joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100356d0
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x10]
push esi
movzx esi, word [esp + 0x18]
push edi
cmp ebx, 0x20
jb 0x1003576a
push ebp
mov ebp, ebx
shr ebp, 5
nop dword [eax + eax]
lea eax, [esp + 0x14]
push 0x20
push eax
call fcn.10035890
mov edi, eax
add esp, 8
mov ecx, edi
shr eax, 8
shr ecx, 0x10
sub ebx, 0x20
xor ecx, esi
shl esi, 8
shr ecx, 8
movzx ecx, cl
movzx edx, word [ecx*2 + 0x100836e8]
xor edx, esi
xor eax, edx
shl edx, 8
shr eax, 8
movzx eax, al
movzx ecx, word [eax*2 + 0x100836e8]
mov eax, edi
xor ecx, edx
xor eax, ecx
shl ecx, 8
shr eax, 8
movzx eax, al
movzx edx, word [eax*2 + 0x100836e8]
xor edx, ecx
mov eax, edx
shl edx, 8
shr eax, 8
xor eax, edi
movzx eax, al
movzx esi, word [eax*2 + 0x100836e8]
xor esi, edx
sub ebp, 1
jne 0x100356f0
pop ebp
mov eax, ebx
shr eax, 3
sub eax, 1
je 0x100357ca
sub eax, 1
je 0x100357a4
sub eax, 1
jne 0x100357f3
lea eax, [esp + 0x10]
push 8
push eax
call fcn.10035890
mov ecx, esi
add esp, 8
shr ecx, 8
xor eax, ecx
shl esi, 8
movzx eax, al
movzx eax, word [eax*2 + 0x100836e8]
xor esi, eax
lea eax, [esp + 0x10]
push 8
push eax
call fcn.10035890
mov ecx, esi
add esp, 8
shr ecx, 8
xor eax, ecx
shl esi, 8
movzx eax, al
movzx eax, word [eax*2 + 0x100836e8]
xor esi, eax
lea eax, [esp + 0x10]
push 8
push eax
call fcn.10035890
mov ecx, esi
add esp, 8
shr ecx, 8
xor eax, ecx
shl esi, 8
movzx eax, al
movzx eax, word [eax*2 + 0x100836e8]
xor esi, eax
and ebx, 7
test ebx, ebx
je 0x10035820
lea eax, [esp + 0x10]
push 1
push eax
lea edi, [esi + esi]
call fcn.10035890
shr esi, 0xf
add esp, 8
xor eax, esi
mov esi, edi
xor esi, 0x8005
test al, 1
cmove esi, edi
sub ebx, 1
jne 0x100357f7
pop edi
mov ax, si
pop esi
pop ebx
ret
Function at 0x10039c60
Capabilities:
Encrypt data using aes
Reference aes constants

