joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40afa6
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0xfdc]
mov eax, 0x105c
call fcn.0049b9f0
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp + 0xfd8], eax
push ebx
push esi
push edi
xor edi, edi
push edi
push edi
push str.ProxyEnable
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionInternet_Settings
push esi
call dword [sym.imp.SHLWAPI.dll_SHRegGetBoolUSValueW]
mov dword [ebp - 0x7c], eax
xor eax, eax
push 0x1046
mov word [ebp - 0x70], ax
xor ebx, ebx
lea eax, [ebp - 0x6e]
push edi
inc ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.0048e0e0
add esp, 0xc
push edi
push 0x4b8084
push edi
lea eax, [ebp - 0x80]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x78]
push eax
push str.AutoConfigURL
push esi
mov dword [ebp - 0x80], 0x823
mov dword [ebp - 0x74], edi
call sub.SHLWAPI.dll_SHRegGetUSValueW
test eax, eax
jne 0x40b033
cmp word [ebp - 0x70], di
je 0x40b033
mov dword [ebp - 0x74], ebx
cmp dword [ebp - 0x7c], edi
jne 0x40b041
cmp dword [ebp - 0x74], edi
jne 0x40b041
xor eax, eax
jmp 0x40b043
mov eax, ebx
mov ecx, dword [ebp + 0xfd8]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00488e60
add ebp, 0xfdc
leave
ret

Function at 0x40b0de
Capabilities:
Read file on windows

Disassembly:
push 0x28
mov eax, 0x4a8d5b
call fcn.00490b44
mov edi, ecx
xor esi, esi
push 0x4c42ec
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x34], edi
mov ebx, edx
mov dword [ebp - 0x30], esi
call fcn.0040218e
push 0x4c4e9c
lea eax, [ebp - 0x30]
push ebx
mov dword [ebp - 4], esi
push eax
mov dword [ebp - 0x30], esi
call fcn.0048b616
add esp, 0xc
test eax, eax
je 0x40b13c
lea eax, [ebp - 0x2c]
push eax
mov ecx, edi
call fcn.0040475f
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004045ec
mov eax, edi
jmp 0x40b1c3
push 2
push esi
push dword [ebp - 0x30]
call fcn.0048b6f3
push dword [ebp - 0x30]
call fcn.0048b915
push esi
push esi
push dword [ebp - 0x30]
mov ebx, eax
call fcn.0048b6f3
lea eax, [ebx + 1]
push eax
call fcn.00487d50
mov edi, eax
add esp, 0x20
cmp edi, esi
jne 0x40b177
push dword [ebp - 0x30]
call fcn.0048be9b
jmp 0x40b1a8
lea eax, [ebx + 1]
push eax
push esi
push edi
call fcn.0048e0e0
push dword [ebp - 0x30]
push ebx
push 1
push edi
call fcn.0048bc23
push dword [ebp - 0x30]
call fcn.0048be9b
add esp, 0x20
push edi
lea ecx, [ebp - 0x2c]
call fcn.0040216b
push edi
call fcn.00489298
pop ecx
mov ecx, dword [ebp - 0x34]
lea eax, [ebp - 0x2c]
push eax
call fcn.0040475f
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.004045ec
mov eax, dword [ebp - 0x34]
call fcn.00490bc7
ret
Function at 0x40b3de
Capabilities:
Create thread
Resume thread

Disassembly:
test ebx, ebx
je 0x40b47f
xor eax, eax
cmp ax, word [ebx]
je 0x40b47f
push esi
push 0x2214
push 8
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
test esi, esi
je 0x40b47e
push ebx
mov ecx, 0x104
mov edx, esi
call fcn.004025a1
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40b439
xor ecx, ecx
cmp cx, word [eax]
je 0x40b439
push eax
lea edx, [esi + 0x208]
mov ecx, 0x1000
call fcn.004025a1
mov eax, dword [esp + 8]
and dword [esi + 0x2210], 0
push 0
push 4
push esi
push 0x40b26e
mov dword [esi + 0x2208], eax
mov eax, dword [esp + 0x20]
push 0
push 0
mov dword [esi + 0x220c], eax
call fcn.0048a081
mov esi, eax
add esp, 0x18
test esi, esi
je 0x40b47e
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret

Function at 0x40b53e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x4f85ec], 0
push ebx
mov ebx, eax
je 0x40b558
