joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4077a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x614
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x206]
push ecx
mov word [ebp - 0x208], ax
call fcn.00414930
add esp, 0xc
mov dword [ebp - 0x60c], 0
xor eax, eax
mov edi, edi
movzx ecx, word [eax + str.SystemCurrentControlSetServicesWin_Win]
mov word [ebp + eax - 0x208], cx
add eax, 2
test cx, cx
jne 0x4077e0
lea edx, [ebp - 0x60c]
push edx
push 0x20019
push 0
lea eax, [ebp - 0x208]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40784a
mov eax, dword [ebp - 0x60c]
test eax, eax
je 0x40782c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x41eb9c
call fcn.004033d0
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
xor ecx, ecx
push 0x1fe
push ecx
lea edx, [ebp - 0x406]
push edx
mov word [ebp - 0x408], cx
call fcn.00414930
add esp, 0xc
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x606]
push ecx
mov dword [ebp - 0x610], 1
mov word [ebp - 0x608], ax
call fcn.00414930
add esp, 0xc
mov dword [ebp - 0x614], 0x200
xor eax, eax
lea esp, [esp]
movzx ecx, word [eax + 0x41d344]
mov word [ebp + eax - 0x408], cx
add eax, 2
test cx, cx
jne 0x4078a0
lea edx, [ebp - 0x614]
push edx
lea eax, [ebp - 0x608]
push eax
mov eax, dword [ebp - 0x60c]
lea ecx, [ebp - 0x610]
push ecx
push 0
lea edx, [ebp - 0x408]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
mov eax, dword [ebp - 0x60c]
test eax, eax
je 0x4078f5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x407917
push 0x41ebcc
call fcn.004033d0
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push 0x41ec00
call fcn.004033d0
mov ecx, dword [ebp - 4]
add esp, 4
xor ecx, ebp
mov eax, 1
pop esi
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x407940
Capabilities:
Delete registry key
Delete registry value
Persist via windows service
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x618
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor eax, eax
push 0x1fe
push eax
lea ecx, [ebp - 0x206]
push ecx
xor bl, bl
mov dword [ebp - 0x60c], 0
mov dword [ebp - 0x614], 0
mov word [ebp - 0x208], ax
call fcn.00414930
add esp, 0xc
xor edx, edx
push 0x3fe
push edx
lea eax, [ebp - 0x606]
push eax
mov word [ebp - 0x608], dx
call fcn.00414930
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push 0x41af7c
lea ecx, [ebp - 0x208]
push str.SystemCurrentControlSetServices_s
push ecx
call esi
add esp, 0xc
lea edx, [ebp - 0x60c]
push edx
push 0x2001f
push 0
lea eax, [ebp - 0x208]
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x407a7a
push 0x41af7c
lea ecx, [ebp - 0x608]
push 0x41ec7c
push ecx
call esi
lea edx, [ebp - 0x608]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
lea eax, [ebp - 0x614]
push eax
lea ecx, [ebp - 0x60c]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [ebp - 0x208]
push edx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x407a78
push 0x41af7c
lea eax, [ebp - 0x608]
push 0x41ecb0
push eax
call esi
lea ecx, [ebp - 0x608]
add esp, 0xc
push ecx
call fcn.004033d0
add esp, 4
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
mov bl, 1
mov eax, dword [ebp - 0x60c]
push 4
lea edx, [ebp - 0x610]
push edx
push 4
push 0
push str.TestValue
push eax
mov dword [ebp - 0x610], 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x407ae7
push eax
lea ecx, [ebp - 0x608]
push 0x41ed00
push ecx
call esi
lea edx, [ebp - 0x608]
add esp, 0xc
push edx
call fcn.004033d0
mov eax, dword [ebp - 0x60c]
add esp, 4
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x60c]
push str.TestValue
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push eax
lea edx, [ebp - 0x608]
push 0x41ed48
push edx
call esi
lea eax, [ebp - 0x608]
add esp, 0xc
push eax
call fcn.004033d0
mov ecx, dword [ebp - 0x60c]
add esp, 4
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test bl, bl
je 0x407b5e
lea edx, [ebp - 0x60c]
push edx
push 0xf003f
push 0
push 0
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x407b5e