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
lea ebp, [eax*4 + 4]
xor esi, esi
mov dword [esp + 0x10], ebp
mov dword [esp + 0x18], 0x10095688
test edi, edi
je 0x10039cbb
mov eax, dword [esp + 0x24]
add eax, 2
movzx edx, byte [eax + 1]
lea eax, [eax + 4]
movzx ecx, byte [eax - 4]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 5]
shl edx, 8
or edx, ecx
movzx ecx, byte [eax - 6]
shl edx, 8
or edx, ecx
mov dword [ebx + esi*4], edx
inc esi
cmp esi, edi
jb 0x10039c91
mov esi, edi
cmp edi, ebp
jae 0x10039d8d
mov ebp, ebx
xor edx, edx
mov ebx, dword [ebx + esi*4 - 4]
mov eax, esi
div edi
test edx, edx
jne 0x10039d26
movzx eax, bl
mov edx, dword [esp + 0x18]
movzx ecx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
mov eax, ebx
shr eax, 0x10
movzx eax, al
shr ebx, 8
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx ebx, byte [eax + str.cw]
movzx eax, byte [edx]
or ebx, ecx
xor ebx, eax
inc edx
mov dword [esp + 0x18], edx
jmp 0x10039d73
cmp edi, 6
jbe 0x10039d73
cmp edx, 4
jne 0x10039d73
mov eax, ebx
shr eax, 0x10
movzx eax, al
movzx ecx, byte [eax + str.cw]
mov eax, ebx
shr eax, 0x18
movzx eax, byte [eax + str.cw]
shl eax, 8
or ecx, eax
mov eax, ebx
shr eax, 8
movzx eax, al
shl ecx, 8
movzx eax, byte [eax + str.cw]
or ecx, eax
movzx eax, bl
shl ecx, 8
movzx ebx, byte [eax + str.cw]
or ebx, ecx
mov eax, dword [ebp]
add ebp, 4
xor eax, ebx
mov ebx, dword [esp + 0x20]
mov dword [ebx + esi*4], eax
inc esi
cmp esi, dword [esp + 0x10]
jb 0x10039cc7
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x1003b063
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
lea edx, [ecx + 0x18]
add edx, eax
movzx eax, word [ecx + 6]
imul esi, eax, 0x28
add esi, edx
jmp 0x1003b098
mov ecx, dword [edx + 0xc]
cmp dword [ebp + 0xc], ecx
jb 0x1003b095
mov eax, dword [edx + 8]
add eax, ecx
cmp dword [ebp + 0xc], eax
jb 0x1003b0a1
add edx, 0x28
cmp edx, esi
jne 0x1003b083
xor eax, eax
pop esi
pop ebp
ret
mov eax, edx
jmp 0x1003b09e