test ebx, ebx
jne 0x40b607
push esi
push edi
push 4
pop eax
push 0x64
pop edi
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x4c4eb8
push str.Control_PanelDesktopWindowMetrics
push 0x80000001
mov dword [ebp - 4], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov esi, dword [sym.imp.KERNEL32.dll_MulDiv]
test eax, eax
jne 0x40b5d6
mov eax, dword [ebp - 4]
sub eax, 0x60
je 0x40b5d3
sub eax, 0x18
je 0x40b5ca
sub eax, 0x18
je 0x40b5c1
sub eax, 0x30
je 0x40b5b8
push 0x60
push edi
push dword [ebp - 4]
call esi
mov dword [ebp - 4], eax
jmp 0x40b5d6
mov dword [ebp - 4], 0xc8
jmp 0x40b5d6
mov dword [ebp - 4], 0x96
jmp 0x40b5d6
mov dword [ebp - 4], 0x7d
jmp 0x40b5d6
mov dword [ebp - 4], edi
mov eax, dword [ebp - 4]
test ebx, ebx
jne 0x40b5e9
test eax, eax
je 0x40b5e5
cmp eax, edi
jne 0x40b605
mov eax, edi
jmp 0x40b605
test eax, eax
jbe 0x40b603
cmp eax, edi
je 0x40b603
cmp byte [ebp + 8], 0
je 0x40b5fc
push eax
push ebx
push edi
jmp 0x40b5ff
push edi
push ebx
push eax
call esi
mov ebx, eax
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40b60a
Capabilities:
Get mac address on windows
Query or enumerate registry value

Disassembly:
push ebp
sub esp, 0x108
lea ebp, [esp - 4]
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp + 0x108], eax
push 0x1c
mov eax, 0x4a832f
call fcn.00490adb
mov ebx, ecx
mov esi, 0x288
push esi
mov dword [ebp - 0x1c], ebx
call fcn.00487d50
pop ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], esi
call sub.IPHLPAPI.DLL_GetAdaptersInfo
cmp eax, 0x6f
jne 0x40b682
mov eax, dword [ebp - 0x14]
dec eax
cmp eax, 0xfffe
ja 0x40b7e7
push dword [ebp - 0x18]
call fcn.00489298
push dword [ebp - 0x14]
call fcn.00487d50
pop ecx
pop ecx
lea ecx, [ebp - 0x14]
push ecx
push eax
mov dword [ebp - 0x18], eax
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
jne 0x40b7e7
mov esi, dword [ebp - 0x18]
jmp 0x40b7df
lea edi, [esi + 8]
test edi, edi
je 0x40b7dd
cmp byte [edi], 0
je 0x40b7dd
push str.SYSTEMCurrentControlSetControlNetwork4D36E972_E325_11CE_BFC1_08002BE10318_
lea eax, [ebp - 0x10]
push eax
call fcn.00405f88
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 0x10]
push eax
call fcn.0040742a
push str.Connection
lea eax, [ebp - 0x10]
push eax
call fcn.0040742a
mov eax, 0x104
push eax
mov dword [ebp - 0x28], eax
lea eax, [ebp + 1]
push 0
push eax
mov dword [ebp - 0x24], 1
mov byte [ebp], 0
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x24]
push eax
push str.PnPInstanceId
push dword [ebp - 0x10]
push 0x80000002
call dword [sym.imp.SHLWAPI.dll_SHGetValueA]
mov edi, dword [sym.imp.SHLWAPI.dll_StrCmpNIA]
push 3
push 0x4c4f88
lea eax, [ebp]
push eax
call edi
test eax, eax
je 0x40b73d
push 3
push 0x4c4f8c
lea eax, [ebp]
push eax
call edi
test eax, eax
jne 0x40b7ce
mov eax, dword [ebx]
xor edi, edi
cmp dword [eax - 0xc], edi
je 0x40b751
push 0x4c4f90
push ebx
call fcn.0040742a
cmp dword [esi + 0x190], edi
jbe 0x40b7c4
mov eax, dword [0x4f4a0c]
mov ecx, 0x4f4a0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], 1
movzx eax, byte [esi + edi + 0x194]
push eax
push str._.2X
lea eax, [ebp - 0x20]
call fcn.00406578
mov ebx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
pop ecx
pop ecx
push dword [ebx - 0xc]
push ebx
call fcn.004063b2
cmp edi, dword [esi + 0x190]
jae 0x40b7ac
push 0x4c4418
push dword [ebp - 0x1c]
call fcn.0040742a
lea eax, [ebx - 0x10]
mov byte [ebp - 4], 0
call fcn.00404bfa
inc edi
cmp edi, dword [esi + 0x190]
jb 0x40b759
mov ebx, dword [ebp - 0x1c]
lea eax, [esi + 8]
push eax
push ebx
call fcn.0040742a