mov ecx, dword [ebp - 0x60c]
lea eax, [ebp - 0x208]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x408100
Capabilities:
Delete service
Manipulate safe mode programs
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x23c], eax
test eax, eax
je 0x408242
mov edi, dword [sym.imp.ADVAPI32.dll_OpenServiceW]
push 0xf01ff
push str.WinMaster_Service7
push eax
call edi
mov ebx, dword [sym.imp.ADVAPI32.dll_ControlService]
mov esi, eax
test esi, esi
je 0x408174
lea eax, [ebp - 0x21c]
push eax
push 1
push esi
call ebx
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov ecx, dword [ebp - 0x23c]
push 0xf01ff
push 0x41af7c
push ecx
call edi
mov edi, eax
test edi, edi
je 0x40823c
xor edx, edx
push 0x1f2
push edx
lea eax, [ebp - 0x1fe]
push eax
mov word [ebp - 0x200], dx
call fcn.00414930
add esp, 0xc
lea ecx, [ebp - 0x21c]
push ecx
push 0xc8
push edi
xor esi, esi
call ebx
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
lea edx, [ebp - 0x238]
push edx
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x234], 1
je 0x408221
inc esi
push esi
lea eax, [ebp - 0x200]
push 0x41f258
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x200]
add esp, 0xc
push ecx
call fcn.004033d0
add esp, 4
cmp esi, 5
je 0x408228
lea edx, [ebp - 0x21c]
push edx
push 0xc8
push edi
call ebx
cmp esi, 5
jle 0x4081c0
push 0x41f2a0
jmp 0x40822d
push str._t_t_t_STOP_All_Service_
call fcn.004033d0
add esp, 4
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov eax, dword [ebp - 0x23c]
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, str.SYSTEMCurrentControlSetServicesWinMaster_Service7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootMinimalwin_win7
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetControlSafeBootNetworkwin_win7
mov ecx, 0x80000002
call fcn.0040a170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x408290
Capabilities:
Delete file
Delete service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x824
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x806]
push ecx
mov word [ebp - 0x808], ax
call fcn.00414930
add esp, 0xc
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, eax
test edi, edi
je 0x408364
push 0xf01ff
push 0x41af90
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x40835d
lea edx, [ebp - 0x824]
push edx
push 0xc8
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x7d0
call dword [sym.imp.KERNEL32.dll_Sleep]
call fcn.00402340
test eax, eax
je 0x408330
push str._t_t_t_Delete_wmcUpdater_Service__wmcUpdater
call fcn.004033d0
add esp, 4
call fcn.00402170
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
lea eax, [ebp - 0x808]
push 0x41f530
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x808]
push ecx
call fcn.004033d0
add esp, 0xc
push esi
call ebx
jmp 0x408371
push str._t_t_t_Delete_wmcUpdater_Service__OpenService_Fail_
jmp 0x408369
push str._t_t_t_Delete_wmcUpdater_Service_
call fcn.004033d0
add esp, 4
push edi
call ebx
push str.C:WindowsSysWOW64wmcUpdater.exe
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esi, str.SoftwareMicrosoftWindowsCurrentVersionUninstallwmcUpdater
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstallwmcUpdater
mov ecx, 0x80000002
call fcn.0040a170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x4083b0
Capabilities:
Delete service
Query service status
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov edi, eax
mov dword [ebp - 0x23c], edi
test edi, edi
je 0x408562
push 0xf01ff
push 0x41af7c
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
mov esi, eax
test esi, esi
je 0x40851f
xor eax, eax
push 0x1f2
push eax
lea ecx, [ebp - 0x1fe]
push ecx
mov word [ebp - 0x200], ax
call fcn.00414930
add esp, 0xc
lea edx, [ebp - 0x21c]
push edx
push 0xc8
push esi
xor edi, edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0xbb8
call ebx
lea eax, [ebp - 0x238]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp dword [ebp - 0x234], 1
je 0x408497
inc edi
push edi