Function at 0x10041b7f
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10041bbe
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10041bbe
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10041bbe
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10041bbe
cmp dword [ecx + 0x74], 0xe
jbe 0x10041bbe
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x10043db2
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100982e8
push 0x100982e0
push str.FlsAlloc
push 0x1f
call fcn.10043cce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043de6
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006f160]
call esi
jmp 0x10043dec
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x10043e30
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x100982f8
push 0x100982f0
push str.FlsGetValue
push 0x21
call fcn.10043cce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043e67
push dword [ebp + 8]
mov ecx, esi
call dword [0x1006f160]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x10043e6f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x10098300
push 0x100982f8
push str.FlsSetValue
push 0x22
call fcn.10043cce
mov esi, eax
add esp, 0x10
test esi, esi
je 0x10043ea9
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x1006f160]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x100483bd
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1004845a
push ebx
push esi
call fcn.10048386
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1004831a
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10048407
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10048459
push edi
push eax
call fcn.10043ab7
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10048427
call fcn.10043a7d
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10048458
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1004831a
add esp, 0x20
test eax, eax
jne 0x10048446
push edi
call fcn.10043a7d
jmp 0x1004844e
push ebx
call fcn.10043a7d
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x10066840
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, dword [esp + 0x44]
push ebp
mov ebp, dword [esp + 0x5c]
cmp ebx, 0x11
jl 0x1006688b
cmp ebp, 0x11
jl 0x1006688b
push dword [esp + 0x60]
push ebp
push dword [esp + 0x60]
push dword [esp + 0x60]
push dword [esp + 0x60]
push dword [esp + 0x60]
push ebx
push dword [esp + 0x60]
push dword [esp + 0x60]
push dword [esp + 0x60]
push dword [esp + 0x60]
call fcn.10066a50
add esp, 0x2c
pop ebp
pop ebx
add esp, 0x2c
ret
mov edx, dword [esp + 0x60]
lea ecx, [ebx + ebp]
shl ecx, 2
mov dword [esp + 0x24], ecx
push esi
mov esi, dword [esp + 0x40]
lea eax, [edx + ebx*4]
mov dword [esp + 0x20], eax
add eax, ecx
mov ecx, dword [esp + 0x54]
cmp ebx, ebp
mov dword [esp + 0x24], eax
mov eax, ebp
cmovl ecx, edx
mov dword [esp + 0x2c], 2
mov dword [esp + 0x30], ecx
cmovl eax, ebx
mov ecx, ebx
mov dword [esp + 0x4c], eax
cmovl ecx, ebp
mov dword [esp + 0xc], ecx
mov ecx, edx
cmovl ecx, dword [esp + 0x54]
push edi
mov edi, dword [esp + 0x40]
mov dword [esp + 0x38], ecx
push ebx
push edi
push edx
call fcn.10001160
mov eax, dword [esp + 0x68]
add esp, 0xc
cmp ebx, ebp
jl 0x10066911
mov ecx, dword [esp + 0x54]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x60]
mov dword [esp + 0x14], eax
mov eax, edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x18], esi
jmp 0x1006692b
mov dword [esp + 0x20], eax
mov ecx, edi
mov eax, dword [esp + 0x60]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x54]
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
push dword [esp + 0x50]
push ecx
push dword [esp + 0x18]
push eax
push dword [esp + 0x34]
call fcn.10052eb0
push dword [esp + 0x64]
push dword [esp + 0x2c]
push dword [esp + 0x2c]
push dword [esp + 0x38]
push dword [esp + 0x4c]
call fcn.10052eb0
push dword [esp + 0x78]
push dword [esp + 0x48]
push dword [esp + 0x40]
push dword [esp + 0x54]
push edi
call fcn.10052eb0
push dword [esp + 0x8c]
push dword [esp + 0x74]
push dword [esp + 0x54]
push dword [esp + 0x80]
push esi
call fcn.10052eb0
add esp, 0x50
lea eax, [ebx + ebp]
push eax
push dword [esp + 0x28]
push edi
push edi
call section..text
mov ecx, dword [esp + 0x3c]
mov dword [ecx + edi], eax
lea eax, [ebx + ebp]
push eax
push dword [esp + 0x3c]
push esi
push esi
call section..text
mov ecx, dword [esp + 0x4c]
add esp, 0x20
sub dword [esp + 0x30], 1
mov edi, dword [esp + 0x48]
mov edx, dword [esp + 0x68]
mov dword [ecx + esi], eax
mov esi, dword [esp + 0x4c]
jne 0x100668e2
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x2c
ret
Function at 0x1006b730
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
movaps xmm3, xmmword [0x1009e950]
xorps xmm6, xmm6
movaps xmm4, xmmword [0x1009e960]
mov ecx, 0x1c
movaps xmm5, xmmword [0x1009e940]
mov edx, 0xe0
movaps xmm7, xmmword [0x1009e970]
push esi
mov esi, dword [esp + 8]
lea eax, [esi + 0x634]
nop dword [eax]
nop dword [eax + eax]
lea eax, [eax + 0x20]
movaps xmm1, xmm4
movups xmm0, xmmword [eax - 0x654]
movups xmm2, xmmword [eax - 0x650]
andps xmm1, xmm0
andps xmm2, xmm3
orps xmm2, xmm1
movaps xmm1, xmm5
andps xmm1, xmm2
psrld xmm2, 1
pcmpeqd xmm1, xmm6
andnps xmm1, xmmword [0x1009e980]
andps xmm1, xmm7
movups xmm0, xmmword [eax - 0x20]
xorps xmm1, xmm0
xorps xmm1, xmm2
movups xmmword [eax - 0x654], xmm1
movaps xmm1, xmm5
movups xmm2, xmmword [eax - 0x640]
movups xmm0, xmmword [eax - 0x644]
andps xmm2, xmm3
andps xmm0, xmm4
orps xmm2, xmm0
andps xmm1, xmm2
psrld xmm2, 1
pcmpeqd xmm1, xmm6
andnps xmm1, xmmword [0x1009e980]
andps xmm1, xmm7
movups xmm0, xmmword [eax - 0x10]
xorps xmm1, xmm0
xorps xmm1, xmm2
movups xmmword [eax - 0x644], xmm1
sub ecx, 1
jne 0x1006b770
mov ecx, dword [esi + edx*4 + 4]
xor ecx, dword [esi + edx*4]
and ecx, 0x7fffffff
xor ecx, dword [esi + edx*4]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + edx*4 + 0x634]
xor eax, ecx
mov dword [esi + edx*4], eax
inc edx
cmp edx, 0xe3
jl 0x1006b801
mov eax, 0xe3
nop dword [eax]
mov edx, dword [esi + eax*4 + 4]
xor edx, dword [esi + eax*4]
and edx, 0x7fffffff
xor edx, dword [esi + eax*4]
mov ecx, edx
and cl, 1
movzx ecx, cl
neg ecx
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [esi + eax*4 - 0x38c]
xor ecx, edx
mov dword [esi + eax*4], ecx
inc eax
cmp eax, 0x26f
jl 0x1006b840
mov eax, dword [esi + 0x9bc]
mov ecx, dword [esi]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x630]
xor eax, ecx
mov dword [esi + 0x9bc], eax
pop esi
ret

Function at 0x1006ce20
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1006ce4d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006ce4d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4010c0
Capabilities:
Link many functions at runtime

Disassembly:
push ebx
push ebp
push esi
mov esi, ecx
push edi
push str.NMSAPI.DLL
lea ebp, [esi + 4]
mov dword [ebp], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
mov dword [esi + 8], eax
je 0x4011b5
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NMSBeginSession
push eax
call edi
mov ebx, eax
mov eax, dword [esi + 8]
push str.NMSEndSession
push eax
call edi
mov ecx, dword [esi + 8]
push str.NMSEnumerateAdapters
push ecx
mov dword [esi + 0x5a8], eax
call edi
mov edx, dword [esi + 8]
push str.NMSGetAdapterCount
push edx
mov dword [esi + 0x5ac], eax
call edi
mov dword [esi + 0x5b0], eax
mov eax, dword [esi + 8]
push str.NMSGetAdapterStatus
push eax
call edi
mov ecx, dword [esi + 8]
push str.NMSGetAdapter
push ecx
mov dword [esi + 0x5b4], eax
call edi
test ebx, ebx
mov dword [esi + 0x5b8], eax
je 0x4011b5
mov eax, dword [esi + 0x5a8]
test eax, eax
je 0x4011b5
mov eax, dword [esi + 0x5ac]
test eax, eax
je 0x4011b5
mov eax, dword [esi + 0x5b0]
test eax, eax
je 0x4011b5
mov eax, dword [esi + 0x5b4]
test eax, eax
je 0x4011b5
push esi
push ebp
push 0
call ebx
add esp, 0xc
test eax, eax
jl 0x4011b5
mov edx, dword [esi]
lea edi, [esi + 0xc]
push edi
push edx
call dword [esi + 0x5b0]
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0x4011ab
mov ecx, dword [esi]
lea eax, [esi + 0x10]
push eax
push edi
push ecx
call dword [esi + 0x5ac]
add esp, 0xc
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
ret
Function at 0x401380
Capabilities:
Query or enumerate registry value

Disassembly:
jmp 0x403f40
sub esp, 0x30c
push 0x10000000
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0x100
mov dword [esp + 4], 0
call fcn.00403de0
add esp, 4
test eax, eax
je 0x403f7b
lea eax, [esp + 0xc]
push str.SYSTEMCurrentControlSetServicesClassNet
push eax
jmp 0x403f9f
push 0x10
call fcn.00403de0
add esp, 4
test eax, eax
je 0x403f95
lea ecx, [esp + 0xc]
push str.SYSTEMCurrentControlSetControlClass4D36E972_E325_11CE_BFC1_08002BE10318
push ecx
jmp 0x403f9f
lea edx, [esp + 0xc]
push str.SYSTEMCurrentControlSetServicesWLA11ND4
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push esi
xor esi, esi
push 0x20
mov dword [esp + 0x10], 0
call fcn.00403de0
add esp, 4
test eax, eax
push esi
je 0x403fe1
lea eax, [esp + 0x1c]
lea ecx, [esp + 0x11c]
push eax
push str._s_dParameters
push ecx
jmp 0x403ff3
lea edx, [esp + 0x1c]
lea eax, [esp + 0x11c]
push edx
push str._s_04d
push eax
call fcn.004044ce
add esp, 0x10
lea ecx, [esp + 0xc]
lea edx, [esp + 0x118]
push ecx
push 0x20019
push 0
push edx
push 0x80000002
call ebx
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40406b
lea ecx, [esp + 0x10]
lea edx, [esp + 0x218]
push ecx
lea ecx, [esp + 0x18]
push edx
push ecx
push 0
push str.CLSGUID
push eax
mov dword [esp + 0x28], 0x100
call ebp
lea edx, [esp + 0x218]
push edx
call fcn.00403b00
add esp, 4
test eax, eax
mov eax, dword [esp + 0xc]
jne 0x40408c
test eax, eax
je 0x40406b
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov dword [esp + 0xc], eax
inc esi
cmp esi, 0x64
jl 0x403fb6
test eax, eax
je 0x404080
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x30c
ret
test eax, eax
je 0x404097
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30c
ret

Function at 0x402730
Capabilities:
Create process on windows

Disassembly:
mov ecx, dword [0x40f544]
sub esp, 0x100
lea eax, [esp]
push 0xff
push eax
push 0x7534
push ecx
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp]
push 5
push edx
call dword [sym.imp.KERNEL32.dll_WinExec]
add esp, 0x100
ret

Function at 0x402770
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x110
mov ecx, dword [0x40f544]
mov eax, 4
mov dword [esp + 0xc], eax
mov dword [esp + 8], eax
lea eax, [esp + 0x10]
push 0xff
push eax
push 0x7533
push ecx
mov dword [esp + 0x14], 1
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp]
lea eax, [esp + 0x10]
push edx
push 0x2001f
push 0
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp]
test eax, eax
je 0x4027ec
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
lea ecx, [esp + 0x10]
push edx
push ecx
push 0
push str.TrayIcon
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [esp + 4]
add esp, 0x110
ret
Function at 0x402800
Capabilities:
Persist via run registry key
Query or enumerate registry value

Disassembly:
sub esp, 0x310
push esi
lea eax, [esp + 0x10]
push 0x104
xor esi, esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
lea edx, [esp + 0x214]
push ecx
push edx
push esi
lea eax, [esp + 0x1c]
push esi
push eax
call fcn.0040465f
lea ecx, [esp + 0x128]
lea edx, [esp + 0x228]
push ecx
push edx
push esi
lea eax, [esp + 0x30]
push esi
push eax
call fcn.004045ce
add esp, 0x28
lea ecx, [esp + 4]
mov dword [esp + 8], 1
mov dword [esp + 0xc], esi
push ecx
push 0x20019
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 4]
cmp eax, esi
je 0x4028a5
lea edx, [esp + 0xc]
lea ecx, [esp + 8]
push edx
push esi
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x4028a5
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x310
ret

Function at 0x4028c0
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
sub esp, 0x308
lea eax, [esp + 4]
push ebx
push esi
push edi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x114]
lea edx, [esp + 0x214]
push ecx
push edx
push 0
lea eax, [esp + 0x1c]
push 0
push eax
call fcn.0040465f
lea ecx, [esp + 0x128]
lea edx, [esp + 0x228]
push ecx
push edx
push 0
lea eax, [esp + 0x30]
push 0
push eax
call fcn.004045ce
lea edi, [esp + 0x38]
or ecx, 0xffffffff
xor eax, eax
add esp, 0x28
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov esi, ecx
lea ecx, [esp + 0xc]
push ecx
push 0x2001f
push eax
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
inc esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40296e
lea edx, [esp + 0x10]
push esi
push edx
push 1
lea ecx, [esp + 0x1c]
push ebx
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x40296e
mov ebx, 1
mov edx, dword [esp + 0xc]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
mov eax, ebx
pop esi
pop ebx
add esp, 0x308
ret

Function at 0x402990
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10c
mov ecx, dword [0x40f544]
push esi
lea eax, [esp + 0x10]
push 0xff
push eax
xor esi, esi
push 0xce
push ecx
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], esi
call dword [sym.imp.USER32.dll_LoadStringA]
lea edx, [esp + 4]
lea eax, [esp + 0x10]
push edx
push 0x20019
push esi
push eax
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 4]
cmp eax, esi
je 0x402a05
lea ecx, [esp + 8]
lea edx, [esp + 0xc]
push ecx
push esi
push edx
push esi
push str.Name
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x402a05
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret
Function at 0x402a20
Capabilities:
Delete registry value
Persist via run registry key