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404bfa
mov esi, dword [esi]
test esi, esi
jne 0x40b692
push dword [ebp - 0x18]
call fcn.00489298
mov eax, dword [ebx]
pop ecx
xor ecx, ecx
cmp dword [eax - 0xc], ecx
setne cl
mov eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x108]
xor ecx, ebp
call fcn.00488e60
add ebp, 0x10c
leave
ret
Function at 0x40c4b1
Capabilities:
Set registry value

Disassembly:
push ebp
sub esp, 0x80
lea ebp, [esp - 4]
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp + 0x80], eax
push 8
mov eax, 0x4a86fe
call fcn.00490adb
mov eax, dword [0x4f4a0c]
mov esi, 0x4f4a0c
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
mov eax, dword [0x4f4a0c]
mov ecx, esi
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov byte [ebp - 4], 1
call fcn.0040b81f
mov ebx, dword [ebp - 0x14]
cmp dword [ebx - 0xc], 0
mov esi, dword [sym.imp.SHLWAPI.dll_SHSetValueW]
pop ecx
mov edi, 0x80000001
je 0x40c573
xor eax, eax
push 0x7e
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.0048e0e0
mov eax, dword [ebx - 0xc]
mov ecx, dword [ebp - 0x14]
push 0x3f
push eax
lea ebx, [ebp]
call fcn.00417983
add esp, 0x14
test eax, eax
je 0x40c573
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40c54f
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp]
push eax
push 1
push str.umid
push str.SoftwareJHotNews
push edi
call esi
lea ecx, [ebp - 0x10]
call fcn.0040c04a
mov ebx, dword [ebp - 0x10]
cmp dword [ebx - 0xc], 0
je 0x40c5d7
xor eax, eax
push 0x7e
push eax
mov word [ebp], ax
lea eax, [ebp + 2]
push eax
call fcn.0048e0e0
mov eax, dword [ebx - 0xc]
mov ecx, dword [ebp - 0x10]
push 0x3f
push eax
lea ebx, [ebp]
call fcn.00417983
add esp, 0x14
test eax, eax
je 0x40c5d7
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
inc eax
inc eax
test cx, cx
jne 0x40c5b3
sub eax, edx
sar eax, 1
add eax, eax
push eax
lea eax, [ebp]
push eax
push 1
push 0x4b8084
push str.SoftwareJHotNews
push edi
call esi
mov eax, dword [ebp - 0x14]
add eax, 0xfffffff0
call fcn.00404bfa
mov eax, dword [ebp - 0x10]
add eax, 0xfffffff0
call fcn.00404bfa
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x80]
xor ecx, ebp
call fcn.00488e60
add ebp, 0x84
leave
ret
Function at 0x40c653
Capabilities:
Create thread
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x70]
sub esp, 0x9c
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp + 0x6c], eax
mov eax, dword [ebp + 0x78]
push ebx
xor ebx, ebx
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], ebx
cmp eax, ebx
je 0x40c776
push esi
push edi
push 0x7e
pop edi
xor eax, eax
push edi
mov word [ebp - 0x14], ax
lea eax, [ebp - 0x12]
push ebx
push eax
call fcn.0048e0e0
xor esi, esi
inc esi
add esp, 0xc
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
cmp dword [ebp + 0x7c], ebx
jne 0x40c6d2
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4b8084
push str.SoftwareJHotNews
push 0x80000001
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40c6d2
cmp word [ebp - 0x14], bx
jne 0x40c756
push ebx
push ebx
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
lea ecx, [ebp - 0x2c]
push ecx
push ebx
push eax
push 0x40c610
push ebx
push ebx
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x2c], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x493e0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x40c747
push 0x80
lea eax, [ebp - 0x14]
push ebx
push eax
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
push eax
push 0x4b8084
push str.SoftwareJHotNews
push 0x80000001
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp word [ebp - 0x14], bx
