joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40eba0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x190
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
test esi, esi
jne 0x40ec22
call fcn.004198e3
and eax, 0x800000ff
jns 0x40ebd3
dec eax
or eax, 0xffffff00
inc eax
mov byte [ebp + esi - 0x64], al
inc esi
cmp esi, 0x10
jl 0x40ebc0
xor esi, esi
nop
mov dl, byte [ebp + esi - 0x64]
mov al, 9
mov cl, dl
shr cl, 4
cmp al, cl
sbb al, al
and dl, 0xf
and al, 0x27
add al, 0x30
add al, cl
mov byte [ebp + esi*2 - 0x8c], al
mov al, 9
cmp al, dl
sbb al, al
and al, 0x27
add al, 0x30
add al, dl
mov byte [ebp + esi*2 - 0x8b], al
inc esi
cmp esi, 0x10
jl 0x40ebe0
mov byte [ebp - 0x6c], 0
lea esi, [ebp - 0x8c]
push 0
lea eax, [ebp - 0x190]
mov dword [ebp - 0x190], 0
push eax
push 0
push 0xf013f
push 0
push 0
push 0
push str.SoftwareStartIsBackLicense
push edi
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x40ed75
push 0x20
push esi
push 1
push eax
push str.LicenseHash
push dword [ebp - 0x190]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40ed75
push dword [ebp - 0x190]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 0x54]
mov byte [ebp - 0x54], 0
push eax
mov byte [ebp - 0x2c], 0
call fcn.00410350
lea eax, [ebp - 0x2c]
push eax
call fcn.0040fd90
mov al, byte [ebp - 0x2c]
add esp, 8
cmp byte [ebp - 0x54], 0
jne 0x40ecc3
test al, al
je 0x40ed86
movaps xmm0, xmmword [str.0000000000000000]
movups xmmword [ebp - 0x54], xmm0
movups xmmword [ebp - 0x44], xmm0
movq qword [ebp - 0x34], xmm0
test al, al
jne 0x40ecdb
movaps xmm0, xmmword [str.0000000000000000]
movups xmmword [ebp - 0x2c], xmm0
movups xmmword [ebp - 0x1c], xmm0
movq qword [ebp - 0xc], xmm0
push edi
call fcn.0040fb30
movaps xmm0, xmmword [str.0000000000000000]
mov ebx, eax
movups xmmword [ebp - 0x10c], xmm0
lea eax, [ebp - 0x18c]
movups xmmword [ebp - 0xfc], xmm0
push eax
movups xmm0, xmmword [esi]
lea eax, [ebp - 0x10c]
push eax
movups xmmword [ebp - 0xec], xmm0
movups xmm0, xmmword [esi + 0x10]
movups xmmword [ebp - 0xdc], xmm0
movups xmm0, xmmword [ebp - 0x2c]
movups xmmword [ebp - 0xcc], xmm0
movups xmm0, xmmword [ebp - 0x1c]
movups xmmword [ebp - 0xbc], xmm0
movups xmm0, xmmword [ebp - 0x54]
movups xmmword [ebp - 0xac], xmm0
movups xmm0, xmmword [ebp - 0x44]
movups xmmword [ebp - 0x9c], xmm0
call fcn.0040f790
add esp, 0xc
test eax, eax
je 0x40ed86
lea eax, [ebp - 0x18c]
push eax
push ebx
push edi
call fcn.00411260
add esp, 0xc
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x190]
test eax, eax
je 0x40ed86
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
Function at 0x40ee00
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0xf013f
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartPage3
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40ee4e
push str.Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test eax, eax
jne 0x40ee4e
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, eax
je 0x40ee5c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x40ee70
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea eax, [ebp - 0x6c]
push str.yyyy_yyyy
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
call fcn.00410250
add esp, 4
mov byte [ebp - 0x5f], 0x2d
mov eax, 0x2d30
mov byte [ebp - 0x55], 0x2d
mov word [ebp - 0x5b], ax
lea eax, [ebp - 0x134]
mov byte [ebp - 0x52], 0x39
push str.SOFTWAREClassesCLSID
push eax
call esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x6c]
push eax
lea eax, [ebp - 0x134]
push eax
call esi
push 0x428c4c
lea eax, [ebp - 0x134]
push eax
call esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExA]
