joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40d9a4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
call fcn.0040d057
mov edi, eax
test edi, edi
je 0x40da54
mov ecx, edi
call fcn.004013f0
test al, al
jne 0x40da54
call fcn.00415279
test al, al
jne 0x40da0f
push esi
mov edx, 0xc1440136
lea ecx, [ebp - 4]
call fcn.0043b4b9
push 0x10
push 0x486308
mov esi, eax
call sym.Dismx86.exe_DismMultiLanguage
push eax
mov eax, dword [edi + 8]
lea ecx, [edi + 8]
push dword [esi]
call dword [eax + 0x1c]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_MessageBoxW]
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0043c924
pop esi
jmp 0x40da54
push 0x490888
call sym.Dismx86.exe_DismMultiLanguage
push eax
mov ecx, edi
call fcn.0047dbc3
push 4
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
pop ecx
xor ecx, ecx
test eax, eax
je 0x40da34
mov dword [eax], edi
jmp 0x40da36
mov eax, ecx
push ecx
push ecx
push eax
push 0x43291d
push ecx
push ecx
call dword [sym.imp.msvcrt.dll__beginthreadex]
add esp, 0x18
test eax, eax
je 0x40da54
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
leave
ret 0x10
Function at 0x40e62d
Capabilities:
Check for time delay via gettickcount
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebx + 0x64]
xor esi, esi
cmp eax, 0xfa
jb 0x40e664
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 8]
mov dword [ebx + 0x64], eax
push esi
push 0x472
push dword [ebx + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
push str..dll
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call dword [sym.imp.SHLWAPI.dll_StrCmpIW]
test eax, eax
jne 0x40e70f
push esi
push esi
push 3
push esi
push 5
push 0x80000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp eax, 0xffffffff
jne 0x40e6a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40e6f3
push esi
push esi
push esi
push 2
push esi
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
push esi
push esi
push esi
push 4
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [ebp - 0xc], eax
test eax, eax
jne 0x40e6d5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x40e6eb
mov ecx, eax
call fcn.0044b986
push dword [ebp - 0xc]
mov bl, al
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
test bl, bl
je 0x40e6ff
lea ecx, [ebp - 4]
call fcn.0043ab9a
lea ecx, [ebp - 8]
call fcn.0043ab9a
mov eax, esi
jmp 0x40e71a
lea ecx, [ebp - 4]
call fcn.0043ab9a
lea ecx, [ebp - 8]
call fcn.0043ab9a
mov edx, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
call fcn.0044caf5
pop esi
pop ebx
leave
ret 8

Function at 0x40e828
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [esi + 0x64]
cmp eax, 0xfa
jb 0x40e85a
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push dword [ebp + 8]
mov dword [esi + 0x64], eax
push 0
push 0x472
push dword [esi + 0x60]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [ebp + 8]
call fcn.0044ca9c
pop esi
pop ebp
ret 4

Function at 0x40ec38
Capabilities:
Hide graphical window

Disassembly:
push esi
push edi
mov edi, ecx
push 0x3e9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push 0xffff
mov esi, eax
push 0xc5
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
mov edx, str.Data_UserAgreement
mov ecx, 0x4ab4f8
call fcn.0043a873
test eax, eax
je 0x40ec86
mov eax, dword [eax + 4]
test eax, eax
jne 0x40ec7e
mov eax, 0x491414
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
push 0
push 1
push 0xcf
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
push 0x3f9
push dword [edi + 4]
call dword [sym.imp.USER32.dll_GetDlgItem]
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop edi
inc eax
pop esi
ret 0x10
Function at 0x40fda9
