xb3c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00413700
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0xa0e]
push eax
mov dword [ebp - 0xb3c], 0
mov word [ebp - 0xa10], dx
call fcn.00413700
add esp, 0xc
lea ecx, [ebp - 0xb3c]
push ecx
lea edx, [ebp - 0xb34]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
push str.systemcurrentcontrolset_servicesWin_Win7
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov esi, eax
test esi, esi
je 0x406e75
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
lea eax, [ebp - 0xa10]
push 0x41df40
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0xa10]
push ecx
call fcn.00402950
add esp, 0x14
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
push 0x11c
lea edx, [ebp - 0xb30]
push 0
push edx
mov dword [ebp - 0xb38], 3
call fcn.00413700
add esp, 0xc
lea eax, [ebp - 0xb30]
push eax
mov dword [ebp - 0xb30], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0xb2c], 6
mov eax, dword [ebp - 0xb34]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 4
lea edx, [ebp - 0xb38]
push edx
push 4
push 0
sbb ecx, ecx
push str.Start
add ecx, 3
push eax
mov dword [ebp - 0xb38], ecx
call esi
xor eax, eax
movzx ecx, word [eax + 0xf9c150]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x406ee1
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x406f01
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0xb34]
push ecx
lea edx, [ebp - 0x210]
push edx
push 1
push 0
push str.Version
push eax
call esi
mov ecx, dword [ebp - 0xb34]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
Function at 0x406f50
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa18
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov dword [ebp - 0xa18], 0
mov word [ebp - 0x210], ax
call fcn.00413700
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0xa0e]
push eax
mov word [ebp - 0xa10], dx
call fcn.00413700
add esp, 0xc
xor eax, eax
jmp 0x406fb0
movzx ecx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionUninstall_]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x406fb0
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0xa10]
push 0x41e048
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0xa10]
add esp, 0xc
push eax
call fcn.00402950
add esp, 4
lea ecx, [ebp - 0xa18]
push ecx
lea edx, [ebp - 0xa14]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [ebp - 0x210]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40708e
jmp 0x407030
movzx ecx, word [eax + 0xf9c150]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x407030
lea eax, [ebp - 0x210]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407050
sub eax, edx
sar eax, 1
lea ecx, [eax + eax + 2]
mov eax, dword [ebp - 0xa14]
push ecx
lea edx, [ebp - 0x210]
push edx
push 1
push 0
push str.DisplayVersion
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xa14]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
Function at 0x4070b0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa8c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x24e]
push ecx
mov dword [ebp - 0xa68], 0
mov word [ebp - 0x250], ax
call fcn.00413700
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0xa4e]
push eax
mov word [ebp - 0xa50], dx
call fcn.00413700
add esp, 0xc
xor ecx, ecx
push 0x3e
push ecx
lea edx, [ebp - 0x46]
push edx
mov word [ebp - 0x48], cx
call fcn.00413700
add esp, 0xc
lea eax, [ebp - 0xa60]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0xa5a]
movzx edx, word [ebp - 0xa5e]
movzx eax, word [ebp - 0xa60]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push ecx
push edx
push eax
lea ecx, [ebp - 0x48]
push str._04u_02u_02u
push ecx
call esi
add esp, 0x14
xor eax, eax
lea ebx, [ebx]
movzx ecx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionUninstallWinMaster7_Console]
mov word [ebp + eax - 0x250], cx
add eax, 2
test cx, cx
jne 0x407160
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0xa50]
push 0x41e048
push eax
call esi
lea ecx, [ebp - 0xa50]
add esp, 0xc
push ecx
call fcn.00402950
add esp, 4
push str.GetNativeSystemInfo
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x4071c2
lea edx, [ebp - 0xa8c]
push edx
call eax
movzx eax, word [ebp - 0xa8c]
test eax, eax
je 0x4071d2
cmp eax, 9
je 0x4071e9
lea eax, [ebp - 0xa68]
push eax
lea ecx, [ebp - 0xa64]
push ecx
push 0
push 0xf003f
jmp 0x4071fe
lea eax, [ebp - 0xa68]
push eax
lea ecx, [ebp - 0xa64]
push ecx
push 0
push 0xf013f
push 0
push 0
push 0
lea edx, [ebp - 0x250]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x4072da
mov edi, edi
movzx ecx, word [eax + 0xf9c150]
mov word [ebp + eax - 0x250], cx
add eax, 2
test cx, cx
jne 0x407220
lea eax, [ebp - 0x250]
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x407240
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
sub eax, edx
mov edx, dword [ebp - 0xa64]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x250]
push ecx
push 1
push 0
push str.DisplayVersion