lea eax, [ebp - 0x134]
push 0
push 0xf013f
push eax
push 0x80000001
call esi
test eax, eax
jne 0x40ef2c
push eax
push 0xf003f
lea eax, [ebp - 0x134]
push eax
push 0x80000001
call esi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
Function at 0x40f1a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
mov edx, ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 0x64], 0x72486b64
mov dword [ebp - 0x60], 0x4e3a672c
mov dword [ebp - 0x5c], 0x529f5168
mov esi, dword [esi]
mov dword [ebp - 0x58], 0x8bd580fd
mov dword [ebp - 0x54], 0x671f7528
mov dword [ebp - 0x50], 0x204e3a
mov dword [ebp - 0x4c], 0x300033
mov dword [ebp - 0x48], 0x65e50020
mov dword [ebp - 0x44], 0x8bd57684
mov dword [ebp - 0x40], 0x72487528
mov dword [ebp - 0x3c], 0x3002672c
mov dword [ebp - 0x38], 0x75288bd5
mov dword [ebp - 0x34], 0x6ee1671f
mov dword [ebp - 0x30], 0xff0c540e
mov dword [ebp - 0x2c], 0x679c5982
mov dword [ebp - 0x28], 0x898160a8
mov dword [ebp - 0x24], 0x7eed7ee7
mov dword [ebp - 0x20], 0x75284f7f
mov dword [ebp - 0x1c], 0x7a0b672c
mov dword [ebp - 0x18], 0xff0c5e8f
mov dword [ebp - 0x14], 0x6fc08bf7
mov dword [ebp - 0x10], 0x5b836d3b
mov dword [ebp - 0xc], 0xd3002
mov word [ebp - 8], 0xa
mov dword [ebp - 0xc4], 0x72486b64
mov dword [ebp - 0xc0], 0x4e3a672c
mov dword [ebp - 0xbc], 0x965065e0
mov dword [ebp - 0xb8], 0x51685236
mov dword [ebp - 0xb4], 0x80fd529f
mov dword [ebp - 0xb0], 0x672c7248
mov dword [ebp - 0xac], 0xd3002
mov dword [ebp - 0xa8], 0xd000a
mov dword [ebp - 0xa4], 0xd000a
mov dword [ebp - 0xa0], 0xd000a
mov dword [ebp - 0x9c], 0xd000a
mov dword [ebp - 0x98], 0xd000a
mov dword [ebp - 0x94], 0xd000a
mov dword [ebp - 0x90], 0xd000a
mov dword [ebp - 0x8c], 0xd000a
mov dword [ebp - 0x88], 0xd000a
mov dword [ebp - 0x84], 0xd000a
mov dword [ebp - 0x80], 0xd000a
mov dword [ebp - 0x7c], 0xd000a
mov dword [ebp - 0x78], 0xd000a
mov dword [ebp - 0x74], 0xd000a
mov dword [ebp - 0x70], 0xd000a
mov dword [ebp - 0x6c], 0xd000a
mov word [ebp - 0x68], 0xa
cmp esi, 0x5e
jb 0x40f3e9
nop dword [eax]
cmp byte [edx], 0x64
jne 0x40f366
xor ecx, ecx
inc ecx
inc edx
cmp ecx, 0x5e
je 0x40f382
mov al, byte [edx]
cmp al, byte [ebp + ecx - 0x64]
je 0x40f357
inc edx
mov eax, edx
sub eax, ebx
add eax, 0x5e
cmp eax, esi
jbe 0x40f350
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
add edx, 0xffffffa2
je 0x40f3e9
push edi
nop dword [eax + eax]
mov eax, dword [ebp + 0xc]
lea esi, [ebp - 0xc4]
mov edi, edx
mov ecx, 0x17
rep movsd dword es:[edi], dword [esi]
mov edx, ebx
movsw word es:[edi], word [esi]
mov esi, dword [eax]
cmp esi, 0x5e
jb 0x40f3e8
nop dword [eax]
cmp byte [edx], 0x64
jne 0x40f3c6
xor eax, eax
inc eax
inc edx
cmp eax, 0x5e
je 0x40f3e3
mov cl, byte [edx]
cmp cl, byte [ebp + eax - 0x64]
je 0x40f3b7
inc edx
mov eax, edx
sub eax, ebx
add eax, 0x5e
cmp eax, esi
jbe 0x40f3b0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
add edx, 0xffffffa2
jne 0x40f390
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
Function at 0x40fa60
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x6c]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
push ecx
push 0x101
push 0
push str.SoftwareStartIsBackLicense
push eax
mov dword [ebp - 0x6c], 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40fb07
push esi
push str.ActivationData
lea eax, [ebp - 0x68]
push str._s_d
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
mov dword [ebp - 0x70], 0x80
lea eax, [ebp - 0x70]
mov ecx, str.ActivationData
test esi, esi
push eax
push edi
push 0
push 0
lea eax, [ebp - 0x68]
cmove eax, ecx
push eax
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x40fb07
