joyce8/EMBER2024-capa huggingface dataset:
Function at 0xae15cf
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0xf0acb0dc
jmp 0xae1642
mov word [esp + 1], di
pop word [esp]
pushfd
jmp 0xae15df
mov word [esp + 3], bp
lea esp, [esp + 2]
mov dword [esp + 0x18], edi
lea esp, [esp + 0x18]
jmp 0xae1725
mov ch, byte [esp]
lea ecx, [edi*4]
jmp 0xae1622
bsf di, bx
jmp 0xae1606
mov esi, dword [esp + 0x2c]
lea ecx, [ebx*4]
popfd
add byte [eax], al
add byte [eax], al
not bl
sub esp, 0xc
jne 0xae1693
pop dword [esp + 1]
call fcn.00ae165a
scasb al, byte es:[edi]
mov ecx, 0x81d2fb98
in eax, dx
jmp 0xae1628
sub ebp, 0x58c4e2eb
je 0xae161c
bsf di, bx
mov ch, byte [esp]
lea ecx, [edi*4]
jmp 0xae1622
pop dword [esp + 1]
lea edi, [esp + 8]
lea ecx, [edx + edx]
mov eax, edx
btc ecx, ecx
je 0xae1705
jne 0xae17fe
xor dh, byte [edx + ebp + 0x210cbc4d]
jmp 0xae1670
jmp 0xae17fe
mov ecx, ebx
mov ebx, esi
mov al, byte [esp]
xchg dh, cl
shl ch, 0
js 0xae17a3
cmc
inc cl
jmp 0xae1741
pushfd
jmp 0xadfc9d
bswap ecx
xchg ecx, eax
jmp 0xae174b
dec ax
btr eax, eax
mov edx, dword [esp]
jmp 0xae1776
not esi
sub esp, 0xf
jnp 0xae177a
rcl edx, 3
xchg dword [esp + 3], ecx
lea edx, [eax - 5]
cmp ecx, 0xdeaf105c
neg cx
jmp 0xae17cd
cmc
inc cl
dec ax
btr eax, eax
mov edx, dword [esp]
mov cl, 0xb1
jmp 0xae172b
rcl edx, 3
jmp 0xae1783
xchg dword [esp + 3], ecx
lea edx, [eax - 5]
cmp ecx, 0xdeaf105c
jmp 0xae17ca
jmp 0xae176b
bsf edx, ecx
jge 0xae17dd
mov al, 0x3c
stc
jmp 0xae17e2
bsf dx, bx
jmp 0xae1849
neg cx
lea esp, [esp + 3]
lea esp, [esp + 0xc]
xor esi, 0x39a6a9f9
jmp 0xae17a5
mov al, 0x3c
stc
jmp 0xae17b3
bsf dx, bx
jmp 0xae1849
xchg cl, dh
mov ah, ch
mov dx, word [esp]
mov ecx, 0x6f48ee13
jmp 0xae1830
sub esp, 0xb8
mov ebp, esp
mov eax, esp
setl dl
jmp 0xae170a
mov ecx, 0x6f48ee13
jmp 0xae1830
xchg cl, dh
mov ah, ch
mov dx, word [esp]
jmp 0xae1810
dec esi
mov ah, 0x85
bsr ax, si
jne 0xae1869
invalid
je 0xae1853
push cs
sahf
or al, 0x6b
cmpsb byte [esi], byte es:[edi]
jl 0xae1836
arpl word [esi], ax
cmc
inc esp
jbe 0xae18aa
inc esi
mov al, ah
neg ax
jg 0xae17e8
jle 0xae1826
mov ax, word [esp]
xchg dl, al
xchg ah, dl
jmp 0xae1890
mov ax, word [esp]
xchg dl, al
xchg ah, dl
sub esp, 8
stc
mov edx, esp
mov ah, byte [esp + 1]
jmp 0xae1896
sub esp, 8
stc
jmp 0xae1875
lea esp, [esp + 8]
dec esi
lea edx, [ecx + edi]
mov dx, 0x7fa5
push esp
jmp 0xae191d
push edi
mov ch, 0x2e
mov esp, 0xbf8136db
lea eax, [eax + 0x17]
inc dl
jmp 0xae18d4
jmp 0xae18c9
mov dl, bh
add esi, dword [edi]
lea edx, reloc.WINMM.dll_midiStreamStop
dec al
jg 0xae18ea
lea eax, [eax + 0x17]
inc dl
jmp 0xae18d4
Function at 0xbff612
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [edx - 0xf5]
cmc
setns bl
mov ax, dx
jmp 0xbff61f
mov ax, 0xcbfc
mov dword [esp + 7], esi
bt bx, dx
pop edx
rol eax, cl
bswap edx
jmp 0xbff5d7
bts ax, sp
lea edx, [edx*4]
jmp 0xbff5ed
mov dword [esp + 0xa], esp
xchg edx, eax
std
push word [esp + 8]
lea edx, [esi*4]
xchg edx, ebx
jmp 0xbff6ef
xchg dword [esp + 4], edx
ror edx, cl
mov dx, di
push dword [esp + 5]
sub esp, 0x16
mov ah, 0xcb
jmp 0xbff6aa
push edx
xchg byte [esp + 0xc], bl
rdtsc
setge al
inc dl
rdtsc
jmp 0xbff65e
add esp, 6
mov dh, byte [esp + 0xa]
push dword [esp + 0xf]
rdtsc
rdtsc
jmp 0xbff6d6
pop word [esp + 0x1b]
pop edx
xchg word [esp + 0x15], dx
xchg dword [esp + 0x12], ebx
add esp, 0xd
xchg edx, eax
jmp 0xbff694
mov eax, 0x7a00af4b
push dword [esp + 4]
mov bl, byte [esp + 5]
jmp 0xbff736
xchg word [esp + 0xf], dx