je 0x40c76f
lea eax, [ebp - 0x14]
push eax
push 0x4c2d64
push 0x40
push dword [ebp - 0x28]
call fcn.00488ec0
add esp, 0x10
mov dword [ebp - 0x20], esi
mov eax, dword [ebp - 0x20]
pop edi
pop esi
jmp 0x40c778
xor eax, eax
mov ecx, dword [ebp + 0x6c]
xor ecx, ebp
pop ebx
call fcn.00488e60
add ebp, 0x70
leave
ret
Function at 0x40cd84
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x144
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
push edi
push 0x118
xor edi, edi
lea eax, [ebp - 0xa4]
push edi
push eax
mov dword [ebp - 0xa8], 0x11c
call fcn.0048e0e0
mov esi, dword [sym.imp.KERNEL32.dll_GetVersionExW]
add esp, 0xc
lea eax, [ebp - 0xa8]
push eax
call esi
test eax, eax
jne 0x40cdea
lea eax, [ebp - 0xa8]
push eax
mov dword [ebp - 0xa8], 0x114
call esi
test eax, eax
je 0x40cea5
mov eax, dword [ebp - 0x98]
sub eax, edi
je 0x40cea5
dec eax
je 0x40cea5
dec eax
jne 0x40cea5
mov eax, dword [ebp - 0xa4]
cmp eax, 0xa
jne 0x40ce24
cmp dword [ebp - 0xa0], edi
jne 0x40cea5
mov al, 5
jmp 0x40cea7
cmp eax, 6
jne 0x40ce4c
mov eax, dword [ebp - 0xa0]
cmp eax, 2
je 0x40ce39
cmp eax, 3
jne 0x40ce3d
mov al, 3
jmp 0x40cea7
cmp eax, 1
jne 0x40ce46
mov al, 2
jmp 0x40cea7
cmp eax, edi
jne 0x40cea5
jmp 0x40ce42
cmp eax, 5
jne 0x40cea5
cmp dword [ebp - 0xa0], 2
jne 0x40ce9a
push 8
pop ecx
xor eax, eax
mov dword [ebp - 0xcc], 0x24
lea edi, [ebp - 0xc8]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0xcc]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
push 0x59
call dword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x40cea5
cmp byte [ebp + 0x72], 1
jne 0x40cea5
cmp word [ebp - 0xcc], 9
jmp 0x40cea1
cmp dword [ebp - 0xa0], 1
mov al, 1
je 0x40cea7
mov al, 4
mov ecx, dword [ebp + 0x74]
pop edi
xor ecx, ebp
pop esi
call fcn.00488e60
add ebp, 0x78
leave
ret

Function at 0x40cf0c
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
mov dword [ebp - 0x294], eax
xor eax, eax
mov esi, 0x208
push esi
push eax
mov word [ebp - 0x290], ax
lea eax, [ebp - 0x28e]
push eax
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x29c]
push eax
lea eax, [ebp - 0x290]
push eax
lea eax, [ebp - 0x298]
push eax
push 0x4b8084
push str.CLSIDD27CDB6E_AE6D_11cf_96B8_444553540000InprocServer32
push 0x80000000
mov dword [ebp - 0x298], 1
mov dword [ebp - 0x29c], esi
call dword [sym.imp.SHLWAPI.dll_SHGetValueW]
test eax, eax
jne 0x40d015
lea eax, [ebp - 0x290]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d015
push ebx
push edi
xor eax, eax
push 0x7e
push eax
mov word [ebp - 0x84], ax
lea eax, [ebp - 0x82]
push eax
call fcn.0048e0e0
add esp, 0xc
push 0x3f
pop ebx
lea esi, [ebp - 0x84]
lea edi, [ebp - 0x290]
call fcn.0041dd5a
pop edi
pop ebx
test eax, eax
je 0x40d015
mov eax, esi
push 0x2e
push eax
call fcn.0048b20b
pop ecx
pop ecx
test eax, eax
je 0x40d015
add eax, 2
push 0x2e
push eax
call fcn.0048b20b
pop ecx
pop ecx
test eax, eax
je 0x40d015
xor ecx, ecx
mov word [eax], cx
mov eax, esi
push eax
push 0x4c2d64
push 0x40
push dword [ebp - 0x294]
call fcn.00488ec0
xor eax, eax
add esp, 0x10
inc eax
jmp 0x40d017
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00488e60
leave
ret
Function at 0x40d0cb
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d0ef
xor eax, eax
jmp 0x40d1e6
mov eax, 0xcd44
mov word [ebp - 0x10], ax
mov eax, 0x11d0
mov word [ebp - 0xe], ax
xor eax, eax
lea edi, [ebp - 0x30]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 0x10
pop edi
xor ebx, ebx
push 0x30
lea eax, [ebp - 0x60]
push ebx
push eax
mov dword [ebp - 0x14], 0xaac56b