cmp dword [ebp - 0x70], 0x80
jne 0x40fb07
push dword [ebp - 0x6c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x6c]
test eax, eax
je 0x40fb15
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.00414e7e
mov esp, ebp
pop ebp
ret

Function at 0x40fb30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x6c]
push esi
push ecx
push 0x101
xor esi, esi
push esi
push str.SoftwareStartIsBackLicense
push eax
mov dword [ebp - 0x6c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40fb74
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov edi, dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x68]
push 0
push str.ActivationData
push str._s_d
push eax
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea eax, [ebp - 0x70]
add esp, 0x10
mov dword [ebp - 0x70], 0x80
push eax
push 0
push 0
push 0
push str.ActivationData
push dword [ebp - 0x6c]
call ebx
test eax, eax
jne 0x40fbf3
inc esi
lea eax, [ebp - 0x68]
push esi
push str.ActivationData
push str._s_d
push eax
call edi
add esp, 0x10
mov dword [ebp - 0x70], 0x80
lea eax, [ebp - 0x70]
test esi, esi
mov ecx, str.ActivationData
push eax
push 0
push 0
push 0
lea eax, [ebp - 0x68]
cmove eax, ecx
push eax
push dword [ebp - 0x6c]
call ebx
test eax, eax
je 0x40fbb6
mov eax, dword [ebp - 0x6c]
pop edi
pop ebx
test eax, eax
je 0x40fc03
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
Function at 0x40fc20
Capabilities:
Get storage device properties

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2d2c
call fcn.00414eb0
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0x60c]
push edi
push dword [ebp + 8]
push 0x428c50
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x60c]
push 0
push 0
push 3
push 0
push 3
push 0
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x40fd73
push 0x270f
lea eax, [ebp - 0x2d1c]
mov dword [ebp - 0x2d20], 0
push 0
push eax
mov dword [ebp - 0x2d28], 0
mov dword [ebp - 0x2d24], 0
call fcn.00416c90
add esp, 0xc
lea eax, [ebp - 0x2d2c]
push 0
push eax
push 0x270f
lea eax, [ebp - 0x2d1c]
push eax
push 0xc
lea eax, [ebp - 0x2d28]
push eax
push 0x2d1400
push edi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x40fd6c
push 0x400
lea eax, [ebp - 0x404]
push 0
push eax
call fcn.00416c90
mov eax, dword [ebp - 0x2d04]
add esp, 0xc
test eax, eax
je 0x40fd2b
lea ecx, [ebp - 0x2d1c]
add ecx, eax
cmp byte [ecx], 0
je 0x40fd2b
lea edx, [ebp - 0x404]
sub edx, ecx
movzx eax, byte [ecx + 1]
lea ecx, [ecx + 2]
mov byte [edx + ecx - 2], al
movzx eax, byte [ecx - 2]
mov byte [edx + ecx - 1], al
cmp byte [ecx], 0
jne 0x40fd13
lea eax, [ebp - 0x404]
push eax
call fcn.004103b0
add esp, 4
test eax, eax
je 0x40fd6c
push dword [ebp - 0x404]
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
jne 0x40fd5e
push dword [ebp - 0x3f1]
call dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
test eax, eax
je 0x40fd6c
lea eax, [ebp - 0x404]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
Function at 0x40fd90
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc34
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x830]
push esi
push edi
push str.xxxx_xxxx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push 0x104
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
xor eax, eax
mov word [ebp - 0x42a], ax
lea eax, [ebp - 0x210]
push 0x104
push eax
lea eax, [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeNameForVolumeMountPointW]
lea ecx, [ebp - 0x210]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x40fe00
sub ecx, edx
sar ecx, 1
lea ecx, [ecx*2 - 2]
cmp ecx, 0x208
jae 0x40ffd8
xor eax, eax
push eax
push eax
push 3
push eax