Disassembly:
sub esp, 0x308
lea eax, [esp + 4]
push esi
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea ecx, [esp + 0x10c]
lea edx, [esp + 0x20c]
push ecx
push edx
push 0
lea eax, [esp + 0x14]
push 0
push eax
call fcn.0040465f
lea ecx, [esp + 0x120]
lea edx, [esp + 0x220]
push ecx
push edx
push 0
lea eax, [esp + 0x28]
push 0
push eax
call fcn.004045ce
add esp, 0x28
lea ecx, [esp + 4]
xor esi, esi
push ecx
push 0x2001f
push esi
push str.SOFTWAREMicrosoftWindowsCurrentVersionRun
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [esp + 4]
test eax, eax
je 0x402ab2
lea edx, [esp + 8]
push edx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
test eax, eax
jne 0x402ab2
mov esi, 1
mov eax, dword [esp + 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x308
ret
Function at 0x403de0
Capabilities:
Check os version

Disassembly:
sub esp, 0x94
push edi
mov ecx, 0x25
xor eax, eax
lea edi, [esp + 4]
rep stosd dword es:[edi], eax
lea eax, [esp + 4]
mov dword [esp + 4], 0x94
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [esp + 0x9c]
pop edi
cmp eax, 0x10
jg 0x403ee1
je 0x403ec7
dec eax
je 0x403e99
dec eax
je 0x403e5e
sub eax, 2
jne 0x403f34
cmp dword [esp + 0x10], 1
jne 0x403f34
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x403e52
jne 0x403f34
cmp dword [esp + 8], 0x59
jbe 0x403f34
mov eax, 1
add esp, 0x94
ret
cmp dword [esp + 0x10], 1
jne 0x403f34
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x403e8d
jne 0x403f34
mov eax, dword [esp + 8]
test eax, eax
jbe 0x403f34
cmp eax, 0x5a
jae 0x403f34
mov eax, 1
add esp, 0x94
ret
cmp dword [esp + 0x10], 1
jne 0x403f34
mov eax, dword [esp + 4]
cmp eax, 4
ja 0x403f34
jne 0x403ebb
mov eax, dword [esp + 8]
test eax, eax
ja 0x403f34
mov eax, 1
add esp, 0x94
ret
cmp dword [esp + 0x10], 2
jne 0x403f34
cmp dword [esp + 4], 5
jne 0x403f34
mov eax, 1
add esp, 0x94
ret
cmp eax, 0x20
je 0x403f1a
cmp eax, 0x10000000
je 0x403f07
cmp eax, 0x20000000
jne 0x403f34
cmp dword [esp + 0x10], 2
jne 0x403f34
mov eax, 1
add esp, 0x94
ret
cmp dword [esp + 0x10], 1
jne 0x403f34
mov eax, 1
add esp, 0x94
ret
cmp dword [esp + 0x10], 2
jne 0x403f34
cmp dword [esp + 4], 4
ja 0x403f34
mov eax, 1
add esp, 0x94
ret
xor eax, eax
add esp, 0x94
ret
Function at 0x401240
Capabilities:
Get file attributes
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push str.APPDATA
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor ecx, ecx
cmp ecx, eax
sbb eax, eax
and eax, 0x7ff8ffa9
add eax, 0x80070057
js 0x4012ca
push str.MicrosoftWindowsStart_MenuProgramsRtkToastMsg2.lnk
lea eax, [ebp - 0x20c]
push 0x104
push eax
call fcn.004014b8
add esp, 0xc
neg eax
sbb eax, eax
and eax, 0x80070057
jl 0x4012ca
push 0x40dd80
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xfffffff
jb 0x4012c5
call section..text
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401373
mov esp, ebp
pop ebp
ret
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401373
mov esp, ebp
pop ebp
ret