mov bh, 0x53
xchg ah, dh
neg ax
mov word [esp + 1], di
jmp 0xbff6c0
lea eax, [edx*4]
bt bx, dx
mov edx, eax
pop dx
rcr bx, cl
pop eax
jmp 0xbff684
lea edx, [esp + esi]
mov ebx, ecx
std
pop dx
btr eax, edx
add esp, 0
jmp 0xbff78a
mov eax, 0x3d3f581c
pop word [esp]
mov bx, di
push word [esp + 1]
pop edx
xchg word [esp], ax
jmp 0xbff704
lea ebx, [ebx*4]
pop bx
mov dl, ch
lea esp, [esp + 0x11]
mov bx, sp
setnp bh
jmp 0xbff71a
mov ebx, edx
xchg al, dl
xchg al, dl
lea esp, [esp]
mov ah, byte [esp]
stc
jmp 0xbff7de
mov edx, dword [esp]
lea edx, [eax + edx]
add esp, 0
and edx, esp
lea edx, [ebp - 0x37]
mov ah, dh
jmp 0xbff74d
rdtsc
bswap edx
mov ax, bx
bsf bx, di
mov byte [esp], cl
shr al, cl
jmp 0xbff763
lea edx, [ecx*4]
dec bh
xchg ebx, edx
xchg al, dl
not dx
jmp 0xbff7c8
mov bx, cx
mov al, 0x52
mov byte [esp + 9], ah
ror dx, 1
mov eax, dword [esp + 5]
mov eax, dword [esp + 8]
jmp 0xbff79c
mov ah, byte [esp + 4]
mov edx, dword [esp + 4]
lea edx, [esp + ebp]
pop bx
jmp 0xbff7f0
sub edx, esp
mov bl, byte [esp]
xchg ebx, eax
sete bh
mov dx, cx
sub esp, 0xe
jmp 0xbff7b2
pop dword [esp + 3]
inc bx
bsr dx, dx
bswap ebx
pop dword [esp]
mov bx, 0xf2d1
jmp 0xbff8ab
setns bh
xchg dh, al
call 0xbff82a
btc edx, ebx
push word [esp + 7]
dec edx
mov word [esp + 8], dx
cmc
cld
jmp 0xbff882
pop dword [esp + 2]
mov dh, 0xde
xchg edx, eax
pop bx
mov eax, edx
jmp 0xbff84a
not dx
lea eax, reloc.WINMM.dll_midiStreamStop
mov bx, 0xeb06
lea eax, [esi*4]
mov dword [esp + 1], ebx
call fcn.00bffafc
ror byte [edi - 0x21], 1
mov edx, 0x9d62d049
in al, dx
inc esi
jno 0xbff860
mov ah, 0xdc
mov al, 0xa8
lea edx, [esi + ebp]
fdiv qword [eax + 0x2e148da8]
lea ebx, reloc.WINMM.dll_midiStreamStop
lea eax, [eax + esi]
xchg dh, bl
jmp 0xbff840

Function at 0xbffa44
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea edx, reloc.WINMM.dll_midiStreamStop
neg eax
xchg word [esp], bx
jmp 0xbff9f1

Function at 0xbffa4c
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop dx
mov edx, 0xbd9dcddf
cmc
jmp 0xbffa87
push word [esp + 1]
xchg ebx, eax
mov al, bh
xchg al, dh
xchg byte [esp], dl
mov word [esp + 2], cx
jmp 0xbffa71
Function at 0xbffd58
Capabilities:
Access peb ldr_data

Disassembly:
call fcn.00bfecca
push dword [esp + 3]
jmp 0xbffd9c
mov dword [esp + 0x24], esi
push ebx
mov dword [esp], esp
pushal
mov word [esp + 0xf], cx
mov dword [esp + 0x44], edi
jmp 0xbffdef
mov eax, dword [eax + 0x1c]
jmp 0xbffdfe
lea esp, [esp + 0x44]
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
jmp 0xbffdd7
mov eax, dword [eax]
mov eax, dword [eax + 8]
push eax
jmp 0xbfecc5
Function at 0x402300
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, ecx
cmp esi, 1
jne 0x402349
mov eax, dword [ebx + 0x10]
mov ecx, dword [ebx + 0x14]
mov edx, dword [ebx + 0x18]
push eax
mov eax, dword [ebx + 0x1c]
push ecx
mov ecx, dword [edi + 0x78]
push edx
push eax
lea esi, [edi + 0xb0]
push ecx
call fcn.004025c0
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push ebx
push edx
push esi
mov ecx, edi
call fcn.00412f60
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp esi, 0x18
jne 0x4023c4
mov edx, dword [edi + 0xb0]
push edx
call dword [sym.imp.USER32.dll_IsWindow]
cmp dword [ebp + 0xc], 0
je 0x40239d
test eax, eax
je 0x4023f7
mov eax, dword [edi + 0xb0]
push 5
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [edi + 0xb0]
push 1
push 0
push ecx
call dword [sym.imp.USER32.dll_InvalidateRect]
mov edx, dword [ebp + 0xc]
push ebx
push edx
push esi
mov ecx, edi
call fcn.00412f60
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
test eax, eax
je 0x4023f7
mov eax, dword [edi + 0xb0]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [ebp + 0xc]
push ebx
push edx
push esi
mov ecx, edi
call fcn.00412f60
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
cmp esi, 3
jne 0x4023f7
push 0x25
mov ecx, ebx
shr ecx, 0x10
push 0
movsx edx, cx
sub edx, dword [edi + 0xb8]
mov ecx, dword [edi + 0xb0]
push 0
movsx eax, bx
sub eax, dword [edi + 0xb4]
push edx
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_SetWindowPos]
mov edx, dword [ebp + 0xc]
push ebx
push edx
push esi
mov ecx, edi
call fcn.00412f60
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x402630
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esi]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x402655
mov ecx, dword [esi]
push 5
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [esi]
push 1
push 0
push edx
call dword [sym.imp.USER32.dll_InvalidateRect]
ret
Function at 0x403b00
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454b56
mov eax, dword fs:[0]
push eax
sub esp, 0x7c
mov eax, dword [0x46d674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
mov dword [ebp - 0x88], esi
call fcn.004377e0
lea edx, [ebp - 0x48]
mov ecx, eax
call fcn.00436d60
push 0x4593ec
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], esi
call fcn.00404940
add esp, 0xc
mov byte [ebp - 4], 1
call fcn.004377e0
lea esi, [ebp - 0x80]
mov edx, eax
call fcn.004037c0
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x2c]
mov esi, 8
mov ebx, 1
mov dword [ebp - 0x88], ebx
cmp dword [ebp - 0x18], esi
jae 0x403b8c
lea ecx, [ebp - 0x2c]
cmp dword [eax + 0x14], esi
jb 0x403b93
mov eax, dword [eax]
push 0xea60
push ecx
push eax
call fcn.004087a0
add esp, 0xc
test eax, eax
jne 0x403be3
call fcn.004377e0
lea esi, [ebp - 0x64]
mov edx, eax
call fcn.00403730
mov ecx, eax
mov ebx, 3
mov dword [ebp - 4], ebx
mov eax, dword [ecx + 0x10]
push str.none
lea edi, [ebx + 1]
mov dword [ebp - 0x88], ebx
call fcn.00404ae0
lea esi, [ebx + 5]
mov byte [ebp - 0x81], 1
test eax, eax
jne 0x403bea
mov byte [ebp - 0x81], 0
test bl, 2
je 0x403c17
and ebx, 0xfffffffd
cmp dword [ebp - 0x50], esi
jb 0x403c03
mov edx, dword [ebp - 0x64]
push edx
call fcn.0043e981
add esp, 4
xor eax, eax
mov dword [ebp - 0x50], 7
mov dword [ebp - 0x54], 0
mov word [ebp - 0x64], ax
mov dword [ebp - 4], 1
test bl, 1
je 0x403c34
cmp dword [ebp - 0x6c], esi
jb 0x403c34
mov ecx, dword [ebp - 0x80]
push ecx
call fcn.0043e981
add esp, 4
cmp byte [ebp - 0x81], 0
je 0x403cb3
mov ecx, dword [ebp - 0x48]
cmp dword [ebp - 0x34], esi
jae 0x403c48
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x403c53
lea eax, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x403d05
call fcn.004377e0
lea esi, [ebp - 0x80]
mov edx, eax
call fcn.00403730
mov ecx, eax
mov byte [ebp - 4], 4
mov eax, dword [ecx + 0x10]
push str.allst
mov edi, 5
call fcn.00404ae0
test eax, eax
sete bl
mov byte [ebp - 4], 1
cmp dword [ebp - 0x6c], 8
jb 0x403ca5
mov edx, dword [ebp - 0x80]
push edx
call fcn.0043e981
add esp, 4
test bl, bl
je 0x403cae
call fcn.00404230
mov esi, 8
cmp dword [ebp - 0x18], esi
jb 0x403cc4
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0043e981
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
cmp dword [ebp - 0x34], esi
jb 0x403ce9
mov edx, dword [ebp - 0x48]
push edx
call fcn.0043e981
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e417
