joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443e80
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670260
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x81c
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x820], ebx
push 4
call fcn.00441890
lea eax, [ebp - 0x820]
push eax
push 9
push ebx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockAccessOfExecutablesOnUSBDrive_ExclusionList
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x18
mov esi, eax
cmp esi, ebx
je 0x443f35
lea ecx, [ebp - 0x820]
push ecx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockAccessOfExecutablesOnUSBDrive_ExclusionList
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov esi, eax
cmp esi, ebx
jne 0x443f35
mov edx, dword [ebp - 0x820]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x820]
push eax
push 9
push ebx
push str.SoftwareMicroWorldeScan_For_WindowsMwMonitorBlockAccessOfExecutablesOnUSBDrive_ExclusionList
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x14
mov esi, eax
mov eax, dword [0x72c288]
cmp eax, ebx
je 0x443f4d
push eax
call fcn.005e0865
add esp, 4
mov dword [0x72c288], ebx
cmp esi, ebx
jne 0x443ffe
mov byte [ebp - 0x81c], bl
push 0x3ff
push ebx
lea ecx, [ebp - 0x81b]
push ecx
call fcn.005dfd60
mov byte [ebp - 0x41c], bl
push 0x3ff
push ebx
lea edx, [ebp - 0x41b]
push edx
call fcn.005dfd60
add esp, 0x18
xor esi, esi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumValueA]
mov dword [ebp - 0x82c], esi
mov byte [ebp - 0x81c], bl
mov byte [ebp - 0x41c], bl
mov eax, 0x400
mov dword [ebp - 0x824], eax
mov dword [ebp - 0x828], eax
lea eax, [ebp - 0x828]
push eax
lea ecx, [ebp - 0x81c]
push ecx
push ebx
push ebx
lea edx, [ebp - 0x824]
push edx
lea eax, [ebp - 0x41c]
push eax
push esi
mov ecx, dword [ebp - 0x820]
push ecx
call edi
cmp eax, ebx
jne 0x443ffe
cmp byte [ebp - 0x41c], bl
je 0x443ffb
push ebx
push 0x2c
lea edx, [ebp - 0x41c]
push edx
push 0x72c288
call fcn.004e5820
inc esi
jmp 0x443f90
mov eax, dword [ebp - 0x820]
cmp eax, ebx
je 0x444015
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x820], ebx
push 4
call fcn.004418a0
add esp, 4
jmp 0x444040
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x4454b0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x20c]
push str._s:Zone.Identifier
xor esi, esi
push eax
mov dword [ebp - 0x210], esi
call fcn.005dfb23
push esi
push 0x80
push 3
push esi
push 3
lea ecx, [ebp - 0x20c]
push connect
push ecx
call fcn.004e0400
add esp, 0x28
mov dword [ebp - 0x214], eax
cmp eax, 0xffffffff
jne 0x44551c
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, esi
je 0x4455bb
push ebx
lea ebx, [edi + edi + 1]
push ebx
mov dword [ebp - 0x218], esi
call fcn.005e20e4
mov esi, eax
add esp, 4
test esi, esi
je 0x4455ba
push ebx
push 0
push esi
call fcn.005dfd60
mov eax, dword [ebp - 0x214]
add esp, 0xc
push 0
lea edx, [ebp - 0x218]
push edx
push edi
push esi
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4455b1
push 0
push str.ZoneId
push esi
call fcn.004f5880
add esp, 0xc
cmp eax, 0xffffffff
je 0x4455b1
lea ecx, [eax + esi + 6]
push 0x3d
push ecx
call fcn.005e0940
mov edi, eax
add esp, 8
test edi, edi
je 0x4455b1
inc edi
push edi
call fcn.004e1290
push edi
call fcn.005e0909
add esp, 8
mov dword [ebp - 0x210], eax
push esi
call fcn.005e0865
add esp, 4
pop ebx
lea edx, [ebp - 0x214]
push edx
call fcn.004dca10
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x210]
pop edi
xor ecx, ebp
pop esi
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret

Function at 0x4455e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
mov dword [ebp - 0x110], edi
call fcn.004d96c0
mov esi, eax
neg esi
sbb esi, esi
lea eax, [ebp - 0x108]
push str.SOFTWAREPoliciesMicrosoftWindowsNetwork_Connections
and esi, 0x100
push eax
add esi, 0x20019
call fcn.005dfb23
add esp, 8
lea ecx, [ebp - 0x10c]
push ecx
push esi
push edi
lea edx, [ebp - 0x108]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fadc0