mov byte [ebp - 0xc], 0x8c
mov byte [ebp - 0xb], 0xc2
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], 0xc0
mov byte [ebp - 8], 0x4f
mov byte [ebp - 7], 0xc2
mov byte [ebp - 6], 0x95
mov byte [ebp - 5], 0xee
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x2c], esi
call fcn.0048e0e0
lea eax, [ebp - 0x30]
add esp, 0xc
mov dword [ebp - 0x48], eax
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x14]
push eax
push ebx
mov dword [ebp - 0x60], 0x30
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x54], 2
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x44], 3
mov dword [ebp - 0x38], edi
call sub.WINTRUST.dll_WinVerifyTrust
test eax, eax
jl 0x40d189
xor eax, eax
inc eax
jmp 0x40d1e6
push ebx
push ebx
lea eax, [ebp - 0x18]
push eax
call sub.WINTRUST.dll_CryptCATAdminAcquireContext
test eax, eax
je 0x40d0e8
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push esi
xor edi, edi
call fcn.0040d024
add esp, 0xc
test eax, eax
je 0x40d1db
push ebx
push ebx
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push dword [ebp - 0x18]
call sub.WINTRUST.dll_CryptCATAdminEnumCatalogFromHash
cmp eax, ebx
je 0x40d1d2
push ebx
push eax
push dword [ebp - 0x18]
inc edi
call sub.WINTRUST.dll_CryptCATAdminReleaseCatalogContext
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_LocalFree]
push ebx
push dword [ebp - 0x18]
call sub.WINTRUST.dll_CryptCATAdminReleaseContext
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00488e60
leave
ret
Function at 0x40d561
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x40d662
push str.NtQueryInformationProcess
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 3
cmp eax, ebx
je 0x40d662
mov dword [ebp - 0x30], ebx
xor eax, eax
lea edi, [ebp - 0x2c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x14], ebx
stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 8], esi
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0xc], ebx
cmp eax, ebx
je 0x40d60c
push eax
push ebx
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
cmp edi, ebx
je 0x40d60c
lea eax, [ebp - 0x14]
push eax
push 0x18
lea eax, [ebp - 0x30]
push eax
push ebx
push edi
call dword [ebp - 0x18]
push edi
mov dword [ebp - 0x10], eax
call esi
cmp dword [ebp - 0x10], ebx
jne 0x40d662
mov eax, dword [ebp - 0x1c]
cmp eax, ebx
je 0x40d611
mov ecx, dword [ebp - 8]
inc dword [ebp - 0xc]
add dword [ebp - 8], 0xc
cmp dword [ebp - 0xc], 2
mov dword [ecx], eax
jl 0x40d5c2
cmp dword [ebp - 0x10], ebx
jne 0x40d662
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov edi, eax
cmp edi, ebx
je 0x40d65d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 8]
push eax
push ebx
lea eax, [ebp - 0x24]
push eax
push 0x40d1f4
push ebx
push ebx
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x1c], edi
mov dword [ebp + 8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call esi
push 0x493e0
push edi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push edi
call esi
xor eax, eax
inc eax
jmp 0x40d664
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40d7dc
Capabilities:
Check if file exists
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x19c]
sub esp, 0x21c
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp + 0x198], eax
mov eax, dword [ebp + 0x1a4]
push edi
xor edi, edi
mov dword [ebp - 0x80], eax
mov dword [ebp - 0x7c], edi
cmp eax, edi
je 0x40d8d6
push ebx
push esi
xor eax, eax
mov esi, 0x206
push esi
mov word [ebp - 0x70], ax
lea eax, [ebp - 0x6e]
push edi
push eax
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
push edi
mov edi, dword [sym.imp.SHLWAPI.dll_SHGetValueW]
mov ebx, str.SoftwareMicrosoftWindowsCurrentVersionApp_PathsJHotNews.exe
push ebx
push 0x80000001
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x78], esi
call edi
test eax, eax
jne 0x40d865
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x40d8a1
cmp dword [0x4f85c8], 0
jne 0x40d8a1
push 0x208
lea eax, [ebp - 0x70]
push 0
push eax
call fcn.0048e0e0
add esp, 0xc
lea eax, [ebp - 0x78]
push eax
lea eax, [ebp - 0x70]
push eax
lea eax, [ebp - 0x74]
push eax
push 0
push ebx
push 0x80000002
mov dword [ebp - 0x74], 1
mov dword [ebp - 0x78], esi
call edi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
pop esi
pop ebx
test eax, eax
je 0x40d8d1
lea eax, [ebp - 0x70]
push eax
push 0x4c2d64
push 0x102
push dword [ebp - 0x80]
mov dword [ebp - 0x7c], 1
call fcn.00488ec0
add esp, 0x10
mov eax, dword [ebp - 0x7c]
jmp 0x40d8d8
xor eax, eax
mov ecx, dword [ebp + 0x198]
xor ecx, ebp
pop edi
call fcn.00488e60
add ebp, 0x19c
leave
ret

Function at 0x40d8ee
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x4dbc40]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x80000002
push edi
xor edi, edi
mov dword [ebp - 0x234], eax
mov dword [ebp - 0x230], str.SOFTWAREHintsoft
mov dword [ebp - 0x22c], eax
mov dword [ebp - 0x228], str.SOFTWARESicent
mov dword [ebp - 0x224], eax
mov dword [ebp - 0x220], str.SOFTWAREGoyoo
mov dword [ebp - 0x21c], eax
mov dword [ebp - 0x218], str.SOFTWARE_
xor esi, esi
lea eax, [ebp - 0x214]
push eax
push 1
push edi
push dword [ebp + esi*8 - 0x230]
mov dword [ebp - 0x214], edi
push dword [ebp + esi*8 - 0x234]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40d9e0
inc esi
cmp esi, 4
jb 0x40d94c
xor eax, eax
push 0x206
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push edi
push eax
call fcn.0048e0e0
add esp, 0xc
push 0x103
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push 0x4c60d4
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x40d9d0
xor edi, edi
inc edi
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.00488e60
leave
ret
push dword [ebp - 0x214]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x40d9cd
Function at 0x40d9ee
Capabilities:
Get common file path

Disassembly:
push 0x218
mov eax, 0x4aa48f
call fcn.00490b44
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0x224], eax
cmp eax, edi
je 0x40db05
xor eax, eax
push 0x206
mov word [ebp - 0x218], ax
lea eax, [ebp - 0x216]
push edi
push eax
xor esi, esi
call fcn.0048e0e0
lea eax, [ebp - 0x218]
add esp, 0xc
push eax
call fcn.0040d7dc
pop ecx
test eax, eax
jne 0x40da54
push 0x103
lea eax, [ebp - 0x218]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push dword [ebp - 0x218]
call fcn.0048c0c2
pop ecx
test eax, eax
jne 0x40da9b
push 0x208
lea eax, [ebp - 0x218]
push edi
push eax
call fcn.0048e0e0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x218]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push dword [ebp - 0x218]
call fcn.0048c0c2
pop ecx
test eax, eax
je 0x40daa2
movzx esi, word [ebp - 0x218]
mov eax, dword [0x4f4a0c]
mov ecx, 0x4f4a0c
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x220], eax
push esi
lea eax, [ebp - 0x219]
push eax
lea ebx, [ebp - 0x220]
mov dword [ebp - 4], edi
call fcn.00409839
mov esi, dword [ebp - 0x220]
test eax, eax
je 0x40daf9
cmp dword [esi - 0xc], edi
je 0x40daf9
push esi
push 0x4c2d64
push 0x102
push dword [ebp - 0x224]
call fcn.00488ec0
xor edi, edi
add esp, 0x10
inc edi
lea eax, [esi - 0x10]
call fcn.00404bfa
mov eax, edi
jmp 0x40db07
xor eax, eax
call fcn.00490bc7
ret