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 1]
push ebx
mov ebx, dword [sym.imp.ntdll.dll_RtlAdjustPrivilege]
push esi
push edi
push eax
xor edi, edi
xor esi, esi
push edi
inc esi
push esi
push 0x11
call ebx
test eax, eax
je 0x40fdd5
or eax, 0x10000000
jmp 0x40ff1a
lea eax, [ebp - 1]
push eax
push edi
push esi
push 0x12
call ebx
test eax, eax
jne 0x40fdcb
push str.BCD00000000
lea ecx, [ebp - 8]
call fcn.0043b487
cmp dword [ebp + 8], edi
je 0x40fea7
mov ecx, dword [ebp + 8]
call fcn.0044c9a8
test eax, eax
jne 0x40fe0a
push 2
pop ebx
jmp 0x40fe2f
lea eax, [ebp - 0x10]
push eax
push 0x20019
push dword [0x4ab220]
push str.SYSTEMCurrentControlSetControlhivelist
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
je 0x40fe37
mov esi, dword [ebp - 8]
jmp 0x40ff10
xor ebx, ebx
inc ebx
jmp 0x40fe3d
inc ebx
push ebx
lea eax, [ebp - 0xc]
push str.REGISTRYMACHINEBCD_.8X
push eax
call fcn.00449eea
add esp, 0xc
lea ecx, [ebp - 0x14]
push ecx
push edi
push edi
push edi
push dword [eax]
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, dword [ebp - 0xc]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043c924
test esi, esi
je 0x40fe3c
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebx
lea eax, [ebp - 8]
push str.BCD_.8X
push eax
call fcn.0043b543
mov esi, dword [ebp - 8]
add esp, 0xc
push dword [ebp + 8]
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov ebx, eax
test ebx, ebx
je 0x40feaa
jmp 0x40ff10
mov esi, dword [ebp - 8]
lea eax, [ebp - 0x18]
push eax
push 0x2000000
push dword [0x4ab220]
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, eax
test ebx, ebx
jne 0x40feff
push 0x24
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new_unsigned_int_]
mov dword [ebp - 0x10], eax
pop ecx
test eax, eax
je 0x40fef8
push ecx
lea ecx, [esi - 0x10]
mov edi, esp
call fcn.0043baa0
mov ecx, dword [ebp - 0x10]
add eax, 0x10
mov dword [edi], eax
push dword [ebp - 0x18]
call fcn.0040f52b
mov edi, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
jmp 0x40ff10
cmp dword [ebp + 8], edi
je 0x40ff10
push esi
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
lea ecx, [esi - 0x10]
call fcn.0043c924
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40ff75
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
lea eax, [ebp - 4]
push edi
push eax
xor edi, edi
push edi
push edi
push 0x62
mov dword [ebp - 4], edi
call esi
cmp eax, 0xc0000023
jne 0x40fffc
push ebx
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
pop ecx
mov ebx, eax
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push ebx
push 0x62
call esi
mov dword [ebp - 8], eax
test eax, eax
jne 0x40fff0
movzx ecx, word [ebx]
add ecx, 0x1c
push ecx
push edi
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov esi, dword [sym.imp.msvcrt.dll_memcpy]
mov edi, eax
push 0x1e
push str._GLOBALROOT
push edi
call esi
movzx ecx, word [ebx]
lea eax, [edi + 0x1c]
add ecx, 2
push ecx
push dword [ebx + 4]
push eax
call esi
mov eax, dword [ebp + 8]
add esp, 0x18
mov dword [eax], edi
push ebx
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
mov eax, dword [ebp - 8]
pop ecx
pop ebx
pop edi
pop esi
leave
ret
Function at 0x410754
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
push ebx
push esi
push edi
mov dword [ebp - 8], edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0x18]
push 0x2a
call fcn.0044b175
mov edx, eax
lea ecx, [ebp - 0x14]
call fcn.00430f7e
pop ecx
lea ecx, [ebp - 0x270]
push ecx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ecx, dword [ebp - 0x14]
mov ebx, eax
add ecx, 0xfffffff0
mov dword [ebp - 0x10], ebx
call fcn.0043c924
mov ecx, dword [ebp - 0x18]
add ecx, 0xfffffff0
call fcn.0043c924