test eax, eax
jne 0x445698
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x110]
push ecx
push edi
push edi
push str.NC_ShowSharedAccessUI
push edx
mov dword [ebp - 0x114], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x44568b
test ebx, ebx
je 0x445686
mov eax, dword [ebp - 0x110]
mov dword [ebx], eax
mov edi, 1
mov ecx, dword [ebp - 0x10c]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x4456b0
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670300
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x11c
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 4], edi
call fcn.004d9b00
test eax, eax
je 0x445832
mov dword [ebp - 0x124], edi
mov dword [ebp - 0x128], edi
push str.SOFTWAREPoliciesMicrosoftWindowsNetwork_Connections
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.004d96c0
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x100
add esi, 0xf003f
xor ecx, ecx
cmp dword [ebp + 8], edi
sete cl
mov dword [ebp - 0x128], ecx
lea edx, [ebp - 0x124]
push edx
push esi
push edi
lea eax, [ebp - 0x120]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fadc0
cmp eax, edi
je 0x44577e
push edi
lea ecx, [ebp - 0x124]
push ecx
push edi
push esi
push edi
push edi
push edi
lea edx, [ebp - 0x120]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fae50
cmp eax, edi
jne 0x4457fa
mov eax, dword [ebp + 0xc]
cmp eax, edi
jne 0x4457a5
push 4
lea eax, [ebp - 0x128]
push eax
push 4
push edi
push str.NC_ShowSharedAccessUI
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4457e8
cmp eax, 1
jne 0x4457e3
call fcn.004dd0c0
and eax, 0x800003ff
jns 0x4457bd
dec eax
or eax, 0xfffffc00
inc eax
mov dword [ebp - 0x12c], eax
push 4
lea eax, [ebp - 0x12c]
push eax
push 4
push edi
push str.NC_Random
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x4457fa
cmp eax, 2
jne 0x4457fa
push str.NC_Random
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [ebp - 0x124]
cmp eax, edi
je 0x445832
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x124], edi
jmp 0x445832
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x445860
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x670320
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x124
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor edi, edi
mov dword [ebp - 0x12c], edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x124], edi
mov ebx, 1
mov dword [ebp - 0x128], ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesExplorer
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
call fcn.004d96c0
mov esi, eax
neg esi
sbb esi, esi
and esi, 0x100
add esi, 0xf003f
xor ecx, ecx
cmp dword [ebp + 8], edi
setne cl
mov dword [ebp - 0x128], ecx
lea edx, [ebp - 0x124]
push edx
push esi
push edi
lea eax, [ebp - 0x120]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fadc0
cmp eax, edi
je 0x445930
push edi
lea ecx, [ebp - 0x124]
push ecx
push edi
push esi
push edi
push edi
push edi
lea edx, [ebp - 0x120]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004fae50
cmp eax, edi
jne 0x4459ba
mov dword [ebp - 0x130], 0xffffffff
mov dword [ebp - 0x134], 4
lea eax, [ebp - 0x134]
push eax
lea ecx, [ebp - 0x130]
push ecx
push edi
push edi
push str.NoControlPanel
mov edx, dword [ebp - 0x124]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x445992
mov eax, dword [ebp - 0x130]
cmp eax, dword [ebp - 0x128]
je 0x4459ba
push 4
lea ecx, [ebp - 0x128]
push ecx
push 4
push edi
push str.NoControlPanel
mov edx, dword [ebp - 0x124]
push edx
jmp 0x4459aa
push 4
lea eax, [ebp - 0x128]
push eax
push 4
push edi
push str.NoControlPanel
mov ecx, dword [ebp - 0x124]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x4459ba
mov dword [ebp - 0x12c], ebx
mov eax, dword [ebp - 0x124]
cmp eax, edi
je 0x4459f2
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x124], edi
jmp 0x4459f2
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x12c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x4480e0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x6703a0