lea ecx, [ebp - 0x200]
push 0x41f810
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x200]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
cmp edi, 5
je 0x40849e
lea eax, [ebp - 0x21c]
push eax
push 0xc8
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
cmp edi, 5
jle 0x408436
push 0x41f860
jmp 0x4084a3
push 0x41f8b0
call fcn.004033d0
add esp, 4
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x4084ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x200]
push 0x41f908
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x200]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
add dword [0x4288f0], 4
jmp 0x40850b
lea eax, [ebp - 0x200]
push str._t_t_t_Delete_All_Service_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea ecx, [ebp - 0x200]
push ecx
call fcn.004033d0
add esp, 0xc
push 0x3e8
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov edi, dword [ebp - 0x23c]
push 0xf01ff
push str.WInMaster_Service7
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x408562
lea edx, [ebp - 0x21c]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
push 0x7d0
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
push 0x3e8
call ebx
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov esi, str.SYSTEMCurrentControlSetServicesW7_Main_Service
mov ecx, 0x80000002
call fcn.0040a170
mov esi, str.SYSTEMCurrentControlSetServicesWInMaster_Service7
mov ecx, 0x80000002
call fcn.0040a170
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x409660
Capabilities:
Delete file
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe10
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x7fe
xor ebx, ebx
lea ecx, [ebp - 0xc02]
xor eax, eax
push ebx
push ecx
mov word [ebp - 0xc04], ax
call fcn.00414930
push 0x1fe
lea eax, [ebp - 0x402]
xor edx, edx
push ebx
push eax
mov dword [ebp - 0xe08], ebx
mov word [ebp - 0x404], dx
call fcn.00414930
push 0x1fe
lea edx, [ebp - 0x202]
xor ecx, ecx
push ebx
push edx
mov dword [ebp - 0xe10], 1
mov word [ebp - 0x204], cx
call fcn.00414930
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0xe04]
mov esi, 0x200
add esp, 0x24
rep stosd dword es:[edi], eax
mov dword [ebp - 0xe0c], esi
xor eax, eax
jmp 0x409710
movzx ecx, word [eax + str.SoftwareMicrosoftWindowsCurrentVersionExplorerShell_Folders]
mov word [ebp + eax - 0xe04], cx
add eax, 2
test cx, cx
jne 0x409710
lea eax, [ebp - 0xe08]
push eax
push 0x20019
push 0
lea ecx, [ebp - 0xe04]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4097d8
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x404]
rep stosd dword es:[edi], eax
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x80
lea edi, [ebp - 0x204]
rep stosd dword es:[edi], eax
mov dword [ebp - 0xe0c], esi
xor eax, eax
jmp 0x409790
movzx ecx, word [eax + str.Common_Start_Menu]
mov word [ebp + eax - 0x404], cx
add eax, 2
test cx, cx
jne 0x409790
lea eax, [ebp - 0xe0c]
push eax
lea ecx, [ebp - 0x204]
push ecx
mov ecx, dword [ebp - 0xe08]
lea edx, [ebp - 0xe10]
push edx
push 0
lea eax, [ebp - 0x404]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x4097d8
mov bl, 1
mov edx, dword [ebp - 0xe08]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp bl, 1
jne 0x4098b4
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea edi, [ebp - 0xc04]
rep stosd dword es:[edi], eax
push 0x421830
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xc04]
push str._s_s.lnk
push ecx
call esi
mov ebx, dword [sym.imp.KERNEL32.dll_DeleteFileW]
add esp, 0x10
lea edx, [ebp - 0xc04]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0xc04]
rep stosd dword es:[edi], eax
push 0x42185c
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xc04]
push str._s_s.lnk
push ecx
call esi
add esp, 0x10
lea edx, [ebp - 0xc04]
push edx
call ebx
xor eax, eax
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
mov ecx, 0x200
lea edi, [ebp - 0xc04]
rep stosd dword es:[edi], eax
push str.WiNet7
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0xc04]
push str._s_s.lnk
push ecx
call esi
add esp, 0x10
lea edx, [ebp - 0xc04]
push edx
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x409de0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.00414930
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.00414930
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push str.CheckTaskHour7
lea edx, [ebp - 0x20c]
push str.__Delete__TN___ls___F
push edx
call esi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0xc
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str.schtasks.exe
push str.open
push 0
call edi
push 0x208
lea edx, [ebp - 0x20c]
push 0
push edx
call fcn.00414930
push str.CheckTaskDaily7
lea eax, [ebp - 0x20c]
push str.__Delete__TN___ls___F
push eax
call esi
add esp, 0x18
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.schtasks.exe
push str.open
push 0
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x409ee0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x412]
push ecx
mov word [ebp - 0x414], ax
call fcn.00414930
xor edx, edx
push 0x206
push edx
lea eax, [ebp - 0x20a]
push eax
mov word [ebp - 0x20c], dx
call fcn.00414930
add esp, 0x18
push 0x104
lea ecx, [ebp - 0x414]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push 0x208
lea edx, [ebp - 0x20c]
push 0
push edx
call fcn.00414930
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push 0x22
push 0x22
push 0x22
push 0x22
lea eax, [ebp - 0x20c]
push str.__delstore__cRoot_c__cSMR_Public_CA_c
push eax
call esi
mov edi, dword [sym.imp.SHELL32.dll_ShellExecuteW]
add esp, 0x24
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.certutil.exe
push str.open
push 0
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00414930
push 0x22
push 0x22
push 0x22
push 0x22
lea ecx, [ebp - 0x20c]
push str.__delstore__cRoot_c__cSMR_Private_CA_c
push ecx
call esi
add esp, 0x24
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x20c]
push eax
push str.certutil.exe
push str.open
push 0
call edi
push 0x208
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.00414930
push 0x22
push 0x22
push 0x22
push 0x22
push str.__delstore__cMy_c__cSMR_Public_Server_c
lea edx, [ebp - 0x20c]
push edx
call esi
add esp, 0x24
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str.certutil.exe
push str.open
push 0
call edi
push 0x208
lea edx, [ebp - 0x20c]
push 0
push edx
call fcn.00414930
push 0x22
push 0x22
push 0x22
push 0x22
lea eax, [ebp - 0x20c]
push str.__delstore__cMy_c__cSMR_Private_Server_c
push eax
call esi
add esp, 0x24
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.certutil.exe
push str.open
push 0
call edi
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.00414930
push 0x22
push 0x22
push 0x22
push 0x22
lea ecx, [ebp - 0x20c]
push str.__delstore__cMy_c__cSMR_Private_Client_c
push ecx
call esi
add esp, 0x24
push 0
lea edx, [ebp - 0x414]
push edx
lea eax, [ebp - 0x20c]
push eax
push str.certutil.exe
push str.open
push 0
call edi
push 0x208
lea ecx, [ebp - 0x20c]
push 0
push ecx
call fcn.00414930
push 0x22
push 0x22
push 0x22
push 0x22
lea edx, [ebp - 0x20c]
push str.__user__delstore__cMy_c__cSMR_Private_Client_c
push edx
call esi
add esp, 0x24
push 0
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push ecx
push str.certutil.exe
push str.open
push 0
call edi
push 0x208
lea edx, [ebp - 0x20c]
push 0
push edx
call fcn.00414930
push 0x22
push 0x22
push 0x22
push 0x22
lea eax, [ebp - 0x20c]
push str.__user__delstore__cMy_c__cSMR_Public_Client_c
push eax
call esi
add esp, 0x24
push 0
lea ecx, [ebp - 0x414]
push ecx
lea edx, [ebp - 0x20c]
push edx
push str.certutil.exe
push str.open
push 0
call edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x40a170
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x53c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor eax, eax
push 0x40e
mov ebx, ecx
push eax
lea ecx, [ebp - 0x416]
push ecx
mov word [ebp - 0x418], ax
call fcn.00414930
add esp, 0xc
mov edx, esi
lea ecx, [ebp - 0x418]
call fcn.00401000