cmp ebx, 0xffffffff
jne 0x4107ba
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x4108d8
xor edi, edi
lea edx, [ebp - 0x244]
lea ecx, [ebp - 0x1c]
call fcn.00449fb5
push eax
lea edx, [ebp + 8]
lea ecx, [ebp - 4]
call fcn.004315b4
pop ecx
mov ecx, dword [ebp - 0x1c]
lea ecx, [ecx - 0x10]
call fcn.0043c924
test byte [ebp - 0x270], 0x10
je 0x410847
lea ecx, [ebp - 0x244]
call fcn.0044bd7f
test al, al
je 0x410805
mov ecx, dword [ebp - 4]
add ecx, 0xfffffff0
jmp 0x4108a4
push 0x5c
lea ecx, [ebp - 4]
call fcn.004388a5
mov esi, dword [ebp - 4]
push 0x1503
push ecx
mov edi, esp
lea ecx, [esi - 0x10]
call fcn.0043a61b
mov edx, dword [ebp - 8]
add eax, 0x10
mov ecx, dword [ebp - 0xc]
mov dword [edi], eax
call fcn.00410754
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x4108a1
lea ecx, [esi - 0x10]
call fcn.0043c924
jmp 0x4108d1
mov esi, dword [ebp - 4]
cmp dword [esi - 4], 1
jle 0x41085e
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0043abd1
mov esi, dword [ebp - 4]
cmp dword [esi - 4], 1
mov ebx, esi
jle 0x410874
push dword [esi - 0xc]
lea ecx, [ebp - 4]
call fcn.0043abd1
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
push 0x1503
push 0x410524
push fcn.00410390
push 0
push 0
add eax, ebx
push eax
push esi
push dword [ebp - 0xc]
call dword [sym.imp.Cabinet.dll_FCIAddFile]
add esp, 0x20
test eax, eax
je 0x4108c1
mov ebx, dword [ebp - 0x10]
lea ecx, [esi - 0x10]
call fcn.0043c924
lea eax, [ebp - 0x270]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x4107bc
jmp 0x4108d1
lea ecx, [esi - 0x10]
mov edi, 0x65b
call fcn.0043c924
mov ebx, dword [ebp - 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 8]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4108ea
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x338
mov eax, dword [eax - 0xc]
push ebx
push esi
push edi
mov edi, ecx
test eax, eax
jne 0x41090a
push 0x57
pop esi
jmp 0x410a80
dec eax
lea ecx, [ebp + 8]
push eax
call fcn.004316b4
cmp al, 0x5c
je 0x410922
push 0x5c
lea ecx, [ebp + 8]
call fcn.004388a5
push edi
lea ecx, [ebp - 4]
call fcn.00431543
mov ecx, dword [eax]
call fcn.0044c9a8
mov ecx, dword [ebp - 4]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043c924
test esi, esi
je 0x410973
mov edx, edi
lea ecx, [ebp - 4]
call fcn.0044b175
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [ebp - 4]
mov esi, eax
add ecx, 0xfffffff0
call fcn.0043c924
test esi, esi
jne 0x410973
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
jmp 0x410a80
xor ebx, ebx
mov dword [ebp - 0x334], 0xdbba0
push 0x31c
lea eax, [ebp - 0x330]
mov dword [ebp - 0x338], ebx
push ebx
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x324], 1
mov eax, 0x3039
mov dword [ebp - 0x320], ebx
mov word [ebp - 0x318], ax
push edi
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameA]
mov esi, eax
lea eax, [ebp - 0x216]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
sub esi, edi
lea eax, [ebp - 0x116]
inc esi
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpynA]
push ebx
lea eax, [ebp - 0x338]
push eax
push 0x410469
push 0x410429
push 0x4104f8
push fcn.004104d2
push 0x4103f4
push 0x4103bf
push fcn.00410393
push dword [sym.imp.msvcrt.dll_free]
lea eax, [ebp - 0x10]
push dword [sym.imp.msvcrt.dll_malloc]
push fcn.00410390
push eax
call dword [sym.imp.Cabinet.dll_FCICreate]
mov edi, eax
add esp, 0x34
test edi, edi
jne 0x410a35
mov esi, 0x65b
jmp 0x410a80
push ecx
push ecx
mov ecx, dword [ebp + 8]
mov esi, esp
lea ecx, [ecx - 0x10]
call fcn.0043a61b
add eax, 0x10
mov ecx, edi
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov edx, dword [eax - 0xc]
call fcn.00410754
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x410a78
push fcn.00410390
push ebx
push ebx
push edi
call dword [sym.imp.Cabinet.dll_FCIFlushCabinet]
add esp, 0x10
test eax, eax
jne 0x410a78
mov esi, 0x65b
push edi
call dword [sym.imp.Cabinet.dll_FCIDestroy]
pop ecx
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.0043c924
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x412987
Capabilities:
Create directory
Set environment variable
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, edx
test esi, esi
je 0x412ae4
xor eax, eax
cmp word [esi], ax
je 0x412ae4
push ebx
call dword [sym.imp.CBSHost.dll_GetConfig]
mov ebx, eax
cmp dword [ebx + 4], 0xffffffff
je 0x4129c1
push dword [ebx + 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [ebx + 4], 0xffffffff
xor eax, eax
test edi, edi
je 0x412a01
cmp word [edi], ax
je 0x412a01
push eax
push 0x2000080
push 2
push eax
push 7
push 0x40000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebx + 4], eax
cmp eax, 0xffffffff
je 0x4129ff
push 0
lea ecx, [ebp + 8]
push ecx
push 2
push 0x486320
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
call fcn.0043c5cd
push eax
lea ecx, [ebp + 8]
call fcn.0043ac50
lea edx, [ebp + 8]
mov ecx, esi
call fcn.0044bb25
mov edi, eax
test edi, edi
je 0x412a3a
jle 0x412a32
movzx edi, di
or edi, 0x80070000
mov esi, dword [ebp + 8]
jmp 0x412ad7
lea eax, [ebp + 8]
mov edx, 0x4916b4
push eax
lea ecx, [ebp - 4]
call fcn.00430fb9
pop ecx
push eax
lea ecx, [ebp + 8]
call fcn.0043b599
mov ecx, dword [ebp - 4]
lea ecx, [ecx - 0x10]
call fcn.0043c924
mov esi, dword [ebp + 8]
lea ecx, [ebp + 8]
mov eax, dword [esi - 0xc]
dec eax
push eax
call fcn.0043a8ec
push 0x5c
pop ecx
cmp ax, cx
je 0x412a84
push ecx
lea ecx, [ebp + 8]
call fcn.0043b93f
mov esi, dword [ebp + 8]
lea eax, [ebx + 8]
mov dword [ebx], 4
push esi
push eax
call dword [sym.imp.msvcrt.dll_wcscpy]
mov edi, dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop ecx
pop ecx
push 0x48e394
push str.WIM_SKIP_WIMBOOT_CHECK
call edi
push 0x4916f0
push str.TRY_FULLY_OPTIMIZED_WIMGAPI
call edi
push 0x490cc8
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x412ad3
xor eax, eax
push eax
push 0x4128ce
push eax
call dword [sym.imp.WIMGAPI.DLL_WIMRegisterMessageCallback]
xor eax, eax
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.0043c924
mov eax, edi
pop ebx
jmp 0x412ae9
mov eax, 0x80070057
pop edi
pop esi
leave
ret 4
Function at 0x413cf2
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push esi
lea eax, [ebp - 8]
mov dword [ebp - 0x10], 1
push eax
push 0x20019
push dword [0x4ab220]
mov esi, str.Security
push esi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413e06
push ebx
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea eax, [ebp - 4]
push eax
xor ebx, ebx
push ebx
push ebx
push ebx
push esi
push dword [ebp - 8]
mov dword [ebp - 4], ebx
call edi
test eax, eax
jne 0x413dfb
push dword [ebp - 4]
call dword [sym.imp.msvcrt.dll_void____cdecl_operator_new___unsigned_int_]
pop ecx
mov esi, eax
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push str.Security
push dword [ebp - 8]
call edi
lea eax, [ebp - 0x14]
push eax
push 0xf01ff
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x413df3
lea eax, [ebp - 0x20]
push eax
push 2
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_DuplicateToken]
test eax, eax
je 0x413df3
mov eax, 0x20019
mov dword [ebp - 0xc], 0x2001f
mov dword [ebp - 0x30], eax
lea edi, [ebp - 0x44]
mov dword [ebp - 0x28], eax
xor eax, eax
stosd dword es:[edi], eax
mov dword [ebp - 0x2c], 0x20006
mov dword [ebp - 0x24], 0xf003f
mov dword [ebp - 0x18], ebx
stosd dword es:[edi], eax
mov dword [ebp - 0x1c], 0x14
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ADVAPI32.dll_MapGenericMask]
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0xc]
push dword [ebp - 0x20]
push esi
call dword [sym.imp.ADVAPI32.dll_AccessCheck]
push esi
call dword [sym.imp.msvcrt.dll_void___cdecl_operator_delete___void__]
pop ecx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop ebx
mov eax, dword [ebp - 0x10]
pop esi
leave
ret
Function at 0x413e0c
Capabilities:
Query or enumerate registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push esi
push edx
push 0x2000000
mov eax, dword [eax + 0x48]
xor esi, esi
push str.SYSTEMCurrentControlSetServices
mov dword [ebp - 4], esi
push 0x80000002
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
test eax, eax
jne 0x413f8e
push esi
push esi
push esi
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x10]
push eax
push esi
push esi
push esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x413f8e
imul eax, dword [ebp - 0x10], 0xc14
push ebx
push edi
push eax
push esi
call dword [sym.imp.OLEAUT32.dll_DllRegisterServer]
mov ecx, dword [ebp - 0x10]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x14], 4
test ecx, ecx
je 0x413f74
mov eax, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
cmp dword [ebp + 0x14], esi
je 0x413ea8
xor edx, edx
div ecx
push dword [ebp + 0x18]
push esi
push eax
push 0x9478
call dword [ebp + 0x14]
push 0x104
lea eax, [ebp - 0x224]
push eax
push ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyW]
test eax, eax
jne 0x413f5c
lea eax, [ebp - 0xc]
push eax
push 0x20019
push dword [0x4ab220]
lea eax, [ebp - 0x224]
push eax
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x413f5c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x14], 4
push eax
lea eax, [ebp - 8]
push eax
push esi
push esi
push 0x48f600
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x413f53
test byte [ebp - 8], 0x33
je 0x413f53
mov ecx, 0xc14
push ecx
push esi
push edi
call dword [sym.imp.msvcrt.dll_memset]
add esp, 0xc
test byte [ebp - 8], 0x30
je 0x413f2d
mov dword [edi], esi
jmp 0x413f39
test byte [ebp - 8], 3
je 0x413f39
mov dword [edi], 2
mov edx, dword [ebp - 0xc]
lea eax, [ebp - 0x224]
mov ecx, dword [ebp + 8]
push edi
push eax
call fcn.0041c155
mov eax, 0xc14
add edi, eax
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x18]
inc ebx
mov ecx, dword [ebp - 0x10]
add eax, 0x64
mov dword [ebp - 0x18], eax
cmp ebx, ecx
jne 0x413e92
mov ebx, dword [ebp - 0x1c]
sub edi, ebx
mov ecx, 0xc14
mov eax, edi
cdq
idiv ecx
mov ecx, dword [ebp + 0x10]
pop edi
mov dword [ecx], eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
pop ebx
jmp 0x413f90
mov esi, eax
lea ecx, [ebp - 4]
call fcn.0043a910
mov eax, esi
pop esi
leave
ret 0x14
Function at 0x41400a
Capabilities:
Delete registry value
Persist via windows service
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x414159
xor ebx, ebx
cmp word [edi], bx
je 0x414159
mov eax, dword [ebp + 8]
lea edx, [ebp - 4]
push esi
push edx
push 0x2000000
mov eax, dword [eax + 0x48]
push str.SYSTEMCurrentControlSetServices
mov dword [ebp - 4], ebx
push 0x80000002
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
mov esi, eax
test esi, esi
jne 0x41414c
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push 0x2001f
push dword [0x4ab220]
push edi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov esi, eax
test esi, esi
jne 0x414144
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
lea eax, [ebp + 8]
push eax
push ebx
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push 0x48f600
push dword [ebp + 0xc]
call ebx
mov esi, eax
test esi, esi
jne 0x414144
test byte [ebp + 8], 0x33