push 0x5dfbd0
mov eax, dword fs:[0]
push eax
sub esp, 0x318
mov eax, dword [0x6aae14]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
xor ebx, ebx
mov dword [ebp - 4], ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp dword [0x734108], ebx
je 0x44813f
call esi
sub eax, dword [0x734108]
cmp eax, 0x7d0
jbe 0x448208
push 0x6e8cb0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x734108], ebx
je 0x448161
call esi
sub eax, dword [0x734108]
cmp eax, 0x7d0
jbe 0x4481dc
mov byte [ebp - 0x120], bl
push 0x103
push ebx
lea eax, [ebp - 0x11f]
push eax
call fcn.005dfd60
push ebx
lea ecx, [ebp - 0x120]
push ecx
call fcn.004c3aa0
add esp, 0x14
mov dword [0x72bddc], eax
call esi
mov dword [0x734108], eax
cmp dword [0x734104], ebx
jne 0x4481dc
mov dword [0x734104], 1
lea edx, [ebp - 0x120]
push edx
mov eax, dword [0x72bddc]
push eax
push str._CONN__Connected_Users:_u__LastErr:_s
lea ecx, [ebp - 0x328]
push ecx
call fcn.005dfb23
push ebx
push 1
lea edx, [ebp - 0x328]
push edx
push 0x6aec98
call fcn.004311c0
add esp, 0x20
push 0x6e8cb0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x448208
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x4483c0
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 0xc]
push 0x6afef0
push 0x104
lea eax, [ebp - 0x414]
push eax
push 0x60cf3c
push str.FrightsRunForSecServer
push 0x60da74
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp byte [ebp - 0x414], 0x31
je 0x448585
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x6af4b8]
mov byte [ebp + eax - 0x20c], cl
inc eax
test cl, cl
jne 0x448410
lea ecx, [ebp - 0x20c]
push ecx
call fcn.004e24e0
lea eax, [ebp - 0x20c]
add esp, 4
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x448438
mov edx, dword [str.frights.ini]
mov ecx, dword [0x621f8c]
mov dword [eax], edx
mov edx, dword [0x621f90]
mov dword [eax + 4], ecx
mov dword [eax + 8], edx
lea eax, [ebp - 0x20c]
push eax
call fcn.004e0670
add esp, 4
xor eax, eax
jmp 0x448470
mov cl, byte [eax + 0x6af4b8]
mov byte [ebp + eax - 0x108], cl
inc eax
test cl, cl
jne 0x448470
lea ecx, [ebp - 0x108]
push ecx
call fcn.004e24e0
lea eax, [ebp - 0x108]
add esp, 4
dec eax
mov cl, byte [eax + 1]
inc eax
test cl, cl
jne 0x448498
mov edx, dword [str.frights.exe]
mov ecx, dword [0x621f80]
push 1
push 0
mov dword [eax], edx
mov edx, dword [0x621f84]
push 0
mov dword [eax + 4], ecx
push 0
mov dword [eax + 8], edx
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.004e8950
add esp, 0x18
test eax, eax
jne 0x448551
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x108]
push ecx
push edx
lea eax, [ebp - 0x310]
push str.Executing_FRIGHTS__u__for_SecServer___s_
push eax
call fcn.005dfb23
push 0
push 1
lea ecx, [ebp - 0x310]
push ecx
push 0x6aec98
call fcn.004311c0
push 0
push 0
push 0
push 0xffffffffffffffff
push 0
lea edx, [ebp - 0x108]
push 0
push edx
mov dword [esi], 1
call fcn.00506de0
push 0x6afef0
push 0x615678
push str.FrightsRunForSecServer
push 0x60da74
call fcn.004e0cb0
add esp, 0x4c
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x108]
push eax
push ecx
lea edx, [ebp - 0x310]
push str.Unable_to_execute_FRIGHTS__u__for_SecServer___s_
push edx
call fcn.005dfb23
push 0
push 1
lea eax, [ebp - 0x310]
push eax
push 0x6aec98
call fcn.004311c0
add esp, 0x20
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x44dda0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push str._sysdir_driversetchosts
push 0x72cf00
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 1
push 0x72cf00
call fcn.00515650
call fcn.0052b840
test eax, eax
jne 0x44de0f
mov eax, dword [ebp + 8]
cmp eax, 1
jne 0x44de0a
push 0
push 0
push 0
push 0
push 0x72cf00
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x44de08
cmp dword [0x72cefc], eax
jne 0x44de08
call fcn.00416880
push 0x72cefc
push 0x72cf00
call fcn.0044da70
add esp, 8
pop ebp
ret
cmp eax, 2
jne 0x44de08
push 0
push 0
push 0
push 0
push 0x72cf00
call fcn.004ec5a0