push 0x11c
lea edx, [ebp - 0x538]
push 0
push edx
call fcn.00414930
add esp, 0xc
lea eax, [ebp - 0x538]
push eax
mov dword [ebp - 0x538], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x534], 6
lea ecx, [ebp - 0x418]
jb 0x40a201
call fcn.0040a220
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push ecx
push ebx
call fcn.0040a410
mov ecx, dword [ebp - 4]
add esp, 8
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret

Function at 0x40a410
Capabilities:
Delete registry key
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x20e]
push ecx
mov word [ebp - 0x210], ax
call fcn.00414930
add esp, 0xc
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
test eax, eax
je 0x40a482
lea edx, [ebp - 0x214]
push edx
push 0xf003f
push 0
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x40a4b8
cmp eax, 2
jne 0x40a498
push str.Key_not_found._n
call fcn.0040e29e
add esp, 4
mov eax, 1
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push str.Error_opening_key._n
call fcn.0040e29e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp word [esi + eax*2 - 2], 0x5c
lea edi, [esi + eax*2]
je 0x40a4da
mov eax, 0x5c
mov word [edi], ax
add edi, 2
xor ecx, ecx
mov word [edi], cx
lea edx, [ebp - 0x220]
push edx
mov edx, dword [ebp - 0x214]
push 0
push 0
push 0
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
push edx
mov dword [ebp - 0x218], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x40a565
lea edx, [ebp - 0x210]
mov ecx, edi
call fcn.00401000
push esi
push ebx
call fcn.0040a410
add esp, 8
test eax, eax
je 0x40a565
lea eax, [ebp - 0x220]
push eax
mov eax, dword [ebp - 0x214]
push 0
push 0
push 0
lea ecx, [ebp - 0x218]
push ecx
lea edx, [ebp - 0x210]
push edx
push 0
push eax
mov dword [ebp - 0x218], 0x104
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
je 0x40a512
xor ecx, ecx
mov word [edi - 2], cx
mov edx, dword [ebp - 0x214]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp - 4]
neg eax
pop edi
sbb eax, eax
pop esi
xor ecx, ebp
inc eax
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
Function at 0x40c3d0
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x84c
mov eax, dword [0x42603c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor esi, esi
push 0x7fe
lea ecx, [ebp - 0x806]
xor eax, eax
push esi
push ecx
mov dword [ebp - 0x80c], esi
mov word [ebp - 0x808], ax
call fcn.00414930
add esp, 0xc
lea edx, [ebp - 0x808]
push 0x422c08
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x808]
push eax
call fcn.004033d0
mov ebx, dword [sym.imp.SHELL32.dll_ShellExecuteExW]
add esp, 0xc
mov edi, 1
jmp 0x40c440
push edi
lea ecx, [ebp - 0x808]
push 0x422c30
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x808]
add esp, 0xc
push edx
call fcn.004033d0
add esp, 4
push esi
push str.C:Program_Filesww2017cfwmcUser7.exe
call fcn.0040e72e
add esp, 8
test eax, eax
jne 0x40c55a
lea eax, [ebp - 0x848]
push eax
mov dword [ebp - 0x848], 0x3c
mov dword [ebp - 0x844], 0x40
mov dword [ebp - 0x840], esi
mov dword [ebp - 0x83c], esi
mov dword [ebp - 0x838], 0x41a750
mov dword [ebp - 0x834], str.__ucbfs
mov dword [ebp - 0x830], str.C:Program_Filesww2017cf
mov dword [ebp - 0x82c], esi
mov dword [ebp - 0x828], esi
call ebx
push 0x422c5c
call fcn.004033d0
add esp, 4
call fcn.00407b80
cmp eax, 1
je 0x40c543
inc edi
cmp edi, 3
jle 0x40c440
push 0x422d78
call fcn.004033d0
add esp, 4
mov esi, str.SYSTEMCurrentControlSetServicescbregistry20
mov ecx, 0x80000002
call fcn.0040a170
lea ecx, [ebp - 0x808]
push str._____
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edx, [ebp - 0x808]
push edx
call fcn.004033d0
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x80c]
add esp, 0xc
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040d7f6
mov esp, ebp
pop ebp
ret
push str.C:Program_Filesww2017cfcbregistry.cab
mov dword [ebp - 0x80c], 1
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x40c50b
mov dword [ebp - 0x80c], 2
push str.wmcUser7.exe
jmp 0x40c4f4