jne 0x4140b6
mov esi, 0x80070057
jmp 0x414144
and dword [ebp - 0xc], 0
mov edi, dword [ebp + 0x10]
cmp edi, 1
jbe 0x41411c
cmp edi, 4
jbe 0x41410c
push 5
pop esi
cmp edi, esi
jne 0x414141
lea eax, [ebp - 0xc]
xor edi, edi
push eax
push edi
push edi
push edi
push str.Group
push dword [ebp + 0xc]
call ebx
test eax, eax
je 0x414141
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 1
push eax
push 4
push edi
push str.DelayedAutoStart
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x414144
push 2
pop edi
jmp 0x414122
push str.DelayedAutoStart
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
jmp 0x414122
test byte [ebp + 8], 3
je 0x414141
push 4
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], edi
push eax
push 4
push 0
push str.Start
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esi, eax
jmp 0x414144
push 0x57
pop esi
lea ecx, [ebp + 0xc]
call fcn.0043a910
lea ecx, [ebp - 4]
call fcn.0043a910
mov eax, esi
pop esi
jmp 0x41415e
mov eax, 0x80070057
pop edi
pop ebx
leave
ret 0xc
Function at 0x4151c5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
lea eax, [ebp - 0x212]
push esi
push edi
mov esi, 0x4916b4
lea edi, [ebp - 0x21c]
push 0x1fe
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
xor esi, esi
push esi
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x214]
push 0x100
push eax
push str.SystemDrive
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x415275
push esi
push 0x2000000
push 3
push esi
push 7
push 0x80000000
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0xc], eax
cmp eax, 0xffffffff
je 0x41526b
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 0x14], 1
push ecx
push 4
lea ecx, [ebp - 8]
mov dword [ebp - 0x10], 2
push ecx
push 8
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], esi
push ecx
push 0x90368
push eax
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x41526b
mov esi, dword [ebp - 8]
lea ecx, [ebp - 0xc]
call fcn.0043ab9a
mov eax, esi
pop edi
pop esi
leave
ret
Function at 0x41565f
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x29c
push ebx
push esi
push edi
push 0x4021
push 7
lea eax, [ebp - 0x20]
mov esi, edx
push eax
lea eax, [ebp + 8]
mov dword [ebp - 8], esi
push eax
push 0x100001
lea eax, [ebp - 4]
mov ebx, ecx
push eax
call dword [sym.imp.ntdll.dll_NtOpenFile]
test eax, eax
jne 0x415784
xor edi, edi
mov dword [ebp - 0x10], eax
push edi
push ebx
push 0xff
push 0x25
push 0x270
lea ecx, [ebp - 0x10]
mov dword [ebp + 0x10], ecx
lea eax, [ebp - 0x230]
lea ecx, [ebp - 0x298]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
push ecx
lea ecx, [ebp - 0x20]
mov dword [ebp + 0xc], eax
push ecx
push edi
push edi
push edi
push eax
jmp 0x41576d
test dword [ebp - 0x260], 0x400
jne 0x41574e
test byte [ebp - 0x260], 0x10
je 0x415728
mov esi, dword [ebp - 0x25c]
lea ecx, [ebp - 0x230]
mov edx, esi
call fcn.0044bd57
test al, al
jne 0x41574b
sub esp, 0x18
mov word [ebp - 0xe], si
mov word [ebp - 0x10], si
lea esi, [ebp + 8]
push 6
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
xor ecx, ecx
mov edx, esi
call fcn.0041565f
add esp, 0x18
xor edi, edi
jmp 0x41574e
mov eax, dword [ebp - 0x238]
mov ecx, esi
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x234]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.00434cfa
jmp 0x41574e
mov esi, dword [ebp - 8]
push edi
push ebx
push 0xff
push 0x25
push 0x270
lea eax, [ebp - 0x298]
push eax
lea eax, [ebp - 0x20]
push eax
push edi
push edi
push edi
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_ZwQueryDirectoryFile]
test eax, eax
je 0x4156d4
push dword [ebp - 4]
call dword [sym.imp.ntdll.dll_NtClose]
pop edi
pop esi
pop ebx
leave
ret