add esp, 0x14
test eax, eax
jne 0x44de08
cmp dword [0x72cefc], 1
jne 0x44de08
push 0x72cefc
push 0x72cf00
call fcn.0044dc30
add esp, 8
pop ebp
jmp fcn.00416880
Function at 0x44fc20
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x524
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
push 0x103
lea ecx, [ebp - 0x113]
push ebx
push ecx
mov dword [ebp - 0x520], eax
mov byte [ebp - 0x114], bl
call fcn.005dfd60
lea edx, [ebp - 0x518]
push edx
push 9
push ebx
push str.SOFTWAREMicroWorldeScan_for_WindowsBackupSchedulerJobs
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
test eax, eax
jne 0x44fe14
mov ecx, dword [ebp - 0x518]
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
push 0x400
lea eax, [ebp - 0x514]
push eax
push ebx
push ecx
xor esi, esi
mov byte [ebp - 0x514], bl
call edi
test eax, eax
jne 0x44fe05
lea esp, [esp]
lea edx, [ebp - 0x514]
push edx
lea eax, [ebp - 0x114]
push str.SOFTWAREMicroWorldeScan_for_WindowsBackupSchedulerJobs_s
push eax
call fcn.005dfb23
lea ecx, [ebp - 0x51c]
push ecx
push 1
push ebx
lea edx, [ebp - 0x114]
push edx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004dc0a0
add esp, 0x20
test eax, eax
jne 0x44fde0
mov edx, dword [ebp - 0x51c]
lea eax, [ebp - 0x524]
push eax
lea ecx, [ebp - 0x514]
push ecx
push ebx
push ebx
push str.DirName
push edx
mov dword [ebp - 0x524], 0x400
mov byte [ebp - 0x514], bl
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [ebp - 0x51c]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp byte [ebp - 0x514], bl
je 0x44fde0
cmp byte [ebp - 0x513], 0x3a
jne 0x44fde0
push 2
lea ecx, [ebp - 0x514]
xor eax, eax
push ecx
lea edx, [ebp - 0x10]
push edx
mov byte [ebp - 0x10], bl
mov dword [ebp - 0xf], eax
mov dword [ebp - 0xb], eax
mov byte [ebp - 7], al
call fcn.005e2f3c
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0xe], bl
call fcn.004e24e0
add esp, 0x10
lea ecx, [ebp - 0x10]
push ecx
call fcn.004e9b10
cmp eax, 3
jne 0x44fde0
lea edx, [ebp - 0x514]
push edx
call fcn.004ec720
add esp, 4
test eax, eax
jne 0x44fdba
lea eax, [ebp - 0x514]
push 0x60c81c
push eax
call fcn.004e92a0
lea ecx, [ebp - 0x514]
push ecx
call fcn.004ec720
add esp, 0xc
test eax, eax
je 0x44fde0
lea edx, [ebp - 0x514]
push edx
call fcn.004e24e0
mov ecx, dword [ebp - 0x520]
add esp, 4
push 1
push 0x2c
lea eax, [ebp - 0x514]
push eax
push ecx
call fcn.004e5820
mov eax, dword [ebp - 0x518]
push 0x400
lea edx, [ebp - 0x514]
push edx
inc esi
push esi
push eax
mov byte [ebp - 0x514], bl
call edi
test eax, eax
je 0x44fcb0
mov ecx, dword [ebp - 0x518]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x4501f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount]
push edi
call esi
mov edi, eax
call esi
sub eax, edi
cmp eax, 0x3e8
jae 0x450238
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov edi, edi
push 0
push 1
push 0
push 0x2010101
call dword [0x6e9118]
add esp, 0x10
test eax, eax
jge 0x450237
push 0x64
call ebx
call esi
sub eax, edi
cmp eax, 0x3e8
jb 0x450210
pop ebx
pop edi
pop esi
ret
Function at 0x451ac0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x630
mov eax, dword [0x6aae14]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push 1
lea ecx, [ebp - 0x620]
push ecx
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorExcludeFolders
xor esi, esi
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x62c], eax
xor ebx, ebx
mov dword [ebp - 0x624], esi
call fcn.004dc050
add esp, 0x10
test eax, eax
jne 0x451c85
push edi
push 0x207
lea edx, [ebp - 0x20b]
push ebx
push edx
mov byte [ebp - 0x20c], bl
call fcn.005dfd60
mov ecx, dword [ebp - 0x620]
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
add esp, 0xc
push 0x208
lea eax, [ebp - 0x414]
push eax
push ebx
push ecx
mov dword [ebp - 0x628], 0x208
mov byte [ebp - 0x414], bl
call edi
test eax, eax
jne 0x451c61
jmp 0x451b60
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x61c]
push str.SoftwareMicroWorldeScan_for_WindowsMwMonitorExcludeFolders_s