push 1
push eax
mov word [ebp + ecx - 0x210], ax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov esi, eax
push 0
lea eax, [ebp - 0xc34]
push eax
push 0x3e8
lea eax, [ebp - 0xc18]
push eax
push 0
push 0
push 0x560000
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0xc04]
lea eax, [ebp - 0x830]
push eax
push esi
call fcn.0040fc20
add esp, 8
cmp byte [ebp - 0x830], 0x78
jne 0x40ffa0
push esi
lea eax, [ebp - 0x430]
push 0x428c50
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x430]
push 0
push 0
push 3
push 0
push 7
push 0xc0000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x40ffa0
push 0
lea eax, [ebp - 0xc34]
mov dword [ebp - 0xc34], 0
push eax
push 0x18
lea eax, [ebp - 0xc30]
xorps xmm0, xmm0
push eax
push 0
push 0
push 0x74080
push esi
movups xmmword [ebp - 0xc30], xmm0
movq qword [ebp - 0xc20], xmm0
call edi
test eax, eax
je 0x40ff99
push 0x221
lea eax, [ebp - 0x228]
push 0
push eax
call fcn.00416c90
add esp, 0xc
mov byte [ebp - 0x21e], 0xec
lea eax, [ebp - 0xc34]
push 0
push eax
push 0x221
lea eax, [ebp - 0x228]
push eax
push 0x21
push eax
push 0x7c088
push esi
call edi
test eax, eax
je 0x40ff99
lea eax, [ebp - 0x204]
push eax
call fcn.004103b0
add esp, 4
test eax, eax
je 0x40ff99
push dword [ebp - 0x204]
mov edi, dword [sym.imp.USER32.dll_IsCharAlphaNumericA]
call edi
test eax, eax
jne 0x40ff85
push dword [ebp - 0x1f1]
call edi
test eax, eax
je 0x40ff99
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x830]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [ebp - 0x830]
push eax
push ebx
call fcn.0040cc80
mov ecx, dword [ebp - 4]
add esp, 0xc
mov byte [ebx + 0x20], 0
xor ecx, ebp
mov eax, 1
pop edi
pop esi
pop ebx
call fcn.00414e7e
mov esp, ebp
pop ebp
ret
call fcn.004152dc
int3
Function at 0x40ffe0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x101
push 0
push str.SoftwareMicrosoftWindowsCurrentVersionExplorerStartPage3
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410096
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0
push str.Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x410096
mov eax, dword [ebp - 8]
cmp eax, 8
jb 0x410096
push eax
call fcn.00414eeb
add esp, 4
mov esi, eax
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.Favorites
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x41008d
cmp dword [ebp - 8], 8
jb 0x41008d
mov ecx, dword [ebp + 8]
mov eax, dword [esi]
push esi
mov dword [ecx], eax
mov eax, dword [esi + 4]
mov dword [ecx + 4], eax
call fcn.00414ef4
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push esi
call fcn.00414ef4
add esp, 4
mov eax, dword [ebp - 4]
test eax, eax
je 0x4100a4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4101c0
Capabilities:
Delete registry value
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0x101
push 0
push str.SoftwareStartIsBackLicense
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x410238
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 8]
push eax
push esi
push 0
push 0
push str.LicenseHash
push dword [ebp - 4]
mov dword [ebp - 8], 0x21
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x410238
cmp dword [ebp - 8], 0x21
jne 0x410238
cmp byte [esi + 0x20], al
jne 0x410238
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
test eax, eax
je 0x410246
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x410250
Capabilities:
Get system firmware table

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
push esi
push 0
push 0
push 0
push 0x52534d42
call ebx
mov esi, eax
test esi, esi
je 0x41033f
lea ecx, [esi + 8]
push edi
push ecx
call fcn.00414eeb
add esp, 4
mov edi, eax
mov dword [ebp - 4], edi
push esi
push edi
push 0
push 0x52534d42
call ebx
mov dword [ebp - 8], eax
test eax, eax
je 0x410335
mov ebx, 8
cmp eax, ebx
jbe 0x410335
nop word [eax + eax]
add edi, ebx
cmp byte [edi], 1
je 0x4102ec
movzx esi, byte [edi + 1]
or eax, 0xffffffff
nop
inc eax
add esi, eax
lea eax, [esi + edi]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x4102c0
mov edi, dword [ebp - 4]
inc ebx
add ebx, esi
cmp ebx, dword [ebp - 8]
jb 0x4102b0
push edi
call fcn.00414ef4
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
movzx eax, byte [edi + 0x14]
push eax
movzx eax, byte [edi + 0x15]
push eax
movzx eax, byte [edi + 0x16]
push eax
movzx eax, byte [edi + 0x17]
push eax
movzx eax, byte [edi + 0x10]
push eax
movzx eax, byte [edi + 0x11]
push eax
movzx eax, byte [edi + 0x12]
push eax
movzx eax, byte [edi + 0x13]
push eax
movzx eax, word [edi + 0xc]
push eax
movzx eax, word [edi + 0xe]
push eax
push dword [edi + 8]
push str._08x__04x_04x__02x_02x_02x_02x__02x_02x_02x_02x
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_wsprintfA]
mov edi, dword [ebp - 4]
add esp, 0x34
push edi
call fcn.00414ef4
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x410410
Capabilities:
Find taskbar

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
push 0
push str.Shell_TrayWnd
call dword [sym.imp.USER32.dll_FindWindowW]
mov edi, eax
test edi, edi
je 0x410494
push ebx
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push dword [ebp - 4]
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push 1
push 0x590
push edi
mov ebx, eax
call dword [sym.imp.USER32.dll_PostMessageW]
push 0
push 0
push 0x5b4
push edi
call dword [sym.imp.USER32.dll_PostMessageW]
test ebx, ebx
je 0x410493
push 0x1388
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x41048c
push 1
push str.taskkill.exe__F__IM_explorer
call fcn.00411100
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x411070
Capabilities:
Extract resource via kernel32 functions
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x10]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x4110f5
push 0
lea eax, [ebp - 8]
push eax
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x4110f5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x411100
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x468
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push esi
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov esi, dword [ebp + 0xc]
xor ecx, ecx
xor eax, eax
mov dword [ebp - 0x468], 0x44
mov word [ebp - 0x426], ax
test esi, esi
mov eax, 0xa
mov dword [ebp - 0x43c], 1
cmovne eax, ecx
xorps xmm0, xmm0
mov word [ebp - 0x438], ax
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
movlpd qword [ebp - 0x464], xmm0
push eax
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
lea eax, [ebp - 0x414]
movlpd qword [ebp - 0x45c], xmm0
push eax
push ecx
movlpd qword [ebp - 0x454], xmm0
movlpd qword [ebp - 0x44c], xmm0
movlpd qword [ebp - 0x444], xmm0
movlpd qword [ebp - 0x436], xmm0
movlpd qword [ebp - 0x42e], xmm0
movups xmmword [ebp - 0x424], xmm0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test esi, esi
je 0x4111d1
push 0xea60
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
push 0
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00414e7e
mov esp, ebp
pop ebp
ret

Function at 0x411200
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x431618]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.explorer.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00411100
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
call fcn.00414e7e
mov esp, ebp
pop ebp
ret