push edx
call esi
xor eax, eax
jmp 0x407280
movzx ecx, word [ebp + eax - 0x48]
mov word [ebp + eax - 0x250], cx
add eax, 2
test cx, cx
jne 0x407280
lea eax, [ebp - 0x250]
lea edx, [eax + 2]
mov edi, edi
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4072a0
sub eax, edx
mov edx, dword [ebp - 0xa64]
sar eax, 1
lea eax, [eax + eax + 2]
push eax
lea ecx, [ebp - 0x250]
push ecx
push 1
push 0
push str.InstallDate
push edx
call esi
mov eax, dword [ebp - 0xa64]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
Function at 0x4072f0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa6c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00413700
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0xa0e]
push eax
mov word [ebp - 0xa10], dx
call fcn.00413700
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push str.C:UsersPublicSMR7WM7installTemp
lea ecx, [ebp - 0x210]
push str.__swmcUpdater.exe___smr_inst
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x210]
push edx
lea eax, [ebp - 0xa10]
push 0x41e1cc
push eax
call esi
lea ecx, [ebp - 0xa10]
add esp, 0xc
push ecx
call fcn.00402950
add esp, 4
push 0x44
lea edx, [ebp - 0xa68]
push 0
push edx
call fcn.00413700
add esp, 0xc
xor eax, eax
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0xa18], eax
mov dword [ebp - 0xa14], eax
lea eax, [ebp - 0xa20]
push eax
lea ecx, [ebp - 0xa68]
push ecx
push 0
push 0
push 0x20
push 0
push 0
push 0
lea edx, [ebp - 0x210]
push edx
push 0
mov dword [ebp - 0xa68], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407411
mov eax, dword [ebp - 0xa20]
push 0x2710
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov ecx, dword [ebp - 0xa1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [ebp - 0xa20]
push edx
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040f51e
mov esp, ebp
pop ebp
ret

Function at 0x407420
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa6c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00413700
add esp, 0xc
xor edx, edx
push 0x7fe
push edx
lea eax, [ebp - 0xa0e]
push eax
mov word [ebp - 0xa10], dx
call fcn.00413700
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0xf9a0f0
lea ecx, [ebp - 0x210]
push str.__swmcUpdater.exe___smr_stop
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0xa10]
push 0x41e234
push edx
call esi
lea eax, [ebp - 0xa10]
push eax
call fcn.00402950
add esp, 0xc
push 0x44
lea ecx, [ebp - 0xa68]
push 0
push ecx
call fcn.00413700
add esp, 0xc
xor eax, eax
lea edx, [ebp - 0xa20]
push edx
mov dword [ebp - 0xa20], eax
mov dword [ebp - 0xa1c], eax
mov dword [ebp - 0xa18], eax
mov dword [ebp - 0xa14], eax
lea eax, [ebp - 0xa68]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push 0
mov dword [ebp - 0xa68], 0x44
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x407537
mov edx, dword [ebp - 0xa20]
push 0x2710
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0xa1c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call esi
mov ecx, dword [ebp - 0xa20]
push ecx
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
Function at 0x407550
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa1c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x7fe
mov esi, ecx
push eax
lea ecx, [ebp - 0xa0e]
push ecx
mov word [ebp - 0xa10], ax
call fcn.00413700
add esp, 0xc
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20e]
push eax
mov word [ebp - 0x210], dx
call fcn.00413700
add esp, 0xc
push 0x3ff
lea ecx, [ebp - 0xa10]
push esi
push ecx
call fcn.0040f8f5
lea eax, [ebp - 0xa10]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x4075c0
sub eax, edx
sar eax, 1
lea esi, [eax + eax]
xor eax, eax
jmp 0x4075e0
movzx ecx, word [eax + str.systemcurrentcontrolset_services_]
mov word [ebp + eax - 0x210], cx
add eax, 2
test cx, cx
jne 0x4075e0
lea eax, [ebp - 0x210]
add eax, 0xfffffffe
mov cx, word [eax + 2]
add eax, 2
test cx, cx
jne 0x407600
mov edx, dword [0x41e2a0]
mov ecx, dword [0x41e2a4]
mov dword [eax], edx
mov edx, dword [0x41e2a8]
mov dword [eax + 4], ecx
mov ecx, dword [0x41e2ac]
mov dword [eax + 8], edx
mov edx, dword [0x41e2b0]
mov dword [eax + 0xc], ecx
mov cx, word [0x41e2b4]
mov dword [eax + 0x10], edx
mov word [eax + 0x14], cx
lea edx, [ebp - 0xa18]
push edx
lea eax, [ebp - 0xa14]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
lea ecx, [ebp - 0x210]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x407692
push 0x41e2b8
call fcn.00402950
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0xa14]
push esi
lea edx, [ebp - 0xa10]
push edx
push 1
push 0
push str.LastRestartExecuteFileTime
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x4076df
push 0x41e2f4
call fcn.00402950
mov ecx, dword [ebp - 0xa14]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040f51e
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0xa14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040f51e
mov esp, ebp
pop ebp
ret