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x403d10
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x403cb3
Function at 0x404030
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454ad8
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x46d674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [ebp - 4], ebx
call fcn.004377e0
lea edx, [ebp - 0x2c]
mov ecx, eax
call fcn.00436d60
mov eax, dword [ebp - 0x2c]
mov edi, 8
cmp dword [ebp - 0x18], edi
jae 0x40407e
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4040f5
cmp byte [esi + 0x99], bl
je 0x4040f5
mov ecx, dword [ebp + 8]
mov byte [esi + 0x99], bl
cmp dword [ebp + 0x1c], edi
jae 0x4040a2
lea ecx, [ebp + 8]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x4040ad
lea eax, [ebp - 0x2c]
push 1
push ebx
push ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
jbe 0x4040f5
cmp dword [ebp - 0x18], edi
jb 0x4040d0
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0043e981
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], cx
cmp dword [ebp + 0x1c], edi
jb 0x4040f1
mov edx, dword [ebp + 8]
push edx
call fcn.0043e981
add esp, 4
mov al, 1
jmp 0x404129
cmp dword [ebp - 0x18], edi
jb 0x404106
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0043e981
add esp, 4
xor ecx, ecx
mov word [ebp - 0x2c], cx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], 7
cmp dword [ebp + 0x1c], edi
jb 0x404127
mov edx, dword [ebp + 8]
push edx
call fcn.0043e981
add esp, 4
xor al, al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e417
mov esp, ebp
pop ebp
ret 0x1c

Function at 0x404150
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x46d674]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call fcn.00438820
mov esi, eax
push 0
lea eax, [ebp - 0x20]
push 0x459b2c
push eax
mov dword [esi + 0x214], 0
call fcn.0040ad00
mov edi, 8
add esp, 0xc
cmp dword [esi + 0x14], edi
jb 0x404192
mov esi, dword [esi]
mov eax, dword [ebp - 0x20]
cmp dword [ebp - 0xc], edi
jae 0x40419d
lea eax, [ebp - 0x20]
push esi
push eax
push str.PrepareUpgrade
push str.Update
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 0xc], edi
jb 0x4041c0
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.0043e981
add esp, 4
call fcn.004377e0
lea edx, [ebp - 0x20]
mov ecx, eax
call fcn.00436d60
cmp dword [eax + 0x14], edi
jb 0x4041d6
mov eax, dword [eax]
mov esi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
push eax
call esi
cmp dword [ebp - 0xc], edi
jb 0x4041f0
mov edx, dword [ebp - 0x20]
push edx
call fcn.0043e981
add esp, 4
call fcn.004377e0
lea ecx, [ebp - 0x20]
call fcn.00436f60
cmp dword [eax + 0x14], edi
jb 0x404204
mov eax, dword [eax]
push eax
call esi
cmp dword [ebp - 0xc], edi
pop edi
pop esi
jb 0x40421a
mov eax, dword [ebp - 0x20]
push eax
call fcn.0043e981
add esp, 4
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e417
mov esp, ebp
pop ebp
ret
Function at 0x404230
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454aa0
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x46d674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
call fcn.00438820
mov esi, eax
push 1
lea eax, [ebp - 0x48]
push 0x459b2c
push eax
mov dword [esi + 0x214], 1
call fcn.0040ad00
mov edi, 8
add esp, 0xc
cmp dword [esi + 0x14], edi
jb 0x40428b
mov esi, dword [esi]
mov eax, dword [ebp - 0x48]
cmp dword [ebp - 0x34], edi
jae 0x404296
lea eax, [ebp - 0x48]
push esi
push eax
push str.PrepareUpgrade
push str.Update
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
cmp dword [ebp - 0x34], edi
jb 0x4042b9
mov ecx, dword [ebp - 0x48]
push ecx
call fcn.0043e981
add esp, 4
call fcn.004377e0
lea ecx, [ebp - 0x2c]
call fcn.00436ea0
lea edx, [ebp - 0x64]
push edx
lea ebx, [ebp - 0x2c]
mov dword [ebp - 4], 0
call fcn.00404a30
add esp, 4
mov edi, eax
mov esi, ebx
mov byte [ebp - 4], 1
call fcn.00403390
xor ebx, ebx
mov edi, 8
mov byte [ebp - 4], bl
cmp dword [ebp - 0x50], edi
jb 0x404304
mov eax, dword [ebp - 0x64]
push eax
call fcn.0043e981
add esp, 4
push 1
mov eax, 0x459418
lea ecx, [ebp - 0x2c]
call fcn.00403510
push edi
mov eax, 0x45941c
lea ecx, [ebp - 0x2c]
call fcn.00403510
lea esi, [ebp - 0x70]
mov dword [ebp - 0x70], ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 0x68], ebx
call fcn.0040a740
mov edx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], edi
jae 0x40433d
lea edx, [ebp - 0x2c]
mov eax, edx
lea esi, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x404342
sub eax, esi
mov esi, dword [ebp - 0x70]
sar eax, 1
lea ecx, [eax + eax + 2]
push ecx
push edx
push 1
push ebx
push 0x459494
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edi, dword [ebp - 0x6c]
cmp edi, ebx
je 0x404379
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor edi, edi
cmp esi, ebx
je 0x404386
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
cmp edi, ebx
je 0x404391
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, ebx
je 0x40439c
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 8
jb 0x4043ae
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0043e981
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e417
mov esp, ebp
pop ebp
ret
Function at 0x404840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
mov eax, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push SysStringLen
mov dword [ebp - 8], ebx
xor esi, esi
mov dword [ebp - 4], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x40487f
mov esi, dword [ebp - 4]
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x10]
push eax
push ebx
push str.EnableLUA
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
je 0x4048a7
push esi
call edi
xor esi, esi
cmp dword [ebp - 8], ebx
setne bl
test esi, esi
je 0x4048b4
push esi
call edi
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4048c0
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20006
xor esi, esi
push esi
push str.SoftwareMicrosoftWindowsCurrentVersionRunOnce
push Ordinal_4
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x4048eb
mov esi, dword [ebp - 4]
push 0x459494
push esi
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
test esi, esi
je 0x404902
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x405ed0
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454d10
mov eax, dword fs:[0]
push eax
sub esp, 0x40
mov eax, dword [0x46d674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
call fcn.004377e0
lea edx, [ebp - 0x48]
mov ecx, eax
call fcn.00436d60
push 0x4593ec
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
push ecx
mov dword [ebp - 4], 0
call fcn.00404940
add esp, 0xc
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x48]
mov esi, 8
cmp dword [ebp - 0x34], esi
jae 0x405f3b
lea ecx, [ebp - 0x48]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x405f46
lea eax, [ebp - 0x2c]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
jne 0x405f64
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x405f5d
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x470094
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp byte [edi + 0x79], 0
jne 0x405fac
cmp dword [ebp - 0x18], esi
jb 0x405f86
mov edx, dword [ebp - 0x2c]
push edx
call fcn.0043e981
add esp, 4
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], ax
cmp dword [ebp - 0x34], esi
jb 0x406041
mov ecx, dword [ebp - 0x48]
push ecx
jmp 0x406039
cmp dword [edi + 0x44], 0
je 0x406000
sub esp, 0x1c
mov esi, esp
mov dword [ebp - 0x4c], esp
xor edx, edx
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], 0
push 0xb
mov eax, str.menuupgrade
mov word [esi], dx
call fcn.00401490
mov esi, dword [edi + 0x44]
call fcn.00404030
test al, al
jne 0x405ffb
push 0
call fcn.00438820
mov ecx, eax
call fcn.00438790
mov eax, dword [edi]
mov edx, dword [eax]
mov ecx, edi
call edx
mov esi, 8
push 0x470094
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp dword [ebp - 0x18], esi
jb 0x40601c
mov eax, dword [ebp - 0x2c]
push eax
call fcn.0043e981
add esp, 4
xor ecx, ecx
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], 0
mov word [ebp - 0x2c], cx
cmp dword [ebp - 0x34], esi
jb 0x406041
mov edx, dword [ebp - 0x48]
push edx
call fcn.0043e981
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e417
mov esp, ebp
pop ebp
ret
Function at 0x406990
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x454748
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x46d674]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], 7
mov dword [ebp - 0x1c], ebx
mov word [ebp - 0x2c], ax
mov dword [ebp - 4], ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 0x4c], ebx
lea ecx, [ebp - 0x58]
push ecx
push 0x20019
push ebx
push str.SOFTWAREFunshionFunshion
mov byte [ebp - 4], 1
push SysStringLen
mov dword [ebp - 0x58], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, ebx
jne 0x406a07
mov edx, dword [ebp - 0x58]
mov dword [ebp - 0x54], edx
mov dword [ebp - 0x4c], ebx
lea eax, [ebp - 0x54]
push eax
lea edx, [ebp - 0x2c]
mov ecx, str.Install_Path
call fcn.0040a7b0
push str.Funshion.exe
lea ecx, [ebp - 0x2c]
push ecx
lea edx, [ebp - 0x48]
push edx
call fcn.00404940
add esp, 0xc
mov edi, eax
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.00403390
mov esi, 8
cmp dword [ebp - 0x34], esi
jb 0x406a51
mov eax, dword [ebp - 0x48]
push eax
call fcn.0043e981
add esp, 4
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], esi
jae 0x406a5c
lea eax, [ebp - 0x2c]
push 5
push ebx
push ebx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov eax, dword [ebp - 0x50]
cmp eax, ebx
je 0x406a7a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x50], ebx
mov eax, dword [ebp - 0x54]
cmp eax, ebx
je 0x406a8b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x54], ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor edi, edi
push 0
push str.FunshionMainFrame
call dword [sym.imp.USER32.dll_FindWindowW]
mov esi, eax
test esi, esi
jne 0x406ab5
push 0x1f4
call ebx
inc edi
cmp edi, 4
jl 0x406a93
jmp 0x406ad9
mov edi, dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call edi
push 3
push 0
push 0
push 0
push 0
push 0xfffffffffffffffe
push esi
call edi
mov eax, dword [ebp - 0x50]
test eax, eax
je 0x406ae7
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x54]
test eax, eax
je 0x406af5
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp - 0x18], 8
jb 0x406b07
mov ecx, dword [ebp - 0x2c]
push ecx
call fcn.0043e981
add esp, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0043e417
mov esp, ebp
pop ebp
ret