push eax
call fcn.005dfb23
add esp, 0xc
lea ecx, [ebp - 0x628]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.ObjectName
lea eax, [ebp - 0x61c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5770
cmp al, 1
jne 0x451be9
mov ecx, dword [ebp - 0x62c]
push ecx
lea edx, [ebp - 0x20c]
push edx
call fcn.004dd620
add esp, 8
test eax, eax
jne 0x451be9
lea eax, [ebp - 0x630]
push eax
push str.OBjectType
lea ecx, [ebp - 0x61c]
push ecx
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.004d5820
cmp al, 1
jne 0x451be9
mov edx, dword [ebp + 0xc]
cmp dword [ebp - 0x630], edx
je 0x451c57
push 0x207
lea eax, [ebp - 0x20b]
push ebx
push eax
inc esi
mov byte [ebp - 0x20c], bl
call fcn.005dfd60
mov edx, dword [ebp - 0x620]
add esp, 0xc
push 0x208
lea ecx, [ebp - 0x414]
push ecx
push esi
push edx
mov dword [ebp - 0x628], 0x208
mov byte [ebp - 0x414], bl
call edi
test eax, eax
je 0x451b60
mov eax, dword [ebp - 0x620]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x624]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x624], 1
mov eax, dword [ebp - 0x620]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x624]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.005dfbbe
mov esp, ebp
pop ebp
ret
Function at 0x452980
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push 0x60cf0c
push 0x6e9268
call fcn.005e00ad
mov edi, eax
xor ebx, ebx
add esp, 8
cmp edi, ebx
jne 0x4529a5
pop edi
xor eax, eax
pop ebx
pop ebp
ret
push esi
mov esi, dword [ebp + 8]
push edi
push 1
push 0x33fb8
push esi
call fcn.005e057f
add esp, 0x10
lea ecx, [esi + 0x1b163]
lea eax, [esi + 0xfcf]
mov edx, 0xc8
pop esi
lea esp, [esp]
mov byte [eax - 0xfa0], bl
mov byte [eax], bl
mov byte [ecx - 0x191f0], bl
mov byte [ecx], bl
add eax, 0x14
add ecx, 0x200
sub edx, 1
jne 0x4529d0
push edi
call fcn.005dff6d
add esp, 4
pop edi
mov eax, 1
pop ebx
pop ebp
ret

Function at 0x4534f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x14]
test edi, edi
je 0x453502
mov dword [edi], 0
mov esi, dword [ebp + 8]
test esi, esi
je 0x453631
cmp byte [esi], 0
je 0x453631
push 3
push 0x62577c
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4535ae
push 3
push 0x625778
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4535ae
push 3
push 0x625774
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4535ae
push 3
push 0x625770
push esi
call fcn.004dd670
add esp, 0xc
test eax, eax
je 0x4535ae
cmp dword [ebp + 0x10], 0
je 0x453631
test edi, edi
je 0x453631
push str.crdownload
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
jne 0x453631
cmp dword [ebp + 0x18], 0x19000
jae 0x453631
mov dword [edi], 1
pop edi
mov eax, 1
pop esi
pop ebp
ret
mov esi, dword [ebp + 0xc]
mov al, byte [esi]
cmp al, 0x69
je 0x4535bb
cmp al, 0x49
jne 0x4535c8
mov cl, byte [esi + 1]
cmp cl, 0x6d
je 0x453609
cmp cl, 0x4d
je 0x453609
cmp al, 0x6b
je 0x4535d0
cmp al, 0x4b
jne 0x4535dd
mov cl, byte [esi + 1]
cmp cl, 0x65
je 0x453602
cmp cl, 0x45
je 0x453602
cmp al, 0x69
je 0x4535e5
cmp al, 0x49
jne 0x453631
mov al, byte [esi + 1]
cmp al, 0x70
je 0x4535f0
cmp al, 0x50
jne 0x453631
mov al, byte [esi + 2]
cmp al, 0x7a
je 0x4535fb
cmp al, 0x5a
jne 0x453631
push 0x625760
jmp 0x453620
push 0x62575c
jmp 0x453620
push 0x625758
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4535a5
push str.image
push esi
call fcn.004dd6e0
add esp, 8
test eax, eax
je 0x4535a5
pop edi
xor eax, eax
pop esi
pop ebp
ret

Function at 0x454c50
Capabilities:
Move file

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
xor esi, esi
push edi
mov dword [ebp - 4], esi
call fcn.004d96c0
test eax, eax
je 0x454c72
lea eax, [ebp - 4]
push eax
call fcn.004f77e0
add esp, 4
mov esi, eax
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ecx
push edx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExA]
mov edi, eax
test esi, esi
je 0x454c96
mov ecx, dword [ebp - 4]
push ecx
call fcn.004f7860
add esp, 4
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret